Qubes sudo / su / root Hardening - Development Discussion

[nurmagoz]

@Patrick

upgrade-nonroot is broken at time of writing when qubes-core-agent-passwordless-root is not installed. But this, I’d like to fix soon.

Default or luxury? if default then dont fix, not the purpose. user need to use dom0 then use root to do root works inside Appvm/Template.

@Patrick

To fix this, to be able to perform passwordless operating system upgrades as user user, one solution is to allow group members of group user [1] need to be allowed to run sudo upgrade-nonroot.

No passwordless operating system upgrades as a user user (doesnt matter fixed for admin to replace that or not currently, implementation is no root given to user).

@Patrick

Otherwise the implementation for non-Qubes versus Qubes would differ, which would be a confusing usability issue.

Doesnt matter, let it be.