mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-04-06 21:53:40 -04:00
Fix /wiki/ -> /doc/, add slash at the end
Addresses without a slash are redirected to a version with slash, but with forced protocol http instead of https.
This commit is contained in:
parent
ceb8074479
commit
8a6890174d
@ -27,9 +27,9 @@ More information regarding configuration in the [README](http://git.qubes-os.org
|
||||
Security Considerations
|
||||
-----------------------
|
||||
|
||||
[Qubes security guidelines](/wiki/SecurityGuidelines) dictate that USB devices should never be attached directly to dom0, since this can result in the entire system being compromised. However, in its default configuration, installing and using AEM requires attaching a USB drive (i.e., [mass storage device](https://en.wikipedia.org/wiki/USB_mass_storage_device_class)) directly to dom0. (The other option is to install AEM to an internal disk. However, this carries significant security implications, as explained [here](http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html).) This presents us with a classic security trade-off: each Qubes user must make a choice between protecting dom0 from a potentially malicious USB drive, on the one hand, and protecting the system from Evil Maid attacks, on the other hand. Given the practical feasibility of attacks like [BadUSB](https://srlabs.de/badusb/) and revelations regarding pervasive government hardware backdoors, this is no longer a straightforward decision. New, factory-sealed USB drives cannot simply be assumed to be "clean" (e.g., to have non-malicious microcontroller firmware). Therefore, it is up to each individual Qubes user to evaluate the relative risk of each attack vector against his or her security model.
|
||||
[Qubes security guidelines](/doc/SecurityGuidelines/) dictate that USB devices should never be attached directly to dom0, since this can result in the entire system being compromised. However, in its default configuration, installing and using AEM requires attaching a USB drive (i.e., [mass storage device](https://en.wikipedia.org/wiki/USB_mass_storage_device_class)) directly to dom0. (The other option is to install AEM to an internal disk. However, this carries significant security implications, as explained [here](http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html).) This presents us with a classic security trade-off: each Qubes user must make a choice between protecting dom0 from a potentially malicious USB drive, on the one hand, and protecting the system from Evil Maid attacks, on the other hand. Given the practical feasibility of attacks like [BadUSB](https://srlabs.de/badusb/) and revelations regarding pervasive government hardware backdoors, this is no longer a straightforward decision. New, factory-sealed USB drives cannot simply be assumed to be "clean" (e.g., to have non-malicious microcontroller firmware). Therefore, it is up to each individual Qubes user to evaluate the relative risk of each attack vector against his or her security model.
|
||||
|
||||
For example, a user who frequently travels with a Qubes laptop holding sensitive data may be at a much higher risk of Evil Maid attacks than a home user with a stationary Qubes desktop. If the frequent traveler judges her risk of an Evil Maid attack to be higher than the risk of a malicious USB device, she might reasonably opt to install and use AEM. On the other hand, the home user might deem the probability of an Evil Maid attack occurring in her own home to be so low that there is a higher probability that any USB drive she purchases is already compromised, in which case she might reasonably opt never to attach any USB devices directly to dom0. (In either case, users can--and should--secure dom0 against further USB-related attacks through the use of a [USBVM](/wiki/SecurityGuidelines#CreatingandUsingaUSBVM).)
|
||||
For example, a user who frequently travels with a Qubes laptop holding sensitive data may be at a much higher risk of Evil Maid attacks than a home user with a stationary Qubes desktop. If the frequent traveler judges her risk of an Evil Maid attack to be higher than the risk of a malicious USB device, she might reasonably opt to install and use AEM. On the other hand, the home user might deem the probability of an Evil Maid attack occurring in her own home to be so low that there is a higher probability that any USB drive she purchases is already compromised, in which case she might reasonably opt never to attach any USB devices directly to dom0. (In either case, users can--and should--secure dom0 against further USB-related attacks through the use of a [USBVM](/doc/SecurityGuidelines/#CreatingandUsingaUSBVM).)
|
||||
|
||||
For more information, please see [this discussion thread](https://groups.google.com/d/msg/qubes-devel/EBc4to5IBdg/n1hfsHSfbqsJ).
|
||||
|
||||
|
@ -17,7 +17,7 @@ Qubes Backup, Restoration, and Migration
|
||||
|
||||
With Qubes, it's easy to back up and restore your whole system, as well as to migrate between two physical machines.
|
||||
|
||||
As of Qubes R2B3, these functions are integrated into the Qubes VM Manager GUI. There are also two command-line tools available which perform the same functions: [qvm-backup](/wiki/Dom0Tools/QvmBackup) and [qvm-backup-restore](/wiki/Dom0Tools/QvmBackupRestore).
|
||||
As of Qubes R2B3, these functions are integrated into the Qubes VM Manager GUI. There are also two command-line tools available which perform the same functions: [qvm-backup](/doc/Dom0Tools/QvmBackup/) and [qvm-backup-restore](/doc/Dom0Tools/QvmBackupRestore/).
|
||||
|
||||
Creating a Backup
|
||||
-----------------
|
||||
@ -32,7 +32,7 @@ Creating a Backup
|
||||
|
||||
1. Select the destination for the backup:
|
||||
|
||||
- If you wish to send your backup to a [USB mass storage device](/wiki/StickMounting), select the device in the dropdown box next to **Device** (feature removed in R3, select appropriate **Target AppVM** and mount the stick with one click in file selection dialog).
|
||||
- If you wish to send your backup to a [USB mass storage device](/doc/StickMounting/), select the device in the dropdown box next to **Device** (feature removed in R3, select appropriate **Target AppVM** and mount the stick with one click in file selection dialog).
|
||||
- If you wish to send your backup to a (currently running) AppVM, select the AppVM in the dropdown box next to **Target AppVM**.
|
||||
|
||||
You must also specify a directory on the device or in the AppVM, or a command to be executed in the AppVM as a destination for your backup. For example, if you wish to send your backup to the `~/backups` folder in the target AppVM, you would simply type `backups` in this field. This destination directory must already exist. If it does not exist, you must create it manually prior to backing up.
|
||||
@ -54,7 +54,7 @@ Restoring from a Backup
|
||||
|
||||
1. Select the source location of the backup to be restored:
|
||||
|
||||
- If your backup is located on a [USB mass storage device](/wiki/StickMounting), select the device in the dropdown box next to **Device**.
|
||||
- If your backup is located on a [USB mass storage device](/doc/StickMounting/), select the device in the dropdown box next to **Device**.
|
||||
- If your backup is located in a (currently running) AppVM, select the AppVM in the dropdown box next to **AppVM**.
|
||||
|
||||
You must also specify the directory in which the backup resides (or a command to be executed in an AppVM). If you followed the instructions in the previous section, "Creating a Backup," then your backup is most likely in the location you chose as the destination in step 3. For example, if you had chosen the `~/backups` directory of an AppVM as your destination in step 3, you would now select the same AppVM and again type `backups` into the **Backup directory** field.
|
||||
@ -84,7 +84,7 @@ For emergency restore of backup created on Qubes R2 or newer take a look [here](
|
||||
Migrating Between Two Physical Machines
|
||||
---------------------------------------
|
||||
|
||||
In order to migrate your Qubes system from one physical machine to another, simply follow the backup procedure on the old machine, [install Qubes](/wiki/QubesDownloads) on the new machine, and follow the restoration procedure on the new machine. All of your settings and data will be preserved!
|
||||
In order to migrate your Qubes system from one physical machine to another, simply follow the backup procedure on the old machine, [install Qubes](/doc/QubesDownloads/) on the new machine, and follow the restoration procedure on the new machine. All of your settings and data will be preserved!
|
||||
|
||||
Notes
|
||||
-----
|
||||
|
@ -88,7 +88,7 @@ wget http://mir.archlinux.fr/iso/2013.06.01/archlinux-2013.06.01-dual.iso.sig
|
||||
The nm-applet (network manager icon) fails to start when archlinux is defined as a template-vm:
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
In fact /etc/dbus-1/system.d/org.freedesktop.[NetworkManager?](/wiki/NetworkManager).conf does not allow a standard user to run network manager clients. To allow this, one need to change inside \<policy context="default"\>:
|
||||
In fact /etc/dbus-1/system.d/org.freedesktop.[NetworkManager?](/doc/NetworkManager/).conf does not allow a standard user to run network manager clients. To allow this, one need to change inside \<policy context="default"\>:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
<deny send_destination="org.freedesktop.NetworkManager"/>
|
||||
|
@ -5,12 +5,12 @@ permalink: /doc/BuildingNonFedoraTemplate/
|
||||
redirect_from: /wiki/BuildingNonFedoraTemplate/
|
||||
---
|
||||
|
||||
Building a TemplateVM for [ArchLinux?](/wiki/ArchLinux) (or another non fedora OS)
|
||||
Building a TemplateVM for [ArchLinux?](/doc/ArchLinux/) (or another non fedora OS)
|
||||
==================================================================================
|
||||
|
||||
If you don't like using Fedora because of specific administration or package management / building needs, you could build a VM Template for your Distribution of choice.
|
||||
|
||||
This article shows how to build a template for a different OS, taking [ArchLinux?](/wiki/ArchLinux) as an example.
|
||||
This article shows how to build a template for a different OS, taking [ArchLinux?](/doc/ArchLinux/) as an example.
|
||||
|
||||
Qubes builder scripts
|
||||
=====================
|
||||
@ -136,7 +136,7 @@ As soon as you manage to make qrexec and qubes-gui-agent working, it should be s
|
||||
|
||||
Several XEN libraries are required for Qubes to work correctly. In fact, you need to make xenstore commands working before anything else. For this, Qubes git can be used as several patches have been selected by Qubes developpers that could impact the activity inside a VM. Start be retrieving a recent git and identify how you can build a package from it: `git clone git://git.qubes-os.org/marmarek/xen`
|
||||
|
||||
Find the .spec file in the git repository (this is the file being used to build rpm packages), and try to adapt it to your OS in order to build a package similar to the target 'xen-vm'. For example, a PKGBUILD has been created for [ArchLinux?](/wiki/ArchLinux) and can be found on [http://aur.archlinux.org/packages/qu/qubes-vm-xen/PKGBUILD](http://aur.archlinux.org/packages/qu/qubes-vm-xen/PKGBUILD).
|
||||
Find the .spec file in the git repository (this is the file being used to build rpm packages), and try to adapt it to your OS in order to build a package similar to the target 'xen-vm'. For example, a PKGBUILD has been created for [ArchLinux?](/doc/ArchLinux/) and can be found on [http://aur.archlinux.org/packages/qu/qubes-vm-xen/PKGBUILD](http://aur.archlinux.org/packages/qu/qubes-vm-xen/PKGBUILD).
|
||||
|
||||
Don't be afraid with the complexity of the PKGBUILD, most of the code is almost a copy/paste of required sources and patches found in the .spec file provided in the git repository.
|
||||
|
||||
|
@ -19,7 +19,7 @@ First you should decide what you are interested in (and good in). The Qubes proj
|
||||
|
||||
Perhaps the best starting point is to have a look at the [Open Issues on GitHub](https://github.com/QubesOS/qubes-issues/issues?q=is%3Aissue+is%3Aopen) to see what are the most urgent tasks to do.
|
||||
|
||||
Before you engage in some longer activity, e.g. implementing a new feature, it's always good to contact us first (preferably via the [qubes-devel](/wiki/QubesLists) list), to avoid a situation when two or more independent people would work on the same feature at the same time, doubling each others work. When you contact us and devote to a particular task, we will create a ticket for this task with info who is working on this feature and what is the expected date of some early code to be posted.
|
||||
Before you engage in some longer activity, e.g. implementing a new feature, it's always good to contact us first (preferably via the [qubes-devel](/doc/QubesLists/) list), to avoid a situation when two or more independent people would work on the same feature at the same time, doubling each others work. When you contact us and devote to a particular task, we will create a ticket for this task with info who is working on this feature and what is the expected date of some early code to be posted.
|
||||
|
||||
You can also contribute in other areas than coding and testing, e.g. by providing mirrors for Qubes rpm repositories, providing feedback about what features you would like to have in Qubes, or perhaps even preparing some cool You Tube videos that would demonstrate some Qubes' features. You are always encouraged to discuss your ideas on qubes-devel.
|
||||
|
||||
|
@ -44,7 +44,7 @@ You may now paste the log contents to any VM as you normally would (i.e., Ctrl-S
|
||||
|
||||
For data other than logs, there are two options:
|
||||
|
||||
1. [Copy it as a file.](/wiki/CopyToDomZero)
|
||||
1. [Copy it as a file.](/doc/CopyToDomZero/)
|
||||
2. Paste the data to `/var/run/qubes/qubes-clipboard.bin`, then write "dom0" to `/var/run/qubes/qubes-clipboard.bin.source`. Then use Ctrl-Shift-V to paste the data to the desired VM.
|
||||
|
||||
Clipboard automatic policy enforcement
|
||||
|
@ -26,7 +26,7 @@ GUI
|
||||
CLI
|
||||
---
|
||||
|
||||
[qvm-copy-to-vm](/wiki/VmTools/QvmCopyToVm)
|
||||
[qvm-copy-to-vm](/doc/VmTools/QvmCopyToVm/)
|
||||
|
||||
On inter-domain file copy security
|
||||
----------------------------------
|
||||
@ -37,4 +37,4 @@ However, one should keep in mind that performing a data transfer from *less trus
|
||||
|
||||
See also [this article](http://theinvisiblethings.blogspot.com/2011/03/partitioning-my-digital-life-into.html) for more information on this topic, and some ideas of how we might solve this problem in some future version of Qubes.
|
||||
|
||||
You may also want to read how to [revoke "Yes to All" authorization](/wiki/Qrexec#RevokingYestoAllauthorization)
|
||||
You may also want to read how to [revoke "Yes to All" authorization](/doc/Qrexec/#RevokingYestoAllauthorization)
|
||||
|
@ -11,7 +11,7 @@ Understanding and Preventing Data Leaks
|
||||
The Role of the Firewall
|
||||
------------------------
|
||||
|
||||
**[Firewalling in Qubes](/wiki/QubesFirewall) is not intended to be a leak-prevention mechanism.**
|
||||
**[Firewalling in Qubes](/doc/QubesFirewall/) is not intended to be a leak-prevention mechanism.**
|
||||
|
||||
There are several reasons for this, which will be explained below. However, the main reason is that Qubes cannot prevent an attacker who has compromised one AppVM (with restrictive firewall rules) from leaking data via cooperative covert channels through a different AppVM (with sufficiently nonrestrictive firewall rules, if any) which the attacker has also compromised.
|
||||
|
||||
|
@ -24,7 +24,7 @@ There a few things that are KDE-specific, but generally it should not be a big p
|
||||
|
||||
- Qubes requires KDM (KDE Login Manager), rather than GDM, for the very simple reason that GDM doesn't obey standards and start `/usr/bin/Xorg` instead of `/usr/bin/X`. This is important for Qubes, because we need to load a special "X wrapper" (to make it possible to use Linux usermode shared memory to access Xen shared memory pages in our App Viewers -- see the sources [here](http://qubes-os.org/gitweb/?p=mainstream/gui.git;a=tree;f=shmoverride;h=75133ddcdad0c6a59e630f005569bb8c758b67c5;hb=HEAD)). So, Qubes makes the `/usr/bin/X` to be a symlink to the Qubes X Wrapper, which, in turn, executes the `/usr/bin/Xorg`. This works well with KDM (and would probably also work with other X login managers), but not with GDM. If somebody succeeded in makeing GDM to execute `/usr/bin/X` instead of `/usr/bin/Xorg`, we would love to hear about it!
|
||||
|
||||
- We maintain a special [repository](/wiki/KdeDom0) for building packages specifically for Qubes Dom0.
|
||||
- We maintain a special [repository](/doc/KdeDom0/) for building packages specifically for Qubes Dom0.
|
||||
|
||||
- We've patched the KDE's Window Manager (specifically [one of the decoration plugins](https://qubes-os.org/gitweb/?p=mainstream/kde-dom0.git;a=commit;h=e1a530d8188a47921da35beff03998eb3fce8e2c)) to draw window decorations in the color of the specific AppVM's label.
|
||||
|
||||
@ -36,7 +36,7 @@ Any rpm-based, 64-bit. Preferred Fedora.
|
||||
|
||||
### Q: How to build Qubes from sources?
|
||||
|
||||
See [the instruction](/wiki/QubesBuilder)
|
||||
See [the instruction](/doc/QubesBuilder/)
|
||||
|
||||
### Q: How do I submit a patch?
|
||||
|
||||
|
@ -10,7 +10,7 @@ Development Workflow
|
||||
|
||||
A workflow for developing Qubes OS+
|
||||
|
||||
First things first, setup [QubesBuilder](/wiki/QubesBuilder). This guide assumes you're using qubes-builder to build Qubes.
|
||||
First things first, setup [QubesBuilder](/doc/QubesBuilder/). This guide assumes you're using qubes-builder to build Qubes.
|
||||
|
||||
Repositories and Committing Code
|
||||
--------------------------------
|
||||
@ -127,7 +127,7 @@ RPMS will appear in qubes-src/kernel/rpm/x86\_64:
|
||||
-rw-rw-r-- 1 user user 54502117 Nov 17 05:37 kernel-qubes-vm-3.4.18-1debug20121117a.pvops.qubes.x86_64.rpm
|
||||
{% endhighlight %}
|
||||
|
||||
### Useful [QubesBuilder](/wiki/QubesBuilder) commands
|
||||
### Useful [QubesBuilder](/doc/QubesBuilder/) commands
|
||||
|
||||
1. *make check* - will check if all the code was commited into repository and if all repository are tagged with signed tag.
|
||||
2. *make show-vtags* - show version of each component (based on git tags) - mostly useful just before building ISO. **Note:** this will not show version for components containing changes since last version tag
|
||||
@ -141,7 +141,7 @@ When developing it is convenient to be able to rapidly test changes. Assuming yo
|
||||
|
||||
Here are some handy scripts Marek has shared to facilitate this.
|
||||
|
||||
You may also like to run your [test environment on separate machine](/wiki/TestBench).
|
||||
You may also like to run your [test environment on separate machine](/doc/TestBench/).
|
||||
|
||||
### Syncing dom0 files
|
||||
|
||||
|
@ -7,28 +7,28 @@ redirect_from: /wiki/DomZeroTools/
|
||||
|
||||
QVM-tools:
|
||||
|
||||
- [qubes-dom0-update](/wiki/Dom0Tools/QubesDom0Update)
|
||||
- [qubes-prefs](/wiki/Dom0Tools/QubesPrefs)
|
||||
- [qvm-add-appvm](/wiki/Dom0Tools/QvmAddAppvm)
|
||||
- [qvm-add-template](/wiki/Dom0Tools/QvmAddTemplate)
|
||||
- [qvm-backup-restore](/wiki/Dom0Tools/QvmBackupRestore)
|
||||
- [qvm-backup](/wiki/Dom0Tools/QvmBackup)
|
||||
- [qvm-block](/wiki/Dom0Tools/QvmBlock)
|
||||
- [qvm-clone](/wiki/Dom0Tools/QvmClone)
|
||||
- [qvm-create-default-dvm](/wiki/Dom0Tools/QvmCreateDefaultDvm)
|
||||
- [qvm-create](/wiki/Dom0Tools/QvmCreate)
|
||||
- [qvm-firewall](/wiki/Dom0Tools/QvmFirewall)
|
||||
- [qvm-grow-private](/wiki/Dom0Tools/QvmGrowPrivate)
|
||||
- [qvm-ls](/wiki/Dom0Tools/QvmLs)
|
||||
- [qvm-kill](/wiki/Dom0Tools/QvmKill)
|
||||
- [qvm-pci](/wiki/Dom0Tools/QvmPci)
|
||||
- [qvm-prefs](/wiki/Dom0Tools/QvmPrefs)
|
||||
- [qvm-remove](/wiki/Dom0Tools/QvmRemove)
|
||||
- [qvm-revert-template-changes](/wiki/Dom0Tools/QvmRevertTemplateChanges)
|
||||
- [qvm-run](/wiki/Dom0Tools/QvmRun)
|
||||
- [qvm-service](/wiki/Dom0Tools/QvmService)
|
||||
- [qvm-shutdown](/wiki/Dom0Tools/QvmShutdown)
|
||||
- [qvm-start](/wiki/Dom0Tools/QvmStart)
|
||||
- [qvm-sync-appmenus](/wiki/Dom0Tools/QvmSyncAppmenus)
|
||||
- [qvm-template-commit](/wiki/Dom0Tools/QvmTemplateCommit)
|
||||
- [qubes-dom0-update](/doc/Dom0Tools/QubesDom0Update/)
|
||||
- [qubes-prefs](/doc/Dom0Tools/QubesPrefs/)
|
||||
- [qvm-add-appvm](/doc/Dom0Tools/QvmAddAppvm/)
|
||||
- [qvm-add-template](/doc/Dom0Tools/QvmAddTemplate/)
|
||||
- [qvm-backup-restore](/doc/Dom0Tools/QvmBackupRestore/)
|
||||
- [qvm-backup](/doc/Dom0Tools/QvmBackup/)
|
||||
- [qvm-block](/doc/Dom0Tools/QvmBlock/)
|
||||
- [qvm-clone](/doc/Dom0Tools/QvmClone/)
|
||||
- [qvm-create-default-dvm](/doc/Dom0Tools/QvmCreateDefaultDvm/)
|
||||
- [qvm-create](/doc/Dom0Tools/QvmCreate/)
|
||||
- [qvm-firewall](/doc/Dom0Tools/QvmFirewall/)
|
||||
- [qvm-grow-private](/doc/Dom0Tools/QvmGrowPrivate/)
|
||||
- [qvm-ls](/doc/Dom0Tools/QvmLs/)
|
||||
- [qvm-kill](/doc/Dom0Tools/QvmKill/)
|
||||
- [qvm-pci](/doc/Dom0Tools/QvmPci/)
|
||||
- [qvm-prefs](/doc/Dom0Tools/QvmPrefs/)
|
||||
- [qvm-remove](/doc/Dom0Tools/QvmRemove/)
|
||||
- [qvm-revert-template-changes](/doc/Dom0Tools/QvmRevertTemplateChanges/)
|
||||
- [qvm-run](/doc/Dom0Tools/QvmRun/)
|
||||
- [qvm-service](/doc/Dom0Tools/QvmService/)
|
||||
- [qvm-shutdown](/doc/Dom0Tools/QvmShutdown/)
|
||||
- [qvm-start](/doc/Dom0Tools/QvmStart/)
|
||||
- [qvm-sync-appmenus](/doc/Dom0Tools/QvmSyncAppmenus/)
|
||||
- [qvm-template-commit](/doc/Dom0Tools/QvmTemplateCommit/)
|
||||
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/Fetchmail/
|
||||
Fetchmail
|
||||
=========
|
||||
|
||||
Fetchmail is standalone MRA (Mail Retrieval Agent) aka "IMAP/POP3 client". Its sole purpose is to fetch your messages and store it locally or feed to local MTA (Message Transfer Agent). It cannot "read" messages — for that use MUA like Thunderbird or [Mutt](/wiki/Mutt).
|
||||
Fetchmail is standalone MRA (Mail Retrieval Agent) aka "IMAP/POP3 client". Its sole purpose is to fetch your messages and store it locally or feed to local MTA (Message Transfer Agent). It cannot "read" messages — for that use MUA like Thunderbird or [Mutt](/doc/Mutt/).
|
||||
|
||||
Installation
|
||||
------------
|
||||
@ -20,7 +20,7 @@ Configuration
|
||||
|
||||
Assuming you have more than one account (safe assumption these days), you need to spawn multiple fetchmail instances, one for each IMAP/POP3 server (though one instance can watch over several accounts on one server). The easiest way is to create template systemd unit and start it several times. Fedora does not supply any, so we have to write one anyway.
|
||||
|
||||
**NOTE:** this assumes you use [Postfix](/wiki/Postfix) as your local MTA.
|
||||
**NOTE:** this assumes you use [Postfix](/doc/Postfix/) as your local MTA.
|
||||
|
||||
In TemplateVM create `/etc/systemd/system/fetchmail@.service`:
|
||||
|
||||
|
@ -11,7 +11,7 @@ Enabling Full Screen Mode for select VMs
|
||||
What is full screen mode?
|
||||
-------------------------
|
||||
|
||||
Normally Qubes GUI virtualization daemon restricts the VM from "owning" the full screen, ensuring that there are always clearly marked decorations drawn by the trusted Window Manager around each of the VMs window. This allows the user to easily realize to which domain a specific window belongs. See the [screenshots](/wiki/QubesScreenshots) for better understanding.
|
||||
Normally Qubes GUI virtualization daemon restricts the VM from "owning" the full screen, ensuring that there are always clearly marked decorations drawn by the trusted Window Manager around each of the VMs window. This allows the user to easily realize to which domain a specific window belongs. See the [screenshots](/doc/QubesScreenshots/) for better understanding.
|
||||
|
||||
Why is full screen mode potentially dangerous?
|
||||
----------------------------------------------
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/GettingStarted/
|
||||
Getting Started with Qubes OS
|
||||
=============================
|
||||
|
||||
Note: This guide assumes that you've just installed Qubes for the first time. The installation guide for your Qubes release can be found on the [Downloads](/wiki/QubesDownloads) page.
|
||||
Note: This guide assumes that you've just installed Qubes for the first time. The installation guide for your Qubes release can be found on the [Downloads](/doc/QubesDownloads/) page.
|
||||
|
||||
Now that you've installed Qubes, let's cover some basic concepts.
|
||||
|
||||
@ -27,14 +27,14 @@ Each domain, apart from having a distinct name, is also assigned a **label**, wh
|
||||
|
||||

|
||||
|
||||
In addition to AppVMs and TemplateVMs, there's one special domain called "dom0," which is where the Desktop Manager runs. This is where you log in to the system. Dom0 is more trusted than any other domain (including TemplateVMs and black-labeled domains). If dom0 were ever compromised, it would be Game Over<sup>TM</sup>. (The entire system would effectively be compromised.) Due to its overarching importance, dom0 has no network connectivity and is used only for running the Window and Desktop Managers. Dom0 shouldn't be used for anything else. In particular, [you should never run user applications in dom0](/wiki/SecurityGuidelines#Dom0Precautions). (That's what your AppVMs are for!)
|
||||
In addition to AppVMs and TemplateVMs, there's one special domain called "dom0," which is where the Desktop Manager runs. This is where you log in to the system. Dom0 is more trusted than any other domain (including TemplateVMs and black-labeled domains). If dom0 were ever compromised, it would be Game Over<sup>TM</sup>. (The entire system would effectively be compromised.) Due to its overarching importance, dom0 has no network connectivity and is used only for running the Window and Desktop Managers. Dom0 shouldn't be used for anything else. In particular, [you should never run user applications in dom0](/doc/SecurityGuidelines/#Dom0Precautions). (That's what your AppVMs are for!)
|
||||
|
||||
Qubes VM Manager and Command Line Tools
|
||||
---------------------------------------
|
||||
|
||||
All aspects of the Qubes system can be controlled using command line tools run under a dom0 console. To open a console window in dom0, either go to Start-\>System Tools-\>Konsole or press Alt-F2 and type `konsole`.
|
||||
|
||||
Various command line tools are described as part of this guide, and the whole reference can be found [here](/wiki/DomZeroTools).
|
||||
Various command line tools are described as part of this guide, and the whole reference can be found [here](/doc/DomZeroTools/).
|
||||
|
||||

|
||||
|
||||
@ -81,7 +81,7 @@ How Many Domains Do I Need?
|
||||
|
||||
That's a great question, but there's no one-size-fits-all answer. It depends on the structure of your digital life, and this is at least a little different for everyone. If you plan on using your system for work, then it also depends on what kind of job you do.
|
||||
|
||||
It's a good idea to start out with the three domains created automatically by the installer: work, personal, and untrusted. Then, if and when you start to feel that some activity just doesn't fit into any of your existing domains, you can easily create a new domain for it. You'll also be able to easily copy any files you need to the newly created domain, as explained [here](/wiki/CopyingFiles).
|
||||
It's a good idea to start out with the three domains created automatically by the installer: work, personal, and untrusted. Then, if and when you start to feel that some activity just doesn't fit into any of your existing domains, you can easily create a new domain for it. You'll also be able to easily copy any files you need to the newly created domain, as explained [here](/doc/CopyingFiles/).
|
||||
|
||||
More paranoid people might find it worthwhile to read [this article](http://theinvisiblethings.blogspot.com/2011/03/partitioning-my-digital-life-into.html), which describes how one of the Qubes authors partitions her digital life into security domains.
|
||||
|
||||
@ -122,4 +122,4 @@ In order for the changes to take effect, restart the AppVM(s).
|
||||
|
||||
* * * * *
|
||||
|
||||
Now that you're familiar with the basics, feel free to have a look at other [Qubes User Guides](/wiki/UserDoc).
|
||||
Now that you're familiar with the basics, feel free to have a look at other [Qubes User Guides](/doc/UserDoc/).
|
||||
|
@ -614,6 +614,6 @@ Generating and Submitting New Reports
|
||||
|
||||
In order to generate an HCL report in Qubes, simply open a terminal in dom0 and run `qubes-hcl-report <vm-name>`, where `<vm-name>` is the name of the VM to which the generated HCL files will be saved. (Note: If you are working with a new Qubes installation, you may need to update your system in order to download this script.)
|
||||
|
||||
Users are encouraged to submit their HCL reports for the benefit of further Qubes development and other users. If you would like to submit your HCL report, please send the **HCL Info** `.txt` file to `qubes-users@googlegroups.com` (see [here](/wiki/QubesLists) information about the mailing lists) with the subject `HCL - <your machine model name>`. Please include any useful information about any Qubes features you may have tested (see the legend above), as well as general machine compatibility (video, networking, sleep, etc.). If you have problems with your hardware, please send the **HCL Support Files** `.cpio.gz` file as well.
|
||||
Users are encouraged to submit their HCL reports for the benefit of further Qubes development and other users. If you would like to submit your HCL report, please send the **HCL Info** `.txt` file to `qubes-users@googlegroups.com` (see [here](/doc/QubesLists/) information about the mailing lists) with the subject `HCL - <your machine model name>`. Please include any useful information about any Qubes features you may have tested (see the legend above), as well as general machine compatibility (video, networking, sleep, etc.). If you have problems with your hardware, please send the **HCL Support Files** `.cpio.gz` file as well.
|
||||
|
||||
**Please note:** The **HCL Support Files** may contain numerous hardware details, including serial numbers. If, for privacy or security reasons, you do not wish to make this information public, please **do not** send the `.cpio.gz` file to the public mailing list.
|
||||
|
6
HCL.md
6
HCL.md
@ -12,7 +12,7 @@ The HCL is a compilation of reports generated and submitted by users across vari
|
||||
**Note:**
|
||||
Except in the case of developer-reported entries, the Qubes team has not independently verified the accuracy of these reports.
|
||||
Please first consult the data sheets (CPU, chipset, motherboard) prior to buying new hardware for Qubes.
|
||||
Meet the [SystemRequirements](/wiki/SystemRequirements) and search particular for support of:
|
||||
Meet the [SystemRequirements](/doc/SystemRequirements/) and search particular for support of:
|
||||
|
||||
- HVM ("AMD virtualization (AMD-V)", "Intel virtualization (VT-x)", "VIA virtualization (VIA VT)")
|
||||
- IOMMU ("AMD I/O Virtualization Technology (AMD-Vi)", "Intel Virtualization Technology for Directed I/O (VT-d)")
|
||||
@ -32,9 +32,9 @@ In order to generate a HCL report in Qubes, simply open a terminal in dom0 (KDE:
|
||||
(Note: If you are working with a new Qubes installation, you may need to update your system in order to download this script.)
|
||||
|
||||
You are encouraged to submit your HCL report for the benefit of further Qubes development and other users.
|
||||
If you would like to submit your HCL report, please send the **HCL Info** `.txt` file to [\`qubes-users@googlegroups.com\`](/wiki/QubesLists) with the subject `HCL - <your machine model name>`.
|
||||
If you would like to submit your HCL report, please send the **HCL Info** `.txt` file to [\`qubes-users@googlegroups.com\`](/doc/QubesLists/) with the subject `HCL - <your machine model name>`.
|
||||
Please include any useful information about any Qubes features you may have tested (see the legend below), as well as general machine compatibility (video, networking, sleep, etc.).
|
||||
If you have problems with your hardware try a different kernel in the [Troubleshooting menu](/wiki/InstallationGuideR2rc1#Troubleshooting%20problems%20with%20the%20installer).
|
||||
If you have problems with your hardware try a different kernel in the [Troubleshooting menu](/doc/InstallationGuideR2rc1/#Troubleshooting%20problems%20with%20the%20installer).
|
||||
Please consider sending the **HCL Support Files** `.cpio.gz` file as well.
|
||||
|
||||
**Please note:**
|
||||
|
6
HCLR1.md
6
HCLR1.md
@ -17,7 +17,7 @@ Minimum:
|
||||
|
||||
- 4GB of RAM
|
||||
- 64-bit Intel or AMD processor (x86\_64 aka x64 aka AMD64)
|
||||
- Intel GPU strongly preferred (if you have Nvidia GPU, prepare for some [troubleshooting](/wiki/InstallNvidiaDriver); we haven't tested ATI hardware)
|
||||
- Intel GPU strongly preferred (if you have Nvidia GPU, prepare for some [troubleshooting](/doc/InstallNvidiaDriver/); we haven't tested ATI hardware)
|
||||
- At least 20GB of disk (Note that **it is possible to install Qubes on an external USB disk**, so that you can try it without sacrificing your current system. Mind, however, that USB disks are usually SLOW!)
|
||||
- Fast SSD disk strongly recommended
|
||||
|
||||
@ -41,7 +41,7 @@ Specific systems known to work tested by Qubes core developers
|
||||
|
||||
- Samsung X460 - works well on both xenlinux 2.6.38 and pvops 3.2.7 kernel; after resume ethernet driver (sky2) need to be reloaded in netvm to start working again. Even though the chipset suppors VT-d, the BIOS is broken, and so the VT-d is not picked up by Xen, so it effectively doesn't work.
|
||||
|
||||
- Sony Vaio Z 12 (2010 edition) -- works well, but some [tinkering required](/wiki/SonyVaioTinkering)
|
||||
- Sony Vaio Z 12 (2010 edition) -- works well, but some [tinkering required](/doc/SonyVaioTinkering/)
|
||||
|
||||
- Dell Latitude E6420 w/ Intel graphics (Sandy Bridge), i5-2520M CPU - works well on 3.4.18 (haven't tested default 3.2.30 kernel)
|
||||
|
||||
@ -54,7 +54,7 @@ Specific systems known to work tested by the Qubes community
|
||||
- Lenovo Thinkpad x220 8GB RAM, Intel graphics (core i5), VT-d is working. Reported by [Stefan Boresch](https://groups.google.com/group/qubes-devel/msg/f41578eef913446a)
|
||||
- Dell Latitude 5520, requires some minor fixes for networking to work. Reported by [Erik Edin](https://groups.google.com/group/qubes-devel/msg/7418e7084c2de99f?hl=en).
|
||||
- Dell Latitude E6520 with i7-2760QM CPU. VT-d works fine. nVidia graphics not working, but integrated Intel does. Reported by [Steven Collins](https://groups.google.com/group/qubes-devel/msg/340afc6fc2d06d0e)
|
||||
- Dell [PowerEdge?](/wiki/PowerEdge) T110 II, onboard Matrox graphics (Intel Xeon E3-1230), VT-d is working. Reported by [Geoff](https://groups.google.com/group/qubes-devel/msg/8a894915909eeaee)
|
||||
- Dell [PowerEdge?](/doc/PowerEdge/) T110 II, onboard Matrox graphics (Intel Xeon E3-1230), VT-d is working. Reported by [Geoff](https://groups.google.com/group/qubes-devel/msg/8a894915909eeaee)
|
||||
- Toshiba Tecra S11. Requires [some tinkering](https://groups.google.com/group/qubes-devel/browse_thread/thread/fdec0ec165a87726) to enable 3G modem. Reported by Jan Beerden
|
||||
- Toshiba M780 S7240, requires latest BIOS to have VT-d working, [some problems](https://groups.google.com/group/qubes-devel/browse_thread/thread/2b89d2dc5f999ab7) with card reader. Reported by [Franz](https://groups.google.com/group/qubes-devel/browse_thread/thread/66e97c990a08d8e2)
|
||||
- Dell Precision M4600 Intel Core i7-2860QM, 16GB ram, NVIDIA Quadro 1000M, EMEA Intel Pro Wireless 6300. Reported by [nqe](https://groups.google.com/group/qubes-devel/browse_thread/thread/ddf35d12a35f96a3)
|
||||
|
10
HvmCreate.md
10
HvmCreate.md
@ -193,12 +193,12 @@ In the near future we plan on introducing shared template also for HVM domains,
|
||||
~~Installing Qubes support tools in Windows 7 VMs~~ (only for R2 Beta 2)
|
||||
------------------------------------------------------------------------
|
||||
|
||||
Note: the R2 Beta 3 (which is coming soon) has automated most of the actions described below -- please see [this page instead](/wiki/WindowsAppVms).
|
||||
Note: the R2 Beta 3 (which is coming soon) has automated most of the actions described below -- please see [this page instead](/doc/WindowsAppVms/).
|
||||
|
||||
Qubes support tools for Windows VMs is a set of programs and drivers that provide integration of Windows VMs with the rest of the Qubes system. Currently the following features become available for Windows VMs after installation of those tools:
|
||||
|
||||
- Support for [secure clipboard copy/paste](/wiki/CopyPaste) between the Windows VM and other AppVMs
|
||||
- Support for [secure file exchange](/wiki/CopyingFiles) between the Windows VM and other AppVMs
|
||||
- Support for [secure clipboard copy/paste](/doc/CopyPaste/) between the Windows VM and other AppVMs
|
||||
- Support for [secure file exchange](/doc/CopyingFiles/) between the Windows VM and other AppVMs
|
||||
- Support for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM)
|
||||
- Xen PV drivers for Windows that increase performance compared to qemu emulated devices
|
||||
|
||||
@ -294,7 +294,7 @@ And the screenshot below illustrates the Send To entries in a Windows VM that ca
|
||||
Assigning PCI devices to HVM domains
|
||||
------------------------------------
|
||||
|
||||
HVM domains (including Windows VMs) can be [assigned PCI devices](/wiki/AssigningDevices) just like normal AppVMs. E.g. one can assign one of the USB controllers to the Windows VM and should be able to use various devices that require Windows software, such as phones, electronic devices that are configured via FTDI, etc.
|
||||
HVM domains (including Windows VMs) can be [assigned PCI devices](/doc/AssigningDevices/) just like normal AppVMs. E.g. one can assign one of the USB controllers to the Windows VM and should be able to use various devices that require Windows software, such as phones, electronic devices that are configured via FTDI, etc.
|
||||
|
||||
Once problem, however, at the moment, is that after the whole system gets suspend into S3 sleep, and subsequently resumed, such attached devices stop working and should be restarted within the VM. Under Windows this can be achieved by opening the Device Manager, selecting the actual device, such as a USB controller, and then first 'Disabling', and then 'Enabling' the device again. This is illustrated on the screenshot below:
|
||||
|
||||
@ -305,5 +305,5 @@ Further reading
|
||||
|
||||
Other documents related to HVM:
|
||||
|
||||
- [LinuxHVMTips](/wiki/LinuxHVMTips)
|
||||
- [LinuxHVMTips](/doc/LinuxHVMTips/)
|
||||
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/InstallNvidiaDriver/
|
||||
Nvidia proprietary driver installation
|
||||
======================================
|
||||
|
||||
[RpmFusion?](/wiki/RpmFusion) packages
|
||||
[RpmFusion?](/doc/RpmFusion/) packages
|
||||
======================================
|
||||
|
||||
There are rpm packages with all necessary software on rpmfusion. The only package you have to compile is kernel module (but there is ready src.rpm package).
|
||||
@ -54,7 +54,7 @@ Manual installation
|
||||
|
||||
But this is somehow complicated: First - download it from nvidia.com site. Here "NVIDIA-Linux-x86\_64-260.19.44.run" is used. Copy it to dom0. Every next step is done in dom0.
|
||||
|
||||
See [this page](/wiki/CopyToDomZero) for instruction on how to transfer files to Dom0 (where there is normally no networking).
|
||||
See [this page](/doc/CopyToDomZero/) for instruction on how to transfer files to Dom0 (where there is normally no networking).
|
||||
|
||||
**WARNING**: Nvidia doesn't sign their files. To make it worse, you are forced to download them over a plaintext connection. This means there are virtually dozens of possibilities for somebody to modify this file and provide you with a malicious/backdoored file. You should realize that installing untrusted files into your Dom0 is really a bad idea. Perhaps it might be a better idea to just get a new laptop with integrated Intel GPU? You have been warned, anyway.
|
||||
|
||||
|
@ -27,7 +27,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v <iso>.asc
|
||||
@ -60,7 +60,7 @@ If you're already running Qubes 1.0-rc1, you don't need to reinstall, it's just
|
||||
Migrating from Qubes Beta 3
|
||||
---------------------------
|
||||
|
||||
If you have Qubes Beta 3 currently installed on your system, you must reinstall from scratch, as we offer no direct upgrade option in the installer (sorry). However, we do offer tools for smooth migration of your AppVMs. In order to do that, please backup your AppVMs using the `qvm-backup` tool [as usual](/wiki/BackupRestore). Then, after you install Qubes 1.0 rc1, you can restore them using `qvm-backup-restore` tool. However, because we have changed the default template in RC1, you should tell qvm-back-restore about that by passing `--replace-template` option:
|
||||
If you have Qubes Beta 3 currently installed on your system, you must reinstall from scratch, as we offer no direct upgrade option in the installer (sorry). However, we do offer tools for smooth migration of your AppVMs. In order to do that, please backup your AppVMs using the `qvm-backup` tool [as usual](/doc/BackupRestore/). Then, after you install Qubes 1.0 rc1, you can restore them using `qvm-backup-restore` tool. However, because we have changed the default template in RC1, you should tell qvm-back-restore about that by passing `--replace-template` option:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
qvm-backup-restore <backup_dir> --replace-template=fedora-15-x64:fedora-17-x64
|
||||
@ -71,8 +71,8 @@ Installing Updates
|
||||
|
||||
Installing updates is very easy and can be done using the "Update" button in the Qubes Manager. Alternatively it can also be done from command prompt -- see the following for more details:
|
||||
|
||||
- For installing updates for Dom0 -- see instructions [here](/wiki/SoftwareUpdateDom0).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/wiki/SoftwareUpdateVM).
|
||||
- For installing updates for Dom0 -- see instructions [here](/doc/SoftwareUpdateDom0/).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Known Issues
|
||||
------------
|
||||
@ -95,9 +95,9 @@ Known Issues
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-devel* mailing list:
|
||||
- [http://groups.google.com/group/qubes-devel](http://groups.google.com/group/qubes-devel)
|
||||
|
@ -26,7 +26,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v Qubes-R2-x86_64-DVD.iso.asc
|
||||
@ -62,9 +62,9 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading
|
||||
---------
|
||||
|
||||
Upgrading from Qubes R2 rc1 should be a simple matter of installing updates for [dom0](/wiki/SoftwareUpdateDom0) and [VMs](/wiki/SoftwareUpdateVM).
|
||||
Upgrading from Qubes R2 rc1 should be a simple matter of installing updates for [dom0](/doc/SoftwareUpdateDom0/) and [VMs](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Users of R2 beta 3 should follow instructions on how to upgrade to Qubes R2 rc1 [here](/wiki/UpgradeToR2rc1).
|
||||
Users of R2 beta 3 should follow instructions on how to upgrade to Qubes R2 rc1 [here](/doc/UpgradeToR2rc1/).
|
||||
|
||||
Troubleshooting problems with the installer
|
||||
-------------------------------------------
|
||||
@ -95,9 +95,9 @@ It is advised to install updates just after system installation to apply bug fix
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-users* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [https://groups.google.com/group/qubes-users](https://groups.google.com/group/qubes-users)
|
||||
|
@ -26,7 +26,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v <iso>.asc
|
||||
@ -54,15 +54,15 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading from Qubes R1
|
||||
-----------------------
|
||||
|
||||
If you're already running Qubes Release 1, you don't need to reinstall, it's just enough to update the packages in your Dom0 and the template VM(s). This procedure is described [here?](/wiki/UpgradeToR2).
|
||||
If you're already running Qubes Release 1, you don't need to reinstall, it's just enough to update the packages in your Dom0 and the template VM(s). This procedure is described [here?](/doc/UpgradeToR2/).
|
||||
|
||||
Installing Updates
|
||||
------------------
|
||||
|
||||
Installing updates is very easy and can be done using the "Update" button in the Qubes Manager. Alternatively it can also be done from command prompt -- see the following for more details:
|
||||
|
||||
- For installing updates for Dom0 -- see instructions [here](/wiki/SoftwareUpdateDom0).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/wiki/SoftwareUpdateVM).
|
||||
- For installing updates for Dom0 -- see instructions [here](/doc/SoftwareUpdateDom0/).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Known Issues
|
||||
------------
|
||||
@ -87,9 +87,9 @@ Known Issues
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-devel* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [http://groups.google.com/group/qubes-devel](http://groups.google.com/group/qubes-devel)
|
||||
|
@ -26,7 +26,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v <iso>.asc
|
||||
@ -54,17 +54,17 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading from Qubes R1 or R2 Beta 1
|
||||
------------------------------------
|
||||
|
||||
Because of the distribution change in R2B2 (from fc13 to fc18) it's preferred that users reinstall Qubes R2B2 from scratch, and use [qubes backup and restore tools](/wiki/BackupRestore) for migrating of all of the user VMs.
|
||||
Because of the distribution change in R2B2 (from fc13 to fc18) it's preferred that users reinstall Qubes R2B2 from scratch, and use [qubes backup and restore tools](/doc/BackupRestore/) for migrating of all of the user VMs.
|
||||
|
||||
Advanced users (and advanced users only) can also try a manual upgrade procedure that has been described [here](/wiki/UpgradeToR2B2). It's advisable to backup your VMs before proceeding anyway!
|
||||
Advanced users (and advanced users only) can also try a manual upgrade procedure that has been described [here](/doc/UpgradeToR2B2/). It's advisable to backup your VMs before proceeding anyway!
|
||||
|
||||
Installing Updates
|
||||
------------------
|
||||
|
||||
Installing updates is very easy and can be done using the "Update" button in the Qubes Manager. Alternatively it can also be done from command prompt -- see the following for more details:
|
||||
|
||||
- For installing updates for Dom0 -- see instructions [here](/wiki/SoftwareUpdateDom0).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/wiki/SoftwareUpdateVM).
|
||||
- For installing updates for Dom0 -- see instructions [here](/doc/SoftwareUpdateDom0/).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Known Issues
|
||||
------------
|
||||
@ -78,9 +78,9 @@ Known Issues
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-devel* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [http://groups.google.com/group/qubes-devel](http://groups.google.com/group/qubes-devel)
|
||||
|
@ -27,7 +27,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v <iso>.asc
|
||||
@ -63,9 +63,9 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading from Qubes R1 or R2 Beta 2
|
||||
------------------------------------
|
||||
|
||||
The easiest and safest way to upgrade to Qubes R2B3 is to install it from scratch and use [qubes backup and restore tools](/wiki/BackupRestore) for migrating of all of the user VMs.
|
||||
The easiest and safest way to upgrade to Qubes R2B3 is to install it from scratch and use [qubes backup and restore tools](/doc/BackupRestore/) for migrating of all of the user VMs.
|
||||
|
||||
Users can also try a manual upgrade procedure that has been described [here](/wiki/UpgradeToR2B3).
|
||||
Users can also try a manual upgrade procedure that has been described [here](/doc/UpgradeToR2B3/).
|
||||
|
||||
Note: if the user has custom Template VMs (i.e. other than the default template, e.g. created from it by cloning), or Standalone VMs, then the user should perform manual upgrade from R2B2 to R2B3, as described under the link given above.
|
||||
|
||||
@ -76,8 +76,8 @@ NOTE: Updates has been released after R2B3 ISO has been built -- it is recommend
|
||||
|
||||
Installing updates is very easy and can be done using the "Update" button in the Qubes Manager. Alternatively it can also be done from command prompt -- see the following for more details:
|
||||
|
||||
- For installing updates for Dom0 -- see instructions [here](/wiki/SoftwareUpdateDom0).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/wiki/SoftwareUpdateVM).
|
||||
- For installing updates for Dom0 -- see instructions [here](/doc/SoftwareUpdateDom0/).
|
||||
- For installing updates for you domains (VMs) -- see instructions [here](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Troubleshooting problems with the installer
|
||||
-------------------------------------------
|
||||
@ -108,9 +108,9 @@ Known Issues
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-users* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [http://groups.google.com/group/qubes-users](http://groups.google.com/group/qubes-users)
|
||||
|
@ -26,7 +26,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v <iso>.asc
|
||||
@ -62,9 +62,9 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading
|
||||
---------
|
||||
|
||||
The easiest and safest way to upgrade to Qubes R2rc1 (especially from older releases) is to install it from scratch and use [qubes backup and restore tools](/wiki/BackupRestore) for migrating of all of the user VMs.
|
||||
The easiest and safest way to upgrade to Qubes R2rc1 (especially from older releases) is to install it from scratch and use [qubes backup and restore tools](/doc/BackupRestore/) for migrating of all of the user VMs.
|
||||
|
||||
Users of R2 beta 3 can upgrade using procedure that has been described [here](/wiki/UpgradeToR2rc1).
|
||||
Users of R2 beta 3 can upgrade using procedure that has been described [here](/doc/UpgradeToR2rc1/).
|
||||
|
||||
Note: if the user has custom Template VMs (i.e. other than the default template, e.g. created from it by cloning), or Standalone VMs, then the user should perform manual upgrade from R2B3 to R2rc1, as described under the link given above.
|
||||
|
||||
@ -86,16 +86,16 @@ Known Issues
|
||||
|
||||
- If your GPU is not correctly supported by the Dom0 kernel (e.g. the 3D desktop effects do not run smoothly) then you might experience "heaviness" with Windows 7-based AppVMs. In that case, please solve the problem with your GPU support in Dom0 in the first place (by using a different kernel), or install Qubes OS on a different system.
|
||||
|
||||
- HVMs with Qubes Tools installed will not have access to the network if firewallvm uses 3.12 kernel (the default). The workaround is to use older (3.11) kernel for firewallvm. You need to [install kernel-qubes-vm-3.11.10 package](/wiki/SoftwareUpdateDom0#Howtodowngradeaspecificpackage), then ensure that it is used for firewallvm (for example using Qubes Manager - advanced tab of VM settings).
|
||||
- HVMs with Qubes Tools installed will not have access to the network if firewallvm uses 3.12 kernel (the default). The workaround is to use older (3.11) kernel for firewallvm. You need to [install kernel-qubes-vm-3.11.10 package](/doc/SoftwareUpdateDom0/#Howtodowngradeaspecificpackage), then ensure that it is used for firewallvm (for example using Qubes Manager - advanced tab of VM settings).
|
||||
|
||||
- Just after installation, applications menu will not contain colorful application icons (new feature), only padlock in VM color. To get colorful icons, you need to start template VM (fedora-20-x64) and call `qvm-sync-appmenus fedora-20-x64` in dom0 terminal. If you have other Template VMs or Standalone VMs, repeat the steps for them too.
|
||||
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-users* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [https://groups.google.com/group/qubes-users](https://groups.google.com/group/qubes-users)
|
||||
|
@ -26,7 +26,7 @@ Note: We don't recommend installing Qubes in a virtual machine! It will likely n
|
||||
Download installer ISO
|
||||
----------------------
|
||||
|
||||
See [this page](/wiki/QubesDownloads) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/wiki/VerifyingSignatures) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
See [this page](/doc/QubesDownloads/) for ISO downloads. Remember, we have absolutely no control over those servers, and so you should be assuming that they might be compromised, or just be serving a compromised ISOs because their operators decided so, for whatever reason. Always verify the digital signature on the downloaded ISO. See this [page](/doc/VerifyingSignatures/) for more info about how to download and verify our GPG keys, and then verify the downloaded ISO:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
gpg -v Qubes-R2-rc2-x86_64-DVD.iso.asc
|
||||
@ -62,9 +62,9 @@ The installer loads Xen right at the beginning, so chances are high that if you
|
||||
Upgrading
|
||||
---------
|
||||
|
||||
Upgrading from Qubes R2 rc1 should be a simple matter of installing updates for [dom0](/wiki/SoftwareUpdateDom0) and [VMs](/wiki/SoftwareUpdateVM).
|
||||
Upgrading from Qubes R2 rc1 should be a simple matter of installing updates for [dom0](/doc/SoftwareUpdateDom0/) and [VMs](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Users of R2 beta 3 should follow instructions on how to upgrade to Qubes R2 rc1 [here](/wiki/UpgradeToR2rc1).
|
||||
Users of R2 beta 3 should follow instructions on how to upgrade to Qubes R2 rc1 [here](/doc/UpgradeToR2rc1/).
|
||||
|
||||
Troubleshooting problems with the installer
|
||||
-------------------------------------------
|
||||
@ -87,9 +87,9 @@ Known Issues
|
||||
Getting Help
|
||||
------------
|
||||
|
||||
- **User manuals are [here](/wiki/UserDoc).** (Strongly recommended!)
|
||||
- **User manuals are [here](/doc/UserDoc/).** (Strongly recommended!)
|
||||
|
||||
- Developers documentation (normally not needed by users) is [here](/wiki/SystemDoc)
|
||||
- Developers documentation (normally not needed by users) is [here](/doc/SystemDoc/)
|
||||
|
||||
- If you don't find answer in the sources given above, write to the *qubes-users* mailing list (you don't need to be subscribed to the list, just send email to the address given below):
|
||||
- [https://groups.google.com/group/qubes-users](https://groups.google.com/group/qubes-users)
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/InstallationIsoBuilding/
|
||||
How to build Qubes installation ISO
|
||||
===================================
|
||||
|
||||
Qubes uses [FedoraUnity?](/wiki/FedoraUnity) [Revisor](http://revisor.fedoraunity.org/) to build the installation ISO.
|
||||
Qubes uses [FedoraUnity?](/doc/FedoraUnity/) [Revisor](http://revisor.fedoraunity.org/) to build the installation ISO.
|
||||
|
||||
You may want to get familiar with [Revisor documentation](http://revisor.fedoraunity.org/documentation).
|
||||
|
||||
@ -47,7 +47,7 @@ All configuration files for Qubes Revisor are kept in the ```conf/``` directory:
|
||||
|
||||
- ```conf/comps-qubes.xml``` - Repository Comps file for ISO `/Packages` repository, describing packages and package groups of the installer repository. Package groups are used to select which of the packages are mandatory to install, which are optional and which are to be just available on the ISO but not installed by default (not used on Qubes).
|
||||
|
||||
[Create/Update?](/wiki/Create/Update) local repository
|
||||
[Create/Update?](/doc/Create/Update/) local repository
|
||||
------------------------------------------------------
|
||||
|
||||
Revisor fetches all RPM packages from YUM repositories. We currently use 5 repositories:
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/KdeDom0/
|
||||
Qubes-customized KDE packages for Dom0
|
||||
======================================
|
||||
|
||||
The Qubes kde-dom0 project (see [Source Code](/wiki/SourceCode)) contains the source code needed for building the customized KDE packages for use in Qubes Dom0 (the user desktop). The packages are based on Fedora 12 KDE packages, but are heavily slimmed down (Qubes doesn't need lots of KDE functionality in Dom0, such as most of the KDE apps). In the near future those KDE packages will also get some Qubes specific extensions, such as coloured titlebars/frames nicely integrated into the KDE Window Manager. And, of course, custom themes, e.g. for KDM :)
|
||||
The Qubes kde-dom0 project (see [Source Code](/doc/SourceCode/)) contains the source code needed for building the customized KDE packages for use in Qubes Dom0 (the user desktop). The packages are based on Fedora 12 KDE packages, but are heavily slimmed down (Qubes doesn't need lots of KDE functionality in Dom0, such as most of the KDE apps). In the near future those KDE packages will also get some Qubes specific extensions, such as coloured titlebars/frames nicely integrated into the KDE Window Manager. And, of course, custom themes, e.g. for KDM :)
|
||||
|
||||
Getting the sources
|
||||
-------------------
|
||||
|
@ -24,7 +24,7 @@ To achieve it (all commands run as root):
|
||||
X -configure :1 && mv ~/xorg.conf.new /etc/X11/xorg.conf
|
||||
{% endhighlight %}
|
||||
|
||||
2. Add [HorizSync?](/wiki/HorizSync) line to Monitor section, it should look something like:
|
||||
2. Add [HorizSync?](/doc/HorizSync/) line to Monitor section, it should look something like:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
Section "Monitor"
|
||||
|
@ -29,6 +29,6 @@ List of installed applications for each AppVM is stored in its template's `/var/
|
||||
|
||||
Actual command lines for the menu shortcuts involve `qvm-run` command which starts a process in another domain. Example: `qvm-run -q --tray -a w7s 'cmd.exe /c "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk"'` or `qvm-run -q --tray -a untrusted 'firefox %u'`
|
||||
|
||||
`qvm-sync-appmenus` works by invoking *GetAppMenus* [Qubes service](/wiki/Qrexec) in the target domain. This service enumerates installed applications and sends formatted info back to the dom0 script (`/usr/libexec/qubes-appmenus/qubes-receive-appmenus`) which creates .desktop files in the AppVM/TemplateVM directory.
|
||||
`qvm-sync-appmenus` works by invoking *GetAppMenus* [Qubes service](/doc/Qrexec/) in the target domain. This service enumerates installed applications and sends formatted info back to the dom0 script (`/usr/libexec/qubes-appmenus/qubes-receive-appmenus`) which creates .desktop files in the AppVM/TemplateVM directory.
|
||||
|
||||
For Linux VMs the service script is in `/etc/qubes-rpc/qubes.GetAppMenus`. In Windows it's a PowerShell script located in `c:\Program Files\Invisible Things Lab\Qubes OS Windows Tools\qubes-rpc-services\get-appmenus.ps1` by default.
|
||||
|
6
Mutt.md
6
Mutt.md
@ -13,8 +13,8 @@ Mutt is a fast, standards-compliant, efficient MUA (Mail User Agent). In some ar
|
||||
Mutt lacks true MTA (Message Transfer Agent aka "SMTP client") and MRA (Mail
|
||||
Retrieval Agent aka "IMAP/POP3 client"), thus there are some provisions
|
||||
built-in. In principle it is only mail reader and composer. You may install
|
||||
true MTA such as [Postfix](/wiki/Postfix) or Exim and MRA such as
|
||||
[Fetchmail](/wiki/Fetchmail). Alternativelly you can synchronize your mailbox
|
||||
true MTA such as [Postfix](/doc/Postfix/) or Exim and MRA such as
|
||||
[Fetchmail](/doc/Fetchmail/). Alternativelly you can synchronize your mailbox
|
||||
using [OfflineIMAP](https://github.com/OfflineIMAP/offlineimap) and just stick
|
||||
to integrated SMTP support. You can even use itegrated IMAP client, but it is
|
||||
not very convenient.
|
||||
@ -27,7 +27,7 @@ Installation
|
||||
Configuration
|
||||
-------------
|
||||
|
||||
Mutt generally works out of the box. This configuration guide discusses only Qubes-specific setup. In this example we will have one TemplateVM and several AppVMs. It also takes advantage of [SplitGPG?](/wiki/SplitGPG), which is assumed to be already working.
|
||||
Mutt generally works out of the box. This configuration guide discusses only Qubes-specific setup. In this example we will have one TemplateVM and several AppVMs. It also takes advantage of [SplitGPG?](/doc/SplitGPG/), which is assumed to be already working.
|
||||
|
||||
**NOTE:** this requires `qubes-gpg-split >= 2.0.9`. 2.0.8 and earlier contains bug which causes this setup to hang in specific situations and does not allow to list keys.
|
||||
|
||||
|
@ -20,7 +20,7 @@ Security considerations for network printers and drivers
|
||||
|
||||
Some printers require 3rd party drivers, typically downloadable from the vendor's website. Such drivers are typically distributed in a form of ready to install RPM packages. However, they are often unsigned, and additionally the downloads are available via HTTP connections only. As a result, installation of such 3rd party RPMs in a default template VM exposes a risk of compromise of this template VM, which, in turn, leads automatically to compromise of all the AppVMs based on the template. (Again, it's not buggy or malicious drivers that we fear here, but rather malicious installation scripts for those drivers).
|
||||
|
||||
In order to mitigate this risk, one might consider creating a custom template (i.e. clone the original template) and then install the 3rd party, unverified drivers there. Such template might then be made the default template for [Disposable VM creation](/wiki/DisposableVms), which should allow one to print any document by right-clicking on it, choosing "Open in Disposable VM" and print from there. This would allow to print documents from more trusted AppVMs (based on a trusted default template, that is not poisoned by 3rd party printer drivers).
|
||||
In order to mitigate this risk, one might consider creating a custom template (i.e. clone the original template) and then install the 3rd party, unverified drivers there. Such template might then be made the default template for [Disposable VM creation](/doc/DisposableVms/), which should allow one to print any document by right-clicking on it, choosing "Open in Disposable VM" and print from there. This would allow to print documents from more trusted AppVMs (based on a trusted default template, that is not poisoned by 3rd party printer drivers).
|
||||
|
||||
However, one should be aware that most (all?) network printing protocols are insecure, unencrypted protocols. This means, that an attacker who is able to sniff the lock network, or who is controlling the (normally untrusted) Qubes NetVM, will likely be able to see the documents being printed. This is a limitation of today's printers and printing protocols, something that cannot be solved by Qubes or any other OS.
|
||||
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/Postfix/
|
||||
Postfix
|
||||
=======
|
||||
|
||||
Postfix is full featured MTA (Message Transfer Agent). Here we will configure it in smarthost mode as part of common [Mutt](/wiki/Mutt)+Postfix+[Fetchmail](/wiki/Fetchmail) stack.
|
||||
Postfix is full featured MTA (Message Transfer Agent). Here we will configure it in smarthost mode as part of common [Mutt](/doc/Mutt/)+Postfix+[Fetchmail](/doc/Fetchmail/) stack.
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/Qfileexchgd/
|
||||
**This mechanism is obsolete as of Qubes Beta 1!**
|
||||
==================================================
|
||||
|
||||
Please see this [page](/wiki/Qfilecopy) instead.
|
||||
Please see this [page](/doc/Qfilecopy/) instead.
|
||||
|
||||
qfilexchgd, the Qubes file exchange daemon
|
||||
==========================================
|
||||
|
12
Qrexec.md
12
Qrexec.md
@ -55,13 +55,13 @@ In dom0, there is a bunch of files in `/etc/qubes-rpc/policy/` directory, whose
|
||||
|
||||
- qubes.Filecopy
|
||||
- qubes.OpenInVM
|
||||
- qubes.[ReceiveUpdates?](/wiki/ReceiveUpdates)
|
||||
- qubes.[SyncAppMenus?](/wiki/SyncAppMenus)
|
||||
- qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/)
|
||||
- qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- qubes.VMShell
|
||||
- qubes.[ClipboardPaste?](/wiki/ClipboardPaste)
|
||||
- qubes.[ClipboardPaste?](/doc/ClipboardPaste/)
|
||||
- qubes.Gpg
|
||||
- qubes.[NotifyUpdates?](/wiki/NotifyUpdates)
|
||||
- qubes.[PdfConvert?](/wiki/PdfConvert)
|
||||
- qubes.[NotifyUpdates?](/doc/NotifyUpdates/)
|
||||
- qubes.[PdfConvert?](/doc/PdfConvert/)
|
||||
|
||||
These files contain lines with the following format:
|
||||
|
||||
@ -157,4 +157,4 @@ As previously noted, Qubes aims to provide mechanisms that are very simple and t
|
||||
Qubes RPC internals
|
||||
-------------------
|
||||
|
||||
The internal implementation of qrexec in Qubes R2 is described [here](/wiki/Qrexec2Implementation), and in Qubes R3 [here](/wiki/Qrexec3Implementation).
|
||||
The internal implementation of qrexec in Qubes R2 is described [here](/doc/Qrexec2Implementation/), and in Qubes R3 [here](/doc/Qrexec3Implementation/).
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/Qrexec2Implementation/
|
||||
Implementation of qrexec in Qubes R2
|
||||
====================================
|
||||
|
||||
This page describes implementation of the [qrexec framework](/wiki/Qrexec) in Qubes OS R2. Note that the implementation has changed significantly in Qubes R3 (see [Qrexec3Implementation](/wiki/Qrexec3Implementation)), although the user API reminded backwards compatible (i.e. qrexec apps written for Qubes R2 should run without modifications on Qubes R3).
|
||||
This page describes implementation of the [qrexec framework](/doc/Qrexec/) in Qubes OS R2. Note that the implementation has changed significantly in Qubes R3 (see [Qrexec3Implementation](/doc/Qrexec3Implementation/)), although the user API reminded backwards compatible (i.e. qrexec apps written for Qubes R2 should run without modifications on Qubes R3).
|
||||
|
||||
Dom0 tools implementation
|
||||
-------------------------
|
||||
|
12
Qrexec3.md
12
Qrexec3.md
@ -47,13 +47,13 @@ In dom0, there is a bunch of files in */etc/qubes-rpc/policy* directory, whose n
|
||||
|
||||
- qubes.Filecopy
|
||||
- qubes.OpenInVM
|
||||
- qubes.[ReceiveUpdates?](/wiki/ReceiveUpdates)
|
||||
- qubes.[SyncAppMenus?](/wiki/SyncAppMenus)
|
||||
- qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/)
|
||||
- qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- qubes.VMShell
|
||||
- qubes.[ClipboardPaste?](/wiki/ClipboardPaste)
|
||||
- qubes.[ClipboardPaste?](/doc/ClipboardPaste/)
|
||||
- qubes.Gpg
|
||||
- qubes.[NotifyUpdates?](/wiki/NotifyUpdates)
|
||||
- qubes.[PdfConvert?](/wiki/PdfConvert)
|
||||
- qubes.[NotifyUpdates?](/doc/NotifyUpdates/)
|
||||
- qubes.[PdfConvert?](/doc/PdfConvert/)
|
||||
|
||||
These files contain lines with the following format:
|
||||
|
||||
@ -124,4 +124,4 @@ and we should get "3" as answer, after dom0 allows it.
|
||||
Qubes RPC internals
|
||||
-------------------
|
||||
|
||||
See [QrexecProtocol?](/wiki/QrexecProtocol).
|
||||
See [QrexecProtocol?](/doc/QrexecProtocol/).
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/Qrexec3Implementation/
|
||||
Implementation of qrexec in Qubes R3
|
||||
====================================
|
||||
|
||||
This page describes implementation of the [qrexec framework](/wiki/Qrexec) in Qubes OS R3.
|
||||
This page describes implementation of the [qrexec framework](/doc/Qrexec/) in Qubes OS R3.
|
||||
|
||||
Qrexec framework consists of a number of processes communicating with each other using common IPC protocol (described in detail below). Components residing in the same domain use pipes as the underlying transport medium, while components in separate domains use vchan link.
|
||||
|
||||
@ -124,7 +124,7 @@ Details of all possible use cases and the messages involved are described below.
|
||||
- `MSG_DATA_STDOUT` or `MSG_DATA_STDIN` with data `len` field set to 0 in `msg_header` is an EOF marker. Peer receiving such message should close the associated input/output pipe.
|
||||
- When `some_command` terminates, **domX**'s `qrexec-agent` sends `MSG_DATA_EXIT_CODE` header to `qrexec-client` followed by the exit code (**int**). `qrexec-agent` then disconnects from the data vchan.
|
||||
|
||||
### domY: invoke execution of qubes service qubes.[SomeRpc?](/wiki/SomeRpc) in domX and pass stdin/stdout
|
||||
### domY: invoke execution of qubes service qubes.[SomeRpc?](/doc/SomeRpc/) in domX and pass stdin/stdout
|
||||
|
||||
- **domY**: `qrexec-client-vm` is invoked as follows:
|
||||
|
||||
|
@ -97,9 +97,9 @@ You can also build selected component separately. Eg. to compile only gui virtua
|
||||
make gui-daemon
|
||||
|
||||
Full list you can get from make help. For advanced use and preparing sources
|
||||
for use with [QubesBuilder](/wiki/QubesBuilder) take a look at [doc directory
|
||||
for use with [QubesBuilder](/doc/QubesBuilder/) take a look at [doc directory
|
||||
in QubesBuilder](https://github.com/marmarek/qubes-builder/tree/master/doc) or
|
||||
[QubesBuilderDetails](/wiki/QubesBuilderDetails) page.
|
||||
[QubesBuilderDetails](/doc/QubesBuilderDetails/) page.
|
||||
|
||||
Making customized build
|
||||
-----------------------
|
||||
@ -137,7 +137,7 @@ If you want to somehow modify sources, you can also do it, here are some basic s
|
||||
Code verification keys management
|
||||
=================================
|
||||
|
||||
[QubesBuilder](/wiki/QubesBuilder) by default verifies signed tags on every downloaded code. Public keys used for that are stored in `keyrings/git`. By default Qubes developers' keys are imported automatically, but if you need some additional keys (for example your own), you can add them using:
|
||||
[QubesBuilder](/doc/QubesBuilder/) by default verifies signed tags on every downloaded code. Public keys used for that are stored in `keyrings/git`. By default Qubes developers' keys are imported automatically, but if you need some additional keys (for example your own), you can add them using:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
GNUPGHOME=$PWD/keyrings/git gpg --import /path/to/key.asc
|
||||
|
@ -5,18 +5,18 @@ permalink: /doc/QubesBuilderDetails/
|
||||
redirect_from: /wiki/QubesBuilderDetails/
|
||||
---
|
||||
|
||||
[QubesBuilder](/wiki/QubesBuilder) "API"
|
||||
[QubesBuilder](/doc/QubesBuilder/) "API"
|
||||
========================================
|
||||
|
||||
Components Makefile.builder file
|
||||
--------------------------------
|
||||
|
||||
[QubesBuilder](/wiki/QubesBuilder) expects that each component have *Makefile.builder* file in its root directory. This file specifies what should be done to build the package. As name suggests, this is normal makefile, which is included by builder as its configuration. Its main purpose is to set some variables. Generally all available variables/settings are described as comments at the beginning of Makefile.\* in [QubesBuilder](/wiki/QubesBuilder).
|
||||
[QubesBuilder](/doc/QubesBuilder/) expects that each component have *Makefile.builder* file in its root directory. This file specifies what should be done to build the package. As name suggests, this is normal makefile, which is included by builder as its configuration. Its main purpose is to set some variables. Generally all available variables/settings are described as comments at the beginning of Makefile.\* in [QubesBuilder](/doc/QubesBuilder/).
|
||||
|
||||
Variables for Linux build:
|
||||
|
||||
- `RPM_SPEC_FILES` List (space separated) of spec files for RPM package build. Path should be relative to component root directory. [QubesBuilder](/wiki/QubesBuilder) will install all [BuildRequires?](/wiki/BuildRequires) (in chroot environment) before the build. In most Qubes components all spec files are kept in *rpm\_spec* directory. This is mainly used for Fedora packages build.
|
||||
- `ARCH_BUILD_DIRS` List (space separated) of directories with PKGBUILD files for Archlinux package build. Similar to RPM build, [QubesBuilder](/wiki/QubesBuilder) will install all makedepends, then build the package.
|
||||
- `RPM_SPEC_FILES` List (space separated) of spec files for RPM package build. Path should be relative to component root directory. [QubesBuilder](/doc/QubesBuilder/) will install all [BuildRequires?](/doc/BuildRequires/) (in chroot environment) before the build. In most Qubes components all spec files are kept in *rpm\_spec* directory. This is mainly used for Fedora packages build.
|
||||
- `ARCH_BUILD_DIRS` List (space separated) of directories with PKGBUILD files for Archlinux package build. Similar to RPM build, [QubesBuilder](/doc/QubesBuilder/) will install all makedepends, then build the package.
|
||||
|
||||
Most components uses *archlinux* directory for this purpose, so its good to keep this style.
|
||||
|
||||
@ -35,8 +35,8 @@ Variables for Windows build:
|
||||
- `SIGNTOOL` Path to signtool
|
||||
- `WIN_PACKAGE_CMD` Command used to produce installation package (msi or msm). Default value is *wix.bat*, similar to above - use *true* if you don't want this command.
|
||||
- `WIN_OUTPUT_HEADERS` Directory (relative to `WIN_SOURCE_SUBDIRS` element) with public headers of the package - for use in other components.
|
||||
- `WIN_OUTPUT_LIBS` Directory (relative to `WIN_SOURCE_SUBDIRS` element) with libraries (both DLL and implib) of the package - for use in other components. Note that [QubesBuilder](/wiki/QubesBuilder) will copy files specified as *\$(WIN\_OUTPUT\_LIBS)/\*/\** to match WDK directory layout (*\<specified directory\>/\<arch directory\>/\<actual libraries\>*), so you in mingw build you need to place libraries in some additional subdirectory.
|
||||
- `WIN_BUILD_DEPS` List of components required to build this one. [QubesBuilder](/wiki/QubesBuilder) will copy files specified with `WIN_OUTPUT_HEADERS` and `WIN_OUTPUT_LIBS` of those components to some directory and provide its path with `QUBES_INCLUDES` and `QUBES_LIBS` variables. Use those variables in your build scripts (*sources* or *Makefile* - depending on selected compiler). You can assume that the variables are always set and directories always exists, even if empty.
|
||||
- `WIN_OUTPUT_LIBS` Directory (relative to `WIN_SOURCE_SUBDIRS` element) with libraries (both DLL and implib) of the package - for use in other components. Note that [QubesBuilder](/doc/QubesBuilder/) will copy files specified as *\$(WIN\_OUTPUT\_LIBS)/\*/\** to match WDK directory layout (*\<specified directory\>/\<arch directory\>/\<actual libraries\>*), so you in mingw build you need to place libraries in some additional subdirectory.
|
||||
- `WIN_BUILD_DEPS` List of components required to build this one. [QubesBuilder](/doc/QubesBuilder/) will copy files specified with `WIN_OUTPUT_HEADERS` and `WIN_OUTPUT_LIBS` of those components to some directory and provide its path with `QUBES_INCLUDES` and `QUBES_LIBS` variables. Use those variables in your build scripts (*sources* or *Makefile* - depending on selected compiler). You can assume that the variables are always set and directories always exists, even if empty.
|
||||
|
||||
builder.conf settings
|
||||
---------------------
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/QubesContacts/
|
||||
Contacting the Qubes OS Team
|
||||
============================
|
||||
|
||||
**Note:** Please send all the questions regarding Qubes to the [mailing list](/wiki/QubesLists). This way, your questions, as well as answers to those questions, could be also shared with other users.
|
||||
**Note:** Please send all the questions regarding Qubes to the [mailing list](/doc/QubesLists/). This way, your questions, as well as answers to those questions, could be also shared with other users.
|
||||
|
||||
Press & business contact
|
||||
------------------------
|
||||
|
@ -12,7 +12,7 @@ Architects & Core Developers
|
||||
----------------------------
|
||||
|
||||
- Joanna Rutkowska `joanna at invisiblethingslab dot com` - architecture & project management, original core, occasional addons
|
||||
- Marek Marczykowski `marmarek at invisiblethingslab dot com` - everything [Xen/Linux?](/wiki/Xen/Linux) related :)
|
||||
- Marek Marczykowski `marmarek at invisiblethingslab dot com` - everything [Xen/Linux?](/doc/Xen/Linux/) related :)
|
||||
- Wojciech Porczyk `woju at invisiblethingslab dot com` -- various Linux-related things
|
||||
|
||||
Contributors to the open source code
|
||||
|
32
QubesDocs.md
32
QubesDocs.md
@ -13,25 +13,25 @@ Qubes Documentation
|
||||
For Users
|
||||
---------
|
||||
|
||||
- [User Documentation](/wiki/UserDoc/)
|
||||
- [Users' FAQ](/wiki/UserFaq/)
|
||||
- [System Requirements](/wiki/SystemRequirements/)
|
||||
- [User Documentation](/doc/UserDoc/)
|
||||
- [Users' FAQ](/doc/UserFaq/)
|
||||
- [System Requirements](/doc/SystemRequirements/)
|
||||
- [Hardware Compatibility List](/hcl//)
|
||||
- [On Digital Signatures and How to Verify Qubes Downloads](/wiki/VerifyingSignatures/)
|
||||
- [Installation Guides](/wiki/QubesDownloads/)
|
||||
- [Troubleshooting](/wiki/TroubleShooting/)
|
||||
- [Security](/wiki/QubesSecurity/)
|
||||
- [On Digital Signatures and How to Verify Qubes Downloads](/doc/VerifyingSignatures/)
|
||||
- [Installation Guides](/doc/QubesDownloads/)
|
||||
- [Troubleshooting](/doc/TroubleShooting/)
|
||||
- [Security](/doc/QubesSecurity/)
|
||||
|
||||
For Developers
|
||||
--------------
|
||||
|
||||
- [Developer Documentation](/wiki/SystemDoc/)
|
||||
- [Developers' FAQ](/wiki/DevelFaq/)
|
||||
- [How can I contribute to the Qubes project?](/wiki/ContributingHowto/)
|
||||
- [Source Code](/wiki/SourceCode/)
|
||||
- [Coding Guidelines](/wiki/CodingStyle/)
|
||||
- [Books for Developers](/wiki/DevelBooks/)
|
||||
- [Research Papers](/wiki/QubesResearch/)
|
||||
- [Architecture](/wiki/QubesArchitecture/)
|
||||
- [Licensing](/wiki/QubesLicensing/)
|
||||
- [Developer Documentation](/doc/SystemDoc/)
|
||||
- [Developers' FAQ](/doc/DevelFaq/)
|
||||
- [How can I contribute to the Qubes project?](/doc/ContributingHowto/)
|
||||
- [Source Code](/doc/SourceCode/)
|
||||
- [Coding Guidelines](/doc/CodingStyle/)
|
||||
- [Books for Developers](/doc/DevelBooks/)
|
||||
- [Research Papers](/doc/QubesResearch/)
|
||||
- [Architecture](/doc/QubesArchitecture/)
|
||||
- [Licensing](/doc/QubesLicensing/)
|
||||
|
||||
|
@ -8,10 +8,10 @@ redirect_from: /wiki/QubesDownloads/
|
||||
Qubes Downloads
|
||||
===============
|
||||
|
||||
- [System Requirements](/wiki/SystemRequirements)
|
||||
- [System Requirements](/doc/SystemRequirements/)
|
||||
- [Hardware Compatibility List](/hcl/)
|
||||
- [On Digital Signatures and How to Verify Qubes Downloads](/wiki/VerifyingSignatures)
|
||||
- [Licensing](/wiki/QubesLicensing)
|
||||
- [On Digital Signatures and How to Verify Qubes Downloads](/doc/VerifyingSignatures/)
|
||||
- [Licensing](/doc/QubesLicensing/)
|
||||
|
||||
Qubes Release 3.0
|
||||
---------------
|
||||
@ -28,14 +28,14 @@ Qubes Release 2
|
||||
- [Qubes-R2-x86\_64-DVD.iso](http://sourceforge.net/projects/qubesos/files/Qubes-R2-x86_64-DVD.iso/download) (via sourceforge.net)
|
||||
- [Digital Signature](http://sourceforge.net/projects/qubesos/files/Qubes-R2-x86_64-DVD.iso.asc/download) (via sourceforge.net)
|
||||
|
||||
- **[Installation Guide for Qubes R2](/wiki/InstallationGuideR2)**
|
||||
- [Upgrading to Qubes R2](/wiki/InstallationGuideR2#Upgrading)
|
||||
- **[Installation Guide for Qubes R2](/doc/InstallationGuideR2/)**
|
||||
- [Upgrading to Qubes R2](/doc/InstallationGuideR2/#Upgrading)
|
||||
|
||||
- [Qubes-R2-rc2-x86\_64-DVD.iso](http://sourceforge.net/projects/qubesos/files/Qubes-R2-rc2-x86_64-DVD.iso/download) (via sourceforge.net)
|
||||
- [Digital Signature](http://sourceforge.net/projects/qubesos/files/Qubes-R2-rc2-x86_64-DVD.iso.asc/download) (via sourceforge.net)
|
||||
|
||||
- **[Installation Guide for Qubes R2 rc2](/wiki/InstallationGuideR2rc2)**
|
||||
- [Upgrading to Qubes R2 rc2](/wiki/InstallationGuideR2rc2#Upgrading)
|
||||
- **[Installation Guide for Qubes R2 rc2](/doc/InstallationGuideR2rc2/)**
|
||||
- [Upgrading to Qubes R2 rc2](/doc/InstallationGuideR2rc2/#Upgrading)
|
||||
|
||||
Qubes Release 1
|
||||
---------------
|
||||
@ -45,7 +45,7 @@ Qubes Release 1
|
||||
- [Qubes-R1-x86\_64-DVD.iso](http://sourceforge.net/projects/qubesos/files/Qubes-R1-x86_64-DVD.iso/download) (via sourceforge.net)
|
||||
- [Digital Signature](http://sourceforge.net/projects/qubesos/files/Qubes-R1-x86_64-DVD.iso.asc/download) (via sourceforge.net)
|
||||
|
||||
- **[Installation Guide](/wiki/InstallationGuide)**
|
||||
- **[Installation Guide](/doc/InstallationGuide/)**
|
||||
|
||||
Mirrors
|
||||
-------
|
||||
|
@ -38,7 +38,7 @@ Normally Qubes doesn't let the user to stop a NetVM if there are other AppVMs ru
|
||||
qvm-prefs <appvm> -s netvm <netvm>
|
||||
{% endhighlight %}
|
||||
|
||||
Normally AppVMs do not connect directly to the actual NetVM which has networking devices, but rather to the default FirewallVM first, and in most cases it would be the NetVM that would crash, e.g. in response to S3 sleep/restore or other issues with [WiFi?](/wiki/WiFi) drivers. In that case it is necessary to just issue the above command once, for the FirewallVM (this assumes default VM-nameing used by the default Qubes installation):
|
||||
Normally AppVMs do not connect directly to the actual NetVM which has networking devices, but rather to the default FirewallVM first, and in most cases it would be the NetVM that would crash, e.g. in response to S3 sleep/restore or other issues with [WiFi?](/doc/WiFi/) drivers. In that case it is necessary to just issue the above command once, for the FirewallVM (this assumes default VM-nameing used by the default Qubes installation):
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
qvm-prefs firewallvm -s netvm netvm
|
||||
|
@ -44,9 +44,9 @@ This list is for helping users solve various daily problems with Qubes OS. Examp
|
||||
|
||||
Please try searching both the Qubes website and the archives of the mailing lists before sending a question. In addition, please make sure that you have read and understood the following basic documentation prior to posting to the list:
|
||||
|
||||
- [Installation guides, System Requirements, and HCL](/wiki/QubesDownloads) \<-- for problems related to Qubes OS installation
|
||||
- [Qubes User FAQ](/wiki/UserFaq)
|
||||
- [Qubes User Guides](/wiki/UserDoc) \<-- for questions about how to use Qubes OS
|
||||
- [Installation guides, System Requirements, and HCL](/doc/QubesDownloads/) \<-- for problems related to Qubes OS installation
|
||||
- [Qubes User FAQ](/doc/UserFaq/)
|
||||
- [Qubes User Guides](/doc/UserDoc/) \<-- for questions about how to use Qubes OS
|
||||
|
||||
### How to Subscribe and Post
|
||||
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/QubesR3Building/
|
||||
Building Qubes OS 3.0 ISO
|
||||
=========================
|
||||
|
||||
Ensure your system is rpm-based and that you have necessary dependencies installed (see [QubesBuilder](/wiki/QubesBuilder) for more info):
|
||||
Ensure your system is rpm-based and that you have necessary dependencies installed (see [QubesBuilder](/doc/QubesBuilder/) for more info):
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
sudo yum install git createrepo rpm-build make wget rpmdevtools pandoc
|
||||
|
@ -8,11 +8,11 @@ redirect_from: /wiki/QubesSecurity/
|
||||
Qubes Security
|
||||
==============
|
||||
|
||||
- [Reporting Security Issues in Qubes OS](/wiki/SecurityPage)
|
||||
- [Qubes Security Pack](/wiki/SecurityPack)
|
||||
- [Qubes Security Bulletins](/wiki/SecurityBulletins)
|
||||
- [Qubes Security Goals](/wiki/SecurityGoals)
|
||||
- [On digital signatures and how to verify Qubes keys and downloads](/wiki/VerifyingSignatures)
|
||||
- [Reporting Security Issues in Qubes OS](/doc/SecurityPage/)
|
||||
- [Qubes Security Pack](/doc/SecurityPack/)
|
||||
- [Qubes Security Bulletins](/doc/SecurityBulletins/)
|
||||
- [Qubes Security Goals](/doc/SecurityGoals/)
|
||||
- [On digital signatures and how to verify Qubes keys and downloads](/doc/VerifyingSignatures/)
|
||||
|
||||
- [Qubes Keys](http://keys.qubes-os.org/keys/)
|
||||
|
||||
|
@ -5,7 +5,7 @@ permalink: /doc/QubesService/
|
||||
redirect_from: /wiki/QubesService/
|
||||
---
|
||||
|
||||
Usage documentation is on [qvm-service manual page](/wiki/Dom0Tools/QvmService). There are also described predefined services.
|
||||
Usage documentation is on [qvm-service manual page](/doc/Dom0Tools/QvmService/). There are also described predefined services.
|
||||
|
||||
Under the hood enabled service in VM is signaled by file in /var/run/qubes-service. This can be used to implement almost enable/disable **per-VM** switch controlled by dom0. Adding support for systemd services is pretty simple:
|
||||
|
||||
|
@ -15,7 +15,7 @@ There are several disk images which can be easily extended.
|
||||
|
||||
1048576 MB is the maximum size which can be assigned to a private storage through qubes-manager.
|
||||
|
||||
To grow the private disk image of a AppVM beyond this limit [qubes-grow-private](/wiki/Dom0Tools/QvmGrowPrivate) can be used:
|
||||
To grow the private disk image of a AppVM beyond this limit [qubes-grow-private](/doc/Dom0Tools/QvmGrowPrivate/) can be used:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
qvm-grow-private <vm-name> <size>
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/SecurityBulletins/
|
||||
Qubes Security Bulletins
|
||||
========================
|
||||
|
||||
Qubes Security Bulletins are published through the [Qubes Security Pack](/wiki/SecurityPack).
|
||||
Qubes Security Bulletins are published through the [Qubes Security Pack](/doc/SecurityPack/).
|
||||
|
||||
2010
|
||||
----
|
||||
|
@ -10,7 +10,7 @@ Security-Critical Code in Qubes OS
|
||||
|
||||
Below is a list of security-critical (AKA trusted) code in Qubes OS. A successful attack against any of those might allow to compromise the Qubes OS security. This code can be thought of as of a Trusted Computing Base (TCB) of Qubes OS. The goal of the project has been to minimize the amount of this trusted code to an absolute minimum. The size of the current TCB is of an order of hundreds thousands of lines of C code, which is several orders of magnitude less than in other OSes, such as Windows, Linux or Mac, where it is of orders of tens of millions of lines of C code.
|
||||
|
||||
For more information about the security goals of Qubes OS, see [this page](/wiki/SecurityGoals).
|
||||
For more information about the security goals of Qubes OS, see [this page](/doc/SecurityGoals/).
|
||||
|
||||
Security-Critical Qubes-Specific Components
|
||||
-------------------------------------------
|
||||
@ -22,7 +22,7 @@ Below is a code produced by the Qubes project that is security-critical.
|
||||
- Dom0-side of the sound virtualization code (*pacat-simple-vchan*)
|
||||
- Dom0-side in qrexec-related code (*qrexec\_daemon*)
|
||||
- VM memory manager (*qmemman*) that runs in Dom0
|
||||
- select Qubes RPC servers that run in Dom0: qubes.[ReceiveUpdates?](/wiki/ReceiveUpdates) and qubes.[SyncAppMenus?](/wiki/SyncAppMenus)
|
||||
- select Qubes RPC servers that run in Dom0: qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/) and qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- The qubes.Filecopy RPC server that runs in a VM -- this one is critical because it might allow one VM to compromise another one if user allows file copy operation to be performed between them
|
||||
|
||||
Security-Critical 3rd-Party Components
|
||||
|
@ -20,12 +20,12 @@ Security Guidelines
|
||||
9. [Creating and Using a USBVM](#CreatingandUsingaUSBVM)
|
||||
10. [Dom0 Precautions](#Dom0Precautions)
|
||||
|
||||
The [Qubes introduction](http://theinvisiblethings.blogspot.com/2012/09/introducing-qubes-10.html) makes clear that without some active and responsible participation of the user, no real security is possible. So, for example, Qubes does not automagically make your Firefox (or any other app) running in one of the AppVMs suddenly more secure. It is just as [secure (or insecure)](https://en.wikipedia.org/wiki/Computer_insecurity) as on a normal Linux or Windows OS. But what drastically changes is the context in which your applications are used. [This context](/wiki/QubesArchitecture) is a [responsibility of the user](/wiki/SecurityGoals). But participation requires knowledge. So it is worth stressing some basic items:
|
||||
The [Qubes introduction](http://theinvisiblethings.blogspot.com/2012/09/introducing-qubes-10.html) makes clear that without some active and responsible participation of the user, no real security is possible. So, for example, Qubes does not automagically make your Firefox (or any other app) running in one of the AppVMs suddenly more secure. It is just as [secure (or insecure)](https://en.wikipedia.org/wiki/Computer_insecurity) as on a normal Linux or Windows OS. But what drastically changes is the context in which your applications are used. [This context](/doc/QubesArchitecture/) is a [responsibility of the user](/doc/SecurityGoals/). But participation requires knowledge. So it is worth stressing some basic items:
|
||||
|
||||
Download Verification
|
||||
---------------------
|
||||
|
||||
**Verify the authenticity and integrity of your downloads, [particularly Qubes iso](/wiki/VerifyingSignatures).**
|
||||
**Verify the authenticity and integrity of your downloads, [particularly Qubes iso](/doc/VerifyingSignatures/).**
|
||||
|
||||
Standard program installation
|
||||
|
||||
@ -94,21 +94,21 @@ or use the equivalent items in Qubes Manager, which displays an icon when an upd
|
||||
Handling Untrusted Files
|
||||
------------------------
|
||||
|
||||
When you receive or download any file from an **untrusted source**, do not browse to it with a file manager which has preview enabled. **To disable preview in Nautilus**: Gear (up-right-icon) -\> Preferences -\> Preview (tab) -\> Show thumbnails: Never. Note that this change can be made in a TemplateVM (including the [DispVM template](/wiki/UserDoc/DispVMCustomization)) so that future AppVMs created from this TemplateVM will inherit this feature.
|
||||
When you receive or download any file from an **untrusted source**, do not browse to it with a file manager which has preview enabled. **To disable preview in Nautilus**: Gear (up-right-icon) -\> Preferences -\> Preview (tab) -\> Show thumbnails: Never. Note that this change can be made in a TemplateVM (including the [DispVM template](/doc/UserDoc/DispVMCustomization/)) so that future AppVMs created from this TemplateVM will inherit this feature.
|
||||
|
||||
Also, **do not open it in trusted VMs**. Rather open it in a **disposable VM** right-clicking on it. You may even modify it within the disposable VM and then [copy it to other VM](/wiki/CopyingFiles).
|
||||
Also, **do not open it in trusted VMs**. Rather open it in a **disposable VM** right-clicking on it. You may even modify it within the disposable VM and then [copy it to other VM](/doc/CopyingFiles/).
|
||||
|
||||
Alternatively PDFs may be converted to **trusted PDF** right clicking on them. This converts text to graphic form, so size will increase.
|
||||
|
||||
Anti Evil Maid
|
||||
--------------
|
||||
|
||||
If there is a risk that somebody may **physically attack** your computer when you leave it powered down, or if you use Qubes in **dual boot mode**, then you may want to [install AEM](/wiki/AntiEvilMaid) (Anti Evil Maid). AEM will inform you of any unauthorized modifications to your BIOS or boot partition. If AEM alerts you of an attack it is really bad news because **there is no true fix**. If you are really serious about security you have to buy a new laptop and install Qubes from a trusted ISO. So buying a used laptop is not an option for a security focused one.
|
||||
If there is a risk that somebody may **physically attack** your computer when you leave it powered down, or if you use Qubes in **dual boot mode**, then you may want to [install AEM](/doc/AntiEvilMaid/) (Anti Evil Maid). AEM will inform you of any unauthorized modifications to your BIOS or boot partition. If AEM alerts you of an attack it is really bad news because **there is no true fix**. If you are really serious about security you have to buy a new laptop and install Qubes from a trusted ISO. So buying a used laptop is not an option for a security focused one.
|
||||
|
||||
Reassigning USB Controllers
|
||||
---------------------------
|
||||
|
||||
Before you [assign a USB controller to a VM](/wiki/AssigningDevices) check if any **input devices** are included in that controller.
|
||||
Before you [assign a USB controller to a VM](/doc/AssigningDevices/) check if any **input devices** are included in that controller.
|
||||
|
||||
Assigning USB keyboard will **deprive Dom0 VM of a keyboard**. Since a USB controller assignment survives reboot, you may find yourself **unable to access your system**. Most non-Apple laptops have a PS/2 input for keyboard and mouse, so this problem does not exist.
|
||||
|
||||
@ -131,7 +131,7 @@ To avoid this risk it is possible to prepare and utilize a **USBVM**. However th
|
||||
|
||||
Also avoid it if you do not have a **USB controller free of input devices** or programmable devices. However, as already noted most laptops use PS-2 for keyboards and touchpad devices which do not cause problems.
|
||||
|
||||
An **USBVM** operates like a dedicated temporary parking area, used just to prevent any contact between dom0 and the USB drive. Then, every time you connect an **untrusted USB external drive** to a USB port managed by that USB controller, you need to attach it to the VM that needs it, using qubes manager or [terminal](/wiki/StickMounting). Again, this **works only for disk-like USB devices**. Other devices cannot be currently virtualized. So once you assign their controller to your **USBVM** they'll be no more available.
|
||||
An **USBVM** operates like a dedicated temporary parking area, used just to prevent any contact between dom0 and the USB drive. Then, every time you connect an **untrusted USB external drive** to a USB port managed by that USB controller, you need to attach it to the VM that needs it, using qubes manager or [terminal](/doc/StickMounting/). Again, this **works only for disk-like USB devices**. Other devices cannot be currently virtualized. So once you assign their controller to your **USBVM** they'll be no more available.
|
||||
|
||||
**The process for creating a USBVM** is:
|
||||
|
||||
@ -151,7 +151,7 @@ This will cause your new **USBVM** to automatically start when the system starts
|
||||
Dom0 Precautions
|
||||
----------------
|
||||
|
||||
As explained [here](/wiki/GettingStarted#AppVMsDomainsandTemplateVMs), dom0 should not be used for any user operations. There are several reasons for this:
|
||||
As explained [here](/doc/GettingStarted/#AppVMsDomainsandTemplateVMs), dom0 should not be used for any user operations. There are several reasons for this:
|
||||
|
||||
1. Secure isolation among domUs (i.e., AppVMs, StandaloneVMs, HVMs, etc.) is the *raison d'être* of Qubes. This is the primary reason that we recommend the delegation of all user activities to some number of AppVMs. In the event that any given VM is compromised, only that particular VM is compromised. (TemplateVMs are the exception to this. If a TemplateVM were compromised, then every AppVM based on it might also be compromised. Even in this case, however, the entire system would not necessarily have been compromised, since StandaloneVM(s), HVM(s), and/or multiple TemplateVMs might be in use.) By contrast, if dom0 were ever compromised, the entire system would thereby be compromised.
|
||||
2. Due to the absence of convenience mechanisms in dom0 such as the inter-VM clipboard and inter-VM file copying, it is significantly less convenient to attempt to use dom0 for user operations (e.g., password management) in conjunction with AppVMs than it is to use another dedicated AppVM (e.g., a "vault" VM).
|
||||
|
@ -18,7 +18,7 @@ Introduction
|
||||
|
||||
The **Qubes Security Pack (QSP)** is a Git repository which contains:
|
||||
|
||||
- [All Qubes Security Bulletins (QSBs)](/wiki/SecurityBulletins)
|
||||
- [All Qubes Security Bulletins (QSBs)](/doc/SecurityBulletins/)
|
||||
- [All PGP keys](https://keys.qubes-os.org/keys/)
|
||||
- [Warrant canaries](https://en.wikipedia.org/wiki/Warrant_canary)
|
||||
- Other security-related information and announcements (such as key revocations)
|
||||
@ -215,7 +215,7 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||
|
||||
> **Important!**
|
||||
|
||||
> In order to verify the authenticity of the Qubes Master Signing Key prior to trusting it, you should obtain the Qubes Master Signing Key fingerprint from a trustworthy source (ideally, multiple sources) *other than* this website and visually compare it (them) to the fingerprint displayed in the preceding step, ensuring they match. You can read more about digital signatures and key verification [here](/wiki/VerifyingSignatures).
|
||||
> In order to verify the authenticity of the Qubes Master Signing Key prior to trusting it, you should obtain the Qubes Master Signing Key fingerprint from a trustworthy source (ideally, multiple sources) *other than* this website and visually compare it (them) to the fingerprint displayed in the preceding step, ensuring they match. You can read more about digital signatures and key verification [here](/doc/VerifyingSignatures/).
|
||||
|
||||
1. Verify and read the canaries.
|
||||
|
||||
|
@ -12,7 +12,7 @@ If you believe you have found a security issue affecting Qubes OS, either direct
|
||||
|
||||
We promise to treat any reported issue seriously and, if the investigation confirms it affects Qubes, to patch it within a reasonable time, and also to release a public Security Bulletin that describes the issue, discusses potential impact of the vulnerability, references applicable patches or workarounds, and also credits the discoverer.
|
||||
|
||||
The list of all Qubes Security Advisories published so far can be found [here](/wiki/SecurityBulletins).
|
||||
The list of all Qubes Security Advisories published so far can be found [here](/doc/SecurityBulletins/).
|
||||
|
||||
Qubes Security Team
|
||||
-------------------
|
||||
@ -26,7 +26,7 @@ security at qubes-os dot org
|
||||
Qubes Security Team GPG Key
|
||||
---------------------------
|
||||
|
||||
Please use the [this GPG key](http://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) for encrypting any emails send to this address. Like all the GPG keys used by the Qubes project, this key is signed with the Qubes Master key. Please see [this page](/wiki/VerifyingSignatures) for more information on how to verify the keys.
|
||||
Please use the [this GPG key](http://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) for encrypting any emails send to this address. Like all the GPG keys used by the Qubes project, this key is signed with the Qubes Master key. Please see [this page](/doc/VerifyingSignatures/) for more information on how to verify the keys.
|
||||
|
||||
Members of the Security Team
|
||||
----------------------------
|
||||
|
@ -70,8 +70,8 @@ More information
|
||||
|
||||
This page is just a brief sketch of what Qubes is all about, and many technical details have been omitted here for the sake of presentation.
|
||||
|
||||
- If you're a current or potential Qubes user, you may want to check out the [documentation](/wiki/UserDoc) and the [FAQ](/wiki/UserFaq).
|
||||
- If you're a developer, there's dedicated [documentation](/wiki/SystemDoc) and an [FAQ](/wiki/DevelFaq) just for you.
|
||||
- Ready to give Qubes a try? Head on over to the [download page](/wiki/QubesDownloads).
|
||||
- Once you've installed Qubes, here's a guide on [getting started](/wiki/GettingStarted).
|
||||
- If you're a current or potential Qubes user, you may want to check out the [documentation](/doc/UserDoc/) and the [FAQ](/doc/UserFaq/).
|
||||
- If you're a developer, there's dedicated [documentation](/doc/SystemDoc/) and an [FAQ](/doc/DevelFaq/) just for you.
|
||||
- Ready to give Qubes a try? Head on over to the [download page](/doc/QubesDownloads/).
|
||||
- Once you've installed Qubes, here's a guide on [getting started](/doc/GettingStarted/).
|
||||
|
||||
|
@ -19,7 +19,7 @@ The default template is called **fedora-14-x64** in Qubes R1 and **fedora-20-x64
|
||||
|
||||
The side effect of this mechanism is, of course, that if you install any software in your AppVM, more specifically in any directory other than `/home` or `/usr/local` then it will disappear after the AppVM reboot (as the root filesystem for this AppVM will again be "taken" from the Template VM). **This means one normally install software in the Template VM, not in AppVMs.**
|
||||
|
||||
Unlike VM private filesystems, the template VM root filesystem does not support discard, so deleting files does not free the space in dom0. See [these instructions](/wiki/FedoraTemplateUpgrade#Compactingtemplatesroot.img) to recover space in dom0.
|
||||
Unlike VM private filesystems, the template VM root filesystem does not support discard, so deleting files does not free the space in dom0. See [these instructions](/doc/FedoraTemplateUpgrade/#Compactingtemplatesroot.img) to recover space in dom0.
|
||||
|
||||
Installing (or updating) software in the template VM
|
||||
----------------------------------------------------
|
||||
@ -39,7 +39,7 @@ As the template VM is used for creating filesystems for other AppVMs, where you
|
||||
|
||||
There are several ways to deal with this problem:
|
||||
|
||||
- Only install packages from trusted sources -- e.g. from the pre-configured Fedora repositories. All those packages are signed by Fedora, and as we expect that at least the package's installation scripts are not malicious. This is enforced by default (at the [firewall VM level](/wiki/QubesFirewall)), by not allowing any networking connectivity in the default template VM, except for access to the Fedora repos.
|
||||
- Only install packages from trusted sources -- e.g. from the pre-configured Fedora repositories. All those packages are signed by Fedora, and as we expect that at least the package's installation scripts are not malicious. This is enforced by default (at the [firewall VM level](/doc/QubesFirewall/)), by not allowing any networking connectivity in the default template VM, except for access to the Fedora repos.
|
||||
|
||||
- Use *standalone VMs* (see below) for installation of untrusted software packages.
|
||||
|
||||
@ -49,7 +49,7 @@ Some popular questions:
|
||||
|
||||
- So, why should we actually trust Fedora repos -- it also contains large amount of 3rd party software that might buggy, right?
|
||||
|
||||
As long as template's compromise is considered, it doesn't really matter whether /usr/bin/firefox is buggy and can be exploited, or not. What matters is whether its *installation* scripts (such as %post in the rpm.spec) are benign or not. Template VM should be used only for installation of packages, and nothing more, so it should never get a chance to actually run the /usr/bin/firefox and got infected from it, in case it was compromised. Also, some of your more trusted AppVMs, would have networking restrictions enforced by the [firewall VM](/wiki/QubesFirewall), and again they should not fear this proverbial /usr/bin/firefox being potentially buggy and easy to compromise.
|
||||
As long as template's compromise is considered, it doesn't really matter whether /usr/bin/firefox is buggy and can be exploited, or not. What matters is whether its *installation* scripts (such as %post in the rpm.spec) are benign or not. Template VM should be used only for installation of packages, and nothing more, so it should never get a chance to actually run the /usr/bin/firefox and got infected from it, in case it was compromised. Also, some of your more trusted AppVMs, would have networking restrictions enforced by the [firewall VM](/doc/QubesFirewall/), and again they should not fear this proverbial /usr/bin/firefox being potentially buggy and easy to compromise.
|
||||
|
||||
- But why trusting Fedora?
|
||||
|
||||
|
@ -33,4 +33,4 @@ git clone git://github.com/QubesOS/core-admin.git core-admin
|
||||
|
||||
If you want to contribute to the project, there are two preferred ways:
|
||||
1. Use github [fork & pull requests](https://guides.github.com/activities/forking/)
|
||||
2. [sending a patch](/wiki/DevelFaq#Q:HowdoIsubmitapatch) via the project's mailing list (`git format-patch`).
|
||||
2. [sending a patch](/doc/DevelFaq/#Q:HowdoIsubmitapatch) via the project's mailing list (`git format-patch`).
|
||||
|
@ -10,7 +10,7 @@ How to Mount USB Sticks to AppVMs
|
||||
|
||||
(**Note:** In the present context, the term "USB stick" denotes any [USB mass storage device](https://en.wikipedia.org/wiki/USB_mass_storage_device_class). In addition to smaller flash memory sticks, this includes things like USB external hard drives.)
|
||||
|
||||
Qubes supports the ability to mount a USB stick to any AppVM easily, no matter which VM actually handles the USB controller. (The USB controller may be assigned on the **Devices** tab of an AppVM's settings page in Qubes VM Manager or by using the [qvm-pci command](/wiki/AssigningDevices).)
|
||||
Qubes supports the ability to mount a USB stick to any AppVM easily, no matter which VM actually handles the USB controller. (The USB controller may be assigned on the **Devices** tab of an AppVM's settings page in Qubes VM Manager or by using the [qvm-pci command](/doc/AssigningDevices/).)
|
||||
|
||||
As of Qubes R2 Beta 3, USB stick mounting has been integrated into the Qubes VM Manger GUI. Simply insert your USB stick, right-click the desired AppVM in the Qubes VM Manager list, click **Attach/detach block devices**, and select your desired action and device.
|
||||
|
||||
|
46
SystemDoc.md
46
SystemDoc.md
@ -10,39 +10,39 @@ System Documentation for Developers
|
||||
|
||||
1. Fundamentals:
|
||||
1. Qubes OS Architecture v0.3 [(pdf)](http://files.qubes-os.org/files/doc/arch-spec-0.3.pdf) (The original 2009 document that started this all...)
|
||||
2. [Security-critical elements of Qubes OS](/wiki/SecurityCriticalCode)
|
||||
2. [Security-critical elements of Qubes OS](/doc/SecurityCriticalCode/)
|
||||
3. Qubes RPC framework (qrexec):
|
||||
1. [The Qubes RPC/Service API](/wiki/Qrexec)
|
||||
1. [The Qubes RPC/Service API](/doc/Qrexec/)
|
||||
2. Example for writing a qrexec service in Qubes OS [blog post](http://theinvisiblethings.blogspot.com/2013/02/converting-untrusted-pdfs-into-trusted.html)
|
||||
3. [qrexec implementation in Qubes R2](/wiki/Qrexec2Implementation)
|
||||
4. [qrexec implementation in Qubes R3/Odyssey](/wiki/Qrexec3Implementation)
|
||||
3. [qrexec implementation in Qubes R2](/doc/Qrexec2Implementation/)
|
||||
4. [qrexec implementation in Qubes R3/Odyssey](/doc/Qrexec3Implementation/)
|
||||
|
||||
4. [Qubes GUI virtualization protocol](/wiki/GUIdocs)
|
||||
5. [Networking in Qubes](/wiki/QubesNet)
|
||||
6. [Implementation of template sharing and updating](/wiki/TemplateImplementation)
|
||||
4. [Qubes GUI virtualization protocol](/doc/GUIdocs/)
|
||||
5. [Networking in Qubes](/doc/QubesNet/)
|
||||
6. [Implementation of template sharing and updating](/doc/TemplateImplementation/)
|
||||
|
||||
2. Services:
|
||||
1. [Inter-domain file copying](/wiki/Qfilecopy)
|
||||
2. [Dynamic memory management in Qubes](/wiki/Qmemman)
|
||||
3. [Implementation of DisposableVMs](/wiki/DVMimpl)
|
||||
1. [Inter-domain file copying](/doc/Qfilecopy/)
|
||||
2. [Dynamic memory management in Qubes](/doc/Qmemman/)
|
||||
3. [Implementation of DisposableVMs](/doc/DVMimpl/)
|
||||
4. [Article about disposable VMs](http://theinvisiblethings.blogspot.com/2010/06/disposable-vms.html)
|
||||
5. [Dom0 secure update mechanism](/wiki/Dom0SecureUpdates)
|
||||
6. [VM secure update mechanism?](/wiki/VMSecureUpdates)
|
||||
5. [Dom0 secure update mechanism](/doc/Dom0SecureUpdates/)
|
||||
6. [VM secure update mechanism?](/doc/VMSecureUpdates/)
|
||||
|
||||
3. Debugging:
|
||||
1. [Profiling python code](/wiki/Profiling)
|
||||
2. [Test environment in separate machine for automatic tests](/wiki/TestBench)
|
||||
1. [Profiling python code](/doc/Profiling/)
|
||||
2. [Test environment in separate machine for automatic tests](/doc/TestBench/)
|
||||
3. [Automated tests](/doc/AutomatedTests/)
|
||||
3. [VM-dom0 internal configuration interface](/wiki/SystemDoc/VMInterface)
|
||||
4. [Debugging Windows VMs](/wiki/WindowsDebugging)
|
||||
3. [VM-dom0 internal configuration interface](/doc/SystemDoc/VMInterface/)
|
||||
4. [Debugging Windows VMs](/doc/WindowsDebugging/)
|
||||
|
||||
4. Building:
|
||||
1. [Building Qubes](/wiki/QubesBuilder)
|
||||
2. [Development Workflow](/wiki/DevelopmentWorkflow)
|
||||
3. [KDE Dom0 packages for Qubes](/wiki/KdeDom0)
|
||||
4. [How to build Qubes installation ISO](/wiki/InstallationIsoBuilding)
|
||||
5. [Building USB passthrough support (experimental)](/wiki/USBVM)
|
||||
6. [Building a TemplateVM based on a new OS (ArchLinux example)](/wiki/BuildingNonFedoraTemplate)
|
||||
7. [Building the Archlinux Template](/wiki/BuildingArchlinuxTemplate)
|
||||
1. [Building Qubes](/doc/QubesBuilder/)
|
||||
2. [Development Workflow](/doc/DevelopmentWorkflow/)
|
||||
3. [KDE Dom0 packages for Qubes](/doc/KdeDom0/)
|
||||
4. [How to build Qubes installation ISO](/doc/InstallationIsoBuilding/)
|
||||
5. [Building USB passthrough support (experimental)](/doc/USBVM/)
|
||||
6. [Building a TemplateVM based on a new OS (ArchLinux example)](/doc/BuildingNonFedoraTemplate/)
|
||||
7. [Building the Archlinux Template](/doc/BuildingArchlinuxTemplate/)
|
||||
|
||||
|
||||
|
@ -21,7 +21,7 @@ Recommended
|
||||
|
||||
- Fast SSD (strongly recommended)
|
||||
- Intel GPU (strongly preferred)
|
||||
- Nvidia GPUs may require significant [troubleshooting](/wiki/InstallNvidiaDriver).
|
||||
- Nvidia GPUs may require significant [troubleshooting](/doc/InstallNvidiaDriver/).
|
||||
- ATI GPUs have not been formally tested (but see the [Hardware Compatibility List](/hcl/)).
|
||||
- Intel VT-x or AMD-v technology (required for running HVM domains, such as Windows-based AppVMs)
|
||||
- Intel VT-d or AMD IOMMU technology (required for effective isolation of network VMs)
|
||||
|
@ -10,7 +10,7 @@ Test bench for Dom0
|
||||
|
||||
This guide shows how to set up simple test bench that automatically test your code you're about to push. It is written especially for `core3` branch of `core-admin.git` repo, but some ideas are universal.
|
||||
|
||||
We will set up a spare machine (bare metal, not a virtual) that will be hosting our experimental Dom0. We will communicate with it via Ethernet and SSH. This tutorial assumes you are familiar with [QubesBuilder](/wiki/QubesBuilder) and you have it set up and running flawlessly.
|
||||
We will set up a spare machine (bare metal, not a virtual) that will be hosting our experimental Dom0. We will communicate with it via Ethernet and SSH. This tutorial assumes you are familiar with [QubesBuilder](/doc/QubesBuilder/) and you have it set up and running flawlessly.
|
||||
|
||||
Setting up the machine
|
||||
----------------------
|
||||
|
@ -5,5 +5,5 @@ permalink: /doc/TroubleShooting/
|
||||
redirect_from: /wiki/TroubleShooting/
|
||||
---
|
||||
|
||||
- [Home directory is out of disk space error](/wiki/OutOfmemory)
|
||||
- [Home directory is out of disk space error](/doc/OutOfmemory/)
|
||||
|
||||
|
@ -8,7 +8,7 @@ redirect_from: /wiki/UpgradeToR2B2/
|
||||
Upgrading Qubes R1 to R2 (beta2)
|
||||
================================
|
||||
|
||||
Existing users of Qubes R1 (but not R1 betas!) can upgrade their systems to the latest R2 beta release by following the procedure below. As usual, it is advisable to backup the system before proceeding with the upgrade. While it is possible to upgrade the system **it is strongly recommended to reinstall it**. You will preserve all your data and settings thanks to [backup and restore tools](/wiki/BackupRestore).
|
||||
Existing users of Qubes R1 (but not R1 betas!) can upgrade their systems to the latest R2 beta release by following the procedure below. As usual, it is advisable to backup the system before proceeding with the upgrade. While it is possible to upgrade the system **it is strongly recommended to reinstall it**. You will preserve all your data and settings thanks to [backup and restore tools](/doc/BackupRestore/).
|
||||
|
||||
Upgrade all Template and Standalone VM(s)
|
||||
-----------------------------------------
|
||||
|
@ -8,16 +8,16 @@ redirect_from: /wiki/UpgradeToR2B3/
|
||||
Upgrading Qubes R2 Beta 2 to R2 Beta 3
|
||||
======================================
|
||||
|
||||
Current Qubes R2 Beta 2 (R2B2) systems can be upgraded in-place to the latest R2 Beta 3 (R2B3) release by following the procedure below. However, upgrading in-place is riskier than performing a clean installation, since there are more things which can go wrong. For this reason, **we strongly recommended that users perform a [clean installation](/wiki/InstallationGuideR2B3) of Qubes R2 Beta 3**.
|
||||
Current Qubes R2 Beta 2 (R2B2) systems can be upgraded in-place to the latest R2 Beta 3 (R2B3) release by following the procedure below. However, upgrading in-place is riskier than performing a clean installation, since there are more things which can go wrong. For this reason, **we strongly recommended that users perform a [clean installation](/doc/InstallationGuideR2B3/) of Qubes R2 Beta 3**.
|
||||
|
||||
**Before attempting either an in-place upgrade or a clean installation, we strongly recommend that users back up the system by using the built-in [backup tool](/wiki/BackupRestore).**
|
||||
**Before attempting either an in-place upgrade or a clean installation, we strongly recommend that users back up the system by using the built-in [backup tool](/doc/BackupRestore/).**
|
||||
|
||||
Experienced users may be comfortable accepting the risks of upgrading in-place. Such users may wish to first attempt an in-place upgrade. If nothing goes wrong, then some time and effort will have been saved. If something does go wrong, then the user can simply perform a clean installation, and no significant loss will have occurred (as long as the user [backed up](/wiki/BackupRestore) correctly!).
|
||||
Experienced users may be comfortable accepting the risks of upgrading in-place. Such users may wish to first attempt an in-place upgrade. If nothing goes wrong, then some time and effort will have been saved. If something does go wrong, then the user can simply perform a clean installation, and no significant loss will have occurred (as long as the user [backed up](/doc/BackupRestore/) correctly!).
|
||||
|
||||
Upgrade all Template and Standalone VM(s)
|
||||
-----------------------------------------
|
||||
|
||||
By default, in Qubes R2, there is only one Template VM, however users are free to create more Template VMs for special purposes, as well as Standalone VMs. More information on using multiple Template VMs, as well as Standalone VMs, can be found [here](/wiki/SoftwareUpdateVM). The steps described in this section should be repeated in *all* user's Template and Standalone VMs.
|
||||
By default, in Qubes R2, there is only one Template VM, however users are free to create more Template VMs for special purposes, as well as Standalone VMs. More information on using multiple Template VMs, as well as Standalone VMs, can be found [here](/doc/SoftwareUpdateVM/). The steps described in this section should be repeated in *all* user's Template and Standalone VMs.
|
||||
|
||||
It is critical to complete this step **before** proceeding to dom0 upgrade. Otherwise you will most likely ends with unusable system.
|
||||
|
||||
|
@ -10,18 +10,18 @@ Upgrading Qubes R2 Beta 3 to R2 rc1
|
||||
|
||||
Current Qubes R2 Beta 3 (R2B3) systems can be upgraded in-place to the latest R2 rc1 (R2rc1) release by following the procedure below.
|
||||
|
||||
**Before attempting either an in-place upgrade or a clean installation, we strongly recommend that users back up the system by using the built-in [backup tool](/wiki/BackupRestore).**
|
||||
**Before attempting either an in-place upgrade or a clean installation, we strongly recommend that users back up the system by using the built-in [backup tool](/doc/BackupRestore/).**
|
||||
|
||||
Upgrade Template and Standalone VM(s)
|
||||
-------------------------------------
|
||||
|
||||
- Qubes R2 rc1 comes with new template based on Fedora 20. You can upgrade existing template according to procedure described [here](/wiki/FedoraTemplateUpgrade).
|
||||
- Qubes R2 rc1 comes with new template based on Fedora 20. You can upgrade existing template according to procedure described [here](/doc/FedoraTemplateUpgrade/).
|
||||
|
||||
- **It also possible to download a new Fedora 20-based template from our repositories**. To do this please first upgrade the Dom0 distro as described in the section below.
|
||||
|
||||
While technically it is possible to use old Fedora 18 template on R2 rc1, it is strongly recommended to upgrade all the Template VMs and Standalone VMs, because Fedora 18 no longer receive security updates.
|
||||
|
||||
By default, in Qubes R2, there is only one Template VM, however users are free to create more Template VMs for special purposes, as well as Standalone VMs. If more than one template and/or Standalone VMs are used, then it is recommended to upgrade/replace all of them. More information on using multiple Template VMs, as well as Standalone VMs, can be found [here](/wiki/SoftwareUpdateVM).
|
||||
By default, in Qubes R2, there is only one Template VM, however users are free to create more Template VMs for special purposes, as well as Standalone VMs. If more than one template and/or Standalone VMs are used, then it is recommended to upgrade/replace all of them. More information on using multiple Template VMs, as well as Standalone VMs, can be found [here](/doc/SoftwareUpdateVM/).
|
||||
|
||||
Upgrading dom0
|
||||
--------------
|
||||
|
88
UserDoc.md
88
UserDoc.md
@ -9,38 +9,38 @@ Qubes User Documentation
|
||||
========================
|
||||
|
||||
1. **Basic Reading**
|
||||
1. [Getting Started](/wiki/GettingStarted/)
|
||||
2. [Security Guidelines](/wiki/SecurityGuidelines/)
|
||||
3. [Glossary of Qubes Terminology](/wiki/Glossary/)
|
||||
1. [Getting Started](/doc/GettingStarted/)
|
||||
2. [Security Guidelines](/doc/SecurityGuidelines/)
|
||||
3. [Glossary of Qubes Terminology](/doc/Glossary/)
|
||||
|
||||
2. **Dom0**
|
||||
1. [Dom0 Command-Line Tools](/wiki/DomZeroTools/)
|
||||
2. [Updating Software in dom0](/wiki/SoftwareUpdateDom0/)
|
||||
3. [Copying Files to and from dom0](/wiki/CopyToDomZero/)
|
||||
4. [Backup, Restoration, and Migration](/wiki/BackupRestore/)
|
||||
5. [Qubes Policy for InterVM Services](/wiki/Qrexec/#qubes-services-rpc-policy)
|
||||
1. [Dom0 Command-Line Tools](/doc/DomZeroTools/)
|
||||
2. [Updating Software in dom0](/doc/SoftwareUpdateDom0/)
|
||||
3. [Copying Files to and from dom0](/doc/CopyToDomZero/)
|
||||
4. [Backup, Restoration, and Migration](/doc/BackupRestore/)
|
||||
5. [Qubes Policy for InterVM Services](/doc/Qrexec/#qubes-services-rpc-policy)
|
||||
6. Advanced Topics
|
||||
1. [Installing Anti Evil Maid](/wiki/AntiEvilMaid/)
|
||||
2. [XFCE Installation in dom0](/wiki/UserDoc/XFCE/)
|
||||
3. [Installing ZFS in Qubes](/wiki/ZFS/)
|
||||
1. [Installing Anti Evil Maid](/doc/AntiEvilMaid/)
|
||||
2. [XFCE Installation in dom0](/doc/UserDoc/XFCE/)
|
||||
3. [Installing ZFS in Qubes](/doc/ZFS/)
|
||||
|
||||
3. **DomUs**
|
||||
1. [DomU Command-Line Tools](/wiki/VmTools/)
|
||||
1. [DomU Command-Line Tools](/doc/VmTools/)
|
||||
2. **Intra-VM Actions**
|
||||
1. [Enabling Fullscreen Mode](/wiki/FullScreenMode/)
|
||||
2. [Managing Application Shortcuts](/wiki/ManagingAppVmShortcuts/)
|
||||
1. [Enabling Fullscreen Mode](/doc/FullScreenMode/)
|
||||
2. [Managing Application Shortcuts](/doc/ManagingAppVmShortcuts/)
|
||||
|
||||
3. **Inter-VM Actions**
|
||||
1. [Copying and Pasting Text Between Domains](/wiki/CopyPaste/)
|
||||
2. [Copying and Moving Files Between Domains](/wiki/CopyingFiles/)
|
||||
3. [Using GPG more securely in Qubes: Split GPG tutorial](/wiki/UserDoc/SplitGpg/)
|
||||
1. [Copying and Pasting Text Between Domains](/doc/CopyPaste/)
|
||||
2. [Copying and Moving Files Between Domains](/doc/CopyingFiles/)
|
||||
3. [Using GPG more securely in Qubes: Split GPG tutorial](/doc/UserDoc/SplitGpg/)
|
||||
|
||||
4. **NetVMs and ProxyVMs**
|
||||
1. [Understanding Qubes Firewall](/wiki/QubesFirewall/)
|
||||
2. [Understanding and Preventing Data Leaks](/wiki/DataLeaks/)
|
||||
3. [How to Install a Transparent Tor ProxyVM (TorVM)](/wiki/UserDoc/TorVM/)
|
||||
4. [How to set up a ProxyVM as a VPN Gateway](/wiki/VPN/)
|
||||
5. [Adding Bridge Support to the NetVM (EXPERIMENTAL)](/wiki/NetworkBridgeSupport/)
|
||||
1. [Understanding Qubes Firewall](/doc/QubesFirewall/)
|
||||
2. [Understanding and Preventing Data Leaks](/doc/DataLeaks/)
|
||||
3. [How to Install a Transparent Tor ProxyVM (TorVM)](/doc/UserDoc/TorVM/)
|
||||
4. [How to set up a ProxyVM as a VPN Gateway](/doc/VPN/)
|
||||
5. [Adding Bridge Support to the NetVM (EXPERIMENTAL)](/doc/NetworkBridgeSupport/)
|
||||
6. External Links
|
||||
1. [Creating Custom NetVMs and ProxyVMs](http://theinvisiblethings.blogspot.com/2011/09/playing-with-qubes-networking-for-fun.html)
|
||||
2. [How to run TorBrowser using external tor proxy (from TorVM)](https://groups.google.com/group/qubes-devel/msg/34f67194d3422bfa)
|
||||
@ -48,46 +48,46 @@ Qubes User Documentation
|
||||
4. [HTTP filtering proxy in Qubes firewall VM](https://groups.google.com/group/qubes-devel/browse_thread/thread/5252bc3f6ed4b43e/d881deb5afaa2a6c#39c95d63fccca12b)
|
||||
|
||||
5. **[TemplateVMs](/doc/Templates/)**
|
||||
1. [Updating and Installing Software in VMs](/wiki/SoftwareUpdateVM/)
|
||||
2. [Templates: Fedora - minimal](/wiki/Templates/FedoraMinimal/)
|
||||
3. [Templates: Debian](/wiki/Templates/Debian/)
|
||||
1. [Updating and Installing Software in VMs](/doc/SoftwareUpdateVM/)
|
||||
2. [Templates: Fedora - minimal](/doc/Templates/FedoraMinimal/)
|
||||
3. [Templates: Debian](/doc/Templates/Debian/)
|
||||
4. External Links
|
||||
1. [Extending \`root.img\` Size](https://groups.google.com/group/qubes-devel/msg/9d1ac581236ca9b4)
|
||||
|
||||
6. **DispVMs**
|
||||
1. [Disposable VMs](/wiki/DisposableVms/)
|
||||
2. [DispVM Customization](/wiki/UserDoc/DispVMCustomization/)
|
||||
1. [Disposable VMs](/doc/DisposableVms/)
|
||||
2. [DispVM Customization](/doc/UserDoc/DispVMCustomization/)
|
||||
|
||||
7. **HVMs**
|
||||
1. [Resizing AppVM and HVM Disk Images](/wiki/ResizeDiskImage/)
|
||||
2. [Tips for Using Linux in an HVM](/wiki/LinuxHVMTips/)
|
||||
3. [Creating and Using HVM and Windows Domains (Qubes R2 Only)](/wiki/HvmCreate/)
|
||||
1. [Resizing AppVM and HVM Disk Images](/doc/ResizeDiskImage/)
|
||||
2. [Tips for Using Linux in an HVM](/doc/LinuxHVMTips/)
|
||||
3. [Creating and Using HVM and Windows Domains (Qubes R2 Only)](/doc/HvmCreate/)
|
||||
4. External Links
|
||||
1. [Creating Whonix HVMs in Qubes](https://www.whonix.org/wiki/Qubes)
|
||||
2. [Creating NetBSD VM](https://groups.google.com/group/qubes-devel/msg/4015c8900a813985)
|
||||
|
||||
8. **Windows VMs**
|
||||
1. [Installing and Using Windows-based AppVMs (Qubes R2 Beta 3 and Later)](/wiki/WindowsAppVms/)
|
||||
2. [Advanced options and troubleshooting of Qubes Tools for Windows](/wiki/WindowsTools/)
|
||||
1. [Installing and Using Windows-based AppVMs (Qubes R2 Beta 3 and Later)](/doc/WindowsAppVms/)
|
||||
2. [Advanced options and troubleshooting of Qubes Tools for Windows](/doc/WindowsTools/)
|
||||
|
||||
9. Advanced Topics
|
||||
1. [Configuration files](/wiki/UserDoc/ConfigFiles/)
|
||||
2. [Qubes service framework](/wiki/QubesService/)
|
||||
3. [Note regarding password-less root access in VM](/wiki/VMSudo/)
|
||||
1. [Configuration files](/doc/UserDoc/ConfigFiles/)
|
||||
2. [Qubes service framework](/doc/QubesService/)
|
||||
3. [Note regarding password-less root access in VM](/doc/VMSudo/)
|
||||
|
||||
4. **Applications**
|
||||
1. [Languages](/wiki/LanguageLocalization/)
|
||||
1. [Languages](/doc/LanguageLocalization/)
|
||||
|
||||
5. **Hardware**
|
||||
1. [How to Mount USB Sticks to AppVMs](/wiki/StickMounting/)
|
||||
2. [Where are my external storage devices mounted?](/wiki/ExternalDeviceMountPoint/)
|
||||
3. [Assigning PCI Devices to AppVMs](/wiki/AssigningDevices/)
|
||||
4. [Enabling TRIM for SSD disks](/wiki/DiskTRIM/)
|
||||
5. [Configuring a Network Printer](/wiki/NetworkPrinter/)
|
||||
6. [Using External Audio Devices](/wiki/ExternalAudio/)
|
||||
1. [How to Mount USB Sticks to AppVMs](/doc/StickMounting/)
|
||||
2. [Where are my external storage devices mounted?](/doc/ExternalDeviceMountPoint/)
|
||||
3. [Assigning PCI Devices to AppVMs](/doc/AssigningDevices/)
|
||||
4. [Enabling TRIM for SSD disks](/doc/DiskTRIM/)
|
||||
5. [Configuring a Network Printer](/doc/NetworkPrinter/)
|
||||
6. [Using External Audio Devices](/doc/ExternalAudio/)
|
||||
7. Vendor-specific
|
||||
1. [How to install an Nvidia driver in dom0](/wiki/InstallNvidiaDriver/)
|
||||
2. [Getting Sony Vaio Z laptop to work with Qubes](/wiki/SonyVaioTinkering/)
|
||||
1. [How to install an Nvidia driver in dom0](/doc/InstallNvidiaDriver/)
|
||||
2. [Getting Sony Vaio Z laptop to work with Qubes](/doc/SonyVaioTinkering/)
|
||||
|
||||
8. External Links
|
||||
1. [Installing on system with new AMD GPU (missing firmware problem)](https://groups.google.com/group/qubes-devel/browse_thread/thread/e27a57b0eda62f76)
|
||||
|
@ -122,7 +122,7 @@ No. Qubes does not pretend to be a multi-user system. Qubes assumes that the use
|
||||
Installation & Hardware Compatibility
|
||||
-------------------------------------
|
||||
|
||||
(See also: [System Requirements](/wiki/SystemRequirements) and [Hardware Compatibility List](/hcl/).)
|
||||
(See also: [System Requirements](/doc/SystemRequirements/) and [Hardware Compatibility List](/hcl/).)
|
||||
|
||||
### How much disk space does each AppVM require?
|
||||
|
||||
@ -175,7 +175,7 @@ In your TemplateVMs, open a terminal and run `sudo yum upgrade`.
|
||||
|
||||
### How do I run a Windows HVM in non-seamless mode (i.e., as a single window)?
|
||||
|
||||
Enable "debug mode" in the AppVM's settings, either by checking the box labelled "Run in debug mode" in the Qubes VM Manager AppVM settings menu or by running the [qvm-prefs command](/wiki/Dom0Tools/QvmPrefs).)
|
||||
Enable "debug mode" in the AppVM's settings, either by checking the box labelled "Run in debug mode" in the Qubes VM Manager AppVM settings menu or by running the [qvm-prefs command](/doc/Dom0Tools/QvmPrefs/).)
|
||||
|
||||
### I assigned a PCI device to an AppVM, then unassigned it/shut down the AppVM. Why isn't the device available in dom0?
|
||||
|
||||
|
@ -91,7 +91,7 @@ Below is a complete list of configuration made according to the above statement,
|
||||
|
||||
- NetworkManager configuration from normal user (nm-applet)
|
||||
- updates installation (gpk-update-viewer)
|
||||
- user can use pkexec just like sudo Note: above is needed mostly because Qubes user GUI session isn't treated by [PolicyKit?](/wiki/PolicyKit)/logind as "local" session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.
|
||||
- user can use pkexec just like sudo Note: above is needed mostly because Qubes user GUI session isn't treated by [PolicyKit?](/doc/PolicyKit/)/logind as "local" session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.
|
||||
|
||||
3. Empty root password
|
||||
- used for access to 'root' account from text console (xl console) - the only way to access the VM when GUI isn't working
|
||||
@ -124,7 +124,7 @@ While ITL still supports the statement above, some Qubes users may want to enabl
|
||||
user ALL=(ALL) ALL
|
||||
{% endhighlight %}
|
||||
|
||||
- Disable [PolKit?](/wiki/PolKit)'s default-allow behavior:
|
||||
- Disable [PolKit?](/doc/PolKit/)'s default-allow behavior:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
[root@fedora-20-x64]# rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules
|
||||
|
4
VPN.md
4
VPN.md
@ -14,7 +14,7 @@ The Qubes specific part is choose the right VM for the VPN client:
|
||||
|
||||
### NetVM
|
||||
|
||||
The simplest case if you set up a VPN connection using the Network Manager inside your NetVM. Because the [NetworkManager?](/wiki/NetworkManager) already started you are ready to set up your VPN connection. However this has some disadvantages:
|
||||
The simplest case if you set up a VPN connection using the Network Manager inside your NetVM. Because the [NetworkManager?](/doc/NetworkManager/) already started you are ready to set up your VPN connection. However this has some disadvantages:
|
||||
|
||||
- You have to place (and probably save) Your VPN credentials inside the NetVM wich is directly connected to the outside world
|
||||
- All your AppVMs wich are connected to the NetVM will be connected to the VPN (by default)
|
||||
@ -25,7 +25,7 @@ While the Network Manager is not started here (for a good reason) You can config
|
||||
|
||||
### ProxyVM
|
||||
|
||||
**WARNING:** *Currently the [NetworkManager?](/wiki/NetworkManager) is not working in ProxyVMs as expected. Actually it will mess up the routing table and because of that your packets may not be routed to the VPN tunnel. - This surely occurs if your VPN wants to be the default gateway.*
|
||||
**WARNING:** *Currently the [NetworkManager?](/doc/NetworkManager/) is not working in ProxyVMs as expected. Actually it will mess up the routing table and because of that your packets may not be routed to the VPN tunnel. - This surely occurs if your VPN wants to be the default gateway.*
|
||||
|
||||
One of the best thing in Qubes that you can use a special type of VMs called ProxyVM (or FirewallVM). The special thing is that your AppVMs see this as a NetVM, and the NetVMs see it as an AppVM. Because of that You can place a ProxyVM between your AppVMs and Your NetVM. This is how the default firewall VM is working.
|
||||
|
||||
|
@ -56,7 +56,7 @@ pub 4096R/36879494 2010-04-01
|
||||
uid Qubes Master Signing Key
|
||||
{% endhighlight %}
|
||||
|
||||
There should also be a copy of this key at the project's main website, in the [Qubes Security Pack](/wiki/SecurityPack), and in the archives of the project's [developer](https://groups.google.com/forum/#!msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ) and [user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ) mailing lists.
|
||||
There should also be a copy of this key at the project's main website, in the [Qubes Security Pack](/doc/SecurityPack/), and in the archives of the project's [developer](https://groups.google.com/forum/#!msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ) and [user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ) mailing lists.
|
||||
|
||||
Once you have obtained the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)), you should verify the fingerprint of this key very carefully by obtaining copies of the fingerprint from trustworthy independent sources and comparing them to the downloaded key's fingerprint to ensure they match. Then set its trust level to "ultimate" (oh, well), so that it can be used to automatically verify all the keys signed by the Qubes Master Signing Key:
|
||||
|
||||
@ -117,7 +117,7 @@ gpg: Total number processed: 1
|
||||
gpg: imported: 1 (RSA: 1)
|
||||
{% endhighlight %}
|
||||
|
||||
You can also download all the currently used developers' signing keys and current and older release signing keys (and also a copy of the Qubes Master Signing Key) from the [keys directory on our server](https://keys.qubes-os.org/keys/) and from the [Qubes Security Pack](/wiki/SecurityPack).
|
||||
You can also download all the currently used developers' signing keys and current and older release signing keys (and also a copy of the Qubes Master Signing Key) from the [keys directory on our server](https://keys.qubes-os.org/keys/) and from the [Qubes Security Pack](/doc/SecurityPack/).
|
||||
|
||||
The developer signing keys are set to be valid for 1 year only, while the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)) has no expiration date. This latter key was generated and is kept only within a dedicated, air-gapped "vault" machine, and the private portion will (hopefully) never leave this isolated machine.
|
||||
|
||||
|
@ -7,8 +7,8 @@ redirect_from: /wiki/VmTools/
|
||||
|
||||
VM tools:
|
||||
|
||||
- [qvm-copy-to-vm](/wiki/VmTools/QvmCopyToVm)
|
||||
- [qvm-open-in-dvm](/wiki/VmTools/QvmOpenInDvm)
|
||||
- [qvm-open-in-vm](/wiki/VmTools/QvmOpenInVm)
|
||||
- [qvm-run](/wiki/VmTools/QvmRun)
|
||||
- [qvm-copy-to-vm](/doc/VmTools/QvmCopyToVm/)
|
||||
- [qvm-open-in-dvm](/doc/VmTools/QvmOpenInDvm/)
|
||||
- [qvm-open-in-vm](/doc/VmTools/QvmOpenInVm/)
|
||||
- [qvm-run](/doc/VmTools/QvmRun/)
|
||||
|
||||
|
16
WikiStart.md
16
WikiStart.md
@ -12,18 +12,18 @@ redirect_from:
|
||||
Welcome to the Qubes OS Project
|
||||
===============================
|
||||
|
||||
[](/wiki/QubesArchitecture)
|
||||
[](/doc/QubesArchitecture/)
|
||||
|
||||
Qubes is an open-source operating system designed to provide strong security for desktop computing using **Security by Compartmentalization** approach. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers. Qubes **Release 1** was released in September 2012 and **Release 2** in September 2014. Qubes also supports Windows-based AppVMs beginning with Release 2 (currently in "Beta"). Qubes **Release 3** is coming soon and will introduce **Hypervisor Abstraction Layer (HAL)**, allowing easy porting to alternative virtualization systems.
|
||||
|
||||
- [A Simple Introduction to Qubes](/wiki/SimpleIntro)
|
||||
- [Getting Started](/wiki/GettingStarted)
|
||||
- [A Simple Introduction to Qubes](/doc/SimpleIntro/)
|
||||
- [Getting Started](/doc/GettingStarted/)
|
||||
- [Qubes OS Tutorial slides by ITL](http://www.invisiblethingslab.com/resources/2014/LinuxCon_2014_Qubes_Tutorial.pdf) (LinuxCon October 2014)
|
||||
- [Screenshots](/wiki/QubesScreenshots)
|
||||
- [Architecture Overview](/wiki/QubesArchitecture), and also the more recent: [Why Qubes OS is more than a bunch of VMs?](http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- [Security](/wiki/QubesSecurity)
|
||||
- [FAQ](/wiki/UserFaq)
|
||||
- [User Documentation](/wiki/UserDoc)
|
||||
- [Screenshots](/doc/QubesScreenshots/)
|
||||
- [Architecture Overview](/doc/QubesArchitecture/), and also the more recent: [Why Qubes OS is more than a bunch of VMs?](http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- [Security](/doc/QubesSecurity/)
|
||||
- [FAQ](/doc/UserFaq/)
|
||||
- [User Documentation](/doc/UserDoc/)
|
||||
- [How is Qubes OS different from...?](http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-different-from.html)
|
||||
- Beyond Qubes R2 -- the [Qubes Odyssey Framework](http://theinvisiblethings.blogspot.com/2013/03/introducing-qubes-odyssey-framework.html)
|
||||
|
||||
|
@ -13,8 +13,8 @@ Qubes provides special support for running Windows-based AppVMs. This requires t
|
||||
Qubes support tools for Windows is a set of programs and drivers that provide integration of Windows AppVMs with the rest of the Qubes system. Currently the following features are available for Windows VMs after installation of those tools:
|
||||
|
||||
- Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop (available on Qubes R2 Beta 3 and later)
|
||||
- Support for [secure clipboard copy/paste](/wiki/CopyPaste) between the Windows VM and other AppVMs
|
||||
- Support for [secure file exchange](/wiki/CopyingFiles) between the Windows VM and other AppVMs
|
||||
- Support for [secure clipboard copy/paste](/doc/CopyPaste/) between the Windows VM and other AppVMs
|
||||
- Support for [secure file exchange](/doc/CopyingFiles/) between the Windows VM and other AppVMs
|
||||
- Support for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM)
|
||||
- Xen PV drivers for Windows that increase performance compared to qemu emulated devices
|
||||
|
||||
@ -25,7 +25,7 @@ NOTE: Currently only 64-bit versions of Windows 7 are support by Qubes Windows T
|
||||
Installing Windows OS in a Qubes VM
|
||||
-----------------------------------
|
||||
|
||||
Please refer to [this page](/wiki/HvmCreate) for instructions on how to install Windows in a Qubes VM.
|
||||
Please refer to [this page](/doc/HvmCreate/) for instructions on how to install Windows in a Qubes VM.
|
||||
|
||||
Installing Qubes support tools in Windows 7 VMs
|
||||
-----------------------------------------------
|
||||
@ -101,7 +101,7 @@ Qubes allows HVM VMs to share a common root filesystem from a select Template VM
|
||||
qvm-create --hvm-template win7-x64-template -l green
|
||||
{% endhighlight %}
|
||||
|
||||
... and install Windows OS (or other OS) into this template the same way as you would install it into a normal HVM -- please see [this page](/wiki/HvmCreate) instructions. However, it would make lots of sense to store the `C:\Users` directory on the 2nd disk which is automatically exposed by Qubes to all HVMs. This 2nd disk is backed by the `private.img` file in the AppVMs' and is not reset upon AppVMs reboot, so the user's directories and profiles would survive the AppVMs reboot, unlike the "root" filesystem which will be reverted to the "golden image" from the Template VM automatically. To facilitate such separation of user profiles, Qubes Windows Tools provide an option to automatically move `C:\Users` directory to the 2nd disk backed by `private.img`. It's a selectable feature of the installer, enabled by default. If that feature is selected during installation, completion of the process requires two reboots:
|
||||
... and install Windows OS (or other OS) into this template the same way as you would install it into a normal HVM -- please see [this page](/doc/HvmCreate/) instructions. However, it would make lots of sense to store the `C:\Users` directory on the 2nd disk which is automatically exposed by Qubes to all HVMs. This 2nd disk is backed by the `private.img` file in the AppVMs' and is not reset upon AppVMs reboot, so the user's directories and profiles would survive the AppVMs reboot, unlike the "root" filesystem which will be reverted to the "golden image" from the Template VM automatically. To facilitate such separation of user profiles, Qubes Windows Tools provide an option to automatically move `C:\Users` directory to the 2nd disk backed by `private.img`. It's a selectable feature of the installer, enabled by default. If that feature is selected during installation, completion of the process requires two reboots:
|
||||
|
||||
- The private disk is initialized and formatted on the first reboot after tools installation. It can't be done **during** the installation because Xen mass storage drivers are not yet active.
|
||||
- User profiles are moved to the private disk on the next reboot after the private disk is initialized. Reboot is required because the "mover utility" runs very early in the boot process so OS can't yet lock any files in there. This can take some time depending on the profiles' size and because the GUI agent is not yet active dom0/Qubes Manager may complain that the AppVM failed to boot. That's a false alarm (you can increase AppVM's default boot timeout using `qvm-prefs`), the VM should appear "green" in Qubes Manager shortly after.
|
||||
|
@ -44,7 +44,7 @@ Things get complicated if you need to perform kernel debugging or troubleshoot p
|
||||
- On the *host* system, install [WinDbg](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551063(v=vs.85).aspx) and start the kernel debug (Ctrl-K), choose **com1** as the debug port.
|
||||
- Reboot the *target* VM.
|
||||
- Run the above shell script in dom0.
|
||||
- If everything is fine you should see the proper kernel debugging output in [WinDbg?](/wiki/WinDbg). However, if you see something like that:
|
||||
- If everything is fine you should see the proper kernel debugging output in [WinDbg?](/doc/WinDbg/). However, if you see something like that:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
Opened \\.\com1
|
||||
|
Loading…
x
Reference in New Issue
Block a user