## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Please use "/etc/systemcheck.d/50_user.conf" for your
## custom configuration, which will override the defaults found here.
## When systemcheck is updated, this file may be overwritten.

## Run Tor leak tests by default.
#leak_tests=true

## Show (true) or hide (false) IP address during Tor leak tests.
#show_ip=true

## Stop (0) or continue (1) when IP Forwarding is detected on Whonix-Gateway.
## 0: stop when IP Forwarding is detected on Whonix-Gateway
## 1: do not stop when IP Forwarding is detected on Whonix-Gateway
NO_EXIT_ON_IP_FORWARDING_DETECTION="0"

journal_ignore_fixed_list=()
journal_ignore_patterns_list=()
systemcheck_unwanted_package=""
systemcheck_expected_non_freedom_package=""
systemcheck_expected_non_freedom_grep_package=""
systemcheck_skip_functions=""

## Delete temporary files by systemcheck on exit.
## true: enabled
## false: disabled
#DEL_TMP="true"

## How long systemcheck should wait at maximum until Tor bootstrap finished.
## Defaults to: 120
#systemcheck_tor_bootstrap_wait_max="120"

## Unwanted packages systemcheck will warn against.
systemcheck_unwanted_package+=" popularity-contest " ## privacy issues
systemcheck_unwanted_package+=" canonical-census " ## privacy issues
systemcheck_unwanted_package+=" unity-lens-shopping " ## privacy issues
systemcheck_unwanted_package+=" unity-scope-video-remote " ## privacy issues
systemcheck_unwanted_package+=" unity-scope-musicstores " ## privacy issues
systemcheck_unwanted_package+=" bts " ## privacy issues
systemcheck_unwanted_package+=" wnpp-check " ## privacy issues

## https://forums.whonix.org/t/more-unwanted-packages/2155/20
## https://github.com/marmarek/openqa-tests-qubesos/blob/master/extra-files/system-tests/whonix-test.conf
systemcheck_unwanted_package+=" python-pip " ## security issues
systemcheck_unwanted_package+=" python3-pip " ## security issues

systemcheck_unwanted_package+=" gnome-calculator " ## privacy issues

## privacy concerns associated with GeoClue
## https://gitlab.freedesktop.org/geoclue/geoclue/-/issues/177
## https://github.com/Kicksecure/developer-meta-files/issues/3
## https://github.com/Whonix/anon-meta-packages/commit/d9c96fcda6e8dd8ed147d57c71843e003d898d47
systemcheck_unwanted_package+=" geoclue-2.0 "

## privacy concerns associated with stardict
## https://www.kicksecure.com/wiki/Dev/Debian#startdict
systemcheck_unwanted_package+=" stardict "
## Potentially superfluous.
## TODO: Add systemcheck_unwanted_package_match feature.
systemcheck_unwanted_package+=" stardict-common "
systemcheck_unwanted_package+=" stardict-gtk "
systemcheck_unwanted_package+=" stardict-plugin "
systemcheck_unwanted_package+=" stardict-plugin-cal "
systemcheck_unwanted_package+=" stardict-plugin-espeak "
systemcheck_unwanted_package+=" stardict-plugin-festival "
systemcheck_unwanted_package+=" stardict-plugin-fortune "
systemcheck_unwanted_package+=" stardict-plugin-info "
systemcheck_unwanted_package+=" stardict-plugin-spell "
systemcheck_unwanted_package+=" stardict-tools "

systemcheck_unwanted_package+=" chrony " ## interferes with network time synchronization
systemcheck_unwanted_package+=" ntp " ## interferes with network time synchronization
systemcheck_unwanted_package+=" ntpdate " ## interferes with network time synchronization
systemcheck_unwanted_package+=" unattended-upgrades " ## auto-updating when apt has bugs is a security risk
## hardening, opens local listener, can be accidentally installed as dependency
## https://forums.whonix.org/t/kdeconnectd-removal
systemcheck_unwanted_package+=" kdeconnect "

## KDE was deprecated.
## https://forums.whonix.org/t/user-poll-xfce-vs-kde-kde-deprecation-considered/6235
systemcheck_unwanted_package+=" non-qubes-whonix-gateway-kde "
systemcheck_unwanted_package+=" non-qubes-whonix-workstation-kde "
systemcheck_unwanted_package+=" non-qubes-whonix-gateway "
systemcheck_unwanted_package+=" non-qubes-whonix-workstation "

## Then Xfce was deprecated.
## TODO: Add forums link here if applicable
systemcheck_unwanted_package+=" non-qubes-whonix-gateway-xfce "
systemcheck_unwanted_package+=" non-qubes-whonix-workstation-xfce "
systemcheck_unwanted_package+=" kicksecure-xfce "
systemcheck_unwanted_package+=" kicksecure-xfce-vm "
systemcheck_unwanted_package+=" kicksecure-xfce-host "

## Then we restructured the metapackages for Kicksecure and Whonix.
systemcheck_unwanted_package+=" kicksecure-dependencies-system "
systemcheck_unwanted_package+=" kicksecure-dependencies-cli "
systemcheck_unwanted_package+=" kicksecure-recommended-cli "
systemcheck_unwanted_package+=" kicksecure-default-applications-cli "
systemcheck_unwanted_package+=" kicksecure-desktop-environment-essential-gui "
systemcheck_unwanted_package+=" kicksecure-desktop-applications-recommended "
systemcheck_unwanted_package+=" kicksecure-desktop-environment-essential-lxqt "
systemcheck_unwanted_package+=" kicksecure-desktop-applications-lxqt "
systemcheck_unwanted_package+=" kicksecure-shared-host-lxqt "
systemcheck_unwanted_package+=" non-qubes-enhancements-cli "
systemcheck_unwanted_package+=" non-qubes-enhancements-gui "
systemcheck_unwanted_package+=" non-qubes-audio "
systemcheck_unwanted_package+=" kicksecure-cli "
systemcheck_unwanted_package+=" kicksecure-lxqt "
systemcheck_unwanted_package+=" kicksecure-qubes-gui "
systemcheck_unwanted_package+=" kicksecure-cli-host "
systemcheck_unwanted_package+=" kicksecure-cli-host-packages-recommended "
systemcheck_unwanted_package+=" kicksecure-lxqt-host "
systemcheck_unwanted_package+=" kicksecure-cli-vm "
systemcheck_unwanted_package+=" kicksecure-lxqt-vm "
systemcheck_unwanted_package+=" whonix-shared-packages-dependencies-cli "
systemcheck_unwanted_package+=" whonix-shared-packages-recommended-cli "
systemcheck_unwanted_package+=" whonix-shared-default-applications-gui "
systemcheck_unwanted_package+=" whonix-gateway-packages-dependencies-cli "
systemcheck_unwanted_package+=" whonix-gateway-default-applications-gui "
systemcheck_unwanted_package+=" whonix-gateway-shared-packages-shared-meta "
systemcheck_unwanted_package+=" qubes-whonix-gateway "
systemcheck_unwanted_package+=" non-qubes-whonix-gateway-cli "
systemcheck_unwanted_package+=" non-qubes-whonix-gateway-lxqt "
systemcheck_unwanted_package+=" whonix-workstation-packages-dependencies-cli "
systemcheck_unwanted_package+=" whonix-workstation-packages-recommended-cli "
systemcheck_unwanted_package+=" whonix-workstation-packages-recommended-gui "
systemcheck_unwanted_package+=" whonix-workstation-shared-packages-shared-meta "
systemcheck_unwanted_package+=" qubes-whonix-workstation "
systemcheck_unwanted_package+=" non-qubes-whonix-workstation-cli "
systemcheck_unwanted_package+=" non-qubes-whonix-workstation-lxqt "

## To remove selected packages from the list of unwanted packages,
## you could add something like  the following to your
## "/etc/systemcheck.d/50_user.conf". (Replace the below example that is
## using 'popularity-contest' with the actual name of the package you want
## to remove from the list.
#systemcheck_unwanted_package="$(echo "$systemcheck_unwanted_package" | sed 's/ popularity-contest //g')"

## packages ignored by the check non_freedom packages test.

systemcheck_expected_non_freedom_package+=" virtualbox " ## not useful to warn against because of below

systemcheck_expected_non_freedom_package+=" b43-fwcutter "

## installed by default
## warns because it depends on another contrib package torbrowser-launcher
systemcheck_expected_non_freedom_package+=" onionshare "

## installed by default
## since onionshare depends on it
systemcheck_expected_non_freedom_package+=" torbrowser-launcher "

systemcheck_expected_non_freedom_grep_package+=" firmware "
systemcheck_expected_non_freedom_grep_package+=" microcode "
systemcheck_expected_non_freedom_grep_package+=" virtualbox- "

## Using the systemcheck_skip_functions variable you can blacklist one or more
## functions of systemcheck. Not all combinations of selective function
## blacklisting are tested. Blacklisting the check_tor_bootstrap function
## however is fully tested. Some combinations such as disabling
## check_tor_socks_port and leaving check_tor_trans_port enabled may result in
## systemcheck errors. Do not worry, such error do not result in danger, they
## only result in systemcheck showing an error message.

## Check first run initializer.
#systemcheck_skip_functions+=" check_initializer "

## Check Tor's bootstrap status.
## control port Uses the network. only
#systemcheck_skip_functions+=" check_tor_bootstrap "

## Does not use the network.
#systemcheck_skip_functions+=" check_virtualizer "

## You most likely do not need this. Look at
## NO_EXIT_ON_IP_FORWARDING_DETECTION above.
## Does not use the network.
#systemcheck_skip_functions+=" check_ip_forwarding_disabled "

## You most likely do not need this.
## Does not use the network. (Runs only on Whonix-Gateway.)
#systemcheck_skip_functions+=" check_tor_enabled "

## You most likely do not need this.
## Does not use the network. (Runs only on Whonix-Gateway.)
#systemcheck_skip_functions+=" check_tor_config "

## You most likely do not need this.
## Does not use the network. (Runs only on Whonix-Gateway.)
#systemcheck_skip_functions+=" check_tor_running "

## Does not use the network.
#systemcheck_skip_functions+=" check_apt_repository "

## Does not use the network.
#systemcheck_skip_functions+=" check_hostname "

## Uses the network.
#systemcheck_skip_functions+=" check_tor_socks_port "

## Uses the network.
#systemcheck_skip_functions+=" check_tor_trans_port "

## Does not use the network.
#systemcheck_skip_functions+=" check_stream_isolation "

## Checks for operating system updates using apt-get.
## Uses the network.
#systemcheck_skip_functions+=" check_operating_system "

## Uses the network.
#systemcheck_skip_functions+=" download_important_blog "

## Uses the network.
#systemcheck_skip_functions+=" download_feature_blog "

## Does not use the network.
## Textual function only.
#systemcheck_skip_functions+=" disclaimer "

## Does not use the network.
## Textual function only.
## Running with --verbose only.
#systemcheck_skip_functions+=" check_logs "

## Does not use the network.
## Textual function only.
#systemcheck_skip_functions+=" donate "

## Does not use the network.
## Configuration function only.
#systemcheck_skip_functions+=" pin_tpo_ssl_cert "

## Does not use the network.
#systemcheck_skip_functions+=" check_packages "
#systemcheck_skip_functions+=" check_meta_packages "
#systemcheck_skip_functions+=" check_unwanted_packages "


## TODO: report to Qubes as per:
## https://github.com/Kicksecure/systemcheck/commit/8682d30307ec8fa0773edf712ff3bf15e418bf7e#r159006689
#journal_ignore_patterns_list+=( "FocusIn: Window .* data not initialized" )

## False-positive.
## AppArmor denied messages are parsed separately.
journal_ignore_patterns_list+=( "audit\\[[0-9]*\\]: CRED_.* res=success" )
journal_ignore_fixed_list+=( "audit: CONFIG_CHANGE op=set audit_failure=1" )
journal_ignore_fixed_list+=( "AVC apparmor=\"ALLOWED\"" )

## False-positive.
## Part of package 'auditd'.
## Apr 09 12:58:40 localhost augenrules[961]: failure 1
journal_ignore_patterns_list+=( "augenrules.*: failure 1" )

## False-positive.
## The pam module "pam_faillock" has "fail" in its name.
## Apr 09 13:02:00 localhost audit[1595]: USER_AUTH pid=1595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=pam_exec,pam_faillock,pam_faillock,pam_permit,pam_exec,pam_permit acct="user" exe="/usr/sbin/lightdm" hostname=? addr=? terminal=:0 res=success'
journal_ignore_patterns_list+=( "audit.*,pam_faillock" )

## Duplicate. auditd will show messages containing the same information.
journal_ignore_fixed_list+=( "kernel: audit:" )

## False-positive.
## sdwdate sources can sometimes fail. This is not a system issue.
journal_ignore_patterns_list+=( "failed_urls: .* allowed_failures" )
## Mar 05 12:22:50 host sdwdate[1319]: ['error', 'ok', 'ok']
journal_ignore_patterns_list+=( "sdwdate.*\['.*error.*'\]" )
## Mar 05 12:22:50 host sdwdate[1319]: * remote_status: error
journal_ignore_patterns_list+=( "sdwdate.*remote_status: error" )
## Mar 05 12:22:50 host sdwdate[1319]: * stderr: connect error:
journal_ignore_patterns_list+=( "sdwdate.*stderr: connect error:" )
## Apr 25 10:28:43 localhost sdwdate[954]: 2025-04-25 10:28:43 - sdwdate - INFO - PREPARATION RESULT: onion-time-pre-script detected a known permanent (until the user fixes it) error status. Consider running systemcheck for more information.
journal_ignore_fixed_list+=( "onion-time-pre-script detected a known permanent" )
## Mar 18 07:10:08 localhost sdwdate[1152]: __ ### END: ### Exiting with exit_code '1' indicating 'wait, show error icon and retry.'.
journal_ignore_patterns_list+=( "sdwdate.* indicating 'wait, show error icon and retry" )
## Mar 18 07:10:08 localhost sdwdate[1152]: 2025-03-18 11:10:08 - sdwdate - INFO - PREPARATION RESULT: onion-time-pre-script detected a known permanent (until the user fixes it) error status. Consider running systemcheck for more information.
journal_ignore_patterns_list+=( "sdwdate.*onion-time-pre-script detected a known permanent (until the user fixes it) error status" )
## Compile time options for compile time "--error" handling.
## Likely no longer a problem.
#journal_ignore_fixed_list+=( "gcc /usr/src/sdwdate/sclockadj.c -o /usr/libexec/sdwdate/sclockadj" )

## Qubes issue.
## Mar 05 12:23:42 host qubes.StartApp+xfce4-terminal-dom0[1232]: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined
#journal_ignore_patterns_list+=( "qubes\.StartApp\+xfce4-terminal-dom0.*Failed to connect to session manager" )

## Qubes issue.
## Mar 28 16:43:22 host qubes.VMShell-dom0[1302]: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined
#journal_ignore_patterns_list+=( "qubes\.VMShell-dom0.*SESSION_MANAGER environment variable not defined" )

## Qubes issue.
## Apr 17 00:29:35 host qubes.VMShell+WaitForSession-dom0[1317]: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined
#journal_ignore_patterns_list+=( "qubes\.VMShell\+WaitForSession-dom0.*Failed to connect to the session manager" )

## Qubes issue.
## (xfce4-terminal:1207868): xfce4-terminal-WARNING **: 07:48:17.148: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined<br />
journal_ignore_fixed_list+=( "SESSION_MANAGER environment variable not defined" )

## False-positive.
## Disabled on purpose.
## https://forums.whonix.org/t/systemcheck-fails-for-unclear-reason/21424/15
## [2025-03-12 21:38:51] [    3.358990] systemd-udevd[408]: /usr/bin/disabled-intelpmt-by-security-misc: ALERT: This Intel Platform Monitoring Technology (PMT) Telemetry kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args:
journal_ignore_patterns_list+=( "systemd-udevd.*disabled-intelpmt-by-security-misc" )
## [2025-03-12 21:38:51] [    3.360172] (udev-worker)[342]: Error running install command '/usr/bin/disabled-intelpmt-by-security-misc' for module pmt_class: retcode 1
journal_ignore_patterns_list+=( "(udev-worker).*disabled-intelpmt-by-security-misc" )
## Feb 06 04:56:57 localhost (udev-worker)[1980]: Error running install command '/usr/bin/disabled-miscellaneous-by-security-misc' for module joydev: retcode 1
journal_ignore_patterns_list+=( "(udev-worker).*disabled-miscellaneous-by-security-misc" )
## Feb 06 16:07:07 localhost (udev-worker)[582]: Error running install command '/usr/bin/disabled-thunderbolt-by-security-misc' for module thunderbolt: retcode 1
journal_ignore_patterns_list+=( "(udev-worker).*disabled-thunderbolt-by-security-misc" )

## False-positive. WirePlumber or glib bug.
## https://gitlab.freedesktop.org/pipewire/wireplumber/-/issues/255#note_1394211
## Mar 18 07:10:08 localhost wireplumber[1229]: Failed to set scheduler settings: Operation not permitted
journal_ignore_patterns_list+=( "wireplumber.*Failed to set scheduler settings: Operation not permitted" )

## Appears benign, doesn't seem to break audio functionality.
## https://bbs.archlinux.org/viewtopic.php?pid=2118246#p2118246
## Mar 18 07:10:08 localhost wireplumber[1229]: GetManagedObjects() failed: org.freedesktop.DBus.Error.NameHasNoOwner
journal_ignore_patterns_list+=( "wireplumber.*GetManagedObjects\(\) failed: org\.freedesktop\.DBus\.Error\.NameHasNoOwner" )

## False-positive.
## Not an error. "pam_faillock_not_if_x" is the name of the script. It exiting non-zero in some cases is its
## expected mode of communication.
## Mar 18 07:10:43 localhost polkit-agent-helper-1[2345]: pam_exec(polkit-1:auth): /usr/libexec/security-misc/pam_faillock_not_if_x failed: exit code 1
journal_ignore_patterns_list+=( "polkit-agent-helper-1.*pam_exec(polkit-1:auth): /usr/libexec/security-misc/pam_faillock_not_if_x failed: exit code 1" )
journal_ignore_fixed_list+=( "/usr/libexec/security-misc/pam_faillock_not_if_x failed: exit code 1" )

## False-positive.
## 'grep' is used with an option that contains "error" in its name.
## Mar 31 06:24:25 localhost updatecheck-daemon[2636]: + grep --quiet --ignore-case -E -- '^Error:|^E:|^Err:'
journal_ignore_patterns_list+=( "updatecheck-daemon.*grep --quiet --ignore-case -E -- '\^Error:" )

## This is correct but 'apt-get' does not support command 'apt list --upgradable'.
journal_ignore_patterns_list+=( "updatecheck-daemon.*WARNING: apt does not have a stable CLI interface\. Use with caution in scripts\." )

## VirtualBox issue. Cosmetic issue only.
## https://github.com/VirtualBox/virtualbox/issues/67
## Apr 25 10:30:28 localhost kernel: [drm:vmw_host_printf [vmwgfx]] *ERROR* Failed to send host log message.
journal_ignore_patterns_list+=( "\[drm:vmw_host_printf \[vmwgfx\]\] \*ERROR\* Failed to send host log message" )

## Normal if shared folders are not set up.
## https://www.kicksecure.com/wiki/VirtualBox/Guest_Additions#Shared_Folder
## https://www.whonix.org/wiki/KVM#Shared_Folder
## Jul 23 04:04:29 host mount-shared[968]:        dmesg(1) may have more information after failed mount system call.
journal_ignore_patterns_list+=( "mount-shared.*dmesg\(1\) may have more information after failed mount system call\." )

## Likely caused because we do not use Mutter as a window manager / Wayland compositor.
## Jul 23 22:14:55 localhost spice-vdagent[1505]: display: failed to call GetCurrentState from mutter over DBUS
## Jul 23 22:14:55 localhost spice-vdagent[1505]:    error message: Cannot invoke method; proxy is for the well-known name org.gnome.Mutter.DisplayConfig without an owner, and proxy was constructed with the G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START flag
journal_ignore_patterns_list+=( "spice-vdagent.*display: failed to call GetCurrentState from mutter over DBUS" )
journal_ignore_patterns_list+=( "spice-vdagent.*error message: Cannot invoke method; proxy is for the well-known name org\.gnome\.Mutter\.DisplayConfig without an owner, and proxy was constructed with the G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START flag" )

## Only related to ifupdown which is not used in Kicksecure.
## Jul 23 22:14:53 localhost NetworkManager[903]:   [1753308893.6645] failed to open /run/network/ifstate
journal_ignore_patterns_list+=( "NetworkManager.*failed to open /run/network/ifstate" )

## Benign, will occur on first boot into sysmaint mode.
## Jul 23 22:13:32 localhost sysmaint-boot[643]: WARNING: Folder '/home/sysmaint' does not exist. Therefore, file '/home/sysmaint/.dmrc' has not been created.
journal_ignore_patterns_list+=( "sysmaint-boot.*WARNING: Folder '/home/sysmaint' does not exist\. Therefore, file '/home/sysmaint/\.dmrc' has not been created\." )

## This directory is not always guaranteed to exist.
## Jul 23 22:16:37 localhost lightdm[1292]: Could not enumerate user data directory /var/lib/lightdm/data: Error opening directory '/var/lib/lightdm/data': No such file or directory
journal_ignore_patterns_list+=( "lightdm.*Could not enumerate user data directory /var/lib/lightdm/data: Error opening directory '/var/lib/lightdm/data': No such file or directory" )

## Occurs if spice-vdagent can't set the record volume via ALSA. Likely not a concern.
## https://gitlab.freedesktop.org/spice/linux/vd_agent/-/blob/1f4a994ff167dcc959e8c14d8425098c52380b56/src/vdagent/audio.c#L164
## Jul 23 22:40:54 spice-vdagent[1763]: Fail to sync record volume
journal_ignore_patterns_list+=( "spice-vdagent.*Fail to sync record volume" )

## Unclear what operation causes this. Likely benign, it appears that it can occur when a WirePlumber proxy object is destroyed.
## https://pipewire.pages.freedesktop.org/wireplumber/design/understanding_wireplumber.html#the-object-model
## https://github.com/PipeWire/wireplumber/blob/beded0214d6d0b199e069a6b54b7f57994937b16/lib/wp/object.c#L557
## Jul 23 23:01:34 host wireplumber[1572]:  failed to activate item: Object activation aborted: proxy destroyed
journal_ignore_patterns_list+=( "wireplumber.*failed to activate item: Object activation aborted: proxy destroyed" )

## Doesn't seem to occur anymore, the supposedly missing directory exists in Kicksecure 18 under VirtualBox.
## Jul 23 23:12:07 host virtualbox-guest-utils[1134]: libkmod: ERROR ../libkmod/libkmod-module.c:1998 kmod_module_get_holders: could not open '/sys/module/cfg80211/holders': No such file or directory
#journal_ignore_patterns_list+=( "virtualbox-guest-utils.*libkmod: ERROR \.\./libkmod/libkmod-module\.c:1998 kmod_module_get_holders: could not open '/sys/module/cfg80211/holders': No such file or directory" )

## This could indicate a legitimate problem (disk failure), no longer ignoring.
## Jul 23 23:09:51 localhost systemd-journald[497]: Failed to read journal file /var/log/journal/b08dfa6083e7567a1921a715000001fb/user-1001.journal for rotation, trying to move it out of the way: Text file busy
#journal_ignore_patterns_list+=( "systemd-journald.*Failed to read journal file /var/log/journal/.* for rotation, trying to move it out of the way: Text file busy" )

## systemd no longer offers utmp support.
## https://lists.debian.org/debian-qt-kde/2024/11/msg00412.html
## Aug 01 22:03:34 host lightdm[1694]: Failed to write utmpx: No such file or directory
journal_ignore_patterns_list+=( "lightdm.*Failed to write utmpx: No such file or directory" )

## These directories may legitimately not exist.
## Aug 03 23:38:51 localhost polkitd[1425]: Error opening rules directory: Error opening directory _/run/polkit-1/rules.d_: No such file or directory (g-file-error-quark, 4)
## Aug 03 23:38:51 localhost polkitd[1425]: Error opening rules directory: Error opening directory _/usr/local/share/polkit-1/rules.d_: No such file or directory (g-file-error-quark, 4)
## NOTE: The underscores must be replaced with '.*' in the patterns or else the patterns will not match (just '.' is not enough). Probably these are ANSI escape codes that are later
## turned into underscores by stcatn.
journal_ignore_patterns_list+=( "polkitd.*Error opening rules directory: Error opening directory .*/run/polkit-1/rules\.d.*: No such file or directory" )
journal_ignore_patterns_list+=( "polkitd.*Error opening rules directory: Error opening directory .*/usr/local/share/polkit-1/rules\.d.*: No such file or directory" )

## The process emitting this error runs as root and is expected to not have XDG_RUNTIME_DIR set properly.
## VirtualBox's guest additions code doesn't appear to directly need XDG_RUNTIME_DIR, although some Mesa-related parts might.
## Aug 03 23:48:38 localhost virtualbox-guest-utils[1471]: error: XDG_RUNTIME_DIR is invalid or not set in the environment.
journal_ignore_patterns_list+=( "virtualbox-guest-utils.*error: XDG_RUNTIME_DIR is invalid or not set in the environment." )

## False-positive.
## A kernel option that has "warn" in its name.
## Sep 28 04:04:58 localhost panic-on-oops[1607]: kernel.warn_limit = 1
journal_ignore_patterns_list+=( "panic-on-oops.*kernel\.warn_limit = 1" )
journal_ignore_fixed_list+=( "kernel:  warn_alloc" )
journal_ignore_fixed_list+=( "kernel.panic_on_warn" )

## False-positive.
## A kernel message that mentions warnings.
## Sep 29 00:08:07 localhost kernel: x86/split lock detection: #AC: crashing the kernel on kernel split_locks and warning on user-space split_locks
journal_ignore_patterns_list+=( "kernel: x86/split lock detection:.*crashing the kernel on kernel split_locks and warning on user-space split_locks" )

## Occurs when a virtual DVD drive is present under VirtualBox. Likely benign.
## Oct 12 11:50:49 localhost fwupd[21322]: 16:50:49.953 FuEngine             failed to add device /sys/devices/pci0000:00/0000:00:01.1/ata1/host0/target0:0:0/0:0:0:0/block/sr0: failed to subclass open: failed to open /dev/sr0: Operation not permitted
journal_ignore_patterns_list+=( "fwupd.*FuEngine.*failed to add device.*block/sr0: failed to subclass open: failed to open /dev/sr0:" )

## Try to hide kernel segfault reports, these contain some CPU and memory data that could be sensitive.
journal_ignore_patterns_list+=( "kernel: .* segfault at .* likely on CPU .* (core .*, socket .*)" )
journal_ignore_patterns_list+=( "kernel: Code: " )

## False-positive.
## "error_msg='success'" is not an error, but contains the string "error".
## Nov 09 05:37:17 localhost audit[1540]: DM_CTRL module=crypt op=ctr ppid=1409 pid=1540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-cryptse" exe="/usr/bin/systemd-cryptsetup" subj=unconfined dev=254:0 error_msg='success' res=1
journal_ignore_patterns_list+=( "audit.*: DM_CTRL module=crypt .* error_msg='success'" )

## Not a concern as per https://github.com/QubesOS/qubes-gui-agent-linux/pull/251#issuecomment-3550544486
## Nov 18 12:23:56 host qrexec-client-vm[1818]: Error reading from stdin: Kind(UnexpectedEof)
journal_ignore_patterns_list+=( "qrexec-client-vm.*: Error reading from stdin: Kind(UnexpectedEof)" )

## Likely false-positive. Mentions "pam_faillock" which has "fail" in its name.
## CRED_REFR pid=1273468 uid=1000 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:setcred grantors=pam_wheel,pam_faillock,pam_faillock,pam_permit,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/2 res=success'<br />
journal_ignore_patterns_list+=( "CRED_.*grantors=pam_wheel,pam_faillock.*acct=" )

## False positive, the kernel command line itself is showing up as an alert.
journal_ignore_patterns_list+=( "dracut-cmdline.*: Using kernel command line parameters:" )

## Caused by livecheck starting before the system tray is running. Benign, livecheck displays a working system tray icon despite this.
## Feb 06 04:56:57 localhost livecheck[1828]: QDBusTrayIcon encountered a D-Bus error: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "The name org.kde.StatusNotifierWatcher was not provided by any .service files")
journal_ignore_patterns_list+=( "livecheck.*: QDBusTrayIcon encountered a D-Bus error: QDBusError\(\"org\.freedesktop\.DBus\.Error\.ServiceUnknown\", \"The name org\.kde\.StatusNotifierWatcher was not provided by any \.service files\"\)" )

## GLib is unable to detect the desktop or download directories for some reason. No workaround is known yet.
## Feb 06 04:56:57 localhost spice-vdagent[1837]: warning could not get file xfer save dir, file transfers will be disabled
journal_ignore_patterns_list+=( "spice-vdagent.*: warning could not get file xfer save dir, file transfers will be disabled" )

## iwl-debug-yoyo.bin does not exist under /usr/lib/firmware and is not provided by any package in Debian.
## Feb 06 16:07:07 localhost kernel: iwlwifi 0000:00:14.3: firmware: failed to load iwl-debug-yoyo.bin (-2)
journal_ignore_patterns_list+=( "kernel: iwlwifi .*: firmware: failed to load iwl-debug-yoyo.bin" )

## False-positive.
## Informational message that contains "debug".
## Feb 06 16:07:07 localhost kernel: Bluetooth: hci0: Debug lock is disabled
journal_ignore_patterns_list+=( "kernel: Bluetooth: .*: Debug lock is disabled" )

## debugfs is disabled in security-misc.
## Feb 06 16:07:05 localhost kernel: intel-lpss 0000:00:15.0: Failed to create debugfs entries
journal_ignore_patterns_list+=( "kernel: intel-lpss .*: Failed to create debugfs entries" )

## os-prober debugging messages.
journal_ignore_patterns_list+=( "05efi.*: debug:" )
journal_ignore_patterns_list+=( "10freedos.*: debug:" )
journal_ignore_patterns_list+=( "10qnx.*: debug:" )
journal_ignore_patterns_list+=( "20microsoft.*: debug:" )
journal_ignore_patterns_list+=( "30utility.*: debug:" )
journal_ignore_patterns_list+=( "83haiku.*: debug:" )
journal_ignore_patterns_list+=( "macosx-prober.*: debug:" )
journal_ignore_patterns_list+=( "os-prober.*: debug:" )

## False-positive.
## Service startup is expected to stop working during system shutdown.
journal_ignore_patterns_list+=( "Transaction for .* is destructive .* has 'stop' job queued, but 'start' is included in transaction" )
journal_ignore_patterns_list+=( "Transaction for .* is destructive .* has 'start' job queued, but 'stop' is included in transaction" )

## False-positive.
## A kernel setting is being changed that has 'warn' in its name.
## Feb 06 21:57:41 localhost panic-on-oops[8215]: kernel.warn_limit = 0
journal_ignore_patterns_list+=( "panic-on-oops.*: kernel.warn_limit = 0" )

## False-positive.
## systemd considers units using 'KillMode=SIGKILL' as failed when stopped normally. This is arguably a systemd bug. See:
## https://github.com/systemd/systemd/issues/40600
## systemd does not consider this a bug, and suggests using 'SuccessExitStatus=SIGKILL'.
## However, this only silences part of the message according to 'man systemd.unit', so it's likely not worth using it.
journal_ignore_patterns_list+=( "systemd.*: msgcollector-gui.service: Failed with result 'signal'." )
journal_ignore_patterns_list+=( "systemd.*: msgcollector-gui.service: Main process exited, code=killed, status=9/KILL" )

## Expected. Generated as a result of apt-daily-upgrade.service.
## systemd-networkd is not used by default on Kicksecure, and systemd-networkd-wait-online does not operate as expected when called directly under Kicksecure.
## TODO: Maybe disable all things related to apt-daily by default to prevent this from popping up in the first place?
## Feb 06 22:37:35 localhost apt-helper[3089]: E: Sub-process /lib/systemd/systemd-networkd-wait-online returned an error code (1)
journal_ignore_patterns_list+=( "apt-helper.*: E: Sub-process /lib/systemd/systemd-networkd-wait-online returned an error code \(1\)" )

## Benign, occurs when trying to read the TPM event log via ACPI. There are other methods the kernel will use to read the event log if this occurs.
## Feb 06 16:07:04 localhost kernel: tpm tpm0: tpm_read_log_acpi: Failed to map ACPI memory
journal_ignore_patterns_list+=( "kernel: tpm .*: tpm_read_log_acpi: Failed to map ACPI memory" )

## Benign, VirtualBox USB passthrough works despite these, and devices are being created under /dev/vboxusb for some USB devices as expected.
journal_ignore_patterns_list+=( "\(udev-worker\).*: .*: Process '/usr/lib/virtualbox/VBoxCreateUSBNode.sh .*' failed with exit code 1." )

## Occurs during shutdown. Appears benign.
## Feb 07 23:58:10 kicksecure-18-dev (sd-pam)[1018]: pam_systemd(systemd-user:session): Failed to release session: No session '1' known
journal_ignore_patterns_list+=( "\(sd-pam\).*: pam_systemd\(systemd-user:session\): Failed to release session: No session '1' known" )

## Normal, this occurs during shutdown because application stdout can end up in the journal under Qubes OS.
## Feb 08 04:58:18 host qubes.StartApp+qterminal-dom0[1689]: The X11 connection broke (error 1). Did the X11 server die?
journal_ignore_patterns_list+=( "qubes.StartApp.*: The X11 connection broke \(error 1\). Did the X11 server die?" )

## Occurs during shutdown. Cause is unknown. Doesn't seem to caues user-visible issues.
## Feb 08 16:04:31 host ifdown[14325]: Error: ipv6: address not found.
journal_ignore_patterns_list+=( "ifdown.*: Error: ipv6: address not found\." )

## False-positive. Log message contains the string 'warn'.
## Feb 08 16:33:59 host wlr-resize-watcher[1894]: INFO: warn_on_dynamic_resolution_refuse=1 -> sending notify and disabling further warnings.
journal_ignore_patterns_list+=( "wlr-resize-watcher.*: INFO: warn_on_dynamic_resolution_refuse=1 -> sending notify and disabling further warnings\." )

## Due to (apparently?) a race condition in the startup of greetd, labwc sometimes prints a message (originally to the console, now to the systemd journal) because XDG_RUNTIME_DIR is unset.
## This appears to be benign and the way to fix it is unclear, so therefore silencing it.
## https://lists.sr.ht/~kennylevinsen/greetd-devel/%3C20251113233255.64d6bc0f@kf-m2g5%3E
journal_ignore_fixed_list+=( "src/main\.c.* XDG_RUNTIME_DIR is unset" )

## Normal, happens when IPv6 is not enabled under Qubes OS.
## Oct 30 06:33:12 host qubes-whonix-postinit[1420]: Failed to read /qubes-netvm-gateway6
## Oct 30 06:33:12 host qubes-whonix-postinit[1386]: WARNING: 'qubesdb-read /qubes-netvm-gateway6' failed!
## Oct 30 06:33:14 host tor-config-sane[1689]: Failed to read /qubes-netvm-gateway6
## Oct 30 06:33:14 host tor-config-sane[1686]: WARNING: 'qubesdb-read /qubes-netvm-gateway6' failed!
journal_ignore_fixed_list+=( "qubes-whonix-postinit.*: Failed to read /qubes-netvm-gateway6" )
journal_ignore_fixed_list+=( "qubes-whonix-postinit.*: WARNING: 'qubesdb-read /qubes-netvm-gateway6' failed!" )
journal_ignore_fixed_list+=( "tor-config-sane.*: Failed to read /qubes-netvm-gateway6" )
journal_ignore_fixed_list+=( "tor-config-sane.*: WARNING: 'qubesdb-read /qubes-netvm-gateway6' failed!" )

## Not a system issue.
## Tor. Only connectivity issue. Handled in other ways. systemcheck has dedicated network diagnosis output.
journal_ignore_fixed_list+=( "Tor bootstrap not done" )
journal_ignore_fixed_list+=( "Tor Consensus Time" )
journal_ignore_fixed_list+=( "Tor reports: WARN" )
journal_ignore_fixed_list+=( "Discarding this circuit" )
## Apr 09 13:00:42 localhost Tor[1256]: Closed 1 streams for service [scrubbed].onion for reason resolve failed. Fetch status: No more HSDir available to query.
journal_ignore_fixed_list+=( "onion for reason resolve failed. Fetch status: No more HSDir available to query" )
## Apr 25 10:28:41 localhost Tor[903]: Problem bootstrapping. Stuck at 0% (starting): Starting. (Clock skew -91 in local state file from /var/lib/tor/state; CLOCK_SKEW; count 1; recommendation warn; host ? at ?)
journal_ignore_fixed_list+=( "Problem bootstrapping. Stuck at" )
journal_ignore_fixed_list+=( "tor-circuit-established-check failed." )

## An environment variable with "warning" in its name.
journal_ignore_fixed_list+=( "DEBCONF_NOWARNINGS" )

## Normal. Output by anondate-set during time synchronization.
## Dec 10 00:46:50 localhost anondate[1830]: ______ /usr/sbin/anondate-get: WARNING: Could not determine Tor consensus time middle range.
journal_ignore_fixed_list+=( "WARNING: Could not determine Tor consensus time middle range" )

## Normal, occurs when at-spi2-core is not installed.
## Dec 10 00:46:51 localhost xdg-desktop-por[2112]: AT-SPI: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: The name org.a11y.Bus was not provided by any .service files
journal_ignore_fixed_list+=( "AT-SPI: Error retrieving accessibility bus address" )

## Normal, occurs when a privleap connection dies without warning.
journal_ignore_fixed_list+=( "Connection unexpectedly closed" )

## False-positive.
## Dec 10 00:44:23 localhost kernel: RAS: Correctable Errors collector initialized.
journal_ignore_fixed_list+=( "RAS: Correctable Errors collector initialized" )

## Likely caused by swap-file-creator.
journal_ignore_fixed_list+=( "swapon failed: Device or resource busy" )

## Likely benign. Appears to be normal under Qubes OS, occurs even in non-Whonix qubes.
## Dec 11 04:48:26 host kernel: tsc: Fast TSC calibration failed
## Dec 11 04:48:27 host xl[1416]: libxl: error: libxl_utils.c:818:libxl_cpu_bitmap_alloc: failed to retrieve the maximum number of cpus
## Dec 11 04:48:32 host kernel: ACPI Error: No handler or method for GPE 00, disabling event (20240827/evgpe-389)
## Dec 11 05:57:12 host kernel: xen-balloon: vmemmap alloc failure: order:9, mode:0x4cc0(GFP_KERNEL|__GFP_RETRY_MAYFAIL), nodemask=(null),cpuset=/,mems_allowed=0
journal_ignore_fixed_list+=( "Fast TSC calibration failed" )
journal_ignore_fixed_list+=( "Failed to retrieve the maximum number of cpus" )
journal_ignore_fixed_list+=( "No handler or method for GPE" )
journal_ignore_fixed_list+=( "kernel: xen-balloon: vmemmap alloc failure:" )

## False-positive. 'pcspkr' is disabled on purpose by security-misc.
## Dec 11 04:46:11 host loginctl[1838]: Could not attach device: Failed to open device '/sys/devices/platform/pcspkr/input/*': No such device
journal_ignore_fixed_list+=( "Could not attach device: Failed to open device '/sys/devices/platform/pcspkr/input/" )

## Only occurs in Qubes-Whonix-Workstation. Occurs even if input event buffering is turned off entirely via `qvm-features anon-whonix -D gui-events-max-delay`.
## Usually means some app created and then destroyed a window quickly, before the GUI agent managed to get info about it.
## Dec 11 05:57:15 host qubes-gui[1307]: XGetWindowAttributes for 0x200005 failed in handle_create, ret=0x0
journal_ignore_fixed_list+=( "XGetWindowAttributes" )

## TODO: Unsure why or when warnings matched by these lines occur.
journal_ignore_fixed_list+=( "obsolete config item" )
journal_ignore_fixed_list+=( "ACPI: _OSC evaluation for CPUs failed" )
journal_ignore_fixed_list+=( "Failed to connect to bus" )
journal_ignore_fixed_list+=( "error while preloading HID BPF dispatcher" )
journal_ignore_fixed_list+=( "WM_HINTS" )
journal_ignore_fixed_list+=( "WM_NORMAL_HINTS" )
journal_ignore_fixed_list+=( "WARNING handle_focus: FocusOut: Window" )
journal_ignore_fixed_list+=( "Failed to get window dump for window" )

## Not a system issue.
## Unneeded functionality. Missing dependency.
journal_ignore_fixed_list+=( "Failed to load the 'mdraid' libblockdev plugin" )
journal_ignore_fixed_list+=( "failed to load module mdraid: libbd_mdraid.so.2: cannot open shared object file: No such file or directory" )

## False-positive.
## A privleap action that has "fail" in its name.
journal_ignore_fixed_list+=( "read-systemctl-logs-failed-units" )

## Not a system issue.
## GnuPG ('gpg') issue. Missing smartcard daemon. Simply not installed by default.
journal_ignore_fixed_list+=( "can't connect to the SCdaemon: IPC connect call failed" )

## False positive.
## "error" is part of the name of the file.
## Aug 20 08:18:40 kicksecure-17 memlockd[667]: Mapped file /lib/x86_64-linux-gnu/libgpg-error.so.0
journal_ignore_fixed_list+=( "Mapped file /lib/x86_64-linux-gnu/libgpg-error.so.0" )

## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076861
journal_ignore_fixed_list+=( "wireplumber.service: Bound to unit pipewire.service, but unit isn't active" )
journal_ignore_fixed_list+=( "Dependency failed for wireplumber.service - Multimedia Service Session Manager" )
journal_ignore_fixed_list+=( "wireplumber.service: Job wireplumber.service/start failed with result 'dependency'" )

## False-positive.
## Printed by /usr/libexec/sdwdate/suspend-pre during Qubes OS suspend.
journal_ignore_fixed_list+=( "Whonix firewall timesync-fail-closed mode" )

## debugfs is disabled in security-misc.
## Mar 25 10:09:35 localhost kernel: zswap: debugfs initialization failed
journal_ignore_fixed_list+=( "kernel: zswap: debugfs initialization failed" )
## Mar 25 10:09:35 localhost kernel: pinctrl core: failed to create debugfs directory
journal_ignore_fixed_list+=( "kernel: pinctrl core: failed to create debugfs directory" )
## Sep 29 00:08:15 localhost kernel: cec: Failed to create debugfs cec dir
journal_ignore_fixed_list+=( "kernel: cec: Failed to create debugfs cec dir" )

## Happens if SecureBoot is enabled.
## There is no perfect solution yet.
## https://www.kicksecure.com/wiki/Secure_Boot
## In the future, this will be no such issue for users of Sovereign Boot.
## https://www.kicksecure.com/wiki/Sovereign_Boot
## Mar 25 10:09:35 localhost kernel: tirdad: module verification failed: signature and/or required key missing - tainting kernel
journal_ignore_fixed_list+=( "kernel: tirdad: module verification failed: signature and/or required key missing - tainting kernel" )

## updatecheck
## User is notified by 'updatecheck'. No need to duplicate this in systemcheck.
journal_ignore_fixed_list+=( "Software updates check failure" )

## False-positive.
## Bash command. The word "fail" is in shell option "pipefail".
journal_ignore_fixed_list+=( "set -o pipefail" )

## False-positive.
## Bash command. The word "error" is in shell function "error_handler".
journal_ignore_fixed_list+=( "trap error_handler ERR" )

## VirtualBox
## derivtive-maker: see 'build-steps.d/*_create-vbox-vm' command:
## $SUDO_TO_VBOX_TEMP VBoxManage setextradata "$VMNAME" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" "1"
## Apr 25 10:31:50 localhost kernel: 10:31:50.397428 timesync Error: vgsvcTimeSyncWorker: VbglR3GetHostTime failed; rc2=VERR_NOT_SUPPORTED
journal_ignore_fixed_list+=( "timesync Error: vgsvcTimeSyncWorker: VbglR3GetHostTime failed; rc2=VERR_NOT_SUPPORTED" )

## VirtualBox
## Seems benign.
## https://www.kicksecure.com/wiki/Dev/VirtualBox#VBoxClient_VMSVGA:_Error:_unable_to_connect_to_IPC_server,_rc=VERR_FILE_NOT_FOUND
## Apr 25 10:28:42 localhost kernel: 10:28:42.974317 main     VBoxClient VMSVGA: Error: unable to connect to IPC server, rc=VERR_FILE_NOT_FOUND
journal_ignore_fixed_list+=( "VBoxClient VMSVGA: Error: unable to connect to IPC server, rc=VERR_FILE_NOT_FOUND" )

## ACPI MMCONFIG most likely unsupported by VirtualBox.
## Only known to occur under VirtualBox, and Cloud Hypervisor had to implement special support for this, for device passthrough purposes.
## https://github.com/cloud-hypervisor/cloud-hypervisor/issues/221
## Apr 25 10:30:23 localhost kernel: acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
journal_ignore_fixed_list+=( "fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge" )

## Likely just lack of support for an ATA feature in some hypervisors. Seems benign.
## https://www.kicksecure.com/wiki/Dev/VirtualBox#ata1.00:_Read_log_0x00_page_0x00_failed,_Emask_0x1
## Apr 25 10:30:25 localhost kernel: ata1.00: Read log 0x00 page 0x00 failed, Emask 0x1
journal_ignore_fixed_list+=( "ata1.00: Read log 0x00 page 0x00 failed, Emask 0x1" )

## Package 'wireless-regdb' not installed. Unneeded inside VMs.
## Jun 03 13:29:17 host kernel: platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
journal_ignore_fixed_list+=( "kernel: platform regulatory.0: Direct firmware load for regulatory.db failed with error -2" )
## Jun 03 13:29:17 host kernel: cfg80211: failed to load regulatory.db
journal_ignore_fixed_list+=( "kernel: cfg80211: failed to load regulatory.db" )
## Jul 23 21:55:56 host kernel: platform regulatory.0: firmware: failed to load regulatory.db (-2)
journal_ignore_fixed_list+=( "kernel: platform regulatory.0: firmware: failed to load regulatory.db (-2)" )

## Security feature.
## Disabled by security-misc.
## https://github.com/Kicksecure/security-misc/issues/299#issuecomment-2877482100
## https://github.com/Kicksecure/security-misc/pull/306
## Jul 23 03:12:09 localhost kernel: ERST: Error Record Serialization Table (ERST) support is disabled.
journal_ignore_fixed_list+=( "kernel: ERST: Error Record Serialization Table (ERST) support is disabled." )

## Normal if shared folders are not set up.
## Jul 23 03:21:03 localhost mount-shared[867]: /sbin/mount.vboxsf: mounting failed with the error: No such file or directory
## Jul 23 03:21:03 localhost kernel: vboxsf: Host rejected mount of 'shared' with error -2
journal_ignore_fixed_list+=( "/sbin/mount.vboxsf: mounting failed with the error: No such file or directory" )
journal_ignore_fixed_list+=( "kernel: vboxsf: Host rejected mount of 'shared' with error -2" )

## Likely benign, caused by a (buggy?) DHCP server.
## Jul 23 23:09:54 localhost NetworkManager[911]:   [1753312194.0327] dhcp4 (eth0): error parsing DHCP option 15 (domain_name): '.' is not a valid DNS domain
journal_ignore_fixed_list+=( "dhcp4 (eth0): error parsing DHCP option 15 (domain_name): '.' is not a valid DNS domain" )

## Out-commented, because these errors no longer seem to occur on Kicksecure 18.
## Aug 03 23:48:39 localhost kernel: 23:48:39.520137 main      rtldrNativeLoad: dlopen('libwayland-client.so', RTLD_NOW | RTLD_LOCAL) failed: libwayland-client.so:
## Aug 03 23:48:39 localhost kernel: 23:48:39.520555 main      rtldrNativeLoad: dlopen('libX11.so', RTLD_NOW | RTLD_LOCAL) failed: libX11.so: cannot open shared obj
#journal_ignore_fixed_list+=( "rtldrNativeLoad: dlopen('libwayland-client.so', RTLD_NOW | RTLD_LOCAL) failed: libwayland-client.so:" )
#journal_ignore_fixed_list+=( "rtldrNativeLoad: dlopen('libX11.so', RTLD_NOW | RTLD_LOCAL) failed: libX11.so: cannot open shared obj" )

## Benign. VirtualBox implements a VMSVGA adapter, VMware doesn't seem to like how they did it, so VMware added this warning. Users should
## ignore it, as VMSVGA is VirtualBox's recommended virtual graphics adapter.
## https://forums.virtualbox.org/viewtopic.php?p=556934#p556934
## https://github.com/torvalds/linux/commit/35d86fb626a2554de5d5916b6e2d47d06b483d37
## https://superuser.com/a/1403131/1734781 "Contrary to what the manual says, this (VMSVGA) is currently the default for Linux guests."
## Aug 03 23:48:57 localhost kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* vmwgfx seems to be running on an unsupported hypervisor.
## Aug 03 23:48:57 localhost kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* This configuration is likely broken.
## Aug 03 23:48:57 localhost kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* Please switch to a supported graphics device to avoid problems.
journal_ignore_fixed_list+=( "kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* vmwgfx seems to be running on an unsupported hypervisor." )
journal_ignore_fixed_list+=( "kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* This configuration is likely broken." )
journal_ignore_fixed_list+=( "kernel: vmwgfx 0000:00:02.0: [drm] *ERROR* Please switch to a supported graphics device to avoid problems." )

## Likely benign.
## May used to have occurred under older versions of VirtualBox.
## https://forums.virtualbox.org/viewtopic.php?t=113535
## Aug 03 23:48:56 localhost systemd[1]: Failed to read SMBIOS type #11 object 0, ignoring: Bad message
journal_ignore_fixed_list+=( "systemd[1]: Failed to read SMBIOS type #11 object 0, ignoring: Bad message" )

## False-positive.
## System unit that has "warning" in its description.
## Sep 28 04:04:58 localhost systemd[1]: Starting panic-on-oops.service - Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process...
## Sep 28 04:04:58 localhost systemd[1]: Finished panic-on-oops.service - Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process..
journal_ignore_fixed_list+=( "Sets 'sysctl' settings relating to kernel panics on both oopses and warnings late during the boot process" )

## TODO: USB support appears to work despite the above warning, but this is
## still somewhat worrying since the warnings seems to have been added
## specifically to get Linux distributions to fix their module loading order
## if this message appears. See:
## https://bugs.archlinux.org/task/12009.html#comment34295
## https://github.com/VirtualBox/virtualbox/issues/253
## Sep 28 01:12:38 localhost kernel: Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
journal_ignore_fixed_list+=( "Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after" )

## Normal. Occurs the first boot after growing a virtual disk image, due to the backup GPT no longer being at the end of the disk.
## Automatically fixed by systemd-repart.
## Sep 29 00:08:10 localhost kernel: GPT: Use GNU Parted to correct GPT errors.
journal_ignore_fixed_list+=( "kernel: GPT: Use GNU Parted to correct GPT errors." )

## Triggered by a Pipewire component intended to get the remaining battery life of Bluetooth devices.
## Only occurs on Qubes, as UPower is installed on non-Qubes.
## https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/4aa2e4479668939d65951df0702aa36d81409e13/spa/plugins/bluez5/upower.c#L43
## Oct 12 11:30:04 localhost wireplumber[1463]: default: Failed to get percentage from UPower: org.freedesktop.DBus.Error.NameHasNoOwner
journal_ignore_fixed_list+=( "default: Failed to get percentage from UPower: org.freedesktop.DBus.Error.NameHasNoOwner" )

## Appears in sys-whonix. Not a concern, because sys-whonix intentionally does not have audio.
## Nov 03 02:58:18 host xdg-desktop-por[1937]: Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
## Nov 03 02:58:18 host xdg-desktop-por[1937]: Failed connect to PipeWire: Couldn't create PipeWire context
## Nov 23 05:39:29 host pipewire[1944]: mod.rt: RTKit error: org.freedesktop.DBus.Error.ServiceUnknown
journal_ignore_fixed_list+=( "Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files" )
journal_ignore_fixed_list+=( "Failed connect to PipeWire: Couldn't create PipeWire context" )
journal_ignore_fixed_list+=( "mod.rt: RTKit error: org.freedesktop.DBus.Error.ServiceUnknown" )

## Dec 11 04:46:11 host kernel: platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
journal_ignore_fixed_list+=( "kernel: platform regulatory.0: Direct firmware load for regulatory.db failed with error -2" )

## Likely a Qubes upstream bug, see https://github.com/QubesOS/qubes-issues/issues/10384
## Doesn't cause any issues in practice.
## Nov 23 05:53:40 host systemctl[2279]: Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=@.host --user to connect to bus of other user)
journal_ignore_fixed_list+=( 'Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined' )

## Normal, firewalld.service.d also contains a "30_qubes.conf" file under sys-whonix.
## Nov 23 12:15:32 host sysmaint-boot[1995]: dpkg: warning: while removing user-sysmaint-split, directory '/usr/lib/systemd/system/firewalld.service.d' not empty so not removed
journal_ignore_fixed_list+=( "dpkg: warning: while removing user-sysmaint-split, directory '/usr/lib/systemd/system/firewalld.service.d' not empty so not removed" )

## Likely unfixable within virtual machines. Safe to hide in VMs, but should be shown on the host if applicable.
## TODO: Hide on all except baremetal, or show in containers? Ideally we would hide this only on baremetal or in containers running on baremetal, but detecting a VM when running in a container is hard.
## Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options.
if [ "$(systemd-detect-virt || true)" != 'none' ]; then
  journal_ignore_fixed_list+=( "Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options." )
fi

## False positive, the kernel command line itself is showing up as an alert.
journal_ignore_fixed_list+=( "kernel: Command line:" )
journal_ignore_fixed_list+=( "kernel: Kernel command line:" )

## Part of the slub_debug warning.
## Not a concern as we do not know of any user-accessible way of getting to information containing kernel pointers.
## https://github.com/Kicksecure/security-misc/issues/253
## Feb 06 04:56:47 localhost kernel: ** If you see this message and you are not debugging    **
journal_ignore_fixed_list+=( "kernel: ** If you see this message and you are not debugging    **" )

## False-positive. Has the word 'bug' in it.
## Feb 06 04:56:47 localhost kernel: PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
journal_ignore_fixed_list+=( 'kernel: PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug' )

## False-positive. Has the word 'debug' in it.
## Feb 06 04:56:49 localhost systemd[1]: sys-kernel-debug.mount - Kernel Debug File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/debug).
## Feb 06 04:56:50 localhost systemd[1]: sys-kernel-debug.mount - Kernel Debug File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/debug)
journal_ignore_fixed_list+=( "sys-kernel-debug.mount - Kernel Debug File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/debug)." )
journal_ignore_fixed_list+=( "sys-kernel-debug.mount - Kernel Debug File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/debug)" )

## False-positive. Has the word 'debug' in it. Only occurs under Qubes OS, where the lack of our custom kernel command line means debugfs is still available.
## Feb 07 23:42:07 localhost systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System...
## Feb 07 23:42:07 localhost systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System.
journal_ignore_fixed_list+=( "Mounting sys-kernel-debug.mount - Kernel Debug File System..." )
journal_ignore_fixed_list+=( "Mounted sys-kernel-debug.mount - Kernel Debug File System." )

## ACPI errors and warnings are very common, the errors are different from machine to machine, and in many instances devices work perfectly fine despite them.
## Any real bugs shown by ACPI messages would likely be unspecific to Kicksecure. Therefore silence all ACPI messages.
journal_ignore_fixed_list+=( "kernel: ACPI" )

## False-positive.
## Informational message that contains "debug".
## Feb 06 16:07:37 localhost kernel: SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled
journal_ignore_fixed_list+=( "kernel: SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled" )

## False-positive.
## Service startup is expected to stop working during system shutdown.
journal_ignore_fixed_list+=( "Refusing activation, D-Bus is shutting down." )

## Benign greetd bug.
## https://todo.sr.ht/~kennylevinsen/greetd/50
## Feb 06 21:57:41 localhost greetd[8183]: pam_systemd(greetd-greeter:session): Failed to create session: Resource deadlock avoided
journal_ignore_fixed_list+=( "greetd.*: pam_systemd\(greetd-greeter:session\): Failed to create session: Resource deadlock avoided" )

## False-positive (sort of).
## If the Wayland compositor terminates before Wayland applications spawned by systemd's user manager terminate, those other applications may terminate improperly as a result.
## This does not appear to result in user-visible bugs.
## Feb 06 21:57:41 localhost systemd[1297]: livecheck.service: Failed with result 'exit-code'.
## Feb 06 21:57:41 localhost systemd[1297]: livecheck.service: Main process exited, code=exited, status=1/FAILURE
## Feb 06 21:57:41 localhost systemd[1297]: xdg-desktop-portal-gtk.service: Failed with result 'exit-code'.
## Feb 06 21:57:41 localhost systemd[1297]: xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE
## Feb 06 21:57:41 localhost unknown[1979]: Error reading events from display: Broken pipe
## Feb 06 05:59:20 localhost xdg-desktop-por[2002]: Error reading events from display: Broken pipe
journal_ignore_fixed_list+=( "livecheck.service: Failed with result 'exit-code'." )
journal_ignore_fixed_list+=( "livecheck.service: Main process exited, code=exited, status=1/FAILURE" )
journal_ignore_fixed_list+=( "xdg-desktop-portal-gtk.service: Failed with result 'exit-code'." )
journal_ignore_fixed_list+=( "xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE" )
journal_ignore_fixed_list+=( "Error reading events from display: Broken pipe" )

## Occurs if the user runs 'systemcheck --verbose --leak-tests' on the first boot or in a Qubes AppVM.
## Other methods of detecting this error and preventing it may be more resource-intensive than just silencing it.
journal_ignore_fixed_list+=( "No journal boot entry found for the specified boot (-1)." )

## Qubes bug. Seems to cause no user-visible issues.
## https://github.com/QubesOS/qubes-issues/issues/10653
## Feb 07 23:58:10 kicksecure-18-dev systemd[1]: Failed unmounting usr-lib-modules.mount - /usr/lib/modules.
journal_ignore_fixed_list+=( "Failed unmounting usr-lib-modules.mount - /usr/lib/modules." )

## xen.service fails when stopped in domUs due to a bug in /etc/init.d/xen (a function exits non-zero, and a bare 'exit' thereafter results in the script exiting non-zero). Reported upstream via Matrix. Unclear if this is still a problem in the latest versions of Xen.
## Feb 07 23:58:10 kicksecure-18-dev systemd[1]: xen.service: Control process exited, code=exited, status=1/FAILURE
## Feb 07 23:58:10 kicksecure-18-dev systemd[1]: xen.service: Failed with result 'exit-code'.
## Feb 07 23:58:10 kicksecure-18-dev audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=xen comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
journal_ignore_fixed_list+=( "xen.service: Control process exited, code=exited, status=1/FAILURE" )
journal_ignore_fixed_list+=( "xen.service: Failed with result 'exit-code'." )
journal_ignore_patterns_list+=( "audit.*: SERVICE_STOP .* msg='unit=xen comm=\"systemd\" exe=\"/usr/lib/systemd/systemd\" .* res=failed'" )

## Occurs during shutdown. qubes-gui prints no message to the journal logs indicating why it exits non-zero in this situation. Seems to be benign.
## Feb 07 23:58:09 kicksecure-18-dev audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=qubes-gui-agent comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
## Feb 07 23:58:09 kicksecure-18-dev systemd[1]: qubes-gui-agent.service: Failed with result 'exit-code'.
## Feb 07 23:58:09 kicksecure-18-dev systemd[1]: qubes-gui-agent.service: Main process exited, code=exited, status=1/FAILURE
journal_ignore_fixed_list+=( "qubes-gui-agent.service: Main process exited, code=exited, status=1/FAILURE" )
journal_ignore_fixed_list+=( "qubes-gui-agent.service: Failed with result 'exit-code'." )
journal_ignore_patterns_list+=( "audit.*: SERVICE_STOP .* msg='unit=qubes-gui-agent comm=\"systemd\" exe=\"/usr/lib/systemd/systemd\" .* res=failed'" )

## Normal. Occurs during shutdown if fwupd-refresh.service does not finish before the system is shut down.
## Feb 08 16:04:30 host audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=fwupd-refresh comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
## Feb 08 16:04:30 host systemd[1]: fwupd-refresh.service: Failed with result 'signal'.
journal_ignore_fixed_list+=( "fwupd-refresh.service: Failed with result 'signal'." )
journal_ignore_patterns_list+=( "audit.*: SERVICE_START .* msg='unit=fwupd-refresh comm=\"systemd\" exe=\"/usr/lib/systemd/systemd\" .* res=failed'" )

## Expected on systems without a lid (VMs, desktops, etc.).
## Feb 08 16:04:32 host fwupd[9587]: 16:04:32.068 FuPluginUpower       failed to query lid state
journal_ignore_fixed_list+=( "FuPluginUpower       failed to query lid state" )

## Occurs during shutdown, presumably because processes are terminating that were connected to VBoxDRMClient.
## Feb 08 16:36:14 host kernel: 16:36:14.389675 IpcCLT-15238 VBoxDRMClient: Error: unable to handle IPC session, rc=VERR_BROKEN_PIPE
## Feb 08 16:36:14 host virtualbox-guest-utils[1844]: 16:36:14.389675 IpcCLT-15238 VBoxDRMClient: Error: unable to handle IPC session, rc=VERR_BROKEN_PIPE
journal_ignore_fixed_list+=( "VBoxDRMClient: Error: unable to handle IPC session, rc=VERR_BROKEN_PIPE" )

## Benign. Often not actionable.
## localhost kernel: [Firmware Bug]: TSC doesn't count with P0 frequency!
journal_ignore_fixed_list+=( "TSC doesn't count with P0 frequency!" )

## The word "de*bug*ging" is part of the filename and wiki documentation.
## https://www.kicksecure.com/wiki/Sysmaint#Enable_sudo_access_in_user_session
journal_ignore_fixed_list+=( "/etc/privleap/conf.d/privleap-debugging.conf" )

## security-misc systemd unit 'kill-vboxdrmclient-on-shutdown.service'
journal_ignore_fixed_list+=( "Killed VBoxDRMClient" )

## console-setup: disagrees with xorg on what X keys exist ("WARNING: Unknown X keysym")
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903393
journal_ignore_fixed_list+=( 'WARNING: Unknown X keysym "dead_belowmacron"' )

## sdwdate time source with the string "bug" in its URL.
journal_ignore_fixed_list+=( "mjrkrqnlf26etelsi7zpkqc3dzlrzyurvmd3jksmndarzzbugz5xctid.onion" )
