Ssh to dom0

[qubist]

@rustybird

You won’t be executing the qvm-foo or qubes-bar command in dom0 though, but it in the admin client qube. Then the command will make (often multiple) admin API calls to dom0.

But then the “admin client qube” won’t be able to function as “dom0 managed over ssh”. AFAIK, you can’t e.g. qvm-create ... in a domU, so the “admin client qube” will simply not function as such. Or am I missing other options?

@otter2

Seems like @qubist wants arbitrary code execution in dom0 without direct ssh connection.

Not completely arbitrary. The service in dom0 that reads the command queue through polling the “admin qube” domU can check if particular commands are allowed and act accordingly.