Real threat of installing software in dom0?

[fsflover]

@balko

@szz9pza

If we listen to you, it’s “OK” to install every single packages of the Fedora repo into dom0.

No, it is simply not true.

@balko When you say that it’s OK to install something in dom0, you should indeed mention that it’s not really OK for everyone, but only if the user knows what they are doing.

The whole deal with (not) installing additional software in dom0 is about trusted computing base. Qubes provides security through compartmentalization, i.e, your TCB must be as small as reasonably possible. The Qubes team is trying to remove most things from dom0: audio, handling of USB devices, GUI and so on. This is the Qubes way. For advanced users, it’s even recommended to use minimal templates, which have less code – despite the fact that you still can install something in them quickly. For this reason you should avoid installing anything in dom0, unless you know what you are doing.

It would be interesting to see a comment from @unman about possible security implications of installing KDE. This is more or less the reason why I’m not using KDE and stick to xfce, which has less code.

See also:

@Sven

In summary (my understanding):

• Since there is no networking in dom0, any bugs discovered in dom0 desktop components (e.g., the window manager) are unlikely to pose a problem for Qubes, since none of the third-party software running in dom0 is accessible from VMs or the network in any way. Nonetheless, since software running in dom0 can potentially exercise full control over the system, it is important to install only trusted software in dom0.
• The Qubes OS project is actively working on moving more of the hardware handling into dedicated qubes: sys-net, sys-usb, sys-audio, sys-gui, etc. Once this is isolated in a qube you can choose which distro to use.
• Eventually there won’t be any GUI and only very little hardware handling left in dom0 at which point the project might switch to a very minimal build specific to Qubes OS (no other distribution needed).
• Even longer term Qubes OS (Air) might make use of other compartmentalization techniques and there might not even be a Xen/dom0 anymore but only admin qube(s).