On 9/2/20 11:39 PM, airelemental via qubes-users wrote:
I just don't like the idea of putting untrusted code in a templateVM used by
sensitive VMs.
Me neither! But I avoid multiplying templates by installing apps directly into
appvms.
This minimizes the number of templates I have to keep up-to-date.
FYI, that approach is risky. The code sitting in /rw or /home becomes a
way for malware to persist between VM restarts.
The general strategy with installing packages inside appvms (at least those
based on debian) is to make the package cache into a bind-dir and then
reinstall package from cache every appvm startup.
A safer way to add apps at startup would be to use Qubes-vm-hardening
(see my github below) and stash the packages in the
/etc/defaults/vms/<vmname> dir... the vm-boot-protect service will run
just before /rw is mounted and see that config files matching the
current VM name exist. Its a good way to specialize appVMs without
creating new templates.
Should also mention that snaps and flatpaks may be a better fit for
adding apps at boot-time, since there is a chance you can do it quicker
using little more than 'mv'.
--
Chris Laprise, [email protected]
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/ad660e38-766f-d21b-c49b-69696864b0e2%40posteo.net.
