How exactly is dom0 made network-less?

General Discussion
21

Good for you. You endangered your whole Qubes, while I hardened my with qrexec.

22

@quber has mostly covered the missing point:

The kernel could be networked, but at startup all of the relevant PCI devices are bound to inactive, dead, driver modules, that do not even touch the network-y functions of the hardware.

If you run in a dom0 terminal:
lspci -k
you can see for each device:

  • “kernel modules” - which are available modules suitable for that device
  • “driver in use” which is what is actualley being used.

Any place with pciback is using that inert, dummy driver. (see answers from @quber )

That stops the device from doing anything inside dom0.

Normally **, all the net devices are bound to pciback.

1 Like
23

It’s not impossible, but all the relevant things disabled and/or not configured.

Let’s see what would be needed to be ‘networked’:

  • kernel level networking support. This is actually present in dom0
  • a networking device. By default ALL is assigned to sys-net via PCI Passtrough. So there is no physical device in dom0
  • xen level virtual networking - that’s how the VM’s are connected, but still: dom0 has not configured for such.
  • routing and/or networking related software. Not installed and/or disabled in dom0 by default.

As a result of those (provided by the default installation) makes dom0 non-networked.

You - as the Qubes OS main user - can ‘redo’ all of these, but doing so you would break one of the main feature of Qubes OS…. so it is not ‘impossible’ but the reasons behind such activity would be questionable. And not recommended - if you ask me :slight_smile:

3 Likes
24

Thi is partly true - the device can be seen in dom0, but it is not normally usable, becaise of the pciback driver.

If you want to have many problems, (IIRC) you can even detach the pciback driver in dom0, and attach a real driver. This will create huge problems, when dom0 and sys-net kernels both start playing with the device at the same time. Do not try it!

1 Like
25

@quber
@phceac
@Zrubi

Thank you very much for explaining!

I am not looking for a way to enable networking in dom0. I am simply interested in how things work.

1 Like
26

I think it was a good question.

My interest is how things get broken -it’s exactly the same thing, and exactly the opposite.

Sometimes I like to even try doing the breaking!

27

Yep.