4 ms·

One thing that steered me away from QubesOS was that the templates used for all VMs were not hardened at all, instead, the Qubes Fedora template for example wer

One thing that steered me away from QubesOS was that the templates used for all VMs were not hardened at all, instead, the Qubes Fedora template for example were less secure than a normal Fedora install. The template uses passwordless sudo and SELinux is completely removed. Security is about layers and the default templates are lacking in that sense. I want to make initial compromise as hard as possible. For QubesOS reasoning for not needing hardened templates to make sense, I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that.

akvadrako 2y ago
That sounds pretty good. Passwordless sudo and disabling SELinux are the first things I do on new Fedora installs. If somebody can compromise my user account, compromising root is pointless and trivial. More so on Qubes OS, where only breaking out of the VM really matters. SELinux isn't usable in a strict mode because it's config is so ungainly that devs rarely create profiles. So only the opt-in mode is common and that's pretty pointless. Especially compared to using containers.
minitech 2y ago
(SELinux is enabled as of Fedora 39.) > I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that. I think that’s a decent starting point, actually. Not only that, but also separate disposable VMs for individual tasks, like reading a PDF.
fsflover 2y ago
> The template uses passwordless sudo This is easy to change: https://www.qubes-os.org/doc/vm-sudo/#replacing-passwordless-root-access-with-dom0-user-prompt https://www.qubes-os.org/doc/vm-sudo/#replacing-passwordless... and https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074/18 https://forum.qubes-os.org/t/replacing-passwordless-root-wit... See also: https://forum.qubes-os.org/t/passwordless-sudo-selinux-understanding-security-logic/22446/2 https://forum.qubes-os.org/t/passwordless-sudo-selinux-under... Although I'm convinced that passwordless sudo helps a lot to make life easier for new Qubes users. > For QubesOS reasoning for not needing hardened templates to make sense, I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that. This is not necessary. You can group your apps with the same trust level in the same VM. Again, it's especially helpful to the new users. Advanced users like you, with strict threat models, can use minimal VMs to compartmentalize much more.

akvadrako 2y ago

That sounds pretty good. Passwordless sudo and disabling SELinux are the first things I do on new Fedora installs. If somebody can compromise my user account, compromising root is pointless and trivial. More so on Qubes OS, where only breaking out of the VM really matters. SELinux isn't usable in a strict mode because it's config is so ungainly that devs rarely create profiles. So only the opt-in mode is common and that's pretty pointless. Especially compared to using containers.

minitech 2y ago

(SELinux is enabled as of Fedora 39.) > I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that. I think that’s a decent starting point, actually. Not only that, but also separate disposable VMs for individual tasks, like reading a PDF.

fsflover 2y ago

> The template uses passwordless sudo This is easy to change: https://www.qubes-os.org/doc/vm-sudo/#replacing-passwordless-root-access-with-dom0-user-prompt https://www.qubes-os.org/doc/vm-sudo/#replacing-passwordless... and https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074/18 https://forum.qubes-os.org/t/replacing-passwordless-root-wit... See also: https://forum.qubes-os.org/t/passwordless-sudo-selinux-understanding-security-logic/22446/2 https://forum.qubes-os.org/t/passwordless-sudo-selinux-under... Although I'm convinced that passwordless sudo helps a lot to make life easier for new Qubes users. > For QubesOS reasoning for not needing hardened templates to make sense, I would need to have a completely separate AppVM for each application and I don't think QubesOS was meant to be used like that. This is not necessary. You can group your apps with the same trust level in the same VM. Again, it's especially helpful to the new users. Advanced users like you, with strict threat models, can use minimal VMs to compartmentalize much more.