Skip to content

Make it more difficult to attach domU devices to dom0 #10825

@emanruse

Description

@emanruse

Qubes OS release

4.3.0

Brief summary

Although it is not possible to attach a device to dom0 from qui-devices, it is possible to do it from command line.

Steps to reproduce

root@disp624:/tmp/foo # truncate -s 2G file.img
root@disp624:/tmp/foo # mkfs.ext4 file.img >/dev/null 2>&1
root@disp624:/tmp/foo # losetup -f file.img
root@disp624:/tmp/foo #                                                         
 
user@dom0:~ > qvm-device block list
BACKEND:DEVID   DESCRIPTION                                          USED BY
dom0:dm-5       Block_Storage: hosted by dom0 qubes dom0-swap
disp624:loop0  Block_Storage: hosted by disp624 /tmp/foo/file.img
user@dom0:~ > qvm-device block attach dom0 disp624:loop0
user@dom0:~ > qvm-device block list
BACKEND:DEVID   DESCRIPTION                                          USED BY
dom0:dm-5       Block_Storage: hosted by dom0 qubes dom0-swap
disp624:loop0  Block_Storage: hosted by disp624 /tmp/foo/file.img  dom0 (attached: read-only=no, frontend-dev=xvdi)

Expected behavior

Attaching a device this way should be impossible by default, just like it is not possible through gui-devices.

Actual behavior

In STR.

Metadata

Metadata

Assignees

Labels

C: coreThis issue pertains to a Qubes core component.P: defaultPriority: default. Default priority for new issues, to be replaced given sufficient information.good first issueThis is a recommended issue for first-time contributors.pr submittedA pull request has been submitted for this issue.securityThis issue pertains to the security of Qubes OS.uxThis issue pertains to the user experience (UX) in Qubes OS.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions