2012-11-16 10:05:27 -05:00
|
|
|
---
|
2021-03-13 13:06:18 -05:00
|
|
|
lang: en
|
2015-04-10 16:17:45 -04:00
|
|
|
layout: doc
|
2021-06-16 22:56:25 -04:00
|
|
|
permalink: /doc/architecture/
|
2015-10-11 03:04:59 -04:00
|
|
|
redirect_from:
|
2016-02-02 16:45:17 -05:00
|
|
|
- /doc/qubes-architecture/
|
2015-10-28 18:14:40 -04:00
|
|
|
- /en/doc/qubes-architecture/
|
2015-10-11 03:04:59 -04:00
|
|
|
- /doc/QubesArchitecture/
|
|
|
|
|
- /wiki/QubesArchitecture/
|
2021-03-13 13:06:18 -05:00
|
|
|
ref: 56
|
2021-06-16 02:19:45 -04:00
|
|
|
title: Architecture
|
2012-11-16 10:05:27 -05:00
|
|
|
---
|
|
|
|
|
|
2021-06-22 13:39:03 -04:00
|
|
|
Qubes implements a security-by-compartmentalization approach. To do this, Qubes
|
|
|
|
|
utilizes virtualization technology in order to isolate various programs from
|
|
|
|
|
each other and even to sandbox many system-level components, such as networking
|
|
|
|
|
and storage subsystems, so that the compromise of any of these programs or
|
|
|
|
|
components does not affect the integrity of the rest of the system.
|
2012-11-16 10:05:27 -05:00
|
|
|
|
2021-06-18 08:46:02 -04:00
|
|
|
[](/attachment/doc/qubes-schema-v2.png)
|
2012-11-16 10:05:27 -05:00
|
|
|
|
2021-06-22 13:39:03 -04:00
|
|
|
Qubes lets the user define many secure compartments known as
|
|
|
|
|
[qubes](/doc/glossary/#qube), which are implemented as lightweight [virtual
|
|
|
|
|
machines (VMs)](/doc/glossary/#vm). For example, the user can have “personal,”
|
|
|
|
|
“work,” “shopping,” “bank,” and “random” app qubes and can use the applications
|
|
|
|
|
within those qubes just as if they were executing on the local machine. At the
|
|
|
|
|
same time, however, these applications are well isolated from each other. Qubes
|
|
|
|
|
also supports secure copy-and-paste and file sharing between qubes, of course.
|
2020-08-03 17:33:21 -04:00
|
|
|
|
2021-06-22 13:39:03 -04:00
|
|
|
## Key architecture features
|
2012-11-16 10:05:27 -05:00
|
|
|
|
2021-03-13 12:03:23 -05:00
|
|
|
- Based on a secure bare-metal hypervisor (Xen)
|
|
|
|
|
- Networking code sand-boxed in an unprivileged VM (using IOMMU/VT-d)
|
2021-06-22 13:39:03 -04:00
|
|
|
- USB stacks and drivers sand-boxed in an unprivileged VM (currently
|
|
|
|
|
experimental feature)
|
2021-03-13 12:03:23 -05:00
|
|
|
- No networking code in the privileged domain (dom0)
|
2021-06-22 13:39:03 -04:00
|
|
|
- All user applications run in “app qubes,” lightweight VMs based on Linux
|
|
|
|
|
- Centralized updates of all app qubes based on the same template
|
|
|
|
|
- Qubes GUI virtualization presents applications as if they were running
|
|
|
|
|
locally
|
2021-03-13 12:03:23 -05:00
|
|
|
- Qubes GUI provides isolation between apps sharing the same desktop
|
|
|
|
|
- Secure system boot based (optional)
|
2012-11-16 10:05:27 -05:00
|
|
|
|
2021-06-22 13:39:03 -04:00
|
|
|
(For those interested in the history of the project, [Architecture Spec v0.3
|
|
|
|
|
[PDF]](/attachment/doc/arch-spec-0.3.pdf) is the original 2009 document that
|
|
|
|
|
started this all. Please note that this document is for historical interest
|
|
|
|
|
only. For the latest information, please see the rest of the [System
|
|
|
|
|
Documentation](/doc/#system).)
|
2020-08-03 17:33:21 -04:00
|
|
|
|
2021-06-22 13:39:03 -04:00
|
|
|
## Qubes Core Stack
|
2020-08-03 17:33:21 -04:00
|
|
|
|
|
|
|
|
Qubes Core Stack is, as the name implies, the core component of Qubes OS. It's
|
2021-06-22 13:39:03 -04:00
|
|
|
the glue that connects all the other components together, and which allows
|
|
|
|
|
users and admins to interact with and configure the system. The other
|
|
|
|
|
components of the Qubes system include:
|
2020-08-03 17:33:21 -04:00
|
|
|
|
2021-03-13 12:03:23 -05:00
|
|
|
- VM-located core agents (implementing e.g. qrexec endpoints used by various
|
|
|
|
|
Qubes services)
|
|
|
|
|
- VM-customizations (making the VMs lightweight and working well with seamless
|
|
|
|
|
GUI virtualization)
|
|
|
|
|
- Qubes GUI virtualization (the protocol, VM-located agents, and daemons
|
|
|
|
|
located in the GUI domain which, for now, happens to be the same as dom0),
|
|
|
|
|
- GUI domain customizations (Desktop Environment customizations, decoration
|
|
|
|
|
coloring plugin, etc)
|
2021-06-22 13:39:03 -04:00
|
|
|
- The admin qube distribution (various customizations, special services, such
|
|
|
|
|
as for receiving and verifying updates, in the future: custom distro)
|
2021-03-13 12:03:23 -05:00
|
|
|
- The Xen hypervisor (with a bunch of customization patches, occasional
|
|
|
|
|
hardening) or - in the future - some other virtualising or containerizing
|
|
|
|
|
software or technology
|
|
|
|
|
- Multiple "Qubes Apps" (various services built on top of Qubes qrexec
|
|
|
|
|
infrastructure, such as: trusted PDF and Image converters, Split GPG, safe
|
|
|
|
|
USB proxies for HID devices, USB proxy for offering USB devices (exposed via
|
|
|
|
|
qvm-usb), Yubikey support, USB Armory support, etc)
|
|
|
|
|
- Various ready-to-use templates (e.g. Debian-, Whonix-based), which are used
|
|
|
|
|
to create actual VMs, i.e. provide the root filesystem to the VMs
|
|
|
|
|
- Salt Stack integration
|
2020-08-03 17:33:21 -04:00
|
|
|
|
|
|
|
|
And all these components are "glued together" by the Qubes Core Stack.
|
|
|
|
|
|
2021-06-18 08:46:02 -04:00
|
|
|
[](/attachment/doc/qubes-components.png)
|
2020-08-03 17:33:21 -04:00
|
|
|
|
|
|
|
|
This diagram illustrates the location of all these components in the overall
|
2021-06-22 13:39:03 -04:00
|
|
|
system architecture. Unlike the other Qubes architecture diagram above, this
|
|
|
|
|
one takes an app-qube-centric approach.
|
