I’ve been re-reading the wonderful Qubes OS docs, because, you know, they’re so comprehensive and well-written (they actually are!); but it got me thinking.
On a fresh Qubes OS install, if a USB keyboard is detected,
sys-usb is not created at all.
Is there any special reason for this?
The way I see it, under this setup:
- All USB buses go straight into dom0
- All HID devices are detected and accepted without question
- All nob-HID USB devices also go straight into dom0
- A malicious device with firmware that’s specifically crafted for Qubes OS could easily declare itself as a HID device and wreak havoc on your entire machine, including all your VMs
- The user wouldn’t be notified of any such device suddenly pretending to be a keyboard
- I’d imagine quite a lot of new users would get excited about Qubes OS, only to get frustrated when that none of their USB devices work out-of-the-box
- Printers, game controllers, YubiKeys, etc. all go into dom0 and the AppVMs don’t even know they exist
- This forum has quite a few threads about “Why don’t my USB peripherals work?”
Given all of the above, would it not make more sense to:
- Create a
- Move all USB buses into it
sys-usb dom0 allowby default for the qrexec policies
- Notify the user during the initial setup with a big dialog box stating the implications of this, with clear instructions on how to change these settings should they wish to
This would avoid the headache of having to create a
sys-usb yourself, which can be a headache at the best of times for some users. It would allow new users to not erroneously think that they’re “missing drivers” for their USB devices.
It would also avoid the situation I found myself in of passing an AppVM that automatically starts on boot the USB buses containing the internal keyboard and trackpad of my laptop, forgetting to set the dom0 policies, and basically making it impossible to use the entire machine, and eventually rage quitting and reinstalling Qubes.
Not to mention; anyone with hardware containing a PS/2 keyboard would be unaffected either way.
Yes, having the policy of accepting USB keyboards by default does allow for rubber duckies, but so does putting them straight into dom0, so as far as I can see, there isn’t really any difference.
Or is there something I’m not taking into account?