Using safing portmaster for qubes

User Support
1

Hello,

I figured trying portmaster to prevent leaks and add custom filtering. It has a GUI and SPN may come handy some day.

However, the configuration files are stored in the root directory so any appvms will not inherit the configurations.

I could use a dvm-template with the configuration pre-configured but because of how qubes networkVMs are configured it hasnt worked as expected. For example, running portmaster in sys-vpn would not filter my appvm that is connected to it. So any dvm-template options are not an option afaik.

I could run portmaster in each appvm as its relatively low on memory and cpu usage. However, my appvms do not inherit the configuration files for portmaster because they are in the root directory of the template.

  1. Is there a way to change where portmaster stores the config files?
  2. Can portmaster be run in a firewall or sys-vpn while also apply its filtering capabilities?

If none of the above are viable, what are some open snitch alternatives with friendly UX?

2

You can use the /rw/config/rc.local script to copy the configuration files, which have to be stored in /rw/config too, to their proper locations, on every boot.
In other words, “add commands to the rc.local file” in order to achieve the goal.

3

for reference:

make sure that you keep files and directories with same access and ownership to avoid issues

perhaps, copying original files such as (same for other directories: /var/lib/ /var/log/ /run/ … )

cp -ax /etc/application/ /rw/bind-dirs/etc/application/

1 Like