Qubes sudo / su / root Hardening - Development Discussion

[Patrick]

See:

Restrict root access

We’ve identified a less likely case where user-sysmaint-split can be useful on Whonix-Gateway. A process running on Whonix-Gateway might get compromised in theory such as Tor or onion-grater. Once malware is running under account debian-tor or onion-grater, we don’t want these to have access to sudo’s or pkexec’s SUID attack surface. Hence, it’s best if Whonix-Gateway runs in user session. Non-Qubes-Whonix: Ideally, when updating Whonix-Gateway, it’s best to shutdown any Whonix-Workstation (…

(Written just now.)

Additionally, this simplifies (unifies) our code base. Previously - in the unreleased version only - a Whonix-Gateway without user-sysmaint-split had shown up as “user session” in Qubes VM Manager (QVMM). This looked a bit confusing. Fixing that would have required major refactoring.

By having user-sysmaint-split, QVMM advanced tab looks simpler. App Qubes start in user session by default. Templates start in sysmaint mode by default.