FreeBSD template

drtduit · December 27, 2023, 3:35am

I think it would be very useful to create an official or community template with FreeBSD.
FreeBSD is very stable, very very mature and has long release cycles. It’s true that it’s much more complicated, but it also allows a lot of interference in the system, as we know, it’s also a very popular system among advanced server users.

solene · December 27, 2023, 8:33am

A template could only be think of once FreeBSD had support for the qubes services and extra drivers like Xen vchan

fsflover · January 2, 2024, 8:38pm

Somewhat related:

github.com/QubesOS/qubes-issues

Add First-Class Support for OpenBSD

opened 06:53AM - 27 Nov 18 UTC

esote

T: enhancement help wanted C: templates P: default

This issue serves as a way to track possible [OpenBSD](https://www.openbsd.org/)… support in Qubes OS. OpenBSD and Qubes OS are among the very few operating systems that provide serious security for their users. To be clear, I think the way we currently do things is _sufficient_, but I don't think it is _proactive_. ### In dom0 Having the OpenBSD operating system in dom0 is a long way off. I would be surprised if OpenBSD provides the ability to (easy) run as dom0. Currently, FreeBSD dom0 [works](https://wiki.xen.org/wiki/FreeBSD_Dom0). Given that dom0 has a much smaller attack surface than domU, running OpenBSD instead of Fedora would not provide much security benefit. Let me know if I'm wrong here. I suppose it could be helpful in simplifying dom0, given that OpenBSD is vastly stripped down of anything that could be vulnerable on a default install. With the 4.1 dom0-GUI split, we could remove all `x*` [file sets](https://www.openbsd.org/faq/faq4.html#FilesNeeded) in dom0. ### In domU OpenBSD [now supports](https://www.openbsd.org/59.html) running as [PVH domU](https://man.openbsd.org/xen) and [Xen paravirtualized networking](https://man.openbsd.org/xnf). However, currently it is not easy to run OpenBSD -- I've been successful running it as a standalone HVM and can only access it through the debug console. Providing an OpenBSD template, in the same way Fedora, Debian, and Whonix are today (this is what I mean by first-class support), would vastly reduce user attack surface. By attack surface, I mean the kinds of things summarized in [this talk](https://youtu.be/AvSPqo3_3vM?t=2346). We currently strive to reduce Xen's attack surface (and we do a decent job with only 18% of XSA's having affected Qubes OS), so reducing the attack surface in domU is a natural extension of security in depth. Running OpenBSD gives users a secure-by-default environment for their VMs, something that is lacking currently (#4233, #2748, #2045 etc.). OpenBSD is well know for its proactive security and development of [many security features](https://www.openbsd.org/innovations.html) that often slowly filter down to other operating systems. Qubes tools are made with Linux in mind, and some will need to be extended to support *BSD operating systems. --- Let me know what possible obstacles you guys see with this. It would be nice to see these two great operating systems fit together to provide a truly "reasonably secure operating system." (This issue is a requirement of, and related to, #4245).