Is Landlock (Linux Kernel Security Feature) used by dom0 kernel?

[fsflover]

@gonzalo-bulnes are you sure this is offtopic?

Xen/QubesOS Kernel Hardening

Does QubesOS/Xen employ the use of a hardened kernel as per the following Whonix forum discussion?

My personal experience of attempt to harden qubes VM

Just saw this discussion More practical security for Qubes (and more realistic threat model) - #42 by 51lieal @arkenoi so I would like to share some of my experience on harden qubes VM. Basically my opinion is qubes is fantastic about compartmentalization, but abandon in VM security completely is a bad idea. Even for a amateur user like me I can feel the VM security is quite terrible. It seems the developer’s idea is to use seperate VM for every activity, so it is irrelevant to secure each sing…

Hardening Qubes OS?

I was wondering whether anyone has any tips on how to further ‘harden’ Qubes OS. I am currently running all my sys-* as disposable vm’s. These sys* vm’s are all based on fedora-33-minimal. I also use 1 appvm/standalone per program. Any further tips would be appreciated!

Template Hardening

Are there steps that can be taken to harden Qubes templates for Debian and Fedora? Things like exploit mitigations, kernel and boot flags, app sandboxing, apparmor, SELinux, etc. I don’t see any documentation that talks about this. Was looking to follow this guide https://madaidans-insecurities.github.io/guides/linux-hardening.html