Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2024-10-01 01:25:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Revamp "Installing and updating software in dom0"

Browse Source 
- Add general intro
 - Update and revise security section
 - Improve formatting
 - Update kernel upgrade section (QubesOS/qubes-issues#4846)
This commit is contained in:
Andrew David Wong 2019-08-26 19:44:13 -05:00
parent 25019a471e
commit c967544150
No known key found for this signature in database
GPG Key ID: 8CE137352A019A17
1 changed files with 51 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
user/common-tasks/software-update-dom0.md
View File

@ -8,39 +8,31 @@ redirect_from:
- /wiki/SoftwareUpdateDom0/ - /wiki/SoftwareUpdateDom0/
--- ---
Installing and updating software in dom0 # Installing and updating software in dom0
========================================
Why would one want to install or update software in dom0? Updating dom0 is one of the main steps in [Updating Qubes OS].
--------------------------------------------------------- It is very import to keep dom0 up-to-date with the latest [security] updates.
We also publish dom0 updates for various non-security bug fixes and enhancements to Qubes components.
In addition, you may wish to update the kernel, drivers, or libraries in dom0 when [troubleshooting newer hardware].
Normally, there should be few reasons for installing or updating software in dom0. ## Security
This is because there is no networking in dom0, which means that even if some bugs are discovered e.g. in the dom0 Desktop Manager, this really is not a problem for Qubes, because none of the third-party software running in dom0 is accessible from VMs or the network in any way.
Some exceptions to this include: Qubes GUI daemon, Xen store daemon, and disk back-ends.
(We plan move the disk backends to an untrusted domain in a future Qubes release.) Of course, we believe this software is reasonably secure, and we hope it will not need patching.
However, we anticipate some other situations in which installing or updating dom0 software might be necessary or desirable: Since there is no networking in dom0, any bugs discovered in dom0 desktop components (e.g., the window manager) are unlikely to pose a problem for Qubes, since none of the third-party software running in dom0 is accessible from VMs or the network in any way.
Nonetheless, since software running in dom0 can potentially exercise full control over the system, it is important to install only trusted software in dom0.
- Updating drivers/libs for new hardware support The install/update process is split into two phases: *resolve and download* and *verify and install*.
- Correcting non-security related bugs (e.g. new buttons for qubes manager) The *resolve and download* phase is handled by the UpdateVM.
- Adding new features (e.g. GUI backup tool) (The role of UpdateVM can be assigned to any VM in the Qube Manager, and there are no significant security implications in this choice.
By default, this role is assigned to the FirewallVM.)
How is software installed and updated securely in dom0? After the UpdateVM has successfully downloaded new packages, they are sent to dom0, where they are verified and installed.
-------------------------------------------------------
The install/update process is split into two phases: "resolve and download" and "verify and install." The "resolve and download" phase is handled by the "UpdateVM." (The role of UpdateVM can be assigned to any VM in the Qubes VM Manager, and there are no significant security implications in this choice.
By default, this role is assigned to the firewallvm.) After the UpdateVM has successfully downloaded new packages, they are sent to dom0, where they are verified and installed.
This separation of duties significantly reduces the attack surface, since all of the network and metadata processing code is removed from the TCB. This separation of duties significantly reduces the attack surface, since all of the network and metadata processing code is removed from the TCB.
Although this update scheme is far more secure than directly downloading updates in dom0, it is not invulnerable. Although this update scheme is far more secure than directly downloading updates in dom0, it is not invulnerable.
For example, there is nothing that the Qubes project can feasibly do to prevent a malicious RPM from exploiting a hypothetical bug in GPG's `--verify` operation. For example, there is nothing that the Qubes OS Project can feasibly do to prevent a malicious RPM from exploiting a hypothetical bug in the cryptographic signature verification operation.
At best, we could switch to a different distro or package manager, but any of them could be vulnerable to the same (or a similar) attack. At best, we could switch to a different distro or package manager, but any of them could be vulnerable to the same (or a similar) attack.
While we could, in theory, write a custom solution, it would only be effective if Qubes repos included all of the regular TemplateVM distro's updates, and this would be far too costly for us to maintain. While we could, in theory, write a custom solution, it would only be effective if Qubes repos included all of the regular TemplateVM distro's updates, and this would be far too costly for us to maintain.
How to install and update software in dom0 ## How to update dom0
------------------------------------------
### How to update dom0
In the Qube Manager, simply select dom0 in the VM list, then click the **Update VM system** button (the blue, downward-pointing arrow). In the Qube Manager, simply select dom0 in the VM list, then click the **Update VM system** button (the blue, downward-pointing arrow).
In addition, updating dom0 has been made more convenient: You will be prompted on the desktop whenever new dom0 updates are available and given the choice to run the update with a single click. In addition, updating dom0 has been made more convenient: You will be prompted on the desktop whenever new dom0 updates are available and given the choice to run the update with a single click.
@ -52,7 +44,7 @@ To check and install updates for dom0 software:
$ sudo qubes-dom0-update $ sudo qubes-dom0-update
### How to install a specific package ## How to install a specific package
To install additional packages in dom0 (usually not recommended): To install additional packages in dom0 (usually not recommended):
@ -62,7 +54,7 @@ You may also pass the `--enablerepo=` option in order to enable optional reposit
However, this is only for advanced users who really understand what they are doing. However, this is only for advanced users who really understand what they are doing.
You can also pass commands to `dnf` using `--action=...`. You can also pass commands to `dnf` using `--action=...`.
### How to downgrade a specific package ## How to downgrade a specific package
**WARNING:** Downgrading a package can expose your system to security vulnerabilities. **WARNING:** Downgrading a package can expose your system to security vulnerabilities.
@ -80,7 +72,7 @@ You can also pass commands to `dnf` using `--action=...`.
sudo dnf downgrade package-version sudo dnf downgrade package-version
~~~ ~~~
### How to re-install a package ## How to re-install a package
You can re-install in a similar fashion to downgrading. You can re-install in a similar fashion to downgrading.
@ -101,15 +93,15 @@ You can re-install in a similar fashion to downgrading.
Note that `dnf` will only re-install if the installed and downloaded versions match. Note that `dnf` will only re-install if the installed and downloaded versions match.
You can ensure they match by either updating the package to the latest version, or specifying the package version in the first step using the form `package-version`. You can ensure they match by either updating the package to the latest version, or specifying the package version in the first step using the form `package-version`.
### How to uninstall a package ## How to uninstall a package
If you've installed a package such as anti-evil-maid, you can remove it with the following command: If you've installed a package such as anti-evil-maid, you can remove it with the following command:
sudo dnf remove anti-evil-maid sudo dnf remove anti-evil-maid
### Testing repositories ## Testing repositories
There are three Qubes dom0 testing repositories: There are three Qubes dom0 [testing] repositories:
* `qubes-dom0-current-testing` -- testing packages that will eventually land in the stable * `qubes-dom0-current-testing` -- testing packages that will eventually land in the stable
(`current`) repository (`current`) repository
@ -130,11 +122,29 @@ sudo qubes-dom0-update --enablerepo=qubes-dom0-unstable
To enable or disable any of these repos permanently, change the corresponding `enabled` value to `1` in To enable or disable any of these repos permanently, change the corresponding `enabled` value to `1` in
`/etc/yum.repos.d/qubes-dom0.repo`. `/etc/yum.repos.d/qubes-dom0.repo`.
### Kernel Upgrade ### ## Kernel upgrade
This section describes upgrading the kernel in dom0 and domUs.
### dom0
The packages `kernel` and `kernel-latest` are for dom0.
In the `current` repository:
- `kenrnel`: an older LTS kernel that has passed Qubes [testing] (the default dom0 kernel)
- `kernel-latest`: the latest release from kernel.org that has passed Qubes [testing] (useful for [troubleshooting newer hardware])
In the `current-testing` repository:
- `kenrnel`: the latest LTS kernel from kernel.org at the time it was built.
- `kernel-latest`: the latest release from kernel.org at the time it was built.
### domU
The package `kernel-qubes-vm` is for domUs.
See [Managing VM kernel] for more information.
### Example
Install newer kernel for dom0 and VMs.
The package `kernel` is for dom0 and the package `kernel-qubes-vm`
is needed for the VMs.
(Note that the following example enables the unstable repo.) (Note that the following example enables the unstable repo.)
~~~ ~~~
@ -161,7 +171,7 @@ If you wish to upgrade to a kernel that is not available from the repos, then
there is no easy way to do so, but [it may still be possible if you're willing there is no easy way to do so, but [it may still be possible if you're willing
to do a lot of work yourself](https://groups.google.com/d/msg/qubes-users/m8sWoyV58_E/HYdReRIYBAAJ). to do a lot of work yourself](https://groups.google.com/d/msg/qubes-users/m8sWoyV58_E/HYdReRIYBAAJ).
### Upgrading over Tor ### ## Updating over Tor ###
Requires installed [Whonix](/doc/privacy/whonix/). Requires installed [Whonix](/doc/privacy/whonix/).
@ -172,3 +182,10 @@ For example: sys-whonix.
Qubes VM Manager -> System -> Global Settings -> UpdateVM -> sys-whonix Qubes VM Manager -> System -> Global Settings -> UpdateVM -> sys-whonix
[Updating Qubes OS]: /doc/updating-qubes-os/
[security]: /security/
[testing]: /doc/testing/
[troubleshooting newer hardware]: /doc/newer-hardware-troubleshooting/
[Managing VM kernel]: /doc/managing-vm-kernel/