From 9f1c4aa79abce4029023de88cb8e143cbb285e35 Mon Sep 17 00:00:00 2001 From: Malte Date: Tue, 12 Oct 2021 20:38:19 +0200 Subject: [PATCH 001/308] shortcut configuration via qvm-features instead of guid.conf With Qubes 4.1 coming out soon, maybe it's a good time to tell people how to get their shortcuts working again? --- user/how-to-guides/how-to-copy-and-paste-text.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/user/how-to-guides/how-to-copy-and-paste-text.md b/user/how-to-guides/how-to-copy-and-paste-text.md index 787518cf..bef55c77 100644 --- a/user/how-to-guides/how-to-copy-and-paste-text.md +++ b/user/how-to-guides/how-to-copy-and-paste-text.md @@ -76,12 +76,13 @@ For example, if you are certain that you never wish to paste *into* your "vault" Shortcut configuration ---------------------- -The copy/paste shortcuts are configurable in: +The copy/paste shortcuts are configurable via `qvm-features`, e.g. ~~~ -/etc/qubes/guid.conf +qvm-features dom0 gui-default-secure-copy-sequence 'Mod4-c' +qvm-features dom0 gui-default-secure-paste-sequence 'Mod4-v' ~~~ -If you edit a line in this file, you must uncomment it (by removing the initial `#` character), or else it will have no effect. +would change the *copy/paste to global clipboard* to the Win key plus c for copy, or v for paste. -VMs need to be restarted in order for changes in `/etc/qubes/guid.conf` to take effect. +You need to restart Qubes for the changes to take effect. From 1a02c6a9098d441e5f10aa117a8f58c27454173e Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 8 May 2022 13:13:31 +0200 Subject: [PATCH 002/308] Clarify use of IP addresses for frowarding --- user/security-in-qubes/firewall.md | 48 +++++++++++++++++------------- 1 file changed, 27 insertions(+), 21 deletions(-) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index b122afca..06601340 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -268,22 +268,24 @@ Note the IP addresses you will need. **2. Route packets from the outside world to the FirewallVM** +For the following example, we assume that the physical interface eth0 in sys-net has the IP address 192.168.x.y and that the IP adress of sys-firewall is 10.137.1.z. + In the sys-net VM's Terminal, code a natting firewall rule to route traffic on the outside interface for the service to the sys-firewall VM ``` -iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 192.168.x.x -j DNAT --to-destination 10.137.1.x +iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 192.168.x.y -j DNAT --to-destination 10.137.1.z ``` Code the appropriate new filtering firewall rule to allow new connections for the service ``` -iptables -I FORWARD 2 -i eth0 -d 10.137.1.x -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT +iptables -I FORWARD 2 -i eth0 -d 10.137.1.z -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT ``` > If you want to expose the service on multiple interfaces, repeat the steps described in part 1 for each interface. > In Qubes R4, at the moment ([QubesOS/qubes-issues#3644](https://github.com/QubesOS/qubes-issues/issues/3644)), nftables is also used which imply that additional rules need to be set in a `qubes-firewall` nft table with a forward chain. -`nft add rule ip qubes-firewall forward meta iifname eth0 ip daddr 10.137.0.x tcp dport 443 ct state new counter accept` +`nft add rule ip qubes-firewall forward meta iifname eth0 ip daddr 10.137.1.z tcp dport 443 ct state new counter accept` Verify you are cutting through the sys-net VM firewall by looking at its counters (column 2) @@ -301,7 +303,7 @@ nft list table ip qubes-firewall Send a test packet by trying to connect to the service from an external device ``` -telnet 192.168.x.x 443 +telnet 192.168.x.y 443 ``` Once you have confirmed that the counters increase, store these command in `/rw/config/rc.local` so they get set on sys-net start-up @@ -320,8 +322,8 @@ sudo nano /rw/config/rc.local # Create a new firewall natting chain for my service if iptables -w -t nat -N MY-HTTPS; then -# Add a natting rule if it did not exit (to avoid cluter if script executed multiple times) - iptables -w -t nat -A MY-HTTPS -j DNAT --to-destination 10.137.1.x +# Add a natting rule if it did not exist (to avoid clutter if script executed multiple times) + iptables -w -t nat -A MY-HTTPS -j DNAT --to-destination 10.137.1.z fi @@ -330,7 +332,7 @@ fi if ! iptables -w -t nat -n -L PREROUTING | grep --quiet MY-HTTPS; then # add a natting rule for the traffic (same reason) - iptables -w -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 192.168.0.x -j MY-HTTPS + iptables -w -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 192.168.x.y -j MY-HTTPS fi @@ -340,7 +342,7 @@ fi # Create a new firewall filtering chain for my service if iptables -w -N MY-HTTPS; then -# Add a filtering rule if it did not exit (to avoid cluter if script executed multiple times) +# Add a filtering rule if it did not exist (to avoid clutter if script executed multiple times) iptables -w -A MY-HTTPS -s 192.168.x.0/24 -j ACCEPT fi @@ -349,7 +351,7 @@ fi if ! iptables -w -n -L FORWARD | grep --quiet MY-HTTPS; then # add a forward rule for the traffic (same reason) - iptables -w -I FORWARD 2 -d 10.137.1.x -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS + iptables -w -I FORWARD 2 -d 10.137.1.z -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS fi ~~~ @@ -364,23 +366,25 @@ fi if nft -nn list table ip qubes-firewall | grep "tcp dport 443 ct state new"; then # Add a filtering rule - nft add rule ip qubes-firewall forward meta iifname eth0 ip daddr 10.137.0.x tcp dport 443 ct state new counter accept + nft add rule ip qubes-firewall forward meta iifname eth0 ip daddr 10.137.1.z tcp dport 443 ct state new counter accept fi ~~~ **3. Route packets from the FirewallVM to the VM** +For the following example, we use the fact that the physical interface of sys-firewall, facing sys-net, is eth0. Furthermore, we assume that the target VM running the web server has the IP address 10.137.0.xx and that the IP adress of sys-firewall is 10.137.1.z. + In the sys-firewall VM's Terminal, code a natting firewall rule to route traffic on its outside interface for the service to the qube ``` -iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 10.137.1.x -j DNAT --to-destination 10.137.2.y +iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 10.137.1.z -j DNAT --to-destination 10.137.0.xx ``` Code the appropriate new filtering firewall rule to allow new connections for the service ``` -iptables -I FORWARD 2 -i eth0 -s 192.168.x.0/24 -d 10.137.2.y -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT +iptables -I FORWARD 2 -i eth0 -s 192.168.x.0/24 -d 10.137.0.xx -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT ``` > Note: If you do not wish to limit the IP addresses connecting to the service, remove the ` -s 192.168.0.1/24 ` @@ -388,7 +392,7 @@ iptables -I FORWARD 2 -i eth0 -s 192.168.x.0/24 -d 10.137.2.y -p tcp --dport 443 > Note: On Qubes R4 ``` -nft add rule ip qubes-firewall forward meta iifname eth0 ip saddr 192.168.x.0/24 ip daddr 10.137.0.y tcp dport 443 ct state new counter accept +nft add rule ip qubes-firewall forward meta iifname eth0 ip saddr 192.168.x.0/24 ip daddr 10.137.0.xx tcp dport 443 ct state new counter accept ``` Once you have confirmed that the counters increase, store these command in `/rw/config/qubes-firewall-user-script` @@ -407,8 +411,8 @@ sudo nano /rw/config/qubes-firewall-user-script # Create a new firewall natting chain for my service if iptables -w -t nat -N MY-HTTPS; then -# Add a natting rule if it did not exit (to avoid cluter if script executed multiple times) - iptables -w -t nat -A MY-HTTPS -j DNAT --to-destination 10.137.2.y +# Add a natting rule if it did not exist (to avoid clutter if script executed multiple times) + iptables -w -t nat -A MY-HTTPS -j DNAT --to-destination 10.137.0.xx fi @@ -417,7 +421,7 @@ fi if ! iptables -w -t nat -n -L PREROUTING | grep --quiet MY-HTTPS; then # add a natting rule for the traffic (same reason) - iptables -w -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 10.137.1.x -j MY-HTTPS + iptables -w -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -d 10.137.1.z -j MY-HTTPS fi @@ -427,7 +431,7 @@ fi # Create a new firewall filtering chain for my service if iptables -w -N MY-HTTPS; then -# Add a filtering rule if it did not exit (to avoid cluter if script executed multiple times) +# Add a filtering rule if it did not exist (to avoid clutter if script executed multiple times) iptables -w -A MY-HTTPS -s 192.168.x.0/24 -j ACCEPT fi @@ -436,7 +440,7 @@ fi if ! iptables -w -n -L FORWARD | grep --quiet MY-HTTPS; then # add a forward rule for the traffic (same reason) - iptables -w -I FORWARD 4 -d 10.137.2.y -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS + iptables -w -I FORWARD 4 -d 10.137.0.xx -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS fi @@ -447,7 +451,7 @@ fi if ! nft -nn list table ip qubes-firewall | grep "tcp dport 443 ct state new"; then # Add a filtering rule - nft add rule ip qubes-firewall forward meta iifname eth0 ip saddr 192.168.x.0/24 ip daddr 10.137.0.y tcp dport 443 ct state new counter accept + nft add rule ip qubes-firewall forward meta iifname eth0 ip saddr 192.168.x.0/24 ip daddr 10.137.0.xx tcp dport 443 ct state new counter accept fi ~~~ @@ -458,6 +462,8 @@ Finally make this file executable (so it runs at every Firewall VM update) sudo chmod +x /rw/config/qubes-firewall-user-script ~~~ +If the service should be available to other VMs on the same system, do not forget to specifiy the additional rules described above. + **4. Allow packets into the qube to reach the service** Here no routing is required, only filtering. @@ -474,7 +480,7 @@ sudo name /rw/config/rc.local # Create a new firewall filtering chain for my service if iptables -w -N MY-HTTPS; then -# Add a filtering rule if it did not exit (to avoid cluter if script executed multiple times) +# Add a filtering rule if it did not exist (to avoid clutter if script executed multiple times) iptables -w -A MY-HTTPS -j ACCEPT fi @@ -483,7 +489,7 @@ fi if ! iptables -w -n -L INPUT | grep --quiet MY-HTTPS; then # add a forward rule for the traffic (same reason) - iptables -w -I INPUT 5 -d 10.137.2.x -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS + iptables -w -I INPUT 5 -d 10.137.1.z -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS fi ~~~ From c86d57e44bfdfbe49efe52971530661985e8f812 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Fri, 13 May 2022 13:25:54 +0200 Subject: [PATCH 003/308] Add explanation for firewall rule in target VM Is it really the firewall address in the rule of the target VM? Or, instead, the originating address of the web access? --- user/security-in-qubes/firewall.md | 1 + 1 file changed, 1 insertion(+) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index 06601340..55d4155f 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -468,6 +468,7 @@ If the service should be available to other VMs on the same system, do not forge Here no routing is required, only filtering. Proceed in the same way as above but store the filtering rule in the `/rw/config/rc.local` script. +For the following example, we assume that the IP adress of sys-firewall is 10.137.1.z. ``` sudo name /rw/config/rc.local From 66e0f04b1e4321865009b7bcf4fa8fb8d19a5728 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Wed, 25 May 2022 07:50:14 -0700 Subject: [PATCH 004/308] Add Fedora 35 to supported template releases QubesOS/qubes-issues#6969 QubesOS/qubes-posts#96 --- user/downloading-installing-upgrading/supported-releases.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user/downloading-installing-upgrading/supported-releases.md b/user/downloading-installing-upgrading/supported-releases.md index 55bfa789..6c8695fb 100644 --- a/user/downloading-installing-upgrading/supported-releases.md +++ b/user/downloading-installing-upgrading/supported-releases.md @@ -91,8 +91,8 @@ Releases](https://wiki.debian.org/DebianReleases)). | Qubes OS | Fedora | Debian | Whonix | | ----------- | ------ | --------------------------------------------------- | ------ | -| Release 4.0 | 34 | 9 (Stretch),* 10 (Buster), 11 (Bullseye) | 16 | -| Release 4.1 | 34 | 10 (Buster), 11 (Bullseye) | 16 | +| Release 4.0 | 34, 35 | 9 (Stretch),* 10 (Buster), 11 (Bullseye) | 16 | +| Release 4.1 | 34, 35 | 10 (Buster), 11 (Bullseye) | 16 | \* Although Debian 9 has reached regular EOL and is now in [LTS](https://wiki.debian.org/LTS), we continue to support it for Qubes R4.0. From b1ddfdf809dbd30f838fcd47dba6f325a7e65115 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Thu, 26 May 2022 12:27:06 -0700 Subject: [PATCH 005/308] Make '/doc/template[s]/' paths consistent Most pages were using the pattern '/doc/templates/[...]', but some were using the pattern '/doc/template/[...]', which was confusing. This commit unifies on the former. --- user/templates/debian/debian-upgrade.md | 4 +++- user/templates/debian/debian.md | 2 +- user/templates/fedora/fedora-upgrade.md | 4 +++- user/templates/fedora/fedora.md | 2 +- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/user/templates/debian/debian-upgrade.md b/user/templates/debian/debian-upgrade.md index 2189c8fb..12552f22 100644 --- a/user/templates/debian/debian-upgrade.md +++ b/user/templates/debian/debian-upgrade.md @@ -2,8 +2,10 @@ advanced: true lang: en layout: doc -permalink: /doc/template/debian/upgrade/ +permalink: /doc/templates/debian/in-place-upgrade/ redirect_from: +- /doc/template/debian/upgrade/ +- /doc/templates/debian/upgrade/ - /doc/template/debian/upgrade-8-to-9/ - /doc/debian-template-upgrade-8/ - /en/doc/debian-template-upgrade-8/ diff --git a/user/templates/debian/debian.md b/user/templates/debian/debian.md index ff16089b..32ef26fb 100644 --- a/user/templates/debian/debian.md +++ b/user/templates/debian/debian.md @@ -52,7 +52,7 @@ There are two ways to upgrade your template to a new Debian release: - **Recommended:** [Install a fresh template to replace the existing one.](#installing) **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and [switch everything that was set to the old template to the new template](/doc/templates/#switching). You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. In the old Debian template, see `/var/log/dpkg.log` and `/var/log/apt/history.log` for logs of package manager actions. -- **Advanced:** [Perform an in-place upgrade of an existing Debian template.](/doc/template/debian/upgrade/) This option will preserve any modifications you've made to the template, **but it may be more complicated for less experienced users.** +- **Advanced:** [Perform an in-place upgrade of an existing Debian template.](/doc/templates/debian/in-place-upgrade/) This option will preserve any modifications you've made to the template, **but it may be more complicated for less experienced users.** ## Release-specific notes diff --git a/user/templates/fedora/fedora-upgrade.md b/user/templates/fedora/fedora-upgrade.md index a7275ad0..2529e1de 100644 --- a/user/templates/fedora/fedora-upgrade.md +++ b/user/templates/fedora/fedora-upgrade.md @@ -2,8 +2,10 @@ advanced: true lang: en layout: doc -permalink: /doc/template/fedora/upgrade/ +permalink: /doc/templates/fedora/in-place-upgrade/ redirect_from: +- /doc/template/fedora/upgrade/ +- /doc/templates/fedora/upgrade/ - /doc/template/fedora/upgrade-26-to-27/ - /doc/fedora-template-upgrade-26/ - /en/doc/fedora-template-upgrade-26/ diff --git a/user/templates/fedora/fedora.md b/user/templates/fedora/fedora.md index 82c5f30d..eefa7fac 100644 --- a/user/templates/fedora/fedora.md +++ b/user/templates/fedora/fedora.md @@ -44,4 +44,4 @@ There are two ways to upgrade your template to a new Fedora release: - **Recommended:** [Install a fresh template to replace the existing one.](#installing) **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and [switch everything that was set to the old template to the new template](/doc/templates/#switching). You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the old Fedora template and use the `dnf history` command. -- **Advanced:** [Perform an in-place upgrade of an existing Fedora template.](/doc/template/fedora/upgrade/) This option will preserve any modifications you've made to the template, **but it may be more complicated for less experienced users.** +- **Advanced:** [Perform an in-place upgrade of an existing Fedora template.](/doc/templates/fedora/in-place-upgrade/) This option will preserve any modifications you've made to the template, **but it may be more complicated for less experienced users.** From bd9e2f7670a0d78dc622a36208d5380a9f285809 Mon Sep 17 00:00:00 2001 From: Tommy Date: Thu, 26 May 2022 23:02:34 -0400 Subject: [PATCH 006/308] Add missing execute permission for VMAuth --- user/security-in-qubes/vm-sudo.md | 1 + 1 file changed, 1 insertion(+) diff --git a/user/security-in-qubes/vm-sudo.md b/user/security-in-qubes/vm-sudo.md index a4de0acb..e456d5e7 100644 --- a/user/security-in-qubes/vm-sudo.md +++ b/user/security-in-qubes/vm-sudo.md @@ -115,6 +115,7 @@ Do not rely on this for extra security.** [root@dom0 /]# echo "/usr/bin/echo 1" >/etc/qubes-rpc/qubes.VMAuth [root@dom0 /]# echo "@anyvm dom0 ask,default_target=dom0" \ >/etc/qubes-rpc/policy/qubes.VMAuth + [root@dom0 /]# chmod +x /etc/qubes-rpc/qubes.VMAuth ``` (Note: any VMs you would like still to have passwordless root access (e.g. Templates) can be specified in the second file with "\ dom0 allow") From a072318fe4bc31e3ea1d8cad54c018ebe0740f77 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 28 May 2022 13:03:29 +0200 Subject: [PATCH 007/308] IP address use for forwarding external requests --- user/security-in-qubes/firewall.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index 55d4155f..eba39223 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -468,10 +468,10 @@ If the service should be available to other VMs on the same system, do not forge Here no routing is required, only filtering. Proceed in the same way as above but store the filtering rule in the `/rw/config/rc.local` script. -For the following example, we assume that the IP adress of sys-firewall is 10.137.1.z. +For the following example, we assume that the target VM running the web server has the IP address 10.137.0.xx ``` -sudo name /rw/config/rc.local +sudo nano /rw/config/rc.local ``` ~~~ @@ -490,7 +490,7 @@ fi if ! iptables -w -n -L INPUT | grep --quiet MY-HTTPS; then # add a forward rule for the traffic (same reason) - iptables -w -I INPUT 5 -d 10.137.1.z -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS + iptables -w -I INPUT 5 -d 10.137.0.xx -p tcp --dport 443 -m conntrack --ctstate NEW -j MY-HTTPS fi ~~~ From de87082d1e65b8f2fc98862da08d7fe5bd3b23e8 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 28 May 2022 13:06:19 +0200 Subject: [PATCH 008/308] Clarify IP address usage for forwarding --- user/security-in-qubes/firewall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index eba39223..9bf6993e 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -508,4 +508,4 @@ Firewall troubleshooting Firewall logs are stored in the systemd journal of the qube the firewall is running in (probably `sys-firewall`). You can view them by running `sudo journalctl -u qubes-firewall.service` in the relevant qube. -Sometimes these logs can contain useful information about errors that are preventing the firewall from behaving as you would expect. +Sometimes these logs can contain useful i nformation about errors that are preventing the firewall from behaving as you would expect. From 08c96879c589974da467b805996f79e218c1aac9 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 28 May 2022 13:08:00 +0200 Subject: [PATCH 009/308] Clarify IP address usage for forwading --- user/security-in-qubes/firewall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index 9bf6993e..eba39223 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -508,4 +508,4 @@ Firewall troubleshooting Firewall logs are stored in the systemd journal of the qube the firewall is running in (probably `sys-firewall`). You can view them by running `sudo journalctl -u qubes-firewall.service` in the relevant qube. -Sometimes these logs can contain useful i nformation about errors that are preventing the firewall from behaving as you would expect. +Sometimes these logs can contain useful information about errors that are preventing the firewall from behaving as you would expect. From e3e546a97ae65b3462855221a9bd01f7151f3163 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 30 May 2022 15:30:36 -0700 Subject: [PATCH 010/308] Fix typos --- user/security-in-qubes/firewall.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user/security-in-qubes/firewall.md b/user/security-in-qubes/firewall.md index eba39223..0ac04125 100644 --- a/user/security-in-qubes/firewall.md +++ b/user/security-in-qubes/firewall.md @@ -268,7 +268,7 @@ Note the IP addresses you will need. **2. Route packets from the outside world to the FirewallVM** -For the following example, we assume that the physical interface eth0 in sys-net has the IP address 192.168.x.y and that the IP adress of sys-firewall is 10.137.1.z. +For the following example, we assume that the physical interface eth0 in sys-net has the IP address 192.168.x.y and that the IP address of sys-firewall is 10.137.1.z. In the sys-net VM's Terminal, code a natting firewall rule to route traffic on the outside interface for the service to the sys-firewall VM @@ -373,7 +373,7 @@ fi **3. Route packets from the FirewallVM to the VM** -For the following example, we use the fact that the physical interface of sys-firewall, facing sys-net, is eth0. Furthermore, we assume that the target VM running the web server has the IP address 10.137.0.xx and that the IP adress of sys-firewall is 10.137.1.z. +For the following example, we use the fact that the physical interface of sys-firewall, facing sys-net, is eth0. Furthermore, we assume that the target VM running the web server has the IP address 10.137.0.xx and that the IP address of sys-firewall is 10.137.1.z. In the sys-firewall VM's Terminal, code a natting firewall rule to route traffic on its outside interface for the service to the qube @@ -462,7 +462,7 @@ Finally make this file executable (so it runs at every Firewall VM update) sudo chmod +x /rw/config/qubes-firewall-user-script ~~~ -If the service should be available to other VMs on the same system, do not forget to specifiy the additional rules described above. +If the service should be available to other VMs on the same system, do not forget to specify the additional rules described above. **4. Allow packets into the qube to reach the service** From aed67314a415491ea2b18c889087c4bb0e11edb4 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Tue, 7 Jun 2022 04:03:10 -0700 Subject: [PATCH 011/308] Remove support for Fedora 34 templates (EOL) --- user/downloading-installing-upgrading/supported-releases.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user/downloading-installing-upgrading/supported-releases.md b/user/downloading-installing-upgrading/supported-releases.md index 6c8695fb..ed15e3ab 100644 --- a/user/downloading-installing-upgrading/supported-releases.md +++ b/user/downloading-installing-upgrading/supported-releases.md @@ -91,8 +91,8 @@ Releases](https://wiki.debian.org/DebianReleases)). | Qubes OS | Fedora | Debian | Whonix | | ----------- | ------ | --------------------------------------------------- | ------ | -| Release 4.0 | 34, 35 | 9 (Stretch),* 10 (Buster), 11 (Bullseye) | 16 | -| Release 4.1 | 34, 35 | 10 (Buster), 11 (Bullseye) | 16 | +| Release 4.0 | 35 | 9 (Stretch),* 10 (Buster), 11 (Bullseye) | 16 | +| Release 4.1 | 35 | 10 (Buster), 11 (Bullseye) | 16 | \* Although Debian 9 has reached regular EOL and is now in [LTS](https://wiki.debian.org/LTS), we continue to support it for Qubes R4.0. From f49b630d5e1f1716af4b1ebe6f41977cff4f42ec Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 27 Jun 2022 18:28:49 -0700 Subject: [PATCH 012/308] Add Fedora 36 template support for Qubes 4.1 QubesOS/qubes-issues#7544 --- user/downloading-installing-upgrading/supported-releases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/downloading-installing-upgrading/supported-releases.md b/user/downloading-installing-upgrading/supported-releases.md index ed15e3ab..8416e04e 100644 --- a/user/downloading-installing-upgrading/supported-releases.md +++ b/user/downloading-installing-upgrading/supported-releases.md @@ -92,7 +92,7 @@ Releases](https://wiki.debian.org/DebianReleases)). | Qubes OS | Fedora | Debian | Whonix | | ----------- | ------ | --------------------------------------------------- | ------ | | Release 4.0 | 35 | 9 (Stretch),* 10 (Buster), 11 (Bullseye) | 16 | -| Release 4.1 | 35 | 10 (Buster), 11 (Bullseye) | 16 | +| Release 4.1 | 35, 36 | 10 (Buster), 11 (Bullseye) | 16 | \* Although Debian 9 has reached regular EOL and is now in [LTS](https://wiki.debian.org/LTS), we continue to support it for Qubes R4.0. From add0ebf529684c2c565d17dfd2c194c49df9df48 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 4 Jul 2022 20:58:37 -0700 Subject: [PATCH 013/308] Clarify release number usage --- developer/releases/version-scheme.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/developer/releases/version-scheme.md b/developer/releases/version-scheme.md index de261651..a530947c 100644 --- a/developer/releases/version-scheme.md +++ b/developer/releases/version-scheme.md @@ -12,8 +12,11 @@ title: Version scheme The Qubes OS Project uses the [semantic versioning](https://semver.org/) standard. Version numbers are written as `..`. When -`` is zero, it is often omitted as a matter of convention, e.g., `4.1` is -short for `4.1.0`. +`` is omitted (e.g., `4.1`), it is usually either because `` is +zero (as in `4.1.0`) or because we are referring to a specific minor release +irrespective of any particular patch release within it. Similarly, the major +release number alone (e.g., `R4`) is sometimes used to refer to an entire +release series inclusive of all minor and patch releases within it. In general, patch releases are for backward-compatible bug fixes, minor releases are for backward-compatible enhancements and new features, and major From 991c8e816388d962e43fd3dc73e9868ffb180366 Mon Sep 17 00:00:00 2001 From: nyxnor Date: Sat, 9 Jul 2022 15:25:19 +0000 Subject: [PATCH 014/308] Update proxy documentation clarification it had deprecated information and also was not very clear of what is protects against, fixes https://github.com/QubesOS/qubes-issues/issues/7610 --- user/how-to-guides/how-to-install-software.md | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/user/how-to-guides/how-to-install-software.md b/user/how-to-guides/how-to-install-software.md index d9cf0a26..8448cdf3 100644 --- a/user/how-to-guides/how-to-install-software.md +++ b/user/how-to-guides/how-to-install-software.md @@ -144,11 +144,11 @@ Please see [How to Update](/doc/how-to-update/). In order to protect you from performing risky activities in templates, they do not have normal network access by default. Instead, templates use an [updates -proxy](#updates-proxy) that allows you to install and update software without -giving the template direct network access. **The updates proxy is already set -up to work automatically out-of-the-box and requires no special action from -you.** Most users should simply follow the normal instructions for [installing -software from default +proxy](#updates-proxy) that allows you to install and update software using +the distribution package manager without giving the template direct network +access.**The updates proxy is already setup to work automatically +out-of-the-box and requires no special action from you.** Most users should +simply follow the normal instructions for [installing software from default repositories](#installing-software-from-default-repositories) and [updating](/doc/how-to-update/) software. If your software is not available in the default repositories, see [installing software from other @@ -304,19 +304,23 @@ This is like the simple revert, except: ### Updates proxy -Updates proxy is a service which allows access only from package managers. This -is meant to mitigate user errors (like using browser in the template), rather -than some real isolation. It is done with http proxy (tinyproxy) instead of -simple firewall rules because it is hard to list all the repository mirrors -(and keep that list up to date). The proxy is used only to filter the traffic, -not to cache anything. +Updates proxy is a service which allows access from package managers +configured to use the proxy by default, but can be used by any other +program that accepts proxy arguments. +The purpose of the proxy, instead of direct network access, is meant to +mitigate user errors of using applications such as the browser in the +template. Not necessarily what part of the network they can access, but only +to applications trusted by the user, configured to use the proxy. +The http proxy (tinyproxy) does not filter traffic because it is hard to list +all the repository mirrors and keep that list up to date). it also does not +cache anything. The proxy is running in selected VMs (by default all the NetVMs (1)) and -intercepts traffic directed to 10.137.255.254:8082. Thanks to such +intercepts traffic directed to 127.0.0.1:8082. Thanks to such configuration all the VMs can use the same proxy address, and if there is a proxy on network path, it will handle the traffic (of course when firewall rules allow that). If the VM is configured to have access to the updates proxy -(2), the startup scripts will automatically configure dnf to really use the +(2), the startup scripts will automatically configure dnf/apt to really use the proxy (3). Also access to updates proxy is independent of any other firewall settings (VM will have access to updates proxy, even if policy is set to block all the traffic). From 9d3ed9d5fedbadf590e7c5dab24e8d965d24f243 Mon Sep 17 00:00:00 2001 From: Sven Semmler Date: Mon, 18 Jul 2022 13:22:40 -0500 Subject: [PATCH 015/308] remove KDE specifics; add paste request/rationale --- user/hardware/how-to-use-the-hcl.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/user/hardware/how-to-use-the-hcl.md b/user/hardware/how-to-use-the-hcl.md index 3fcbd877..d491a1d5 100644 --- a/user/hardware/how-to-use-the-hcl.md +++ b/user/hardware/how-to-use-the-hcl.md @@ -27,15 +27,11 @@ Also see [Certified Hardware](/doc/certified-hardware/). Generating and Submitting New Reports ------------------------------------- -In order to generate an HCL report in Qubes, simply open a terminal in dom0 (KDE: start-menu -\> System Tools -\> Konsole or Terminal Emulator) -and run `qubes-hcl-report `, where `` is the name of the VM to which the generated HCL files will be saved. -(Note: If you are working with a new Qubes installation, you may need to update your system in order to download this script.) +In order to generate an HCL report in Qubes, simply open a terminal in dom0 (start-menu -\> Terminal Emulator) and run `qubes-hcl-report `, where `` is the name of the VM to which the generated HCL files will be saved. -You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. -When submitting reports, test the hardware yourself, if possible. -If you would like to submit your HCL report, please send the **HCL Info** `.yml` file to [\`qubes-users@googlegroups.com\`](/support/#qubes-users) with the subject `HCL - `. Alternatively you can also create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. -Please include any useful information about any Qubes features you may have tested (see the legend below), as well as general machine compatibility (video, networking, sleep, etc.). -Please consider sending the **HCL Support Files** `.cpio.gz` file as well. To generate these add the `-s` or `--support` command line option. +You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. When submitting reports, test the hardware yourself, if possible. If you would like to submit your HCL report, please copy and paste the contents of the **HCL Info** `.yml` file into an email to [\`qubes-users@googlegroups.com\`](/support/#qubes-users) with the subject `HCL - ` or create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. Pasting the contents into the email or post has the advantage that members of the mailing list and forum can see the report without downloading and opening the file. In addition new forum members are not be able to attach files to posts. + +Please include any useful information about any Qubes features you may have tested (see the legend below), as well as general machine compatibility (video, networking, sleep, etc.). Please consider sending the **HCL Support Files** `.cpio.gz` file as well. To generate these add the `-s` or `--support` command line option. **Please note:** The **HCL Support Files** may contain numerous hardware details, including serial numbers. If, for privacy or security reasons, you do not wish to make this information public, please **do not** send the `.cpio.gz` file to the public mailing list. From 64dd741e8759e4db7963590f9b4d752ec271465b Mon Sep 17 00:00:00 2001 From: Sven Semmler Date: Mon, 18 Jul 2022 13:27:03 -0500 Subject: [PATCH 016/308] minor English correction --- user/hardware/how-to-use-the-hcl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/hardware/how-to-use-the-hcl.md b/user/hardware/how-to-use-the-hcl.md index d491a1d5..07e827cd 100644 --- a/user/hardware/how-to-use-the-hcl.md +++ b/user/hardware/how-to-use-the-hcl.md @@ -29,7 +29,7 @@ Generating and Submitting New Reports In order to generate an HCL report in Qubes, simply open a terminal in dom0 (start-menu -\> Terminal Emulator) and run `qubes-hcl-report `, where `` is the name of the VM to which the generated HCL files will be saved. -You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. When submitting reports, test the hardware yourself, if possible. If you would like to submit your HCL report, please copy and paste the contents of the **HCL Info** `.yml` file into an email to [\`qubes-users@googlegroups.com\`](/support/#qubes-users) with the subject `HCL - ` or create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. Pasting the contents into the email or post has the advantage that members of the mailing list and forum can see the report without downloading and opening the file. In addition new forum members are not be able to attach files to posts. +You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. When submitting reports, test the hardware yourself, if possible. If you would like to submit your HCL report, please copy and paste the contents of the **HCL Info** `.yml` file into an email to [\`qubes-users@googlegroups.com\`](/support/#qubes-users) with the subject `HCL - ` or create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. Pasting the contents into the email or post has the advantage that members of the mailing list and forum can see the report without downloading and opening the file. In addition new forum members are unable to attach files to posts. Please include any useful information about any Qubes features you may have tested (see the legend below), as well as general machine compatibility (video, networking, sleep, etc.). Please consider sending the **HCL Support Files** `.cpio.gz` file as well. To generate these add the `-s` or `--support` command line option. From 03a3b495358cbe33e4d45dbd2008c80022ac4b8e Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 18 Jul 2022 18:22:24 -0700 Subject: [PATCH 017/308] Clean up text --- user/hardware/how-to-use-the-hcl.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user/hardware/how-to-use-the-hcl.md b/user/hardware/how-to-use-the-hcl.md index 07e827cd..463ac8dd 100644 --- a/user/hardware/how-to-use-the-hcl.md +++ b/user/hardware/how-to-use-the-hcl.md @@ -27,11 +27,11 @@ Also see [Certified Hardware](/doc/certified-hardware/). Generating and Submitting New Reports ------------------------------------- -In order to generate an HCL report in Qubes, simply open a terminal in dom0 (start-menu -\> Terminal Emulator) and run `qubes-hcl-report `, where `` is the name of the VM to which the generated HCL files will be saved. +In order to generate an HCL report in Qubes, simply open a terminal in dom0 (Applications Menu > Terminal Emulator) and run `qubes-hcl-report `, where `` is the name of the qube in which the generated HCL files will be saved. -You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. When submitting reports, test the hardware yourself, if possible. If you would like to submit your HCL report, please copy and paste the contents of the **HCL Info** `.yml` file into an email to [\`qubes-users@googlegroups.com\`](/support/#qubes-users) with the subject `HCL - ` or create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. Pasting the contents into the email or post has the advantage that members of the mailing list and forum can see the report without downloading and opening the file. In addition new forum members are unable to attach files to posts. +You are encouraged to submit your HCL report for the benefit of further Qubes development and other users. When submitting reports, test the hardware yourself, if possible. If you would like to submit your HCL report, please copy and paste the contents of the **HCL Info** `.yml` file into an email to the [qubes-users mailing list](/support/#qubes-users) with the subject `HCL - `, or create a post in the [HCL Reports category](https://forum.qubes-os.org/c/user-support/hcl-reports/23) of the forum. Pasting the contents into the email or post has the advantage that members of the mailing list and the forum can see the report without downloading and opening a file. In addition, new forum members are unable to attach files to posts. Please include any useful information about any Qubes features you may have tested (see the legend below), as well as general machine compatibility (video, networking, sleep, etc.). Please consider sending the **HCL Support Files** `.cpio.gz` file as well. To generate these add the `-s` or `--support` command line option. **Please note:** - The **HCL Support Files** may contain numerous hardware details, including serial numbers. If, for privacy or security reasons, you do not wish to make this information public, please **do not** send the `.cpio.gz` file to the public mailing list. + The **HCL Support Files** may contain numerous hardware details, including serial numbers. If, for privacy or security reasons, you do not wish to make this information public, please **do not** post the `.cpio.gz` file on a public mailing list or forum. From 3d08155ea966c4918b0cc6c25b3e3c55ad641114 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Wed, 20 Jul 2022 22:42:37 -0700 Subject: [PATCH 018/308] Add section on re-verifying installation media after writing Thanks to @HW42 and @marmarek for help with this command. --- project-security/verifying-signatures.md | 124 +++++++++++++++++++++++ 1 file changed, 124 insertions(+) diff --git a/project-security/verifying-signatures.md b/project-security/verifying-signatures.md index a4d0e998..c301a591 100644 --- a/project-security/verifying-signatures.md +++ b/project-security/verifying-signatures.md @@ -550,6 +550,130 @@ If you don't see a good signature here, go back and follow the instructions in this section carefully, and consult the [troubleshooting FAQ](#troubleshooting-faq) below. +## How to re-verify installation media after writing + +_This is an optional section intended for advanced users._ + +After you have authenticated your Qubes ISO and written it to your desired +medium (such as a USB drive or optical disc), you can re-verify the data that +has been written to your medium. Why would you want to do this when you've +already verified the original ISO? Well, it's conceivable that a sufficiently +sophisticated adversary might allow your initial ISO verification to succeed +(so as not to alert you that your machine has been compromised, for example), +then surreptitiously modify the data as it is being written onto your +installation medium, resulting in a compromised Qubes installer. This might +increase the odds that the attack goes undetected. One way to mitigate this +risk is to re-verify the installer after writing it onto an installation medium +that cannot be altered, such as a USB drive with a properly-implemented +physical write-protect switch and firmware that is either unflashable or +cryptographically-signed (or both), as discussed in our [installation security +considerations](/doc/install-security/). + +This section will walk through an example of re-verifying the installer on such +a device. We begin by assuming that you have just written your desired Qubes +ISO onto the USB drive. First, unplug your USB drive and flip the write protect +switch so that the data on the drive can no longer be altered. If you have a +different computer from the one you used to create the installation medium, +consider using that computer. If not, try to at least use a fresh VM (e.g., if +it's a Qubes system). The idea is that the original machine may have been +compromised, and using a different one for re-verification forces your +hypothetical adversary to compromise an additional machine in order to succeed. + +Now, our goal is to perform the same verification steps as we did with the +original ISO, except, this time, we'll be reading the installer data directly +from the write-protected USB drive instead of from the original ISO file. +First, let's compute the SHA-256 hash value of the data on the drive. (This +assumes you're already familiar with [how to verify the cryptographic hash +values of Qubes +ISOs](#how-to-verify-the-cryptographic-hash-values-of-qubes-isos).) In order to +do this, we have to know the exact size, in bytes, of the original ISO. There +are two ways to get this information: from the ISO itself and from the Qubes +website. Here's an example of the first way: + +```shell_session +$ dd if=/dev/sdX bs=1M count=$(stat -c %s /path/to/iso) iflag=count_bytes | sha256sum +``` + +(Where `/dev/sdX` is your USB drive and `/path/to/iso` is the path to your Qubes +ISO.) + +This command reads exactly the number of bytes of your Qubes ISO (obtained with +`stat -c %s /path/to/iso`) from the USB drive and pipes them into `sha256sum`. +The output should look something like this: + +```shell_session +0e68dd3347b68618d9e5f3ddb580bf7ecdd2166747630859b3582803f1ca8801 - +5523+0 records in +5523+0 records out +5791285248 bytes (5.8 GB, 5.4 GiB) copied, 76.3369 s, 75.9 MB/s +``` + +(Note that your actual SHA-256 hash value and byte number will depend on which +Qubes ISO you're using. This is just an example.) + +Now, reading the number of bytes directly from the ISO is fine, but you may be +concerned that a sufficiently sophisticated adversary may have compromised the +machine on which you're performing this re-verification and may therefore be +capable of feeding you a false success result. After all, if your adversary +knows the answer you're looking for --- namely, a match to the genuine ISO --- +and has access to that very ISO in the same re-verification environment, then +there is little to prevent him from simply hashing the original ISO and feeding +you that result (perhaps while also reading from the USB drive and piping it +into `/dev/null` so that you see the light on the USB drive blinking to support +the illusion that the data is being read from the USB drive). + +Therefore, in order to make things a bit more difficult for your hypothetical +adversary, you may instead wish to perform the re-verification in an +environment that has never seen the original ISO (e.g., a separate offline +computer or a fresh VM the storage space of which is too small to hold the +ISO). In that case, you'll have to obtain the size of the ISO in bytes and +enter it into the above command manually. You can, of course, obtain the size +by simply using the `stat -c %s /path/to/iso` command from above on the machine +that has the ISO. You can also obtain it from the Qubes website by hovering +over any ISO download button on the [downloads page](/downloads/). (You can +also view these values directly in the downloads page's [source +data](https://github.com/QubesOS/qubesos.github.io/blob/master/_data/downloads.yml).) +Once you have the exact size of the ISO in bytes, simply insert it into the +same command, for example: + +```shell_session +$ dd if=/dev/sdX bs=1M count=5791285248 iflag=count_bytes | sha256sum +``` + +If you wish to compute the values of other hash functions, you can replace +`sha256sum`, e.g., with `md5sum`, `sha1sum`, or `sha512sum`. + +In addition to checking hash values, you can also use GnuPG to verify the +detached PGP signature directly against the data on the USB drive. (This +assumes you're already familiar with [how to verify detached PGP signatures on +Qubes ISOs](#how-to-verify-detached-pgp-signatures-on-qubes-isos).) + +```shell_session +$ dd if=/dev/sdX bs=1M count= iflag=count_bytes | gpg -v --verify Qubes-RX-x86_64.iso.asc - +gpg: Signature made Thu 14 Jul 2022 08:49:38 PM PDT +gpg: using RSA key 5817A43B283DE5A9181A522E1848792F9E2795E9 +gpg: using pgp trust model +gpg: Good signature from "Qubes OS Release X Signing Key" [full] +gpg: binary signature, digest algorithm SHA256, key algorithm rsa4096 +5523+0 records in +5523+0 records out +5791285248 bytes (5.8 GB, 5.4 GiB) copied, 76.6013 s, 75.6 MB/s +``` + +(Where `/dev/sdX` is your USB drive, `` is the size of the original +ISO in bytes, and `Qubes-RX-x86_64.iso.asc` is the detached signature file of +the original ISO.) + +This command reads the exact number of bytes from your USB drive as the size of +the original ISO and pipes them into `gpg`. The usual form of a `gpg` +verification command is `gpg --verify `. Our command +is using shell redirection in order to use data from your USB drive as the +``, which is why the `-` at the end of the command is required. +Remember that you still must have properly imported and trusted the +[QMSK](#how-to-import-and-authenticate-the-qubes-master-signing-key) and +appropriate [RSK](#how-to-import-and-authenticate-release-signing-keys) in +order for this to work. + ## How to verify signatures on Git repository tags and commits Before we proceed, you must first complete the following prerequisite steps: From 2e3c43c8365301879ae009ff15f9ba7c5399044a Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Wed, 20 Jul 2022 22:56:56 -0700 Subject: [PATCH 019/308] Cross-link installation guide and re-verification section --- project-security/verifying-signatures.md | 20 ++++++++++--------- .../installation-guide.md | 3 +++ 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/project-security/verifying-signatures.md b/project-security/verifying-signatures.md index c301a591..6fd549df 100644 --- a/project-security/verifying-signatures.md +++ b/project-security/verifying-signatures.md @@ -554,7 +554,7 @@ FAQ](#troubleshooting-faq) below. _This is an optional section intended for advanced users._ -After you have authenticated your Qubes ISO and written it to your desired +After you have authenticated your Qubes ISO and written it onto your desired medium (such as a USB drive or optical disc), you can re-verify the data that has been written to your medium. Why would you want to do this when you've already verified the original ISO? Well, it's conceivable that a sufficiently @@ -570,14 +570,16 @@ cryptographically-signed (or both), as discussed in our [installation security considerations](/doc/install-security/). This section will walk through an example of re-verifying the installer on such -a device. We begin by assuming that you have just written your desired Qubes -ISO onto the USB drive. First, unplug your USB drive and flip the write protect -switch so that the data on the drive can no longer be altered. If you have a -different computer from the one you used to create the installation medium, -consider using that computer. If not, try to at least use a fresh VM (e.g., if -it's a Qubes system). The idea is that the original machine may have been -compromised, and using a different one for re-verification forces your -hypothetical adversary to compromise an additional machine in order to succeed. +a device. We begin by assuming that you have just [written your desired Qubes +ISO onto the USB +drive](/doc/installation-guide/#copying-the-iso-onto-the-installation-medium). +First, unplug your USB drive and flip the write protect switch so that the data +on the drive can no longer be altered. If you have a different computer from +the one you used to create the installation medium, consider using that +computer. If not, try to at least use a fresh VM (e.g., if it's a Qubes +system). The idea is that the original machine may have been compromised, and +using a different one for re-verification forces your hypothetical adversary to +compromise an additional machine in order to succeed. Now, our goal is to perform the same verification steps as we did with the original ISO, except, this time, we'll be reading the installer data directly diff --git a/user/downloading-installing-upgrading/installation-guide.md b/user/downloading-installing-upgrading/installation-guide.md index 05e6ffcb..18049d8e 100644 --- a/user/downloading-installing-upgrading/installation-guide.md +++ b/user/downloading-installing-upgrading/installation-guide.md @@ -92,6 +92,9 @@ chosen a different medium, please adapt the instructions accordingly. Note: There are important security considerations to keep in mind when choosing an installation medium. + Advanced users may wish to re-verify + their installation media after writing. -### Qubes 4.0 - Advanced users may wish to perform updates via the command-line interface. The recommended way to do this is by using the command-line equivalents of the **Qubes Update** tool. @@ -74,18 +72,13 @@ There are two Salt formulae and two corresponding `qubesctl` commands: - [`update.qubes-dom0`](/doc/salt/#updatequbes-dom0) - [`update.qubes-vm`](/doc/salt/#updatequbes-vm) +In your update qube, a terminal window opens that displays the progress of +operations and output as it is logged. At the end of the process, logs are sent +back to dom0. You answer any yes/no prompts in your dom0 terminal window. + Advanced users may also be interested in learning [how to enable the testing repos](/doc/testing/). -### Qubes 4.1 - -The recommendation, commands, and Salt formulae from 4.0 remain the same. - -Command-line updates in dom0 behave differently in 4.1. In your update qube, a -terminal window opens that displays the progress of operations and output as it -is logged. At the end of the process, logs are sent back to dom0. You answer any -yes/no prompts in your dom0 terminal window. - ## Upgrading to avoid EOL The above covers updating *within* a given operating system (OS) release. From dd29faae5e8aa13b65529dc9caa887eda2e95bfa Mon Sep 17 00:00:00 2001 From: NitrogenPointBlue Date: Mon, 15 Aug 2022 23:24:37 -0400 Subject: [PATCH 039/308] Apply grammar changes to "Using Git with Split GPG" --- user/security-in-qubes/split-gpg.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index bab2c917..625d70f5 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -226,8 +226,8 @@ Now that Keybase is configured to use `qubes-gpg-client-wrapper`, you will be ab ## Using Git with Split GPG -Git can be configured to used with Split GPG, something useful if you would like to contribute to the Qubes OS Project as every commit is required to be signed. -The most basic `~/.gitconfig` file to with working Split GPG looks something like this. +Git can be configured to utilize Split GPG, something useful if you would like to contribute to the Qubes OS Project as every commit is required to be signed. +The most basic `~/.gitconfig` file enabling Split GPG looks something like this. ``` [user] @@ -251,7 +251,7 @@ uid Qubes User ``` To sign commits, you now add the "-S" flag to your commit command, which should prompt for Split GPG usage. -If you would like automatically sign all commits, you can add the following snippet to `~/.gitconfig`. +If you would like to automatically sign all commits, you can add the following snippet to `~/.gitconfig`. ``` [commit] From 28281ee474dbcb23a81fb20e903ba9ccc5f5c853 Mon Sep 17 00:00:00 2001 From: NitrogenPointBlue Date: Mon, 15 Aug 2022 23:53:14 -0400 Subject: [PATCH 040/308] Format .gitconfig in "Using Git with Split GPG" Tabs were added as that is the default format created from running git config --global user.email "you@example.com" git config --global user.name "Your Name" --- user/security-in-qubes/split-gpg.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index 625d70f5..f4cef084 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -231,12 +231,12 @@ The most basic `~/.gitconfig` file enabling Split GPG looks something like this. ``` [user] -name = YOUR NAME -email = YOUR EMAIL ADDRESS -signingkey = YOUR KEY ID + name = + email = + signingKey = [gpg] -program = qubes-gpg-client-wrapper + program = qubes-gpg-client-wrapper ``` Your key id is the public id of your signing key, which can be found by running `qubes-gpg-client -k`. From f05c764c637c064812a82e4bd6194259b753236b Mon Sep 17 00:00:00 2001 From: NitrogenPointBlue Date: Tue, 16 Aug 2022 00:21:06 -0400 Subject: [PATCH 041/308] Update "qubes-gpg-client --list-keys" example Updated example with modern output including the "long" key id format. --- user/security-in-qubes/split-gpg.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index f4cef084..005099f4 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -239,15 +239,19 @@ The most basic `~/.gitconfig` file enabling Split GPG looks something like this. program = qubes-gpg-client-wrapper ``` -Your key id is the public id of your signing key, which can be found by running `qubes-gpg-client -k`. -In this instance, the key id is DD160C74. +Your key id is the public id of your signing key, which can be found by running `qubes-gpg-client --list-keys`. +In this instance, the key id is E142F75A6B1B610E0E8F874FB45589245791CACB. ```shell_session -[user@work-email ~]$ qubes-gpg-client -k +[user@work-email ~]$ qubes-gpg-client --list-keys /home/user/.gnupg/pubring.kbx ----------------------------- -pub rsa4096/DD160C74 2016-04-26 -uid Qubes User +pub ed25519 2022-08-16 [C] + E142F75A6B1B610E0E8F874FB45589245791CACB +uid [ultimate] Qubes User +sub ed25519 2022-08-16 [S] +sub cv25519 2022-08-16 [E] +sub ed25519 2022-08-16 [A] ``` To sign commits, you now add the "-S" flag to your commit command, which should prompt for Split GPG usage. From bd96f7025042e30989bb475e96131722d9d2ef1d Mon Sep 17 00:00:00 2001 From: NitrogenPointBlue Date: Tue, 16 Aug 2022 00:45:01 -0400 Subject: [PATCH 042/308] Format .gitconfig gpgSign example --- user/security-in-qubes/split-gpg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index 005099f4..b5a37af0 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -259,7 +259,7 @@ If you would like to automatically sign all commits, you can add the following s ``` [commit] -gpgsign = true + gpgSign = true ``` Lastly, if you would like to add aliases to sign and verify tags using the conventions the Qubes OS Project recommends, you can add the following snippet to `~/.gitconfig`. From b7c59badbbfe98502e0aa2dfcb0d6552849aa2a2 Mon Sep 17 00:00:00 2001 From: NitrogenPointBlue Date: Thu, 25 Aug 2022 04:01:45 -0400 Subject: [PATCH 043/308] Redirect sign and verify git tag aliases The 'stag' and 'vtag' git aliases are mentioned in both the Split GPG and the Code signing documents. Consolidated into the Code signing document. The Code signing version was kept as it explicitly calls the Bash shell. --- user/security-in-qubes/split-gpg.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index b5a37af0..a10ca40f 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -262,16 +262,7 @@ If you would like to automatically sign all commits, you can add the following s gpgSign = true ``` -Lastly, if you would like to add aliases to sign and verify tags using the conventions the Qubes OS Project recommends, you can add the following snippet to `~/.gitconfig`. - -``` -[alias] -stag = "!id=`git rev-parse --verify HEAD`; git tag -s user_${id:0:8} -m \"Tag for commit $id\"" -vtag = !git tag -v `git describe` -``` - -Replace `user` with your short, unique nickname. -Now you can use `git stag` to add a signed tag to a commit and `git vtag` to verify the most recent tag that is reachable from a commit. +Lastly, if you would like to add aliases to sign and verify tags using the conventions the Qubes OS Project recommends, refer to the [code signing documentation](/doc/code-signing/#using-pgp-with-git). ## Importing public keys From 2a5592ce9e2cf57064e0c5175ea7fd4fe466d04f Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Tue, 30 Aug 2022 00:19:39 -0700 Subject: [PATCH 044/308] Clarify that qubes-announce includes only Qubes-specific announcements --- introduction/support.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/introduction/support.md b/introduction/support.md index d7bee311..e1dbc880 100644 --- a/introduction/support.md +++ b/introduction/support.md @@ -328,8 +328,8 @@ required for any of these mailing lists. This is a read-only list for those who wish to receive only very important, infrequent messages. Only the core Qubes team can post to this list. Only -[Qubes Security Bulletins (QSBs)](/security/qsb/), new stable releases, -and end-of-life notices are announced here. +[Qubes Security Bulletins (QSBs)](/security/qsb/), new stable Qubes OS releases, +and Qubes OS release end-of-life notices are announced here. To subscribe, send a blank email to `qubes-announce+subscribe@googlegroups.com`. (Note: A Google account is **not** From fe965f05f9277cde64a7b152d7626a858793ed5e Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 5 Sep 2022 07:22:25 -0700 Subject: [PATCH 045/308] Clarify the two senses of "free" https://forum.qubes-os.org/t/13035/87 --- introduction/faq.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/introduction/faq.md b/introduction/faq.md index 45d4e56c..049104d2 100644 --- a/introduction/faq.md +++ b/introduction/faq.md @@ -23,13 +23,15 @@ Qubes OS is a security-focused operating system that allows you to organize your ### Is Qubes OS free and open-source software? -Qubes OS is provided at no cost (gratis), though [donations](/donate/) are greatly appreciated. +There are two distinct senses of the word "free" when it comes to free software. The difference in commonly expressed by the phrases "free as in beer" and "free as in speech." -All the software created by the Qubes OS Project is [free (libre) and open-source software (FOSS or FLOSS)](https://www.gnu.org/philosophy/floss-and-foss.en.html). +The first senses is straightforward. Qubes OS is "free as in beer," meaning that it is provided at no cost (_gratis_), though [donations](/donate/) are greatly appreciated. + +The second sense is more complicated. Qubes OS is *mostly* "free as in speech," but not entirely. All the software created by the Qubes OS Project *itself* is [free (libre) and open-source software (FOSS or FLOSS)](https://www.gnu.org/philosophy/floss-and-foss.en.html). This means that everyone is allowed to use, copy, study, and change the software in accordance with its [license](/doc/license/). It also means that the [source code](/doc/source-code/) is [publicly available](https://github.com/QubesOS/) so everyone can audit and contribute to it. -Since Qubes OS is a security-focused operating system, it includes some non-free firmware that was not created by the Qubes OS Project (such as CPU microcode), which is necessary in order to protect against known security vulnerabilities. +However, since Qubes OS is a security-focused operating system, it includes some non-free firmware that was not created by the Qubes OS Project (such as CPU microcode), which is necessary in order to protect against known security vulnerabilities. Moreover, the [architecture](/doc/architecture/) of Qubes OS as a meta-operating system means that it incorporates other software (including entire operating systems) from various upstream projects, some of which may include non-free software of their own. In order to make the installation process easier for a wide range of users across many different devices, standard Qubes [templates](/doc/templates/) also include some non-free firmware and drivers. From bf5ebfcf4f94ab93105dda7265decea74425defb Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Tue, 6 Sep 2022 10:25:47 -0700 Subject: [PATCH 046/308] Add links https://forum.qubes-os.org/t/13035/89 --- introduction/faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/introduction/faq.md b/introduction/faq.md index 049104d2..7dd5877b 100644 --- a/introduction/faq.md +++ b/introduction/faq.md @@ -27,7 +27,7 @@ There are two distinct senses of the word "free" when it comes to free software. The first senses is straightforward. Qubes OS is "free as in beer," meaning that it is provided at no cost (_gratis_), though [donations](/donate/) are greatly appreciated. -The second sense is more complicated. Qubes OS is *mostly* "free as in speech," but not entirely. All the software created by the Qubes OS Project *itself* is [free (libre) and open-source software (FOSS or FLOSS)](https://www.gnu.org/philosophy/floss-and-foss.en.html). +The second sense is more complicated. Qubes OS is *mostly* "free as in speech," but not entirely. All the software created by the Qubes OS Project *itself* is [free (or "libre")](https://www.gnu.org/philosophy/free-sw) and [open-source](https://opensource.org/docs/definition.html) software ([FOSS or FLOSS](https://www.gnu.org/philosophy/floss-and-foss.en.html)). This means that everyone is allowed to use, copy, study, and change the software in accordance with its [license](/doc/license/). It also means that the [source code](/doc/source-code/) is [publicly available](https://github.com/QubesOS/) so everyone can audit and contribute to it. From b80628e2cf2233614b37cbf470166d9edb809136 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Thu, 8 Sep 2022 16:56:16 -0700 Subject: [PATCH 047/308] Remove unused, deprecated page https://groups.google.com/g/qubes-devel/c/ASj7tehn1G0/m/jhLmFjdMBwAJ --- developer/general/join.md | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 developer/general/join.md diff --git a/developer/general/join.md b/developer/general/join.md deleted file mode 100644 index 3e5e036a..00000000 --- a/developer/general/join.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -lang: en -layout: doc -permalink: /join/ -ref: 26 -title: Join ---- - -The Qubes OS Project does not currently have any open positions. -This page will be updated when open positions become available. -In the meantime, there are many different ways you can [contribute to the Qubes OS project](/doc/contributing/). From a3bbdfc35e5e6cc6da0d068805318e815b522603 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Thu, 8 Sep 2022 16:56:51 -0700 Subject: [PATCH 048/308] Add missing forward slash to URL The link is not actually broken. It already works, since your browser just adds the missing forward slash automatically. This just makes it technically syntactically correct. https://groups.google.com/g/qubes-devel/c/ASj7tehn1G0/m/jhLmFjdMBwAJ --- developer/general/documentation-style-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/developer/general/documentation-style-guide.md b/developer/general/documentation-style-guide.md index 565587e9..45064074 100644 --- a/developer/general/documentation-style-guide.md +++ b/developer/general/documentation-style-guide.md @@ -273,7 +273,7 @@ wish to write documentation and submit it to the core docs, but they see only their own writing process and fail to consider that it will have to be kept up-to-date and consistent with the rest of the docs for years afterward. Submissions to the core docs also have to [undergo a review -process](/doc/how-to-edit-the-documentation#security) to ensure accuracy before +process](/doc/how-to-edit-the-documentation/#security) to ensure accuracy before being merged, which takes up valuable time from the team. We aim to maintain high quality standards for the core docs (style and mechanics, formatting), which also takes up a lot of time. If the documentation involves anything From fabed81d63275a68ce5ef6ea60f2dfce062ce1dd Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Thu, 8 Sep 2022 17:16:06 -0700 Subject: [PATCH 049/308] Move not-easily-convertible files to main repo; remove deprecated files https://groups.google.com/g/qubes-devel/c/ASj7tehn1G0/m/jhLmFjdMBwAJ --- project-security/canary-checklist.md | 24 ----------- project-security/canary-template.md | 12 ------ project-security/canary.md | 29 ------------- project-security/pgp-keys.md | 8 ---- project-security/qsb-checklist.md | 26 ------------ project-security/qsb-template.md | 12 ------ project-security/qsb.md | 23 ---------- project-security/xsa.md | 42 ------------------- .../downloads.md | 11 ----- user/hardware/hcl.md | 16 ------- 10 files changed, 203 deletions(-) delete mode 100644 project-security/canary-checklist.md delete mode 100644 project-security/canary-template.md delete mode 100644 project-security/canary.md delete mode 100644 project-security/pgp-keys.md delete mode 100644 project-security/qsb-checklist.md delete mode 100644 project-security/qsb-template.md delete mode 100644 project-security/qsb.md delete mode 100644 project-security/xsa.md delete mode 100644 user/downloading-installing-upgrading/downloads.md delete mode 100644 user/hardware/hcl.md diff --git a/project-security/canary-checklist.md b/project-security/canary-checklist.md deleted file mode 100644 index cb3a3c53..00000000 --- a/project-security/canary-checklist.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/canary/checklist/ -redirect_from: -- /security/canaries/checklist/ -ref: 216 -title: Qubes canary checklist ---- - -## Preparation - -* Draft canary and push to private repository -* Finalize canary, sign, and add signed tags - -## Announcement - -* Push canary to public repository -* Publish a [news post](/news/) using the [Canary - Template](/security/canary/template/) -* Send the content of the news post to the appropriate [mailing - lists](/support/) -* Share link to news post on social media -* Set a reminder for the next canary diff --git a/project-security/canary-template.md b/project-security/canary-template.md deleted file mode 100644 index a32e6275..00000000 --- a/project-security/canary-template.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/canary/template/ -redirect_from: -- /security/canaries/template/ -- /doc/canaries/template/ -redirect_to: -- https://github.com/QubesOS/qubes-secpack/blob/master/canaries/canary-template.txt -ref: 212 -title: Qubes canary template ---- diff --git a/project-security/canary.md b/project-security/canary.md deleted file mode 100644 index f7ea2e98..00000000 --- a/project-security/canary.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/canary/ -redirect_from: -- /security/canaries/ -- /doc/canaries/ -ref: 208 -title: Qubes canaries ---- - -A **Qubes canary** is a security announcement periodically issued by the [Qubes -security team](/security/#qubes-security-team) through the [Qubes security -pack](/security/pack/) consisting of several statements to the effect that the -signers of the canary have not been compromised. The idea is that, as long as -signed canaries including such statements continue to be published, all is -well. However, if the canaries should suddenly cease, if one or more signers -begin declining to sign them, or if the included statements change -significantly without plausible explanation, then this may indicate that -something has gone wrong. - -The name originates from the practice in which miners would bring caged -canaries into coal mines. If the level of methane gas in the mine reached a -dangerous level, the canary would die, indicating to miners that they should -evacuate. See [Wikipedia: warrant -canary](https://en.wikipedia.org/wiki/Warrant_canary) for more information, but -bear in mind that Qubes Canaries are not strictly limited to legal warrants. - -## Full list diff --git a/project-security/pgp-keys.md b/project-security/pgp-keys.md deleted file mode 100644 index 2e20da7a..00000000 --- a/project-security/pgp-keys.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/pgp-keys/ -redirect_to: https://keys.qubes-os.org/keys/ -ref: 250 -title: PGP keys ---- diff --git a/project-security/qsb-checklist.md b/project-security/qsb-checklist.md deleted file mode 100644 index 7fbf32af..00000000 --- a/project-security/qsb-checklist.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/qsb/checklist/ -redirect_from: -- /security/bulletins/checklist/ -- /doc/security-bulletins/checklist/ -ref: 215 -title: Qubes security bulletin (QSB) checklist ---- - -## Preparation - -* Draft QSB and push to private repository -* Build fixed packages -* Finalize QSB, sign, and add signed tags - -## Announcement - -* Upload packages to `security-testing` and `current-testing` repositories -* Push QSB to public repository -* Publish a [news post](/news/) using the [QSB - Template](/security/qsb/template/) -* Send the content of the news post to the appropriate [mailing - lists](/support/) -* Share link to news post on social media diff --git a/project-security/qsb-template.md b/project-security/qsb-template.md deleted file mode 100644 index aa128d28..00000000 --- a/project-security/qsb-template.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/qsb/template/ -redirect_from: -- /security/bulletins/template/ -- /doc/security-bulletins/template/ -redirect_to: -- https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-template.txt -ref: 209 -title: Qubes security bulletin (QSB) template ---- diff --git a/project-security/qsb.md b/project-security/qsb.md deleted file mode 100644 index 089f7138..00000000 --- a/project-security/qsb.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/qsb/ -redirect_from: -- /security/bulletins/ -- /doc/security-bulletins/ -- /en/doc/security-bulletins/ -- /doc/SecurityBulletins/ -- /wiki/SecurityBulletins/ -- /trac/wiki/SecurityBulletins/ -ref: 218 -title: Qubes security bulletins (QSBs) ---- - -A **Qubes security bulletin (QSB)** is a security announcement issued by the -[Qubes security team](/security/#qubes-security-team) through the [Qubes -security pack](/security/pack/). A QSB typically provides a summary and impact -analysis of one or more recently-discovered software vulnerabilities, including -details about patching to address them. For Xen Security Advisories (XSAs), see -the [XSA tracker](/security/xsa/). - -## Full list diff --git a/project-security/xsa.md b/project-security/xsa.md deleted file mode 100644 index 77dfe88f..00000000 --- a/project-security/xsa.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -lang: en -layout: doc -permalink: /security/xsa/ -ref: 214 -title: Xen security advisory (XSA) tracker ---- - -This tracker shows whether Qubes OS is affected by any given [Xen security -advisory (XSA)](https://xenbits.xen.org/xsa/). Shortly after a new XSA is -published, we will add a new row to this tracker. Whenever Qubes is -significantly affected by an XSA, a [Qubes security bulletin -(QSB)](/security/qsb/) is published, and a link to that QSB is added to -the row for the associated XSA. - -Under the "Is Qubes Affected?" column, there are two possible values: **Yes** -or **No**. - -* **Yes** means that the *security* of Qubes OS *is* affected. -* **No** means that the *security* of Qubes OS is *not* affected. - -## Important notes - -* For the purpose of this tracker, we do *not* classify mere [denial-of-service - (DoS) attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack) as - affecting the *security* of Qubes OS. Therefore, if an XSA pertains *only* to - DoS attacks against Qubes, the value in the "Is Qubes Affected?" column will - be **No**. -* For simplicity, we use the present tense ("is affected") throughout this - page, but this does **not** necessarily mean that up-to-date Qubes - installations are *currently* affected by any particular XSA. In fact, it is - extremely unlikely that any up-to-date Qubes installations are vulnerable to - any XSAs on this page, since patches are almost always published concurrently - with QSBs. Please read the QSB (if any) for each XSA for patching details. -* Embargoed XSAs are excluded from this tracker until they are publicly - released, since the [Xen security - policy](https://www.xenproject.org/security-policy.html) does not permit us - to state whether Qubes is affected prior to the embargo date. -* Unused and withdrawn XSA numbers are included in the tracker for the sake of - completeness, but they are excluded from the [statistics](#statistics) - section for the sake of accuracy. -* All dates are in UTC. diff --git a/user/downloading-installing-upgrading/downloads.md b/user/downloading-installing-upgrading/downloads.md deleted file mode 100644 index 8ea9d05d..00000000 --- a/user/downloading-installing-upgrading/downloads.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -lang: en -layout: site -permalink: /downloads/ -redirect_from: -- /doc/QubesDownloads/ -- /wiki/QubesDownloads/ -ref: 2 -title: Download Qubes OS ---- -{% include downloads.html %} diff --git a/user/hardware/hcl.md b/user/hardware/hcl.md deleted file mode 100644 index 3c1f3ff3..00000000 --- a/user/hardware/hcl.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -lang: en -layout: hcl -model: all -permalink: /hcl/ -redirect_from: -- /doc/hcl/ -- /compatible-hardware/ -- /en/doc/hcl/ -- /doc/HCL/ -- /wiki/HCL/ -- /wiki/HCLR1/ -- /wiki/HCL-R2B2/ -ref: 143 -title: Hardware compatibility list (HCL) ---- From ab6125ac3f286b033827e76deac069d8f61ae12e Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Thu, 8 Sep 2022 17:29:50 -0700 Subject: [PATCH 050/308] Move Admin API table back into main document https://groups.google.com/g/qubes-devel/c/ASj7tehn1G0/m/jhLmFjdMBwAJ --- developer/services/admin-api-table.md | 11 ---- developer/services/admin-api.md | 94 +++++++++++++++++++++++++-- 2 files changed, 89 insertions(+), 16 deletions(-) delete mode 100644 developer/services/admin-api-table.md diff --git a/developer/services/admin-api-table.md b/developer/services/admin-api-table.md deleted file mode 100644 index ad60fef9..00000000 --- a/developer/services/admin-api-table.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -lang: en -layout: fullscreen -permalink: /doc/admin-api/table/ -ref: 249 -title: Admin API table ---- - -This page displays the fullscreen table from [Admin API](/doc/admin-api/). - -{% include admin-api-table.md %} diff --git a/developer/services/admin-api.md b/developer/services/admin-api.md index 03678282..8fa12417 100644 --- a/developer/services/admin-api.md +++ b/developer/services/admin-api.md @@ -8,6 +8,7 @@ redirect_from: - /doc/mgmt1/ - /doc/mgmt-architecture/ - /doc/admin-api-architecture/ +- /doc/admin-api/table/ ref: 36 title: Admin API --- @@ -61,11 +62,94 @@ yet documented. The API should be implemented as a set of qrexec calls. This is to make it easy to set the policy using current mechanism. -[View this table on a fullscreen page.](/doc/admin-api/table/) - -{% include admin-api-table.md %} - -[View this table on a fullscreen page.](/doc/admin-api/table/) +| call | dest | argument | inside | return | note | +| ------------------------------------- | --------- | --------- | ----------------------------------------- | --------------------------------------------------------- | ---- | +| `admin.vmclass.List` | `dom0` | - | - | `\n` | +| `admin.vm.List` | `dom0|` | - | - | ` class= state=\n` | +| `admin.vm.Create.` | `dom0` | template | `name= label=