Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-19 Thread raahelps
On Monday, October 17, 2016 at 11:43:26 AM UTC-4, Robert Mittendorf wrote:
> > The data copied to that VM (i.e. the pdf file or whatever you opened) 
> > must be considered leaked if the VM gets compromised via e.g. drive-by 
> > exploits.
> > Agreed, it's limited to that data, but nevertheless an unexpected 
> > potential impact. And depending on your data it can be critical.
> Well, that is why it is a distinct DispVM. If I open a legit PDF from my 
> mail client in a DispVM (say dispvm1) and I open a non-legit URL in a 
> DispVM, this will not be the same dispVM and thereby not leak the PDFs 
> data. If the PDF itself is malicious, I most likely will not care about 
> the leak. Only exception: A legit PDF gets infected and is then mailed 
> to me. Usually that would allow the attacker to leak the PDF from the 
> system it was send from in the first place.
> >  From a usability point of view you'll also get annoyed if you cannot 
> > print in dispVMs just because your firewall rules allowing 
> > connectivity to your printer aren't inherited, but those to allowing 
> > connectivity to the internet suddenly are in place.
> agreed, basically.
> >
> > Btw inheriting netVMs makes a lot of sense if you imagine one Tor 
> > proxy VM and one directly connected one. So a dispVM from a Tor 
> > connected VM would spawn a direct internet connection in your case... 
> > Currently it fortunately does not.
> agreed.
> 
> Well, I was actually suprised that there is more than 1 DispVM. Do the 
> child-DispVMs use the fedora-23-dvm template as well?

oh yes thats a good point.  thats another reason I liked to create dispvm menu 
entries in the applications list,to also inherit that vm's window border 
color that they are launched from.  To remind me what level trust it is.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/257d4379-fcc6-46d8-b93a-7f4b5f555e66%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-17 Thread Robert Mittendorf


The data copied to that VM (i.e. the pdf file or whatever you opened) 
must be considered leaked if the VM gets compromised via e.g. drive-by 
exploits.
Agreed, it's limited to that data, but nevertheless an unexpected 
potential impact. And depending on your data it can be critical.
Well, that is why it is a distinct DispVM. If I open a legit PDF from my 
mail client in a DispVM (say dispvm1) and I open a non-legit URL in a 
DispVM, this will not be the same dispVM and thereby not leak the PDFs 
data. If the PDF itself is malicious, I most likely will not care about 
the leak. Only exception: A legit PDF gets infected and is then mailed 
to me. Usually that would allow the attacker to leak the PDF from the 
system it was send from in the first place.
 From a usability point of view you'll also get annoyed if you cannot 
print in dispVMs just because your firewall rules allowing 
connectivity to your printer aren't inherited, but those to allowing 
connectivity to the internet suddenly are in place.

agreed, basically.


Btw inheriting netVMs makes a lot of sense if you imagine one Tor 
proxy VM and one directly connected one. So a dispVM from a Tor 
connected VM would spawn a direct internet connection in your case... 
Currently it fortunately does not.

agreed.

Well, I was actually suprised that there is more than 1 DispVM. Do the 
child-DispVMs use the fedora-23-dvm template as well?


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a8dfee0a-0107-64f1-7ed2-8ae82809b638%40digitrace.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-17 Thread David Hobach



On 10/17/2016 09:42 AM, Robert Mittendorf wrote:



Currently your easiest option is not to click on the links, but to
copy-paste them to an open dispVM. Small sacrifice for a major
security gain.


Well, the "easiest" option is to use a net-vm directly. What is the
security gain? Its a dispVM after all.



The data copied to that VM (i.e. the pdf file or whatever you opened) 
must be considered leaked if the VM gets compromised via e.g. drive-by 
exploits.
Agreed, it's limited to that data, but nevertheless an unexpected 
potential impact. And depending on your data it can be critical.


 From a usability point of view you'll also get annoyed if you cannot 
print in dispVMs just because your firewall rules allowing connectivity 
to your printer aren't inherited, but those to allowing connectivity to 
the internet suddenly are in place.


Moreover your netVM is also inherited and firewall rules can have a 
different meaning depending on your netvm (just imagine the same private 
subnets being used for 2 different networks), i.e. it makes sense to 
inherit firewall rules, if you do it for netVMs.


Btw inheriting netVMs makes a lot of sense if you imagine one Tor proxy 
VM and one directly connected one. So a dispVM from a Tor connected VM 
would spawn a direct internet connection in your case... Currently it 
fortunately does not.




--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1b04afd0-8e3f-087b-9db1-a381495deb64%40hackingthe.net.
For more options, visit https://groups.google.com/d/optout.


smime.p7s
Description: S/MIME Cryptographic Signature


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-17 Thread Robert Mittendorf


Currently your easiest option is not to click on the links, but to 
copy-paste them to an open dispVM. Small sacrifice for a major 
security gain.


Well, the "easiest" option is to use a net-vm directly. What is the 
security gain? Its a dispVM after all.


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/cdf8657f-cf4f-63d8-563b-15d04af59a0d%40digitrace.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-15 Thread raahelps
On Saturday, October 15, 2016 at 7:23:12 AM UTC-4, raah...@gmail.com wrote:
> On Friday, October 14, 2016 at 11:06:48 PM UTC-4, Andrew David Wong wrote:
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA512
> > 
> > On 2016-10-14 15:18, raahe...@gmail.com wrote:
> > > On Friday, October 14, 2016 at 6:16:16 PM UTC-4, raah...@gmail.com wrote:
> > >> On Thursday, October 13, 2016 at 2:36:30 PM UTC-4, Andrew David Wong 
> > >> wrote:
> > > On 2016-10-13 03:45, Robert Mittendorf wrote:
> > > Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:
> > >>
> > >> feature.  I use to make menu shortcuts to launch programs in dispvms 
> > >> inheriting firewall rules.  But xfce only lets you edit already 
> > >> existing rules,  not create new ones :(   editing a config file is a 
> > >> little too much effort for me lol.
> > >>
> > > You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!
> > >
> > > How can this "feature" be disabled? I want to start a normal DispVM, 
> > > not a "special" DispVM.
> > >
> > > Use Case: Mail VM is only allowed to access Mail-Server. I want to 
> > > start a Browser in DispVM for urls in Mails.
> > > This works fine, but those "special" DispVMs have the same 
> > > limitations. I want just a normal DispVM like the one started via 
> > > Dom0. The only way to achieve this afaik is to let the special DispVM 
> > > connect to NetVM, so no ProxyVM is used. But this means that the 
> > > DispVM has access to the intranet.
> > >
> > > 
> > > This is precisely the use case I described in issue #1296, which I linked 
> > > in my previous message:
> > > 
> > > https://github.com/QubesOS/qubes-issues/issues/1296
> > > 
> > >>
> > >> couldn't you just use a normal dispvm then?  meaning why even launch 
> > >> anything from within an appvm?  Just run it from dom0, like the default 
> > >> firefox dispvm menu item.
> > > 
> > > only reason i'd launch a program in a dispvm from within an appvm,  is to 
> > > inherit its firewall rules. 
> > > 
> > 
> > Starting a new DispVM from dom0 and setting its NetVM is a lot more 
> > labor-intensive than simply clicking a link in an email and having the rest 
> > work automatically.
> > 
> > - -- 
> > Andrew David Wong (Axon)
> > Community Manager, Qubes OS
> > https://www.qubes-os.org
> > -BEGIN PGP SIGNATURE-
> > 
> > iQIcBAEBCgAGBQJYAZ06AAoJENtN07w5UDAwJJoQAIvVrJe8k7MWk2PxHc3sXvv/
> > C4MGgOLJ31WiZAfk1EAz/3MmVgZzG5nNII3ViDEXqGBppk7jxlF3p9UhpmMJNBju
> > xZB3z1MgVzSm5hXkHQ+enU/hv6RoO5iE+MdBSUnE9QGZiSf1Vg3xkCWzabGgjmuV
> > jGBXaRJXt1ioeBpvpke+NGwmtcd52/KJbGJLo9HRDZhBSz7us0T6e2Kh7Z9snDNe
> > mXTYpUvwriFbxnB4VEkfa52V4druYN3DWx39+nBsKZAzHSMpGfqAI7g0ZKdrLpHw
> > J8MQ4YxM1qaMZKOBQX2BOgTQs0V92255u5RiX1atVJmctYFZ4GQEdeJ/nln0I7VT
> > 86+mhkemBhzHVxvZkyPalZLi6+5INyjR8noJZpqkIsUUV50HmX0ZjG4yYPv88yTa
> > EQvglEY+/wjed9mE+M9dB73E7DLFMJr858ime5AYtDai8Baotf1bIRW5XjsxNPdf
> > h5zDU1ciEpoTYsX5O4bx4Fj+nF7+RMH5g0wC/o0/9A/3ougqEQ+9/sn7CWWBnPgA
> > Ucv4c7sd9A3zU80PYy1RSZiW2MxdTkKNMD+rCL97JaeKgUxHWLE2M6wPQbkMRl9d
> > XmbVBZpsj97ifpasDRRmA/zIeDqZT+Fg7F6GhuIyRUV2ym0UT8VvqOznp3Znvaj6
> > 9RV4PZn2lL6pywgVQfY2
> > =BVEY
> > -END PGP SIGNATURE-
> 
> oh yes absolutely, especially for email links for sure thats awesome.  But I 
> thought the OP was asking how *not to inherit firewall rules in general.  So 
> i was just suggesting why even bother opening it in specific appvms anyways 
> then.

xfce is a little frustrating cause you need a 3rd party tool to easily create 
menu entries like in kde to launch diff programs with while inheriting firewall 
rules.  but i'm leary to install one to dom0 so I just gave up and type it out. 
 rather do that then edit the cfg file lol.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e1a92e5e-799c-4f54-b9b3-ef23b44f2872%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-15 Thread raahelps
On Friday, October 14, 2016 at 11:06:48 PM UTC-4, Andrew David Wong wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA512
> 
> On 2016-10-14 15:18, raahe...@gmail.com wrote:
> > On Friday, October 14, 2016 at 6:16:16 PM UTC-4, raah...@gmail.com wrote:
> >> On Thursday, October 13, 2016 at 2:36:30 PM UTC-4, Andrew David Wong wrote:
> > On 2016-10-13 03:45, Robert Mittendorf wrote:
> > Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:
> >>
> >> feature.  I use to make menu shortcuts to launch programs in dispvms 
> >> inheriting firewall rules.  But xfce only lets you edit already 
> >> existing rules,  not create new ones :(   editing a config file is a 
> >> little too much effort for me lol.
> >>
> > You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!
> >
> > How can this "feature" be disabled? I want to start a normal DispVM, 
> > not a "special" DispVM.
> >
> > Use Case: Mail VM is only allowed to access Mail-Server. I want to 
> > start a Browser in DispVM for urls in Mails.
> > This works fine, but those "special" DispVMs have the same limitations. 
> > I want just a normal DispVM like the one started via Dom0. The only way 
> > to achieve this afaik is to let the special DispVM connect to NetVM, so 
> > no ProxyVM is used. But this means that the DispVM has access to the 
> > intranet.
> >
> > 
> > This is precisely the use case I described in issue #1296, which I linked 
> > in my previous message:
> > 
> > https://github.com/QubesOS/qubes-issues/issues/1296
> > 
> >>
> >> couldn't you just use a normal dispvm then?  meaning why even launch 
> >> anything from within an appvm?  Just run it from dom0, like the default 
> >> firefox dispvm menu item.
> > 
> > only reason i'd launch a program in a dispvm from within an appvm,  is to 
> > inherit its firewall rules. 
> > 
> 
> Starting a new DispVM from dom0 and setting its NetVM is a lot more 
> labor-intensive than simply clicking a link in an email and having the rest 
> work automatically.
> 
> - -- 
> Andrew David Wong (Axon)
> Community Manager, Qubes OS
> https://www.qubes-os.org
> -BEGIN PGP SIGNATURE-
> 
> iQIcBAEBCgAGBQJYAZ06AAoJENtN07w5UDAwJJoQAIvVrJe8k7MWk2PxHc3sXvv/
> C4MGgOLJ31WiZAfk1EAz/3MmVgZzG5nNII3ViDEXqGBppk7jxlF3p9UhpmMJNBju
> xZB3z1MgVzSm5hXkHQ+enU/hv6RoO5iE+MdBSUnE9QGZiSf1Vg3xkCWzabGgjmuV
> jGBXaRJXt1ioeBpvpke+NGwmtcd52/KJbGJLo9HRDZhBSz7us0T6e2Kh7Z9snDNe
> mXTYpUvwriFbxnB4VEkfa52V4druYN3DWx39+nBsKZAzHSMpGfqAI7g0ZKdrLpHw
> J8MQ4YxM1qaMZKOBQX2BOgTQs0V92255u5RiX1atVJmctYFZ4GQEdeJ/nln0I7VT
> 86+mhkemBhzHVxvZkyPalZLi6+5INyjR8noJZpqkIsUUV50HmX0ZjG4yYPv88yTa
> EQvglEY+/wjed9mE+M9dB73E7DLFMJr858ime5AYtDai8Baotf1bIRW5XjsxNPdf
> h5zDU1ciEpoTYsX5O4bx4Fj+nF7+RMH5g0wC/o0/9A/3ougqEQ+9/sn7CWWBnPgA
> Ucv4c7sd9A3zU80PYy1RSZiW2MxdTkKNMD+rCL97JaeKgUxHWLE2M6wPQbkMRl9d
> XmbVBZpsj97ifpasDRRmA/zIeDqZT+Fg7F6GhuIyRUV2ym0UT8VvqOznp3Znvaj6
> 9RV4PZn2lL6pywgVQfY2
> =BVEY
> -END PGP SIGNATURE-

oh yes absolutely, especially for email links for sure thats awesome.  But I 
thought the OP was asking how *not to inherit firewall rules in general.  So i 
was just suggesting why even bother opening it in specific appvms anyways then. 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ad541753-69e1-431c-aedb-99c609bc787a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-14 Thread raahelps
On Friday, October 14, 2016 at 6:16:16 PM UTC-4, raah...@gmail.com wrote:
> On Thursday, October 13, 2016 at 2:36:30 PM UTC-4, Andrew David Wong wrote:
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA512
> > 
> > On 2016-10-13 03:45, Robert Mittendorf wrote:
> > > Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:
> > >>
> > >> feature.  I use to make menu shortcuts to launch programs in dispvms 
> > >> inheriting firewall rules.  But xfce only lets you edit already existing 
> > >> rules,  not create new ones :(   editing a config file is a little too 
> > >> much effort for me lol.
> > >>
> > > You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!
> > > 
> > > How can this "feature" be disabled? I want to start a normal DispVM, not 
> > > a "special" DispVM.
> > > 
> > > Use Case: Mail VM is only allowed to access Mail-Server. I want to start 
> > > a Browser in DispVM for urls in Mails.
> > > This works fine, but those "special" DispVMs have the same limitations. I 
> > > want just a normal DispVM like the one started via Dom0. The only way to 
> > > achieve this afaik is to let the special DispVM connect to NetVM, so no 
> > > ProxyVM is used. But this means that the DispVM has access to the 
> > > intranet.
> > > 
> > 
> > This is precisely the use case I described in issue #1296, which I linked 
> > in my previous message:
> > 
> > https://github.com/QubesOS/qubes-issues/issues/1296
> > 
> > - -- 
> > Andrew David Wong (Axon)
> > Community Manager, Qubes OS
> > https://www.qubes-os.org
> > -BEGIN PGP SIGNATURE-
> > 
> > iQIcBAEBCgAGBQJX/9QlAAoJENtN07w5UDAweRkP/0uhxA8ARtTJuYuroi0znFNb
> > gXb/LRC0rCy9F1TdiwXAhj7kHMSx+HObeXCqTGFlvCYl6sJGkTW0GWulN2M6XtCj
> > KLHQ+vS6YpMTB4EYrDu2QBVlMuFoZoNuj+O/XVcup3aK1MUvpeJJwX6VzCc/X2Y4
> > NHYthK8PtbPZ8WHEdsdAYWBrKWw14ewtaQY9bIsx4SBjf/iq0sr/vGeWOR6Trok1
> > 0SCYo0UBgWKKDPCUeRFUKPSrL/ZCPzeF5fC+F4oG+LZE5xHM5Vu8++U5D9lCuOoS
> > pfqfWI9zKib4WTjwv+tQth5G3khM+W9vfmLJfkwuO6bIGO2B59gKSwwh/DCcTH0q
> > jPUgGv7dn4Ypobh15YKxynvilYMNXBLoN5nst/3ZWh2tGMwsJ9Qicc7LRg5lUpWq
> > Gm+V27OEmwf40G3ejFKXr937Jc3j+GjiBAMN3hhTbfb9FkMjTS5HJqVl0rpTOX7V
> > p6YW+JfdtiRGEPhiCY/24ld0p//TIyL72Ry5mT4naSP2mJyViFt3cZr91Uvcr4/p
> > 5BltNOzPvpGvlR+S1CM8Kn3LcV9GZb1uKdHBGRfAVA0Y6Ikh8t8N/i1h28e0gSdr
> > 02Wf9tssdixLIJL5kNQDew36kwqcW79c28qJTsfv60EM+nYHFfhrPSoZyyzrT4ty
> > Jv8Ojecj2huxgn9KS0ln
> > =uR2N
> > -END PGP SIGNATURE-
> 
> couldn't you just use a normal dispvm then?  meaning why even launch anything 
> from within an appvm?  Just run it from dom0, like the default firefox dispvm 
> menu item.

only reason i'd launch a program in a dispvm from within an appvm,  is to 
inherit its firewall rules. 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a36758a3-7a85-42fb-a6b6-2fcea9463102%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-14 Thread raahelps
On Thursday, October 13, 2016 at 2:36:30 PM UTC-4, Andrew David Wong wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA512
> 
> On 2016-10-13 03:45, Robert Mittendorf wrote:
> > Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:
> >>
> >> feature.  I use to make menu shortcuts to launch programs in dispvms 
> >> inheriting firewall rules.  But xfce only lets you edit already existing 
> >> rules,  not create new ones :(   editing a config file is a little too 
> >> much effort for me lol.
> >>
> > You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!
> > 
> > How can this "feature" be disabled? I want to start a normal DispVM, not a 
> > "special" DispVM.
> > 
> > Use Case: Mail VM is only allowed to access Mail-Server. I want to start a 
> > Browser in DispVM for urls in Mails.
> > This works fine, but those "special" DispVMs have the same limitations. I 
> > want just a normal DispVM like the one started via Dom0. The only way to 
> > achieve this afaik is to let the special DispVM connect to NetVM, so no 
> > ProxyVM is used. But this means that the DispVM has access to the 
> > intranet.
> > 
> 
> This is precisely the use case I described in issue #1296, which I linked in 
> my previous message:
> 
> https://github.com/QubesOS/qubes-issues/issues/1296
> 
> - -- 
> Andrew David Wong (Axon)
> Community Manager, Qubes OS
> https://www.qubes-os.org
> -BEGIN PGP SIGNATURE-
> 
> iQIcBAEBCgAGBQJX/9QlAAoJENtN07w5UDAweRkP/0uhxA8ARtTJuYuroi0znFNb
> gXb/LRC0rCy9F1TdiwXAhj7kHMSx+HObeXCqTGFlvCYl6sJGkTW0GWulN2M6XtCj
> KLHQ+vS6YpMTB4EYrDu2QBVlMuFoZoNuj+O/XVcup3aK1MUvpeJJwX6VzCc/X2Y4
> NHYthK8PtbPZ8WHEdsdAYWBrKWw14ewtaQY9bIsx4SBjf/iq0sr/vGeWOR6Trok1
> 0SCYo0UBgWKKDPCUeRFUKPSrL/ZCPzeF5fC+F4oG+LZE5xHM5Vu8++U5D9lCuOoS
> pfqfWI9zKib4WTjwv+tQth5G3khM+W9vfmLJfkwuO6bIGO2B59gKSwwh/DCcTH0q
> jPUgGv7dn4Ypobh15YKxynvilYMNXBLoN5nst/3ZWh2tGMwsJ9Qicc7LRg5lUpWq
> Gm+V27OEmwf40G3ejFKXr937Jc3j+GjiBAMN3hhTbfb9FkMjTS5HJqVl0rpTOX7V
> p6YW+JfdtiRGEPhiCY/24ld0p//TIyL72Ry5mT4naSP2mJyViFt3cZr91Uvcr4/p
> 5BltNOzPvpGvlR+S1CM8Kn3LcV9GZb1uKdHBGRfAVA0Y6Ikh8t8N/i1h28e0gSdr
> 02Wf9tssdixLIJL5kNQDew36kwqcW79c28qJTsfv60EM+nYHFfhrPSoZyyzrT4ty
> Jv8Ojecj2huxgn9KS0ln
> =uR2N
> -END PGP SIGNATURE-

couldn't you just use a normal dispvm then?  meaning why even launch anything 
from within an appvm?  Just run it from dom0, like the default firefox dispvm 
menu item.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ed12f24e-eb0f-4b2a-8232-c4f13a496877%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-13 Thread Andrew David Wong
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-10-13 03:45, Robert Mittendorf wrote:
> Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:
>>
>> feature.  I use to make menu shortcuts to launch programs in dispvms 
>> inheriting firewall rules.  But xfce only lets you edit already existing 
>> rules,  not create new ones :(   editing a config file is a little too much 
>> effort for me lol.
>>
> You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!
> 
> How can this "feature" be disabled? I want to start a normal DispVM, not a 
> "special" DispVM.
> 
> Use Case: Mail VM is only allowed to access Mail-Server. I want to start a 
> Browser in DispVM for urls in Mails.
> This works fine, but those "special" DispVMs have the same limitations. I 
> want just a normal DispVM like the one started via Dom0. The only way to 
> achieve this afaik is to let the special DispVM connect to NetVM, so no 
> ProxyVM is used. But this means that the DispVM has access to the 
> intranet.
> 

This is precisely the use case I described in issue #1296, which I linked in my 
previous message:

https://github.com/QubesOS/qubes-issues/issues/1296

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJX/9QlAAoJENtN07w5UDAweRkP/0uhxA8ARtTJuYuroi0znFNb
gXb/LRC0rCy9F1TdiwXAhj7kHMSx+HObeXCqTGFlvCYl6sJGkTW0GWulN2M6XtCj
KLHQ+vS6YpMTB4EYrDu2QBVlMuFoZoNuj+O/XVcup3aK1MUvpeJJwX6VzCc/X2Y4
NHYthK8PtbPZ8WHEdsdAYWBrKWw14ewtaQY9bIsx4SBjf/iq0sr/vGeWOR6Trok1
0SCYo0UBgWKKDPCUeRFUKPSrL/ZCPzeF5fC+F4oG+LZE5xHM5Vu8++U5D9lCuOoS
pfqfWI9zKib4WTjwv+tQth5G3khM+W9vfmLJfkwuO6bIGO2B59gKSwwh/DCcTH0q
jPUgGv7dn4Ypobh15YKxynvilYMNXBLoN5nst/3ZWh2tGMwsJ9Qicc7LRg5lUpWq
Gm+V27OEmwf40G3ejFKXr937Jc3j+GjiBAMN3hhTbfb9FkMjTS5HJqVl0rpTOX7V
p6YW+JfdtiRGEPhiCY/24ld0p//TIyL72Ry5mT4naSP2mJyViFt3cZr91Uvcr4/p
5BltNOzPvpGvlR+S1CM8Kn3LcV9GZb1uKdHBGRfAVA0Y6Ikh8t8N/i1h28e0gSdr
02Wf9tssdixLIJL5kNQDew36kwqcW79c28qJTsfv60EM+nYHFfhrPSoZyyzrT4ty
Jv8Ojecj2huxgn9KS0ln
=uR2N
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d649c65f-b049-f544-6d3f-709bb0936176%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-13 Thread David Hobach



On 10/13/2016 12:45 PM, Robert Mittendorf wrote:

Am 10/13/2016 um 04:50 AM schrieb raahe...@gmail.com:


feature.  I use to make menu shortcuts to launch programs in dispvms
inheriting firewall rules.  But xfce only lets you edit already
existing rules,  not create new ones :(   editing a config file is a
little too much effort for me lol.


You can edit the rules in Xfce-Dom0 via the Qubes VM Manager?!

How can this "feature" be disabled? I want to start a normal DispVM, not
a "special" DispVM.


Of course it's a feature. You want to open those pesky attachments of 
your mail VM in a dispVM, don't you? But do you want to grant that VM 
internet access? At least I wouldn't want that and thus would expect 
that those firewall rules are inherited.



Use Case: Mail VM is only allowed to access Mail-Server. I want to start
a Browser in DispVM for urls in Mails.
This works fine, but those "special" DispVMs have the same limitations.
I want just a normal DispVM like the one started via Dom0. The only way
to achieve this afaik is to let the special DispVM connect to NetVM, so
no ProxyVM is used. But this means that the DispVM has access to the
intranet.



Currently your easiest option is not to click on the links, but to 
copy-paste them to an open dispVM. Small sacrifice for a major security 
gain.


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a906460e-0754-3b34-ca6e-232d3252ef34%40hackingthe.net.
For more options, visit https://groups.google.com/d/optout.


smime.p7s
Description: S/MIME Cryptographic Signature


[qubes-users] Re: Bug or Feature? DispVM inherits settings from calling VM

2016-10-12 Thread raahelps


feature.  I use to make menu shortcuts to launch programs in dispvms inheriting 
firewall rules.  But xfce only lets you edit already existing rules,  not 
create new ones :(   editing a config file is a little too much effort for me 
lol.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a261a02f-9900-44f2-9dba-3c7528e7b8bf%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.