Commit Graph

133 Commits

Author SHA1 Message Date
Ben Grande
8ff19988d0 feat: install available sequoia-pgp tools 2024-01-31 14:51:17 +01:00
Ben Grande
b5d7371f93 fix: thunar requires xfce helpers to find terminal 2024-01-31 14:42:17 +01:00
Ben Grande
c08b39decc feat: add torrent client to fetcher 2024-01-30 19:32:05 +01:00
Ben Grande
6efcc1da77 chore: copyright update 2024-01-29 16:49:54 +01:00
Ben Grande
b01f2d213a chore: move port forward to dom0 formula
The script can be used with sys-cacher, sys-pihole, sys-syncthing,
sys-ssh and many services you'd want to forward, make it reusable.
2024-01-29 12:11:51 +01:00
Ben Grande
30f2ebe4ce fix: port forward validate values from DomUs 2024-01-29 12:06:33 +01:00
Ben Grande
cb4ff00113 doc: typo in mirage firewall usage 2024-01-28 23:28:00 +01:00
Ben Grande
9183828985 fix: fail early when qubes.VMShell is unsupported
Happens with Mirage Unikernel, as it doesn't have a proper shell.

Fixes: https://github.com/ben-grande/qusal/issues/1
2024-01-28 23:25:03 +01:00
Ben Grande
77d82811ad ci: lint pull request 2024-01-28 23:13:24 +01:00
Ben Grande
03cb70c2c2 fix: port forwarder missing short options usage 2024-01-27 17:05:56 +01:00
Ben Grande
dab297905c fix: mail qrexec policy missing disp in name 2024-01-27 11:38:28 +01:00
Ben Grande
aec644bfc6 feat: add qubes img and pdf converter media qubes 2024-01-26 22:49:18 +01:00
Ben Grande
a04960c1c6 feat: initial split-mail setup
Split-mail allows to separate the receving, reading/composing and
sending of mails to separate qubes, while having the reading/composing
qube offline and a manual step necessary to authorize mails to be sent
form the sender qube.
2024-01-26 22:46:36 +01:00
Ben Grande
7ec20f1863 fix: add file browser to reader
We are already trusting many applications to display files, adding a
file browser is a huge usability improvement in this case.
2024-01-23 13:27:15 +01:00
Ben Grande
e1fe461eb8 doc: project signature verification in dom0 2024-01-22 18:49:17 +01:00
Ben Grande
bd255af41f fix: cleanup audio home directory 2024-01-22 18:42:54 +01:00
Ben Grande
d23a6da9fc doc: separate documents per use case
The main README is very large, by placing the documents in a separate
directory, we allow the user to choose explicitly what they read, giving
a better reading experience and allows a deeper understanding of the
project.
2024-01-22 18:38:04 +01:00
Ben Grande
adba858477 fix: add whonix dvm 2024-01-22 10:56:31 +01:00
Ben Grande
d75a59f54b fix: update dotfiles module 2024-01-21 23:40:55 +01:00
Ben Grande
67403a17a3 feat: whonix setup independent from OEM
Depending on OEM will conflict the state IDs because they are the name
of the qubes being created. As not much changes are needed and we
customize much more, stop depending on upstream.
2024-01-21 23:04:41 +01:00
Ben Grande
3e6ba8ff82 fix: client install the ssh-agent client packages
The client should install the agent client packages and not the
opposite. The way it was, it would not be possible to include the agent
client packages to the ssh client, as it would create a recursive loop.
2024-01-21 22:04:34 +01:00
Ben Grande
97c644a09c fix: invert builder memory and vcpus 2024-01-20 19:51:45 +01:00
Ben Grande
422b01e0f6 feat: remove audiovm setting when unnecessary
Decrease audio attack surface to qubes that will never need to use it.
2024-01-20 19:34:39 +01:00
Ben Grande
71dd9a5280 doc: bluetooth system tray 2024-01-19 12:16:34 +01:00
Ben Grande
4ef0d05279 feat: seamless audio integration with bluetooth 2024-01-19 11:18:37 +01:00
Ben Grande
b95cc6da43 feat: pavucontrol in sys-audio
The mixer provided by the program volumeicon is okay, it shows only one
input and one output. Pavucontrol correctly detects the different inputs
and output of each audio client, you can have deeper control of the
client volume.
2024-01-19 10:14:22 +01:00
Ben Grande
04a016e876 doc: attacker can display a large byte set 2024-01-18 19:49:15 +01:00
Ben Grande
0887c24a19 fix: remove unicode from used files
No considering license, copyright notices kept outside of the installed
directories, but excluding keys that have unicode in their comment
section.
2024-01-18 15:23:52 +01:00
Ben Grande
f8ea066b2b doc: how to update the repository
As it is not easy to get files to dom0 and we don't want to reimplement
a package manager, crude Git is the solution as of know.

With Git we have the following advantages: native fetch format for
source controlled files, cleaner command-line, automatic signature
verification during merge, the disadvantage is that it is not included
by default in Dom0 and filtering it's stdout chars are not possible.
Note that the remote can report messages to the client via stderr, which
is filtered already, and if it tries to send an escape sequence to
stdout, the operation will fail with 'bad line length character: CHAR'
printed to stderr on the client, unfiltered by qrexec, but filtered to
some extent by the git client. If it is an escape character, the char is
transformed to "?", but UTF-8 multibyte characters are not filtered. Up
to 4 bytes can be displayed.

Tar on the other hand is already installed, but it is much ancient and
it's file parsing caused CVEs in the past relatively more drastic than
Git, it also doesn't only include committed files, it can include any
file that is present in the directory, which by far, increases a lot of
the attack surface unless you reset the state to HEAD, clean .git
directory manually and there are possibly other avenues of attack.
2024-01-18 15:22:35 +01:00
Ben Grande
9b740d8314 feat: allow to run setup outside of its directory 2024-01-18 09:25:01 +01:00
Ben Grande
0dd627b670 fix: update dotfiles module 2024-01-18 09:24:36 +01:00
Ben Grande
23bccebaab fix: dom0 as sys-git client
The salt module git.config_get does not work in Dom0 and does not have
a key to set the system gitconfig.
2024-01-18 09:21:21 +01:00
Ben Grande
3faa523820 feat: usb devices in sys-audio
Introduces support for USB connected devices such as Bluetooth and
camera, microphone as well as their integrated versions.
2024-01-17 16:52:55 +01:00
Ben Grande
6bf9b97a36 fix: help option for port forwarder 2024-01-16 12:11:31 +01:00
Ben Grande
80638d64b5 feat: port forwarder
If persistent rules are chosen, it can deal with disposable sys-net, but
not with disposable sys-firewall, as the qube ip will change, the rule
won't work. Applying the rule to the disposable template is a "try it
all", but it's usage is discouraged.
2024-01-16 00:15:29 +01:00
Ben Grande
c3937e881e fix: disposable sys-audio name with disp prefix 2024-01-14 14:05:17 +01:00
Ben Grande
ff4773bf8e doc: kicksecure missing minimal flavor 2024-01-14 08:52:24 +01:00
Ben Grande
23a569d4e1 fix: install less browser packages in reader
The state browse.install installs extraneous packages that we won't
need for an untrusted environment, such as USB and audio support.
2024-01-12 19:47:52 +01:00
Ben Grande
2576d14448 fix: policy file mode not allowing group to write 2024-01-12 19:44:55 +01:00
Ben Grande
ac25ef6b87 fix: sys-usb hide-usb-from-dom0 in keyboard state 2024-01-12 19:08:56 +01:00
Ben Grande
8d7c0a2d0b fix: sys-cacher policy with the new tag name 2024-01-12 18:34:04 +01:00
Ben Grande
2063a4328c fix: clone macro support for optional argument 2024-01-12 18:22:33 +01:00
Ben Grande
6eefceda74 fix: sys-usb disposables must have name prefix 2024-01-12 18:22:18 +01:00
Ben Grande
6828e83dde fix: update dotfiles module 2024-01-12 18:00:40 +01:00
Ben Grande
7eb1f34f73 feat: disposable mirage firewall 2024-01-12 17:58:56 +01:00
Ben Grande
5502103901 fix: separate template formula per flavor
Default template flavor is Gnome, installing Xfce when requesting the
template formula without flavor causes confusion.
2024-01-12 17:47:21 +01:00
Ben Grande
233ac76bcb fix: sys-cacher tag compliance with default tags
The default tags start with the capability than the qube name, such as
audiovm-dom0 and guivm-dom0.
2024-01-12 17:30:29 +01:00
Ben Grande
5e5ae2f704 fix: zsh state import with relative path
Relative path only works well if it is on the salt root.
2024-01-12 17:24:43 +01:00
Ben Grande
a97e3c0c8a feat: kicksecure minimal template 2024-01-12 17:24:31 +01:00
Ben Grande
2b6daac8a9 fix: shellcheck 2024-01-10 14:31:57 +01:00