Are there plans to move to wayland?

qubist · February 3, 2025, 12:13pm

You already trust something like ~1000 packages from Fedora in dom0.

Well, it is more complicated than that:

github.com/QubesOS/qubes-issues

Minimize dom0

opened 09:37AM - 26 Oct 23 UTC

closed 10:55AM - 26 Oct 23 UTC

emanruse

R: declined P: default

### The problem you're addressing (if any) As of Qubes OS 4.1.2, dom0 is not …as minimal (optimal) as it could be. For a security focused OS, this is an open door for various issues capable to affect the system through system updates. There is quite a lot of software which is never used. Example: ``` root@dom0:~ # dnf list --installed *firmware* | sed -r 's/ {2,}.*//g' Installed Packages alsa-sof-firmware.noarch amd-gpu-firmware.noarch intel-gpu-firmware.noarch linux-firmware.noarch linux-firmware-whence.noarch nvidia-gpu-firmware.noarch ``` This is on a system with no NVIDIA or AMD hardware, yet this firmware (which IIUC is certainly **proprietary**) is there by default (not installed by me explicitly). Additionally, image processing libraries (like LibRaw) are installed in dom0 (as dependencies) etc. All this is quite concerning in terms of security and doesn't quite match the advises regarding minimizing the attack surface. fedora-38-xfce is 5.7 GiB. fedora-38-minimal is 2.6 GiB. debian-12-minimal is 1.4 GiB. dom0 is **7.2 GiB**. ### The solution you'd like (Options for) minimal/minimized dom0. Ideally, with a GUI domain, separate from dom0. During installation, provide options to install software necessary only for existing hardware. For hardware which does not exist on the system, provide options not to install drivers and firmware for it during initial installation. For hardware which the user may use in future (but is not present all the time), provide convenient way to install necessary software at a later time, ideally in a temporary, isolated way, so that when the hardware is no longer on the system, the software for it can be easily disabled/removed too. Reduce proprietary software existence on the system to the possible minimum. (Perhaps have options to) base dom0 on other, non-Fedora, templates (e.g. Debian minimal?) explaining to the user the pros and cons. ### The value to a user, and who that user might be - Minimize dom0's vulnerability to potential (security) issues entering it through various libraries and dependencies. - Save storage space and network bandwidth (hence also update times) by not installing (and updating) GiB of unnecessary stuff. https://forum.qubes-os.org/t/how-to-minimize-dom0/20945/