f9ead06408
Updates happens multiple times, normally 2 to 3, even if we consider a state without includes. On states with multiple includes, it could easily get approximately 10 updates being ran. This behavior leads to unnecessary network bandwidth being spent and more time to run the installation state. When the connection is slow and not using the cacher, such as torified connections on Whonix, the installation can occurs much faster. Adding external repositories has to be done prior to update to ensure it is also fetched. Fixes: https://github.com/ben-grande/qusal/issues/29 |
||
|---|---|---|
| .. | ||
| files | ||
| clone.sls | ||
| clone.top | ||
| create.sls | ||
| create.top | ||
| init.top | ||
| install-developers.sls | ||
| install-developers.top | ||
| install-repo.sls | ||
| install-repo.top | ||
| install.sls | ||
| install.top | ||
| kernel-default.sls | ||
| kernel-default.top | ||
| kernel-hvm.sls | ||
| kernel-hvm.top | ||
| kernel-pv.sls | ||
| kernel-pv.top | ||
| prefs.sls | ||
| prefs.top | ||
| README.md | ||
| template.jinja | ||
kicksecure-minimal
Kicksecure Minimal Template in Qubes OS.
Table of Contents
Description
Creates the Kicksecure Minimal template as well as a Disposable Template based on it.
Installation
- Top:
sudo qubesctl top.enable kicksecure-minimal
sudo qubesctl --targets=kicksecure-17-minimal state.apply
sudo qubesctl top.disable kicksecure-minimal
sudo qubesctl state.apply kicksecure-minimal.prefs
- State:
sudo qubesctl state.apply kicksecure-minimal.create
sudo qubesctl --skip-dom0 --targets=kicksecure-17-minimal state.apply kicksecure-minimal.install
sudo qubesctl state.apply kicksecure-minimal.prefs
Kicksecure Developers Installation
If you want to help improve Kicksecure integration on Qubes, install packages
that are known to be broken on Qubes and can break the boot of the Kicksecure
Qube, to report bugs upstream (get a terminal with qvm-console-dispvm):
sudo qubesctl --skip-dom0 --targets=kicksecure-17-minimal state.apply kicksecure-minimal.install-developers
Choose the kernel according to the virt_mode you want for the template:
hvm:
sudo qubesctl state.apply kicksecure-minimal.kernel-hvm
pvh:
sudo qubesctl state.apply kicksecure-minimal.kernel-pv
- Dom0 provided kernel (resets
virt_modetopvh):
sudo qubesctl state.apply kicksecure-minimal.kernel-default
Usage
AppVMs and StandaloneVMs can be based on this template.
Kicksecure Developers Usage
This is intended for Kicksecure Developers to test known to be broken hardening measures. It is not intended for other developers or users.
After you have ran the developers SaltFile, when reporting bugs upstream, share the following information of the customizations made by this formula:
hardened-malloc:
libhardened_malloc.so
hide-hardware-info:
sysfs_whitelist=0
cpuionfo_whitelist=0
permission-hardener:
whitelists_disable_all=true