On Mon, May 04, 2020 at 11:21:18PM +0200, Olaf Klinke wrote: > Where in the documentation is that stated? The manpage of qvm-device > does not mention this. The only hint is that all examples of qvm-usb in > the documentation show sys-usb as backend.
for example in the documentation about usb devices: https://www.qubes-os.org/doc/usb-devices/ "Note: you cannot pass through devices from dom0 (in other words: a USB qube is required)." > 3. Putting the USB keyboard in a qube can and has locked users out of > their systems. forgetting their luks passphrase and careless use of fdisk also can and has locked people out of their systems. doesnt mean we remove disk encryption or all tools that can write to a disk in the wrong place. disabling autostart for the usbvm that has your keyboard is a pretty solid way to avoid locking yourself out hard. and shooting your own foot with it every now and then tends to be educational, just like remote administration of firewalls. :D > 4. If possible, keep the input devices (and only those) attached to > dom0 while attaching all others to sys-usb. i would put _all_ usb controllers into usbvms, even the one(s) used for privileged devices. you still need to make sure that the kbd one is attached to dom0 during boot though. > Luckily I seem to have two USB controllers for my peripheral USB ports, > so I can easily separate input- from other USB-devices. Is (4) i recommend you check if this is actualy the case. there are some _really_ weird USB setups where it looks like different controllers, but it is really just multiple pci devices on the same physical controller. and usb devices plugged into the same usb port end up on one or the other "controller" depending on speed negotiated. my check would be to configure different usbvms for each controller, then plug around some devices between physical ports and see in which vm they end up, and keep notes on that. > possible/recommended? The documentation shows how to hide _all_ USB > controllers from dom0, so I assume one can also choose to hide _some_. https://github.com/QubesOS/qubes-core-admin-linux/blob/master/dracut/modules.d/90qubes-pciback/qubes-pciback.sh rd.qubes.hide_pci=01:23.3,05:67.8 google is hard? perhaps you should consult a data scientist or so? :P -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20200504221655.GH987%40priv-mua.
