Minimizing the TCB in dom0?

General Discussion
1

I would like to shrink dom0, reduce attack surface and also to load it in tmpfs. Possible (removing packages that is)?

Is there a list of unnecessary packages or has it been thought of before? TIA

1 Like
3

sudo dnf remove nvidia-gpu-firmware for a start (108M)

Other firmware probably.

rpm -qa 'kernel*' Does list quite a few kernels. kernel-devel ?

glibc-all-langpacks is one of the largest packages (after kernels) That should be ok to go..:thinking:

qubes-artwork

Also see: Minimize dom0 ¡ Issue #8658 ¡ QubesOS/qubes-issues ¡ GitHub

Fonts* (esp the Google ones), ntfs-3g, hunspell-en, cpp, LibRaw.

The real difference would be when Xorg could be ditched for GUI domain GUI domain ¡ GitHub

1 Like
4
2 Likes
5

Yes.

Yes.

2 Likes
6

Where?

1 Like
7

cheers, hard to see what your conclusion was there? Any ‘gotchyas’ when you removed all that stuff.

1 Like
8

imho, same hardening and “reduce of attack surface” should be done in sys-*, disposables and appvm’s.
Dom0 is enough secure by default, until any appvm with passordless root compromised.

1 Like
9

sudo qubes-dom0-update glibc-langpack-en

followed by sudo dnf remove glibc-all-langpacks $(rpm -qa 'glibc-langpack-*' | grep -v '^glibc-langpack-en-')

If your lang is eng, has so far worked for me.

sudo dnf remove default-fonts-cjk-mono google-noto-sans-mono-cjk-vf-fonts

sudo dnf remove nvidia-gpu-firmware amd-gpu-firmware

Also edit /etc/dnf/dnf.conf

[main]
installonly_limit=2
tsflags=nodocs

Limits it to 2 kernels and does not install docs from packages.

1 Like
10

In 4.3 the situation looks better than in 4.2.
There are only a few XFCE packages that can be removed.

xfce4-eyes-plugin
xfce4-netload-plugin
xfce4-weather-plugin

  • some unused firmware.

Any ‘gotchyas’ when you removed all that stuff.

Haven’t noticed any.

1 Like
11

What is “enough”? How is it defined?

until any appvm with passordless root compromised.

Could you expand?

1 Like
12

You are asking if it has been thought about before, that is evidenced by @qubist’s topic and my own pursuit of a x86 Hyperlaunch stack.

13

No, to this.

Where would this list be?

1 Like
14

I do not have an answer to that side of the mutually exclusive question, my thoughts of the issue obsoletes the former.

15

I provided it above.
I don’t know if anything else can be removed.

2 Likes
16

Everything from dom0 can be removed.

1 Like