Moving files to and from your phone in Qubes OS

This is a repost of a beautiful parulin’s post with minor additions. Helpful if your phone doesn’t mount to the VMs using standard options

Examples of mounting errors:
Without USB debugging, just “File transfer” selected Failed to mount. Unable to open MTP device “001,007”. With USB debugging Error: QubesException - Device attach failed: /usr/lib/qubes/usb-import: 94: echo: echo: I/O error.

android VM - the VM that sends/receives files to/from your phone

sys-usb - the VM that your phone is connected to by default when you plug it in with a USB cable

Workaround is to use the adb command-line tool to send requests from our Android VM to the sys-usb instead of mounting

In the template dedicated to android (maybe you can create a dedicated template like “android-template”), install the android-tools package. Do the same in the template of sys-usb. With Fedora it’s something like this:

dnf install android-tools

Debian:

apt install adb

Now make sure both templates are shutdown and restart sys-usb and your android AppVM.

On your phone:

  1. activate the Developer Options
  2. In the Developer Options menu, allow USB Debugging
  3. Plug your phone into the computer, switch to MTP transfer

On sys-usb, run an adb command like:

adb devices

On your phone: allow the connection.

In sys-usb: you should see some result from the adb devices like:

List of devices attached
XXXXXXXXX       device

Now we will allow the android AppVM to connect to adb via sys-usb.

In dom0: Open Qubes Policy Editor and create a new policy called 30-android.policy. Edit this file like this, replacing your-android-vm with the name of your android AppVM:

qubes.ConnectTCP    *    your-android-vm    @default    allow    target=sys-usb

On the android AppVM, you need to run this command first:

qvm-connect-tcp ::5037

If you get an “Address already in use” error, try

adb kill-server

before trying again

Then you can check that your device is available from android VM:

adb devices

And now you can copy your files:

adb pull /sdcard/Pictures/... Pictures

or push the files to your phone

adb push /path/in/android/vm /storage/emulated/0/path/in/phone

So, your android VM uses adb only to send requests to the 5037 port, then sys-usb intercepts these requests and performs the instructions locally inside itself.