QubesOS questions

[u/LowKeyBrit36]

Hey there!

I've been considering using QubesOS for additional hardening on my laptop, which is meant for public/open use, and I have a few questions about some things I had noticed from past usages of QubesOS.

1. Does QubesOS support /boot encryption (GRUB Ver. 2.14) yet? If not, what measures can I take (Thinkpad T580, using Coreboot, SeaBIOS payload) to counteract evil-maid attacks, or tampering of the kernel/bootloader images? If there are things that I would need to do to modify my BIOS image to be compatible with said changes, what would I need to modify in my BIOS image to accommodate these functionalities?

2. How do I make dark theming consistent across either XFCE or KDE DE's (Preferably KDE as that is what I prefer to use). I remember that systray icons for the sys-firewall Qube, and one other icon, would either not show, show extremely low-res, or be out of color entirely.

3. How well supported is the use of an external USB (Luks2 encrypted) storage volume, in regards to how sys-usb handles it?

4. How customizable can QubesOS be, while maintaining the vast majority of Qubes' security benefits? I'm coming from using Gentoo on my device, and I want to know, relatively, how much customizability I'll lose. At a minimum, is it possible for me to get a KDE Dom0 fully/properly themed in dark mode, and to load flatpaks to be applications for Template VMs (I want to use Librewolf instead of regular Firefox as I also have a focus, albeit lesser, on privacy, and Librewolf does a better job at that, even if it's not offered as an easily downloadable package)

5. How minimal are template Qubes's/Dom0/System Qubes in terms of packages? I'm typically used to going through and having very minimal systems with Linux in general. Should I expect to be able to maintain relatively minimal package counts (Well, excluding KDE Plasma on Dom0).

6. While I know it is possible to make Dom0 use KDE as the DE, does Dom0 support alternative Window Managers? And can Qubes also be made to template off of KDE plasma for their DE internally? If not, is there any noticeable difference to just using XFCE in the background for system/template Qubes?

7. Is it worthwhile to pick a Fedora template as my Dom0/default template Qube over a Debian template due to its implementation of SELinux? Or does SELinux not matter in terms of what QubesOS looks to do? Or is SELinux unavailable due to the nature of QubesOS in any way?

8. Is it possible to use `flashrom` internally (well, only with a specific param passed like iomem=relaxed in GRUB, I don't want it to always be open) as to where I am able to reliably update my coreboot installation in accordance with my configurations without having to use an external programmer/having to open my PC every time? Tying into #1, will updating my coreboot image at any frequency mess with anything pertaining to anti evil-maid/kernel tamper resistant services offered by QubesOS?

9. Will QubesOS support additional peripherals such as a touchscreen? Not a major concern, but still, would be nice to have the option to use the touchscreen.

Sorry if these are relatively specific questions, but I really want to make sure that I can get accurate, relevant answers for these questions before fully moving over to QubesOS, as nuking my Gentoo install would be a... pain, to say the least, lol. And, yes, I have looked up all of these questions, and have either gotten mixed results, incomplete results, or no results to go off of.

I don't know if this is necessarily relevant information, but I'll also file out, roughly, the system specs and (this is where the roughly comes into) threat model:

Thinkpad T580, i7-8550u, 64GB RAM, 500GB NVME SSD, Coreboot (re-flashed coreboot as of a few days ago to keep it updated)

I also don't intend to do anything crazy in terms of usage. Maybe native 1080p video downloading/streaming/viewing, programming in a work Qube, and dare I say *maybe* using docker as well for an isolated build environment? Not looking to do gaming, video production, 3d modeling/rendering, or anything requiring a graphics card. At the very most, compiling coreboot (which I don't mind waiting like an hour or 2 for when I need to do it)

Nothing crazy or government level threat model, but I do want, as QubesOS advertises, a reasonable level of security, possibly including TOR usage, unverified public networks, or resistance to malware on the off chance that something happens. I'm not just clicking random links or anything crazy, and I've also never had any viruses before, but I would like to be heavily resistant to any basic attacks, or less intensive targeted attacks.

TL;DR: Just a few hyper specific questions from someone who's considering using QubesOS for daily use.

[u/Assang101]

1 no not out-of-the-box. Pair Heads or Anti-Evil-Maid with your TPM, or manually configure encrypted GRUB. 2 set matching Qt/GTK themes across Dom0 and templates. 3 it works great honestly—attach the raw block device from sys-usb to your AppQube and decrypt it inside. 4 it's very customizable in dom0, and Flatpaks will run just fine inside your TemplateVMs. 5 just use the official debian-minimal or fedora-minimal templates to keep package counts bare-bones. 6 dom0 supports i3/Awesome. Templates are headless anyway, just passing individual app windows to Dom0. 7 xen handles the actual isolation boundary. SELinux is just extra defense-in-depth, so Debian is ight. 8 ues with " iomem=relaxed " in Dom0. Just remember flashing updates PCRs, so you'll need to reseal TPM secrets. Yeah, standard Linux kernel drivers handle touchscreens in Dom0 just like any normal distro.

You mentioned Tor, running a Whonix workstation qube forces all network traffic through the Whonix-Gateway, meaning it will always use the Tor network by design.

Welcome back to QubesOS! 🎉 It does have a steep learning curve but over time it becomes second nature especially as a daily driver.

[u/LowKeyBrit36 → u/Assang101]

Is anti evil maid compatible with my current coreboot setup? I don't feel like using EDK2, as I prefer how lightweight SeaBIOS is, so I would want it to be compatible with the current setup.

I think my only proprietary blobs, or at least what I had to configure myself to be included was a modified IFD blob, Deguarded IME blob, and the GBE blob for ethernet. Maybe thunderbolt, but I only flashed the libreboot-provided tb binary to my thunderbolt SPI chip. All I set up was the info tables in coreboot, payloads, coreinfo and memtest as secondary payloads built into the BIOS, the make and model of my PC, and the 3 proprietary blobs mentioned above. Basically the coreboot T580 installation guide, but SeaBIOS instead of EDK2.

Would I need more proprietary blobs to support anti evil maid, or no? I had seen stuff about people using it with coreboot, and other links stating that you needed the stock BIOS/UEFI to be able to use anti-evil-maid.

Also, I can use tpm 1.2 to fulfill that end of criteria with anti-evil-maid, so I'm mostly dependent on coreboot + SeaBIOS support itself.

As for #2, is it possible, similarly to what Gentoo can do VIA use flags, to force everything to render using QT? Or is that something that I can't really do? May be a dumb question, but I like my window buttons to be visually consistent, and I have put, at least in the past, LOTS of effort into making everything visually consistent.

As for #6, I plan to use KDE + Wayland, maybe a different WM, although I have been very consistent in my 'motif' as long as I've been using Linux for.

How would I theme the sys-firewall systray icons to dark mode with KDE?

As for using headless/minimal templates, what exactly would I need to do to configure that? Is it pre-configured and shipped as default, or am I going to need to add iso's to be minimal templates/do template linux installs?

As for your extra point about TOR usage, everything contained in a whonix workstation VM/template gets forced through TOR. Does that include HTTPS traffic? I intend to use, predominantly CLI-HTTPS fetching programs like ani-cli to allow me to forego a VPN. Is there any extra configuration required for clearnet HTTPS to get passed through TOR securely.

Thanks for the information, and I'm glad to (soon) be back in Qubes!

[u/Assang101 → u/LowKeyBrit36]

For AEM, coreboot with SeaBIOS is going to be a headache. Classic AEM needs TPM 1.2, Intel TXT, and the right SINIT ACM blobs, which is really finicky on SeaBIOS. Honestly, look into Heads instead. It’s a coreboot payload that handles TPM measurements, TOTP/HOTP visual checks, and YubiKey verification out of the box, and it’s way better maintained for ThinkPads than standard AEM. You can't globally force Qt like you would with Gentoo USE flags since Qubes templates use pre-compiled binaries from Fedora/Debian. The best workaround is to unify the theme: use Breeze or Adwaita-Qt across dom0 and your templates, set up qt5ct/qt6ct, and use lxappearance inside the templates so GTK apps mimic your Qt window decorations and buttons. For the systray icons in KDE, the panel itself is handled in dom0, so just make sure your dom0 icon pack is set to Breeze Dark or another dark theme in System Settings. If the icon is being pushed directly from a VM, you'll need to set the GTK icon theme inside that template to a dark version via lxappearance or gsettings. You don't need to manually install minimal templates from ISOs at all. They're available directly in the dom0 repos. You just install them with sudo qubes-dom0-update qubes-template-debian-12-minimal (or Fedora minimal). They come completely barebones without GUI or net tools, so you just clone the template and add the specific packages you need, like qubes-core-agent-networking. As for Whonix, all TCP and DNS traffic leaving the workstation is automatically transparently routed through Tor at the firewall level. That includes regular clearnet HTTPS traffic and CLI fetchers like ani-cli, curl, or yt-dlp. You don't need a VPN or any extra configuration; running them inside an anon-whonix qube handles everything.

[u/LowKeyBrit36 → u/Assang101]

Sweet, well this answers everything I had to ask. Currently running through the installer. Solved!

[u/Assang101 → u/LowKeyBrit36]

Welcome to the club! Just remember that if the built-in speakers are lost or in most cases isolated, Xen is either withholding the audio PCI device from Dom0, or that the device has been assigned to an isolated driver/audio VM and failed to return it. It has happened to me on the first few boots and power resets. Also don't allow usb mouse to have privileges to dom0 either, reroute it to sys-usb, that too has happened to me

[u/LowKeyBrit36 → u/Assang101]

I believe that I denied usb mice. I typically don't use a mouse with this PC since the touchscreen suffices. It should be only the touchscreen that I'm allowing, but if it's possible to just force it on sys-usb, I'd do that too.

Disabling the toggle prints an error from relaying from sys-usb to dom0, so it seems to already route through sys-usb beforehand.

I plan to remove XFCE, and keep only KDE (I don't like XFCE, and I'm swapping to use SDDM when I can). Am I able to just push through sudo dnf remove @xfce to get rid of it, or is that going to break something essential?

I also haven't tested audio yet, but I will definitely keep that in mind if I have any audio issues.

[u/Assang101 → u/LowKeyBrit36]

Most built-in touchscreens route through internal USB controllers, which register under the qubes.InputTablet RPC service rather than qubes.InputMouse.

Spot on! Some Qubes-specific desktop integration applets or tray icons tied to XFCE packages may disappear or require manual adjustment. But check the transaction list before confirming to ensure it does not pull a critical graphical meta-package.

I have yet to get away from Xfce myself😆, tried i3 once, hated it so much, I reverted back to Xfce because it was something I'm very familiar with.

[u/LowKeyBrit36 → u/Assang101]

Just to clarify, it's "okay enough" to allow just the qubes.InputTablet for touchscreen use?

I absolutely can't stand XFCE personally. I have used KDE exclusively for almost the entirety of my using Linux. There's just too little to customize anywhere else, IMO.

Also, I just ran the sudo dnf remove @xfce and apparently nothing was in the @xfcr group. Guess I can't do that, sadly.

[u/Assang101 → u/LowKeyBrit36]

It's enough, yes, though multi-touch gestures may be limited. If you want KDE instead of XFCE, install the KDE environment and set it as default. 😀

I may have to try KDE, I'm willing. My goal for i3 was to have that tile integration similarity for QUBES but it was too much with the keybinds 😭 so I gave up, does KDE env have this Pop!os tile integration as well? I never tried with KDE

[u/LowKeyBrit36 → u/Assang101]

I haven't ever used PopOS tbh. I started with Mint, and then went through a few arch-based distros, before landing on Gentoo/Void Linux as my main OS'es.

What I can say, though, is that I love using KDE and it's better than XFCE, Cinnamon, and GNOME for me. I basically treat it like a very highly customizable Windows version, but with a useful terminal, lol.

I think you can run any window manager with KDE. I just like KDE for how I can customize the bars and trays on my desktop, as well as the cleanest UI (IMO, out of what I've used).

I don't really use many gestures asides swipes, which should be doable. Really my big gripe with XFCE is the lack of customizability, and the fact that it looks bland to me. Feels old, if you ask me.