By onboarding I refer to the installation of Qubes on your machine, when you’re prompted to partition your drives, configure your timezone, and set a password for your dom0
user.
This only appears during installation. If you wanted to set up a system like this after installation, you’d have to manually configure it.
Your wireless mouse connects via a USB dongle, which plugs into a USB port, controlled by a USB controller. Your USB controller is handled by Xen, which isolates it from dom0
. Exposing a USB controller to dom0
is a bad idea, because USB controllers are often very highly privileged due to their having to interface with things like drivers. If your USB controller was exposed to dom0
and I plugged in a malicious USB drive, for example, I could gain almost complete (if not total) control over your system.
I made the assumption that your wireless headphones connected either by Bluetooth (very common) or by a wireless USB dongle. I’ve never heard of headphones that connect by WiFi.
You are correct in stating that WiFi is not handled by Pulse. Pulse runs in dom0
. Your WiFi connections are handled by the domain attached to your network adapter, by-default sys-net
.
If your wireless headphones connect via WiFi, then you might have to connect your network adapter to dom0
. As far as isolation principles go, this is an extremely bad idea because it exposes dom0
to your not just your entire local network but to the entire internet, un-firewalled (except for router configurations).
It might be possible to put together some sort of isolated audio handler in dom0
that Pulse can interface with that transparently sends your audio to the domain attached to the controller which connects to your headphones (if this hasn’t already been done), sys-usb
for a USB dongle, sys-net
for WiFi headphones, or some other configuration for a Bluetooth controller (I would say just attach it to sys-usb
too, because they’re the same thing as far as isolation principles go, requiring near-physical access and with high privilege in the system).
I don’t know what you mean by this. I assume you’re saying you have a mouse plugged in. Is this mouse plugged in to a USB port on your machine, or a PS/2 port?
It is completely possible that the standard configuration for sys-usb
has a system of proxy handlers than can pipe around your USB mouse and keyboard input, but I’m not sure, I’ve never used either with Qubes.
I’m going to recommend some further reading of the documentation. Check this article out (you can probably skip the part on PCI (but it is interesting)):
Onion: http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/doc/device-handling-security/
And also this article, on specific pitfalls for USB devices:
Onion: http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/doc/usb-troubleshooting/