There must be a quick way to describe “what is Qubes” for technical people who know what Linux and Xen are. “Qubes OS is its own thing” is not very helpful. FAQ itself says that “more of a “Xen distribution” than a Linux one”, and I think it’s a perfect short-cut in such case. I also linked the FAQ for more information that it’s not simply Xen.
In principle, Ubuntu is getting further and further from Debian, see snaps. “Based on Debian” is not supposed to explain everything, only to give an idea how to start thinking.
1- About “When was this written?”, you can check it.
2- About “Why would you need hardening of “Qubes OS itself” if…”, so, applications like Internet browser, LibreOffice and etc. are not run in the Dom0. Am I right?
Why do you trust Dom0? To harden Linux, it is necessary to enable or disable some parameters in the kernel, some services, and apply some firewall rules.
3- About “I explained above that it’s based on Xen. It’s also…”, Xen is just a Hypervisor that you can install it on GNU or BSD. For the Qubes OS, Xen Hypervisor installed on Fedora or Debian?
4- Why did the Qubes OS team choose GNU, not BSD or even Solaris?
At this point I have to think you are simply trolling (on this point).
Dom0 is isolated from domUs. DomUs can access only a few interfaces, such as Xen, device backends (in the dom0 kernel and in other VMs, such as the NetVM), and Qubes tools (gui-daemon, qrexec-daemon, etc.). These components are security-critical, and we provide updates for all of them (when necessary), regardless of the support status of the base distribution. For this reason, we consider it safe to continue using a given base distribution in dom0 even after it has reached end-of-life (EOL).
Xen runs below the OS. So Fedora is the OS in the Admin VM. This is basic stuff posted multiple times now in this thread.
Qubes aims to be as free as possible without sacrificing security . All of the code created by the Qubes OS Project itself is 100% free.
You harden Linux in order to run something untrusted on it. When you don’t run anything on it, there is no reason to harden it. Also, a lot of software is removed from Fedora in dom0, decreasing the attack surface.
Thank you so much.
One thing is very interesting to me and I want to know this. So, Dom0 only runs the main components of the operating system. It’s kind of like a jail for the kernel.
Which one of these two cases is correct:
1- Dom0 runs a Linux distribution and the rest of the applications such as the Internet browser, LibreOffice and etc. run in another Linux distribution.
2- All applications run in a Linux distribution and only Dom0 protects the kernel from interference from other applications.
Sorry if my question is strange or wrong and I could not express my meaning correctly.
Dom0 runs Fedora. The purpose of dom0 is to be the only privileged domain that can command the hypervisor. It’s the AdminVM. This is the domain where the user can command to start other domains (domU) and use Qubes OS tools to configure and control them. Dom0 is offline. It is only meant for admin purposes. It is not meant to be used for anything else.
There are other domains (domU) that can run a variety of OS. Mostly Linux based but also BSD, Windows, Android or even more exotic OS.
AppVMs: these are the qubes where the user runs applications and does their actual computing. Their /home directory is persistent, everything else is copied from the templates and doesn’t persist.
TemplateVMs: these are qubes used as templates for AppVMs. The user only installs software in them but ideally never runs it. Template VMs are offline by default and use a special proxy to install software (via apt or dnf).
ProxyVMs: these are AppVMs or DispVMs providing internet connection to other qubes when set as ‘netvm’ for that qube. These are usually system qubes.
DispVMs: have no persistence at all and use a specially prepared AppVM as template.
System qubes provide services to other qubes. Mostly this is about isolating hardware access: sys-net (Ethernet/Wi-Fi), sys-usb, sys-audio(Mic/Speaker/Headphone), sys-gui(Graphics) but can also provide non-hardware related services: sys-firewall, sys-vpn etc.
The “protection” (aka compartmentalization) comes from the hypervisor (XEN). All domains except dom0 are jails as they can’t see or interact with any other domain / qube. dom0 is the only domain that is not a jail and can see and interact with other domains. Hence it’s the adminVM/qube.
The Qubes OS idea is the security by compartmentalization into domains and providing secure ways of orchestrating them and moving data among them in a controlled way.
You hope Subgraph OS is not abandoned – me too. It looks like an interesting concept and I’d like to see it executed. …but I am not holding my breath.
You don’t like Fedora – me neither. In fact none of my domU run Fedora, they are all Debian. …but I don’t interact with dom0 other then using qvm- and qubes- command line tools and understand that architecturally it doesn’t make a difference security wise.
You want to point out that there are other licenses than GNU – sure there are. If you’d like to discuss the finer points of open source licenses I recommend you find another forum. This is not the place for it.
About “You hope Subgraph OS is not abandoned…”, not really. If it uses Xen Hypervisor, then I hope it will not be abandoned.
About “You don’t like Fedora…”, I did not say that Debian security is better than Fedora or vice versa, I said this because Red Hat and Fedora are enemies of the Xen Project and Debian has more packages.
I think you’re getting hung up on terminology and I can’t blame you; because the terminology has changed over time. The diagram calls dom0 the AdminVM (I think AdminVM is becoming the “official” name for it but that’s going to be a slow process).
The diagram you linked also isn’t trying to display proxies and disposables as such so you’re not going to find them there. It’s not that they don’t exist, it’s just that the diagram is trying to show you something else. Its focus is instead on the interactions and interrelations between qubes (VMs, domains) rather than on what kind of VMs they are.
It depicts a collection of domains (or VMs, or qubes…again, a terminology change in progress). As it turns out, however, depending on your installation and how you’ve set things sup, AppVM 1, AppVM2, and the other AppVM2 might be disposables, or might not be. (The default is that they’ll be regular AppVMs, not disposables.) Also sys-firewall, sys-usb, and sys net might be disposables (they are on my system) as well as being proxies. Sys whonix is a regular AppVM as well as being a proxy.