diff --git a/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf index 4fefe4f..40f9b59 100644 --- a/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf +++ b/usr/lib/permission-hardener.d/25_default_whitelist_qubes.conf @@ -12,10 +12,13 @@ ## qfile-unpacker allows unprivileged users in VMs to gain root privileges ## https://github.com/QubesOS/qubes-issues/issues/8633 ## -## match both: +## matches both: ## - /usr/lib/qubes/qfile-unpacker whitelist ## - Not bit-for-bit identical to /usr/lib/qubes/qfile-unpacker. ## - Stripping SUID from this does *not* break file copying. ## - TODO: further reserach required on its purpose ## - /usr/bin/qfile-unpacker +## - Appears to be an integral part of file transfer between qubes, stripping +## SUID from this in an AppVM results in that AppVM being unable to receive +## files any longer. (It can still send files to other qubes though.) qfile-unpacker matchwhitelist