Why doesn't QubesOS use OpenBSD for its admin vm instead of linux?

General Discussion
1

I don’t have a lot of background in this topic, so I apologise in advance if this is a dumb question.

Right now QubesOS uses an admin vm for system management. This vm is running fedora linux and is given the highest level of trust out of any vms on the machine. While fedora is secure as far as linux distros go it will inevitably have way more vulnerabilites than an os like OpenBSD, which is insanely secure, so why not use OpenBSD instead since the philosophy of QubesOS is to increase security as much as possible? Is there some reason OpenBSD isn’t capable of handling the tasks demanded by QubesOs? If thats the case, what would it take to get OpenBSD to that point? Also, would switching to OpenBSD even give any significant advantages compared to running linux?

2 Likes
2

I’m no expert on this, but there are two reasons I see. Lack of hardware compatibility, OpenBSD does not support as wide of a range of hardware as linux. And, it doesn’t seem like OpenBSD supports being dom0. Doing a quick search, the ai overview says it is not supported. There is only limited support for being a xen guest (domu).

Edit: grammar

2 Likes
3

The security of dom0 (as all the other vms’ security) is not dependent on the distro/OS installed there; it is instead based on isolation.

6 Likes
4

See also:

3 Likes
5

13 years ago, it has been said that someone earlier “liked” Fedora and as of today that is still the only info we have regarding distro choice, alongside the general reluctance of the team to discuss fundamental choices. So, take it cum grano salis, considering also:

1 Like
6

I don’t have a lot of background in this topic, so I apologise in advance if this is a dumb question.

Right now QubesOS uses an admin vm for system management. This vm is running fedora linux and is given the highest level of trust out of any vms on the machine. While fedora is secure as far as linux distros go it will inevitably have way more vulnerabilites than an os like OpenBSD, which is insanely secure, so why not use OpenBSD instead since the philosophy of QubesOS is to increase security as much as possible? Is there some reason OpenBSD isn’t capable of handling the tasks demanded by QubesOs? If thats the case, what would it take to get OpenBSD to that point? Also, would switching to OpenBSD even give any significant advantages compared to running linux?

OpenBSD has an interesting history with virtualisation. As Theo said:

It’s feasible to run Xen on OpenBSD, but there is significant effort in
porting Qubes over.

As to your question, I think it’s already been answered.

4 Likes
7

Just in case anyone is thinking @unman has had a hiccup - there is a problem of formatting…

Most of that post is a quote of Theo de Raadt. (see here, for ex.)

Unman starts writing at “It’s feasible”.

(apologies to Unman, but I think the formatting is not visible on email)

6 Likes
8

No apologies needed but Thanks from me.

The mysteries of this are beyond me - apparently an standard "> " inline
quote marker is interpreted as closing a previous quote marker, and the real
closing quote is ignored. This is really poor - I dont know what
they are smoking.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

4 Likes