On Tue, Oct 16, 2018 at 09:50:10PM +0000, 'awokd' via qubes-users wrote: > Frozentime345 wrote on 10/16/18 5:59 AM: > > System: Fedora 27/Debian 9 Templates, R3.2->upgrading to 4.0 soon > > > > I looked through rpc policy but I couldn't find anything like this, is > > there > > a way to only allow certain block devices for certain appvms? Doesn't > > even have to be a secure feature just something to prevent user error, > > but it has to work at the qubes level so a > > "bad" block device doesn't compromise the appvm. > > I believe there will be some type of block device isolation (a "sys-block" > maybe) coming in Qubes 4.1, so fine grained controls might be part of that.
You can also use udev to set policies to restrict what devices can be attached to particular qubes. If you are concerned you could restrict access to particular specific devices. Not ideal but it would mitigate against user error. > > > Similarly, is there something in sys-net I can use to white-list? I > > tried the network connections manager but I cant seem to stop it from > > connecting to unknown ethernets, after its known I can set “don't > > automatically connect” though. > > This might vary by the distribution you are using for sys-net. Try searching > for what you are trying to accomplish with the distribution name e.g. > "Debian", instead of "Qubes". Most should apply the same way, just make your > changes in sys-net instead. NetworkManager is designed to keep your network connection up and running automatically. That's what it is there for. If you don't want this behaviour you can either disable NetworkManager so it wont automatically start and therefore wont try to make connections, or set a parameter in a config file: [main] no-auto-default=* You can put this in /etc/NetworkManager/NetworkManager.conf or as a fragment in /etc/NetworkManager/conf.d unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181017153254.qlds5ca6fwbli6dj%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
