At 32c3 we’ve discussed moving to an qrexec based updates proxy also. I haven’t found a ticket for this yet, but all of the above influences when and how this should be fixed.
What’s your opinion, when and how this should be implemented? Any [other] tickets the block/influence this? @marmarek
Sorry. I am interested in any option. Just highlighting @marmarek so he is getting e-mail notifications as Marek may not have the whole Whonix forums subscribed since its generating lots of traffic. And because I am not sure anymore we discussed this at 32c3 and what we concluded.
have updates proxy running over qrexec instead of TCP/IP, so template will not have its own netvm at all
ease integration of “qubes firewall rules” with other firewalls (like Whonix one)
So, those are two (related) things: default rules for the template, not enforced by Whonix (will be solved by “1”), and AppVM firewall rules generally when Whonix gateway is in use (“2” will ease solving it, but itself will not be enough).
Any suggestion on how to implement it without re-inventing qubes-core-agent-linux/network/qubes-firewall? Or refactoring the Qubes code so Whonix can just call the required portion of it?
)