Monero Wallet/Daemon Isolation with Qubes + Whonix

[apparatus]

The Whonix guide is using custom service with qrexec + socat and other is using Qubes OS service qubes.ConnectTCP:

Firewall

Both are using old policy format so it’s better to change policy to the new format e.g.:

Guide: split-Protonmail (offline send/receive qubes + pm bridge vm)

Thanks again for writing up this guide! I think we can update some things so that it’s locked down even more, in particular we can eliminate the need to allow arbitrary TCP connections between the qubes. The new policy file (using the new fromat described at Qubes Architecture Next Steps: The New Qrexec Policy System | Qubes OS) looks like this, in /etc/qubes/policy.d/30-protonmail.policy: # Always allow connection to imap. Thunderbird will give you 2 pop-ups every # time it checks for new mes…

Qubes Architecture Next Steps: The New Qrexec Policy System

Qrexec: secure communication across domains