How to combine sys-usb with sys-net

In some cases you maybe need combine sys-usb with sys-net. But it’s less secure than having sys-net and sys-usb separate, so be aware of it before doing it. To do it :

  • In the following file :

nano /etc/qubes-rpc/policy/qubes.InputKeyboard
nano /etc/qubes-rpc/policy/qubes.InputMouse

replace from

sys-usb dom0 allow,user=root


sys-net dom0 allow,user=root

  • Shutdown

Go in the sys-net terminal and shut it down, for exemple with init 0
Go in the sys-usb terminal and shut it down, for exemple with init 0

  • Transfer the usb controler from sys-usb to sys-net

Go in the settings of your sys-usb Qube and disable “start on boot” and apply your modification
Go in the settings of your sys-net Qube, and in the devices section, find the usb controler of your computer, selected it and apply your modification.

  • You can start now sys-net
1 Like

Just to understand this better: what could be the reasons one would want to do that?

If you use a external NIC, it can not work properly sometimes

Since sys-net is an HVM with PCI access, I see it as one of the weakest links in terms of security. A member of the Qubes Team seems to agree with me in the linked thread. I’d recommend creating another sys-usb for all other usb devices not involved in networking.


Not technically-trained; consume advice with salt


Like attaching all the USB devices that is not the external NIC by doing ?

qvm-usb attach sys-usb sys-net:{ID of the usb devices}

1 Like

Good point–I have no idea how to assign individual USB ports/devices to separate sys-usbs. There’s probably a way to do it, but someone more knowledgeable will have to show meus

It’s not ports, it’s controllers.
You identify each controller, and then can allocate them using the
Devices tab in Qube Manager settings for each qube.
Sometimes you may find 2 controllers on the same port -this will be if
the port supports USB2 and USB3.
Once you have allocated the controllers, you can easily identify the
ports they control.

Sometimes too, the USB controller may be associated with other devices -
you may find that the qube does not start until you also allocate these
other devices - common on laptops.