Security and minimal templates

[qEawma5f]

Hi,

I noticed that the minimal templates do not include AppArmor/SELinux. It seems that minimalism was chosen over security in this case. Could someone explain the reasoning behind this choice? Would it be beneficial to add SELinux/AppArmor into the minimal templates? Additionally, what other security “features” have been removed from the minimal templates?

Thank you.

[parulin]

You will find answers here:

Minimizing Minimal Temlpates

I’d like to start off by saying that I am appreciative of Qubes devs and the effort they put into the project. While I do have my criticisms, please understand that they are intended as constructive feedback/requests, not a complaint. With that said, I’ve been using minimal templates for a while now, and I wish they were lighter. When I hear “minimal template,” I think of a template that has the bare minimum to 1) turn on, 2) interact with salt (i.e. salt minion setup), and 3) run a shell via X…

In short: nothing is removed, it’s just not added.

@qEawma5f

It seems that minimalism was chosen over security in this case.

That’s why we call them minimal templates

As far as I understand, the templates in general are not particularly more secure, it’s a standard fedora or debian system with a few packages installed in order to get a nice experience on Qubes OS.

[qEawma5f]

If someone wants to enable apparmor on a debian minimal template they can run (install apparmor and the apparmor profiles)

qvm-features debian-12-minimal apparmor 1
qvm-features debian-12-minimal supported-service.apparmor 1

No idea if the same command exists for selinux.
but this should help (not tested)

How to install & activate SELinux on minimal fedora templates?

you would need to have same packages you have installed (preferably apply this to a new minimal fedora template) but then relabel the file system first then set selinux to enforce as the last step only , here is how to do it : NOTE: switch back the mode to permissive temporarily from /etc/selinux/config then reboot the template ( reboot could be not needed yet) . next create a file called “.autorelabel” at the root directory ( include the dot at the beginning of file name ,ma…