Feature request: Restricting moving/copying files/text between qubes
Before opening an issue for this feature request, I would like to discuss it here.
How to copy and paste text | Qubes OS reads:
However, one should keep in mind that performing a copy and paste operation from less trusted to more trusted qube is always potentially insecure, since the data that we copy could exploit some hypothetical bug in the target qube. […] Therefore, you should always copy clipboard data only from more trusted to less trusted qubes.
Besides “keeping in mind” and “you should [be careful]”, there should be a technical solution to that problem. I suggest to restrict moving/copying files/text between qubes. The user should be able to configure for every pair of qubes to which direction(s) copying/moving of files/text is allowed (or not). When trying to copy/move files/text when it is not allowed, the operation should be aborted and an error message should appear stating the problem and giving a solution, e.g. “You cannot move/copy to the clipboard of qube Y from qube X. If you want to do so, please adapt the copying/moving rules in the settings of qube X.”.
With this feature, the user can enforce the rule not to copy from less trusted qubes to more trusted qubes. It can also enforce the rule not to copy secrets from a more trusted qube to a less trusted one. Thus, accidents can be avoided.
In summary, this feature request gives a security level not just a border color and a name but a technical implementation.
Drawback: Configuring the restrictions has complexity O(n^2) with n being the number of qubes.
The default for new Qubes installations should be “nothing allowed”.
The default for existing Qubes installations should be “everything allowed” (for compatibility reasons) or “nothing allowed” (for security reasons). In the latter case, an announcement could be helpful.
What do you think?
PS: The post What would you like to see improved in Qubes OS? - #169 by qubist seems to mention the problem, too:
Additionally, one may decide to take extra measures for not allowing copying from/to other qubes.