Not yet, but Qubes provides security through compartmentalization, and systemd can’t do much against that, except if it’s really malicious in dom0. For example, your offline VMs will never access the Internet and your compromised VMs will not access the data in the former.
I mean, dom0 has full access to your whole system. It can do anything and any software running in it should be trusted to not actively compromise your security. Unintentional bugs however are typically safe, since there is no_networking in dom0.
Can you please explain what is “unintentional bugs”? Could dom0 come installed with a maliciously modified version of systemd which has been compromised as part of a supply chain attack?
It’s in my links above (which I had to update, since I found more relevant doc pages):
Since there is no networking in dom0, any bugs discovered in dom0 desktop components (e.g., the window manager) are unlikely to pose a problem for Qubes, since none of the third-party software running in dom0 is accessible from VMs or the network in any way. Nonetheless, since software running in dom0 can potentially exercise full control over the system, it is important to install only trusted software in dom0.
“Nonetheless, since software running in dom0 can potentially exercise full control over the system, it is important to install only trusted software in dom0”
Can you define what means “full control” over the system? What does “full control” mean?
Systemd is the very first process that runs. Can you tell me documentation that describes how systemd is integrated with Xen/QubesOS APIs?
However, nobody can attack it, except trusted software already running in dom0, which is minimized and verified. Even more compartmentalization is planned for future Qubes versions: GUI domain | Qubes OS.
You don’t have to use the core-admin. If you expect that it might have bugs, you simply switch off any inter-VM interactions (or interactions between trusted VMs).
It’s discussed in my links above. You should continue these discussions, in order to keep this forum readable, if you’re interested.
You must trust everything running in dom0 in order to be able to run Qubes. You can verify and compile the code yourself, or rely on the Community for that. Also, the developers provide a possibility to verify that the code comes from them without any modification on the way.
GPU and window manager will not have full access to dom0 anymore. Also there is audio domain to isolate the Pulseaudio and sound hardware (and Bluetooth).
Yes, but it’s in beta and without a strong hardware virtualization yet.