How to combine sys-usb with sys-net

[fiftyfourthparallel]

Since sys-net is an HVM with PCI access, I see it as one of the weakest links in terms of security. A member of the Qubes Team seems to agree with me in the linked thread. I’d recommend creating another sys-usb for all other usb devices not involved in networking.

Is sys-net the weak link in our systems' security?

An XSA in the most recent QSB* reminded me to ask about the vulnerability of sys-net and whether there should be increased efforts to make this particular sys-VM run from a unikernel, microkernel, or something else with a minimal attack surface, especially since it really only does one simple job (I think). In brief: My gut feeling since before this QSB has been that sys-net presents the most accessible target for a remote attacker who might want to compromise the whole system as it isn’t (can’…

 

---

^{Not technically-trained; consume advice with salt}