My first foray with Qubes - trying to learn one small piece at a time.
I have not connected the machine to the internet in any fashion yet.
This is my objective.
Create a separate VM to connect/use SD Cards - isolated from networking, dom0 (and my understanding was even sys-usb)
These are the steps I have done
• I selected to clone the work VM, as vault is meant to never have any devices attached, alongside no networking, etc.
• Cloned VM to work-sdcard
• In qube settings, I made these changes
○ Basic tab: Set networking to “none”, checked “start qube automatically on boot”
○ Devices tab: Assigned PCI Express Card Reader.
○ Got the error “can’t attach PCI device to vm in pvh mode” - did some research and ended up making 2 changes to be able to apply my changes
○ Advanced tab: Unchecked “include in memory balancing” and selected HVM instead of PVH for virtualization mode (what I read implied HVM would be better than PV for SD Card/block device.
○ Could now successfully click Apply.
• Started the work-sdcard cube
• Inserted my SD card, it was recognized and appeared under device widget for work-sdcard domain
• My first read through had me assign the SD Card to sys-usb, then I mounted it to a folder I’d created within work-sdcard domain.
• Some reading suggested a reboot would be worthwhile to understand if the domain is working correctly and keeps the PCI device assigned - which it did today.
• Today, I did not assign to sys-usb and just tried mounting and it still worked.
My issue is, if I try to insert any other SD Card - the device itself is not recognized. I get no popup or anything about a new device and nothing appears under the device widget.
I went down this path because when I first tried to insert an SD Card to see what happened, it was connected automatically to dom0 - which it shouldn’t to keep dom0 uncompromised is my understanding. Is this understanding incorrect? If the sd card device is connected in dom0, is that a potential vulnerability? Or as long as I don’t mount it in dom0 it is ok? Regardless I feel if one sd card works in the work-sdcard domain, others should too - but they don’t appear I cannot find a /dev/? Block to mount.
I have read through the qubes documentation including these links - sorry forum won’t let me include them, majority from documentation (How to use devices | Qubes OS, How to use PCI devices | Qubes OS, How to use block storage devices | Qubes OS, AssigningDevices, How to use USB devices | Qubes OS, and as well found these two github issues where it seems a decision was made to not automatically assign PCI devices such as card readers to sys-usb. (Assign memory card readers to USB qube by default · Issue #2055 · QubesOS/qubes-issues · GitHub, Include all DMA-vulnerable controllers (FireWire, Thunderbolt, etc.) in sys-usb (or a separate domain) · Issue #2454 · QubesOS/qubes-issues · GitHub)
All my SD Cards are formatted to FAT32 and work if inserted to another device.
Does anyone have any suggestions? Any gaps in my understanding?