Sys-net as ClockVM with sdwdate in Qubes

Support
1

Quote from the documentation (http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Qubes#ClockVM):

A ClockVM based on the Kicksecure Template is functional out of the box.
The only requirement is that the ClockVM uses Kicksecure as its Template. For example, if using Qubes’ default settings, where ClockVM is set to sys-net by default and sys-net has been configured by the user to use the kicksecure-18 Template, then ClockVM will be functional out of the box and use sdwdate for clock synchronization.

My sys-net and sys-firewall VM are both Kicksecure-based. sys-net is my ClockVM. My time is always off though.
I just took the time to dig into that and noticed that sdwdate isn’t even running in sys-net.

Service status:

Process: 1460 ExecCondition=/usr/libexec/helper-scripts/has_netvm_on_qubes (code=exited, status=1/FAILURE)

The condition requires the VM to have a NetVM as the name suggests, which is not true for sys-net in a normal default setup, so I think the documentation is not correct.

How is it supposed to work? What’s the officially recommended way, make sys-firewall the ClockVM? Thanks

2 Likes
2

I believe you can change the clock VM by going to the application menu → settings gear → Qubes Global Config → General tab → Clock qube drop-down.

That sounds like a bug. Most likely we were trying to keep sdwdate from running on a qube with no Internet connection. sys-net has a connection but no NetVM, so that check isn’t quite right.

2 Likes
3

This might fix it.

Will be fixed in an update at some point.

2 Likes
4

Thank you, will report back when I noticed that it’s included in an update.

I think you accidentally have the condition to exit with 0 when the VM has a NetVM (if qubesdb-read /qubes-gateway) twice now.

1 Like
5

exit 0 → systemd condition success → systemd starting sdwdate.

6

I think they were talking about duplicated code:

if qubesdb-read /qubes-gateway >/dev/null 2>&1; then # first instance
  exit 0
fi

## Qubes sys-net does not have '/qubes-gateway'.
if qubesdb-read /qubes-netvm-gateway /qubes-gateway >/dev/null 2>&1; then
  exit 0
fi

if qubesdb-read /qubes-gateway >/dev/null 2>&1; then # second instance, probably don't need it
  exit 0
fi
2 Likes
7

Yes, thank you. Sorry if I didn’t express myself clear enough.

2 Likes