2024-01-14 02:52:24 -05:00
|
|
|
# kicksecure-minimal
|
2024-01-12 11:22:58 -05:00
|
|
|
|
2024-01-14 02:52:24 -05:00
|
|
|
Kicksecure Minimal Template in Qubes OS.
|
2024-01-12 11:22:58 -05:00
|
|
|
|
|
|
|
|
## Table of Contents
|
|
|
|
|
|
|
|
|
|
* [Description](#description)
|
|
|
|
|
* [Installation](#installation)
|
|
|
|
|
* [Usage](#usage)
|
|
|
|
|
|
|
|
|
|
## Description
|
|
|
|
|
|
2024-01-14 02:52:24 -05:00
|
|
|
Creates the Kicksecure Minimal template as well as a Disposable Template based
|
|
|
|
|
on it.
|
2024-01-12 11:22:58 -05:00
|
|
|
|
|
|
|
|
## Installation
|
|
|
|
|
|
|
|
|
|
- Top:
|
|
|
|
|
```sh
|
2024-01-14 02:52:24 -05:00
|
|
|
qubesctl top.enable kicksecure-minimal
|
|
|
|
|
qubesctl --targets=kicksecure-17-minimal state.apply
|
|
|
|
|
qubesctl top.disable kicksecure-minimal
|
|
|
|
|
qubesctl state.apply kicksecure-minimal.prefs
|
2024-01-12 11:22:58 -05:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- State:
|
|
|
|
|
<!-- pkg:begin:post-install -->
|
|
|
|
|
```sh
|
2024-01-14 02:52:24 -05:00
|
|
|
qubesctl state.apply kicksecure-minimal.create
|
|
|
|
|
qubesctl --skip-dom0 --targets=kicksecure-17-minimal state.apply kicksecure-minimal.install
|
|
|
|
|
qubesctl state.apply kicksecure-minimal.prefs
|
2024-01-12 11:22:58 -05:00
|
|
|
```
|
|
|
|
|
<!-- pkg:end:post-install -->
|
|
|
|
|
|
2024-02-03 14:58:28 -05:00
|
|
|
### Kicksecure Developers Installation
|
|
|
|
|
|
2024-01-14 02:52:24 -05:00
|
|
|
If you want to help improve Kicksecure integration on Qubes, install packages
|
2024-02-01 11:40:26 -05:00
|
|
|
that are known to be broken on Qubes and can break the boot of the Kicksecure
|
|
|
|
|
Qube, to report bugs upstream (get a terminal with `qvm-console-dispvm`):
|
2024-01-12 11:22:58 -05:00
|
|
|
```sh
|
2024-02-01 11:40:26 -05:00
|
|
|
qubesctl --skip-dom0 --targets=kicksecure-17-minimal state.apply kicksecure-minimal.install-developers
|
2024-01-12 11:22:58 -05:00
|
|
|
```
|
|
|
|
|
|
2024-02-03 14:58:28 -05:00
|
|
|
Choose the `kernel` according to the `virt_mode` you want for the template:
|
|
|
|
|
|
|
|
|
|
- `hvm`:
|
|
|
|
|
```sh
|
|
|
|
|
qubesctl state.apply kicksecure-minimal.kernel-hvm
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- `pvh`:
|
|
|
|
|
```sh
|
|
|
|
|
qubesctl state.apply kicksecure-minimal.kernel-pv
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- Dom0 provided kernel (resets `virt_mode` to `pvh`):
|
|
|
|
|
```sh
|
|
|
|
|
qubesctl state.apply kicksecure-minimal.kernel-default
|
|
|
|
|
```
|
|
|
|
|
|
2024-01-12 11:22:58 -05:00
|
|
|
## Usage
|
|
|
|
|
|
|
|
|
|
AppVMs and StandaloneVMs can be based on this template.
|
2024-02-02 03:57:19 -05:00
|
|
|
|
2024-02-03 14:58:28 -05:00
|
|
|
### Kicksecure Developers Usage
|
2024-02-02 03:57:19 -05:00
|
|
|
|
|
|
|
|
This is intended for Kicksecure Developers to test known to be broken
|
|
|
|
|
hardening measures. It is not intended for other developers or users.
|
|
|
|
|
|
|
|
|
|
After you have ran the developers SaltFile, when reporting bugs upstream,
|
|
|
|
|
share the following information of the customizations made by this formula:
|
|
|
|
|
|
|
|
|
|
- `hardened-malloc`:
|
|
|
|
|
```
|
|
|
|
|
libhardened_malloc.so
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- `hide-hardware-info`:
|
|
|
|
|
```
|
|
|
|
|
sysfs_whitelist=0
|
|
|
|
|
cpuionfo_whitelist=0
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- `permission-hardener`:
|
|
|
|
|
```
|
|
|
|
|
whitelists_disable_all=true
|
|
|
|
|
```
|
