sys-usb

PCI handler of USB devices in Qubes OS.

Description
Installation
Access control
Usage
Credits

Description

Setup named disposables for USB qubes. During creation, it tries to separate the USB controllers to different qubes is possible.

Installation

Top:

qubesctl top.enable sys-usb
qubesctl --targets=tpl-sys-usb state.apply
qubesctl top.disable sys-usb

State:

qubesctl state.apply sys-usb.create
qubesctl --skip-dom0 --targets=tpl-sys-usb state.apply sys-usb.install

If you use an USB keyboard, also run:

qubesctl state.apply sys-usb.keyboard

Install the proxy on the client template:

qubesctl --skip-dom0 --targets=tpl-QUBE state.apply sys-usb.install-client-proxy

If the client requires decrypting a device, install on the client template:

qubesctl --skip-dom0 --targets=tpl-QUBE state.apply sys-usb.install-client-cryptsetup

If the client requires a FIDO device, install on the client template:

qubesctl --skip-dom0 --targets=tpl-QUBE state.apply sys-usb.install-client-fido

And enable the CTAP Proxy service for the client qubes:

qvm-features QUBE service.qubes-ctap-proxy 1

Access control

No extra services are implemented, consult upstream to learn how to use the following services:

qubes.InputMouse, qubes.InputKeyboard, qubes.InputTablet;
ctap.GetInfo, ctap.ClientPin, u2f.Register, u2f.Authenticate, policy.RegisterArgument.

Usage

Depending on you system, one or more USB qubes will be created to hold the different controllers. The qube names are disp-sys-usb, disp-sys-usb-left, disp-sys-usb-dock.

Start a USB qube an connect a device to it. USB PCI devices will appear on the system tray icon qui-devices. From there, assign it to the intended qube.

Credits

Unman

2.0 KiB Raw Blame History