2

I was looking at the awesome Qubes OS and I love the idea of the virtualization security setup and was wondering if it's possible to potentially get a similar concept on a standard Linux Desktop.

  1. Can I run applications on my Host machine in separate VMs? For example have Firefox installed and have two separate Firefox instances that can't infect each other. I'd hate to install Virtualbox and have to use different Operating systems for certain tasks or purposes. I don't know if Sanboxing is similar to this but let me know if it is.

  2. Anyway I can run a Virtual Network Adapter on my host machine?

  3. Can I isolate certain files from the rest of the system?

Forgive me if these questions are dumb, I'm not that smart in the security field. Thanks!

Improve this question
1
  • Rather not, since it's using different architecture.
    – Aria
    Dec 8, 2017 at 14:22

1 Answer 1

Reset to default
2

I'd give you a "yes" to each of your three questions (2 being easiest, 1 hardest to achieve), but with a very large footnote.

You can get some (or most) of what Qubes OS does with the technologies you mention (e.g. virtual machines, container/sandboxing technologies, app armor profiles etc), at least if you're on Linux, because this is basically how Qubes OS does it.

However, getting it right is a tremendous amount of work, and you'll never get the same level of isolation that Qubes OS provides you with, because in order to achieve that, you'd have to run your OS as a virtual machine on a hypervisor, and you'd need to hack the windowing system.

The last is the relevant part. Qubes OS gives you a desktop with individual windows that can run in their own virtual machines, and keystrokes, mouse events etc are isolated from each other.

With current X technology, this kind of isolation is simply not reproducible while keeping the same level of usability. The X Window system is designed in a way that makes it pretty much impossible to isolate user events without code changes. Things might change once distributions come with Wayland, though.

I don't know if Sanboxing is similar to this

There is quite a difference between Sandboxing and Virtualization. Virtualization, depending on the degree of virtualization, either simulates a whole computer in software or uses special CPU hardware to virtualize it (which is much faster). Sandboxing means that you're putting some software in an environment where it can't do much harm if it misbehaves. Virtualilzation is one specific way to achieve this, and it provides the best isolation apart from actually using a second computer. Using Linux capabilities to reduce access to specific kernel functions for a given process is another, and chrooting the filesystem so that a process sees only a specific part of the whole filesystem yet another. User Mode Linux (e.g. running a Linux kernel as a process in another Linux) and solutions such as Linux Containers (LXC) are ways to build sandboxes that aren't quite as resource-intensive as full virtualization, but still provide good isolation.

Improve this answer
0

You must log in to answer this question.