Testing Kicksecure 17.3.9.2

Development
1

I tested the new version. It seems to be working great. The only issue is that I couldn’t change theme and background in sysmaintenance mode. Only the theme in the window manager changes. But maybe that’s how you intended it.
The panel is very convenient! It just lacks buttons for viewing the log and searching the log by keyword. This would make the panel perfect and improve the convenience of administration - it’s convenient to administer the system in a few clicks.
Will the maintenance panel be translated into other languages in the future?
Thank you

2 Likes
2

The only issue is that I couldn’t change theme and background in sysmaintenance mode. Only the theme in the window manager changes. But maybe that’s how you intended it.

Right now the background is hardcoded, though it differs between Kicksecure, Whonix-Gateway, and Whonix-Workstation. In theory it could be made configurable, I’m not sure if that’s a good idea though since right now the background allows easy identification of the underlying OS (which is useful if you have multiple VMs of different kinds running at the same time).

The panel is very convenient! It just lacks buttons for viewing the log and searching the log by keyword. This would make the panel perfect and improve the convenience of administration - it’s convenient to administer the system in a few clicks.

Oooh, that’s not a bad idea. @Patrick, what do you think? That would in theory be easy to add.

Will the maintenance panel be translated into other languages in the future?

Currently most (if not all?) of Kicksecure and Whonix’s codebase is English-only.

1 Like
3

It seems that old, outdated information is present after systemcheck in user session mode. If there are new updates, it is recommended to open the terminal in Start menu and enter ‘upgrade-nonroot’. However, the current accurate information is to reboot and start a sysmaint session for updates. This information is also not relevant for the sysmaint session, as there is no Start menu there. Otherwise, the system works perfectly - I have installed programs, uninstalled programs, tried various settings, run programs under different users, and tested all the panel buttons.

4

This is not a problem. The panel requires only a minimal knowledge of English + there is a live mode for testing, where users from different countries can try out what they are unfamiliar with or do not understand.
Thank you very much for your work!

5

Good catch, we should fix that.

1 Like
6

Thinking about it more, I think even if we do want to implement some form of background customization for sysmaint sessions, it should be rather limited (i.e., we shouldn’t allow making an arbitrary image the desktop background). Reasons for this:

  • Getting an image into the sysmaint account is unsafe almost no matter how you do it:
    • You could launch Firefox and download an image, but the web browser offers a substantial amount of attack surface. One of the main reasons for creating sysmaint-panel in the first place was to discourage the user from launching Firefox in a sysmaint session.
    • You could download an image into /home/user/Downloads and then copy it into the sysmaint account in a sysmaint session, but that’s tricky due to user account separations in Kicksecure, and you’re still trusting an arbitrary image from a user account that may be compromised. (Obviously you don’t want your user account compromised, but we try to assume it and other user accounts are compromised and design the sysmaint session accordingly.)
    • You could overcome the clunkiness of having to copy files into the sysmaint account by making there be some way to change the sysmaint account’s background from a user session, but that’s even worse from a security standpoint because now the user account can push arbitrary images into the sysmaint account at will.
  • Image files are a well-known exploit vector due to the complexity of most common image file formats. There probably are zero-days in the image file parsing code used by Qt, if history is any indicator. Therefore image files aren’t something you want to just blindly trust if you can help it.

That being said, implementing some form of background customization might be neat, but I’d want to limit it to setting a solid color or gradient background. Currently the background you see in a sysmaint session isn’t an image at all, it’s created on the fly with a Qt CSS theming trick. Allowing the user to choose the start and end colors of the gradient would allow some customization without any of the dangers of images. I’m not sure if that’s something @Patrick is interested in at the moment, but that’s a theoretical way of doing this.

1 Like
7

I think it’s unnecessary and not worth spending time on it. If you’re going to add new buttons to the panel (such as a journal search, system monitor, firewall…), then the panel will increase in size and will overlap any background.
By the way, have you considered changing the color for Livecheck on the panel: green for live, and yellow/orange/red for persistent mode, to warn users that everything they do will be saved to the system, in order to increase the level of responsibility. When clicking on the circle, you can add a hint “if you’re not sure about your actions, test it in live mode”.

1 Like