On Monday, October 10, 2016 at 9:05:14 PM UTC-4, [email protected] wrote: > On Monday, October 10, 2016 at 8:34:19 PM UTC-4, David Shleifman wrote: > > On Oct. 10, 2016 at 9:27 AM, Unman <[email protected]> wrote > > > > > I wouldn't assign back to dom0. > > > There's no reason why you shouldn't adopt some variation on A, and have > > > different qubes handling different controllers. Of course, you'd have to > > > make sure that you follow a consistent pattern with use of sockets. > > > You could enforce this with configuration in the policy file, and by > > > some udev rules to block anything except storage devices in the relevant > > > ports. > > > > > unman > > > > ------------------------------------------------------------------------- > > > > > > > > Before trying either "A" or "B" direction, I've stumbled upon the following > > difficulty:- after booting, Xfce popes up a dialog box which invites user > > to log in. At this time, sys-usb hasn't started yet. That is why, the USB > > keyboard is not operational. In essence, it is a chicken and egg problem: > > in order to enter a password, the sys-usb VM shall be started; in order to > > start the sys-usb VM, a valid password shall be entered. > > > > > > > > Unman> There's no reason why you shouldn't adopt some variation on AI was > > leaning to adopt some variation of the plan "A". Unfortunately, the > > experience (see previous paragraph) demonstrates that it is not possible :( > > > > > > > > I went forward with the plan "B": > > B-1) Stay with a single sys-usb qube and remove rear.OHCI0 controller from > > sys-usb (using Qubes VM Manager). I assume that the controller will be > > returned back to dom0. Is it correct?B-2) Remove "sys-usb dom0 > > ask,user=root" from /etc/qubes-rpc/policy/qubes.InputKeyboard. > > B-3) Remove "sys-usb dom0 ask,user=root" from > > /etc/qubes-rpc/policy/qubes.InputMouse. > > > > B-4) Remove rd.qubes.hide_all_usb from /etc/default/grub and run > > grub2-mkconfig -o /boot/grub2/grub.cfg in dom. > > > > > > With this plan in place, I am able to log in using the USB keyboard. > > > > > > > > Further enhancements > > -------------------- > > * In the step B-4, it would be nice to hide all USB controllers from dom0 > > except rear.OHCI0. How to achieve this? > > > > Unman> Of course, you'd have to make sure that you follow a consistent > > pattern with use of sockets. You could enforce this with configuration in > > the policy file, and by some udev rules to block anything except storage > > devices in the relevant ports. > > * How to achieve this? Is there some manual? Do you mind to share an > > example? > > > > > > * Correct the policy in > > https://www.qubes-os.org/doc/usb/#how-to-use-a-usb-keyboard manual. It > > should be: > > > > sys-usb dom0 ask,user=root > > go with B1 man. Like I said you can get a ps2 adapter for your usb keyboard > and then can have all controllers in the sys-usb if you want. But I don't > think there is anything to be worried about having your keyboard in dom0. > Unless you got a real sketchy kb. (anything is possible) > > As for how to hide all usb controllers except the rear OHCI0, you can't > unless its on a separate controller. Otherwise just add every other > controller to sys-usb except the OHCI0 one. Again to make sure you are > correctly identifying your controller > https://www.qubes-os.org/doc/assigning-devices/ You test with a device > plugged in the port to identify the controller. > > You can also just go into a vm settings and click on devices to get a list. > look for what says usb, to see how many controllers you actually have.
dont' do B2 you need keyboard, not sure why you want b3, with b4 that means the usb ports aint hidden from dom0 during boot like luks passphrase I think that would be security risk unless you constantly unplugging every usb device except your keyboard when you reboot. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/bc43686e-4e42-45cf-943a-2022355cf5f6%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
