mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2024-12-22 14:05:15 -05:00
307 lines
8.4 KiB
ReStructuredText
307 lines
8.4 KiB
ReStructuredText
|
===============================
|
|||
|
|
How to install software in dom0
|
|||
|
|
===============================
|
|||
|
|
|
|||
|
|
|
|||
|
|
**Warning:** Installing software in dom0 is for advanced users only.
|
|||
|
|
Doing so has the potential to compromise your entire Qubes OS
|
|||
|
|
installation. Exercise extreme caution.
|
|||
|
|
|
|||
|
|
Security
|
|||
|
|
--------
|
|||
|
|
|
|||
|
|
|
|||
|
|
Since there is no networking in dom0, any bugs discovered in dom0
|
|||
|
|
desktop components (e.g., the window manager) are unlikely to pose a
|
|||
|
|
problem for Qubes, since none of the third-party software running in
|
|||
|
|
dom0 is accessible from VMs or the network in any way. Nonetheless,
|
|||
|
|
since software running in dom0 can potentially exercise full control
|
|||
|
|
over the system, it is important to install only trusted software in
|
|||
|
|
dom0.
|
|||
|
|
|
|||
|
|
The install/update process is split into two phases: *resolve and download* and *verify and install*. The *resolve and download* phase is
|
|||
|
|
handled by the UpdateVM. (The role of UpdateVM can be assigned to any VM
|
|||
|
|
in the Qube Manager, and there are no significant security implications
|
|||
|
|
in this choice. By default, this role is assigned to the FirewallVM.)
|
|||
|
|
After the UpdateVM has successfully downloaded new packages, they are
|
|||
|
|
sent to dom0, where they are verified and installed. This separation of
|
|||
|
|
duties significantly reduces the attack surface, since all of the
|
|||
|
|
network and metadata processing code is removed from the TCB.
|
|||
|
|
|
|||
|
|
Although this update scheme is far more secure than directly downloading
|
|||
|
|
updates in dom0, it is not invulnerable. For example, there is nothing
|
|||
|
|
that the Qubes OS Project can feasibly do to prevent a malicious RPM
|
|||
|
|
from exploiting a hypothetical bug in the cryptographic signature
|
|||
|
|
verification operation. At best, we could switch to a different distro
|
|||
|
|
or package manager, but any of them could be vulnerable to the same (or
|
|||
|
|
a similar) attack. While we could, in theory, write a custom solution,
|
|||
|
|
it would only be effective if Qubes repos included all of the regular
|
|||
|
|
template distro’s updates, and this would be far too costly for us to
|
|||
|
|
maintain.
|
|||
|
|
|
|||
|
|
How to update dom0
|
|||
|
|
------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
See :doc:`How to Update </user/how-to-guides/how-to-update>`.
|
|||
|
|
|
|||
|
|
How to install a specific package
|
|||
|
|
---------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
To install additional packages in dom0 (usually not recommended):
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
$ sudo qubes-dom0-update anti-evil-maid
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
You may also pass the ``--enablerepo=`` option in order to enable
|
|||
|
|
optional repositories (see yum configuration in dom0). However, this is
|
|||
|
|
only for advanced users who really understand what they are doing. You
|
|||
|
|
can also pass commands to ``dnf`` using ``--action=...``.
|
|||
|
|
|
|||
|
|
How to downgrade a specific package
|
|||
|
|
-----------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
**WARNING:** Downgrading a package can expose your system to security
|
|||
|
|
vulnerabilities.
|
|||
|
|
|
|||
|
|
1. Download an older version of the package:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo qubes-dom0-update package-version
|
|||
|
|
|
|||
|
|
|
|||
|
|
Dnf will say that there is no update, but the package will
|
|||
|
|
nonetheless be downloaded to dom0.
|
|||
|
|
|
|||
|
|
2. Downgrade the package:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo dnf downgrade package-version
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
How to re-install a package
|
|||
|
|
---------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
You can re-install in a similar fashion to downgrading.
|
|||
|
|
|
|||
|
|
1. Download the package:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo qubes-dom0-update package
|
|||
|
|
|
|||
|
|
|
|||
|
|
Dnf will say that there is no update, but the package will
|
|||
|
|
nonetheless be downloaded to dom0.
|
|||
|
|
|
|||
|
|
2. Re-install the package:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo dnf reinstall package
|
|||
|
|
|
|||
|
|
|
|||
|
|
Note that ``dnf`` will only re-install if the installed and
|
|||
|
|
downloaded versions match. You can ensure they match by either
|
|||
|
|
updating the package to the latest version, or specifying the package
|
|||
|
|
version in the first step using the form ``package-version``.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
How to uninstall a package
|
|||
|
|
--------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
If you’ve installed a package such as anti-evil-maid, you can remove it
|
|||
|
|
with the following command:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo dnf remove anti-evil-maid
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Testing repositories
|
|||
|
|
--------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
If you wish to install updates that are still in
|
|||
|
|
:doc:`testing </user/downloading-installing-upgrading/testing>`, you must enable the appropriate testing
|
|||
|
|
repositories.
|
|||
|
|
|
|||
|
|
**Note:** The following repos are in dom0. For template testing repos,
|
|||
|
|
see :ref:`here <user/how-to-guides/how-to-install-software:testing repositories>`.
|
|||
|
|
|
|||
|
|
- ``qubes-dom0-current-testing`` – testing packages that will
|
|||
|
|
eventually land in the stable (``current``) repository
|
|||
|
|
|
|||
|
|
- ``qubes-dom0-security-testing`` – a subset of
|
|||
|
|
``qubes-dom0-current-testing`` that contains packages that qualify as
|
|||
|
|
security fixes
|
|||
|
|
|
|||
|
|
- ``qubes-dom0-unstable`` – packages that are not intended to land in
|
|||
|
|
the stable (``qubes-dom0-current``) repository; mostly experimental
|
|||
|
|
debugging packages
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
To temporarily enable any of these repos, use the
|
|||
|
|
``--enablerepo=<repo-name>`` option. Example commands:
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing
|
|||
|
|
sudo qubes-dom0-update --enablerepo=qubes-dom0-security-testing
|
|||
|
|
sudo qubes-dom0-update --enablerepo=qubes-dom0-unstable
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
To enable or disable any of these repos permanently, change the
|
|||
|
|
corresponding ``enabled`` value to ``1`` in
|
|||
|
|
``/etc/yum.repos.d/qubes-dom0.repo``.
|
|||
|
|
|
|||
|
|
For testing new templates, please see
|
|||
|
|
:ref:`here <user/downloading-installing-upgrading/testing:templates>`.
|
|||
|
|
|
|||
|
|
Contributed package repository
|
|||
|
|
------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
Please see :doc:`installing contributed packages </user/advanced-topics/installing-contributed-packages>`.
|
|||
|
|
|
|||
|
|
Kernel upgrade
|
|||
|
|
--------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
This section describes upgrading the kernel in dom0 and domUs.
|
|||
|
|
|
|||
|
|
dom0
|
|||
|
|
^^^^
|
|||
|
|
|
|||
|
|
|
|||
|
|
The packages ``kernel`` and ``kernel-latest`` are for dom0.
|
|||
|
|
|
|||
|
|
In the ``current`` repository:
|
|||
|
|
|
|||
|
|
- ``kernel``: an older LTS kernel that has passed Qubes
|
|||
|
|
:doc:`testing </user/downloading-installing-upgrading/testing>` (the default dom0 kernel)
|
|||
|
|
|
|||
|
|
- ``kernel-latest``: the latest release from kernel.org that has passed
|
|||
|
|
Qubes :doc:`testing </user/downloading-installing-upgrading/testing>` (useful for :doc:`troubleshooting newer hardware </user/troubleshooting/hardware-troubleshooting>`)
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
In the ``current-testing`` repository:
|
|||
|
|
|
|||
|
|
- ``kernel``: the latest LTS kernel from kernel.org at the time it was
|
|||
|
|
built.
|
|||
|
|
|
|||
|
|
- ``kernel-latest``: the latest release from kernel.org at the time it
|
|||
|
|
was built.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
domU
|
|||
|
|
^^^^
|
|||
|
|
|
|||
|
|
|
|||
|
|
The packages ``kernel-qubes-vm`` and ``kernel-latest-qubes-vm`` are for
|
|||
|
|
domUs. See :doc:`Managing VM kernel </user/advanced-topics/managing-vm-kernels>` for more
|
|||
|
|
information.
|
|||
|
|
|
|||
|
|
Example
|
|||
|
|
^^^^^^^
|
|||
|
|
|
|||
|
|
|
|||
|
|
(Note that the following example enables the unstable repo.)
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo qubes-dom0-update --enablerepo=qubes-dom0-unstable kernel kernel-qubes-vm
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
If the update process does not automatically do it (you should see it
|
|||
|
|
mentioned in the CLI output from the update command), you may need to
|
|||
|
|
manually rebuild the EFI or grub config depending on which your system
|
|||
|
|
uses.
|
|||
|
|
|
|||
|
|
EFI
|
|||
|
|
^^^
|
|||
|
|
|
|||
|
|
|
|||
|
|
Replace the example version numbers with the one you are upgrading to.
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo dracut -f /boot/efi/EFI/qubes/initramfs-4.14.35-1.pvops.qubes.x86_64.img 4.14.35-1.pvops.qubes.x86_64
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Grub2
|
|||
|
|
^^^^^
|
|||
|
|
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Reboot required.
|
|||
|
|
|
|||
|
|
If you wish to upgrade to a kernel that is not available from the repos,
|
|||
|
|
then there is no easy way to do so, but `it may still be possible if you’re willing to do a lot of work yourself <https://groups.google.com/d/msg/qubes-users/m8sWoyV58_E/HYdReRIYBAAJ>`__.
|
|||
|
|
|
|||
|
|
Changing default kernel
|
|||
|
|
-----------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
This section describes changing the default kernel in dom0. It is
|
|||
|
|
sometimes needed if you have upgraded to a newer kernel and are having
|
|||
|
|
problems booting, for example. On the next kernel update, the default
|
|||
|
|
will revert to the newest.
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
sudo nano /etc/default/grub
|
|||
|
|
[update the following two lines, add if needed]
|
|||
|
|
GRUB_DISABLE_SUBMENU=false
|
|||
|
|
GRUB_SAVEDEFAULT=true
|
|||
|
|
[save and exit nano]
|
|||
|
|
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Then, reboot. Once the grub menu appears, choose “Advanced Options for
|
|||
|
|
Qubes (with Xen hypervisor)”. Next, the top menu item (for example, “Xen
|
|||
|
|
hypervisor, version 4.8.5-9.fc25”). Select the kernel you want as
|
|||
|
|
default, and it will be remembered for next boot.
|
|||
|
|
|
|||
|
|
Updating over Tor
|
|||
|
|
-----------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
Requires installed `Whonix <https://forum.qubes-os.org/t/19014>`__.
|
|||
|
|
|
|||
|
|
Go to Qubes VM Manager -> System -> Global Settings. See the UpdateVM
|
|||
|
|
setting. Choose your desired Whonix-Gateway ProxyVM from the list. For
|
|||
|
|
example: sys-whonix.
|
|||
|
|
|
|||
|
|
.. code:: bash
|
|||
|
|
|
|||
|
|
Qubes VM Manager -> System -> Global Settings -> UpdateVM -> sys-whonix
|
|||
|
|
|
|||
|
|
|