Hi all, I just published document discussing some well known security limitations of Qubes OS:
https://www.pentest.es/Demystifying_QubesOS_Security.pdf there are some suggestions at the end of the document. I'm aware you have your own roadmap so I would like to contribute in some design changes that may be helpful and aligned -not intrusive- with your current architecture. The first thing I would like to: 1) Switch from single user (web browser with root user capabilities) to multi user. The idea is to hard code a random password and allow sudo only via Dom0 confirmation 2) Adding Firejail to default templates. 3) Jailing by default the Firefox browser Having Firejail installed by default on templates will allow to add new/more apps. Also this can open the door to integrate Fireinvoke/Firewarden in the future so directly opening a a malicious file (like the .tar of my "Demystifying_QubesOS_Security.pdf" report) can not be a problem anymore in the future without requiring to open disposable VM's all the time (so, saving computing resources). Would anyone kindly give me some hint about were I can start to achieve this? Thanks, Hugo -- You received this message because you are subscribed to the Google Groups "qubes-devel" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/97ed4cd1-be1f-4526-bf55-4b0b7dfd42b0n%40googlegroups.com.
