Qubes-Lite with KVM and Wayland
roscidus.com
Qubes-Lite with KVM and Wayland
1–10 of 52 posts
Re: Qubes-Lite with KVM and Wayland
#2This is an amazing effort, very cool!
I'm not sure why the author is having so much pain with Qubes. Indeed the lack of GPU in guest VMs is annoying but it is possible now to assign a GPU to a HVM fairly reliably thanks to all of the VFIO/gaming-on-linux enthusiasm in the past years. Otherwise, I also find that running browsers in multiple VMs on laptop is a problem if you don't disable JS by default because modern websites have become so bloated, it's a tragedy. The LVM remark is also strange. It's very reliable for plenty of people, but there is the risk of running out of space for metadata [0]. Thin-pools for VM storage allows for some great Time-Machine-esque incremental backups also [1]. But for managing multiple development environments, Qubes is a blessing, not even including all the security benefits.
Another option for Xen fans is XCP-ng + a thin client machine for accessing the VMs. One can also use firejail+Xephyr to achieve graphical isolation [2] (not sure about Wayland).
It looks like architecture changes in Qubes future [3] may make KVM a reality.
This is still a very cool effort, I'll have to give the Wayland bits a close read.
[0]: https://github.com/QubesOS/qubes-issues/issues/3243, https://listman.redhat.com/archives/linux-lvm/2018-July/msg0...
[1]: https://github.com/tasket/wyng-backup
[2]: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki's_EFI_Instal...
Re: Qubes-Lite with KVM and Wayland
#3This is an amazing effort, very cool! I'm not sure why the author is having so much pain with Qubes. Indeed the lack of GPU in guest VMs is annoying but it is possible now to assign a GPU to a HVM fairly reliably thanks to all of the VFIO/gaming-on-linux enthusiasm in the past years. Otherwise, I also find that running browsers in multiple VMs on laptop is a problem if you don't disable JS by default because modern w…
The Qubes people don't recommend doing GPU passthrough because of the security implications.
As for the OP, I feel like if somebody cares about security, they shouldn't be doing any of this. Trying to come up with some self-designed hodgepodge of things isn't really enough security-wise, even if you do use VMs, and I'd find it hard to trust something like this as a platform to do anything important on.
Re: Qubes-Lite with KVM and Wayland
#4I used qubes for a while, but found it kind of cumbersome to do most things, and I never got over the hump.
Since then I've been using proxmox, and I'm at the point where I don't use the gui anymore, I just do everything from the command line.
You can do VM things (like run macos in a vm), but I do most things in lxc containers.
It would be kind of nice if proxmox had something like a Dockerfile, but with local containers that didn't depend on going out to dockerhub to pull in and run code.
Re: Qubes-Lite with KVM and Wayland
#5This is an amazing effort, very cool! I'm not sure why the author is having so much pain with Qubes. Indeed the lack of GPU in guest VMs is annoying but it is possible now to assign a GPU to a HVM fairly reliably thanks to all of the VFIO/gaming-on-linux enthusiasm in the past years. Otherwise, I also find that running browsers in multiple VMs on laptop is a problem if you don't disable JS by default because modern w…
The Qubes people don't recommend doing GPU passthrough because of the security implications. As for the OP, I feel like if somebody cares about security, they shouldn't be doing any of this. Trying to come up with some self-designed hodgepodge of things isn't really enough security-wise, even if you do use VMs, and I'd find it hard to trust something like this as a platform to do anything important on.
> The Qubes people don't recommend doing GPU passthrough because of the security implications.
Why? DMA?
Re: Qubes-Lite with KVM and Wayland
#6Is this really a good idea considering the security issues with Wayland?[1]
Re: Qubes-Lite with KVM and Wayland
#7Is this really a good idea considering the security issues with Wayland?[1] [1] https://github.com/Aishou/wayland-keylogger
That "security issue with Wayland" is really loading an untrusted .so file from your home directory, which is exactly what running apps in KVM VMs instead (as the article proposes) would fix. So yes, it's a good idea!
Re: Qubes-Lite with KVM and Wayland
#8I used qubes for a while, but found it kind of cumbersome to do most things, and I never got over the hump. Since then I've been using proxmox, and I'm at the point where I don't use the gui anymore, I just do everything from the command line. You can do VM things (like run macos in a vm), but I do most things in lxc containers. It would be kind of nice if proxmox had something like a Dockerfile, but with local conta…
I have been considering grabbing a Librem 14 and switching to Qubes as a daily. Could you elaborate on what you found cumbersome?
Re: Qubes-Lite with KVM and Wayland
#9Is this really a good idea considering the security issues with Wayland?[1] [1] https://github.com/Aishou/wayland-keylogger
That "security issue with Wayland" is really loading an untrusted .so file from your home directory, which is exactly what running apps in KVM VMs instead (as the article proposes) would fix. So yes, it's a good idea!
In addition, the author states that similar techniques would also work on Windows and Mac, and any platform without sandboxing... which would include most installations of X, unless there's something I'm missing.
Re: Qubes-Lite with KVM and Wayland
#10Earlier quoted context omitted.
The Qubes people don't recommend doing GPU passthrough because of the security implications. As for the OP, I feel like if somebody cares about security, they shouldn't be doing any of this. Trying to come up with some self-designed hodgepodge of things isn't really enough security-wise, even if you do use VMs, and I'd find it hard to trust something like this as a platform to do anything important on.
> The Qubes people don't recommend doing GPU passthrough because of the security implications. Why? DMA?
I don't know details. I was thinking about doing GPU passthrough myself, but whenever developers chimed in on any posts about the topic, this is essentially what they said.
Some links I remember going through:
https://www.qubes-os.org/doc/device-handling-security/#pci-s...
> Additionally, Qubes restricts the config-space a VM may use to communicate with a PCI device. Only whitelisted registers are accessible. However, some devices or applications require full PCI access. In these cases, the whole config-space may be allowed. You’re potentially weakening the device isolation, especially if your system is not equipped with a VT-d Interrupt Remapping unit. This increases the VM’s ability to run a side channel attack and vulnerability to the same. See Xen PCI Passthrough: PV guests and PCI quirks and Software Attacks on Intel VT-d (page 7) for more details.
https://security.stackexchange.com/questions/162122/gpu-pass...