A few interesting hardening tips here: "Now You're Thinking with Qubes" .
Using different operating systems may also improve your security through isolation (depending on your threat model). Qubes provides quite a few different OSs: Documentation | Qubes OS and minimal templates: Documentation | Qubes OS .
See also:
opened 12:29PM - 04 Sep 19 UTC
T: enhancement
C: other
security
P: default
**The problem you're addressing (if any)**
The NetVM is exposed to a wide varie… ty of attacks, and it's the first line of defense in hostile local network environments. (e.g there is evidence certain Middle Eastern countries have been building infrastructure to automatically attempt exploiting every device connected to public WLAN networks)
There is demand (see #4551) for running OpenBSD as a VM but efforts are stalled due to OpenBSD's lack of PV support. Since the NetVM is run in HVM mode, PV support is not necessary in this application.
**Describe the solution you'd like**
OpenBSD offers well-reviewed driver code, high code quality, innovative exploit mitigations, excellent hardware support, low resource consumption, and a much smaller attack surface than Linux. OpenBSD also offers a [much simpler](https://www.openbsd.org/faq/faq6.html#Wireless) approach to connecting to wireless networks than does Linux.
**Where is the value to a user, and who might that user be?**
Adding it as a NetVM would likely increase resistance to attackers on the local network, and increase the diversity of the system (from the current-best MirageFW+Linux to OpenBSD+MirageFW+Linux).
**Related, [non-duplicate](https://www.qubes-os.org/doc/reporting-bugs/#new-issues-should-not-be-duplicates-of-existing-issues) issues**
https://github.com/QubesOS/qubes-issues/issues/4551
opened 08:13PM - 21 Aug 18 UTC
T: enhancement
C: core
security
P: default
### Qubes OS version:
<!-- (e.g., `R3.2`)
You can get it from the dom0 te… rminal with the command
`cat /etc/qubes-release`
Type below this line. -->
R4.0
### Affected component(s):
domU kernel and userland
---
### Steps to reproduce the behavior:
<!-- Use single backticks (`) for in-line code snippets and
triple backticks (```) for code blocks.
Type below this line. -->
Note that Qubes VMs run with SELinux disabled, and without any major measures to protect the kernel.
### Expected behavior:
Qubes VMs are hardened by various measures. These might include, but are not limited to:
- blocking historically vulnerable system calls (such as `ptrace(2)`, `perf_event_open(2)`, and `modify_ldt(2)` with seccomp
- using SELinux to disable ioctls and socket options that are almost never needed in practice
- using a hardened kernel
- strict kernel module signing (no loading of unsigned modules)
- deny user-mode programs, even ones running as `root`, access to kernel memory
### Actual behavior:
No such hardening
### General notes:
Like #4232, this is another case of defense in depth. We should aim to make life as hard for an attacker as possible. Most Xen vulnerabilities need kernel privilege to exploit.
---
### Related issues:
#4232
opened 11:37PM - 16 Apr 17 UTC
T: enhancement
security
P: default
community dev
S: needs review
C: contrib package
**Community Dev:** @tasket
**Package:** https://github.com/tasket/Qubes-VM-hard… ening
opened 10:35PM - 04 Jun 16 UTC
T: enhancement
C: kernel
P: minor
https://groups.google.com/d/msgid/qubes-devel/5751F9E4.2070300%40riseup.net
> v… syscall=none
> mce=0
Maybe also others from that discussion - will update above list then.
2 Likes