Hide from apps the fact that you use Qubes by using Distrobox

Community Guides
1

So, one of the apps I had to install does some os fingerprinting. Now I thought hard about how to do so. My idea first idea was - use flatpak. But I found it too complicated. Other solution would have had been using a web version or standalone vm. But those two options are also too complicated for me

But then I remembered how I used to install some apps on distros which don’t have much packages in their default repos

DIstrobox

So, I copied a Debian 13 template. Called it distrobox. Then installed Distrobox into it. After installing Distrobox I made an app vm. Into it I downloaded the default container and let it install packages into itself. Then I cloned it just in case. Then I installed the app I wanted from the default package manager. The result was what I wanted. The app identified my session as “Podman”. Meaning I successfully avoided giving away the fact that I am using Qubes

Distrobox by default creates a separated root file system. While the home folder is shared. So the main giveaway of the fact that it is Qubes is Qubes incoming folder. But there are some others System Identity Camouflage and Virtual Machine Cloaking It will not protect from apps with more invasive fingerprinting techniques

3 Likes
2

So, one of the apps I had to install does some os fingerprinting.

Which app? How exactly does it do it?

3

Not comfortable saying which

1 Like
4

You found flatpak complicated but not this?

I am genuinely confused… :confused:

5

Flatpak template seems confusing to me

If what I described is confusing, can you tell me how to make it easier to understand?

6

@tokaso80 @marcos-morar How does an application identify a session in flatpak?

7

I am not an expert on this but I think flatpak applications take session variables from the host.

Its somewhat explained here:

Environment variables are generally passed on to the sandboxed application

And in here:

Specifically this:

D-Bus access

D-Bus access is filtered by default. The default policy for the session bus only allows the application to own its own namespace named by $FLATPAK_ID, subnames of it and org.mpris.MediaPlayer2.$FLATPAK_ID for MPRIS. Furthermore, it is only allowed to talk to names matching those patterns, the bus itself org.freedesktop.DBus and portal APIs of the form org.freedesktop.portal.*.