Is it safe to use bluetooth with Qubes?

[regi]

Before installing QubesOS, I physically removed the bluetooth from my laptop because there was a risk of it being remotely controlled. I think it was called BlueBorne or something.

Is it better to remove bluetooth even with QubesOS? Or is it safe to use?

[fsflover]

If you set up it correctly, you can safely use Bluetooth on Qubes OS. Here are the details:

Debian-minimal template for sys-audio

Hi, I would like to configure a minimal template for sys-audio instead of the default fedora-34-xfce. I installed qubes-core-agent-usb , qubes-core-admin-client , and pulseaudio-gui-daemon-qubes,alsa-utils,pavucontrol in deb11-audio, which was a clone of debian-11-mimnimal, and changed the pre-configured sys-audio’s template to deb11-audio. I’m happy to see audio streams coming from other qubes in pavucontrol . However, I couldn’t use any physical audio device, including my soundcard (Realtek …

See also:

Sys-audio and bluetooth - how safe?

Hi, I’m trying to make a final judgement on the functionality and the safety considerations of putting a bluetooth daemon inside of sys-audio in order to stream sound to an external bluetooth sink. Is this a functional approach to getting your sound streamed? Are there any issues that come up that make it impractical or not-what-you-want? What are the safety considerations of this? Assuming bluetooth is compromised how much of a risk are you taking? Does sys-audio only get data from other …

[augsch]

A more detailed and more modern ( utilizes pipewire instead of pulseaudio ) guide posted by neowutran can be found here. However it’s not aimed at creating a minimal template.

[neowutran]

It work with minimal template too

[regi]

Is it correct to assume that bluetooth is safe if I create sys-audio and partition it?
I don’t understand how to create sys-audio because it is difficult. Is there a simple explanation?

[fsflover]

The general idea is that you run Pulesaudio/Pipewire software (which manages the sound) in a dedicated VM, sys-audio, isolated from dom0. At the same time, your bluetooth device also never gets in contact with dom0 but only with sys-audio and sys-usb. With such setup, you enjoy the security through compartmentalization, which only Qubes OS offers. To configure it, you should try to follow the above instruction(s) and ask on this forum whenever something unexpected happens.