Qubes code audit

[distopia]

@illuminati

I’m interested in improvements for backups, but I don’t think I could help out with that at the moment.

Sorry my initial question about backup improvement was too wide from this specific topic goal of auditing. I mixed up a little the different purposes of both topics.

Eventual backup tool improvement stays in the previously mentioned topic. To narrow it down to the goal of this one, could a security audit of the code involved in native backup be of interest for you ? And perhaps a good candidate for a pilot community audit session ?

A reason why I made the link was :

In previously mentioned incremental backup topic Tasket is talking about some potential flaws (security issues ?) with native backup tool (run in dom0).

@tasket

From a security perspective, Wyng also has advantages. Unlike qvm-backup it doesn’t parse any un-verified tar archives or other metadata in dom0 (qvm-backup creates archives with two tar layers, the outer layer is un-verified when its processed)– in an OS security model where even reading partition tables in dom0 is considered risky, this is significant.

Wyng also doesn’t hand complex archival tasks to untrusted VMs nor to dispVMs that mount untrusted volumes, which is possible attack surface for causing DoS or worse compromise (and tends to be slow).

To which Rustybird replies :

@rustybird

There’s no signing mechanism (@distopia), but there is a mechanism to defang the outer tar format layer of the Qubes OS backup file during restore:

Assuming that the backup file is being provided by a VM (i.e. it wasn’t manually copied into dom0!), restore.py will not deal with complex tar format data directly. Rather the VM has to convert it to the simpler qfile format (as used for inter-VM filecopy, or for receiving dom0 .rpm package updates) before streaming that to dom0, where the stream will be processed by qfile-dom0-unpacker instead of the tar utility.

Incremental backup possibilities - #34 by rustybird

There are maybe other components which have a higher priority, I remain interested in community auditing for any component.