White-list for block devices, networks, etc

[Frozentime345]

System: Fedora 27/Debian 9 Templates, R3.2->upgrading to 4.0 soon

I looked through rpc policy but I couldn't find anything like this, is there
a way to only allow certain block devices for certain appvms? Doesn't
even have to be a secure feature just something to prevent user error,
but it has to work at the qubes level so a
"bad" block device doesn't compromise the appvm.

Similarly, is there something in sys-net I can use to white-list? I
tried the network connections manager but I cant seem to stop it from
connecting to unknown ethernets, after its known I can set “don't
automatically connect” though.

[awokd]

Frozentime345 wrote on 10/16/18 5:59 AM:

> System: Fedora 27/Debian 9 Templates, R3.2->upgrading to 4.0 soon
>
> I looked through rpc policy but I couldn't find anything like this, is
> there
> a way to only allow certain block devices for certain appvms? Doesn't
> even have to be a secure feature just something to prevent user error,
> but it has to work at the qubes level so a
> "bad" block device doesn't compromise the appvm.

I believe there will be some type of block device isolation (a
"sys-block" maybe) coming in Qubes 4.1, so fine grained controls might
be part of that.

> Similarly, is there something in sys-net I can use to white-list? I
> tried the network connections manager but I cant seem to stop it from
> connecting to unknown ethernets, after its known I can set “don't
> automatically connect” though.

This might vary by the distribution you are using for sys-net. Try
searching for what you are trying to accomplish with the distribution
name e.g. "Debian", instead of "Qubes". Most should apply the same way,
just make your changes in sys-net instead.

[unman]

On Tue, Oct 16, 2018 at 09:50:10PM +0000, 'awokd' via qubes-users wrote:
> Frozentime345 wrote on 10/16/18 5:59 AM:
> > System: Fedora 27/Debian 9 Templates, R3.2->upgrading to 4.0 soon
> >
> > I looked through rpc policy but I couldn't find anything like this, is
> > there
> > a way to only allow certain block devices for certain appvms? Doesn't
> > even have to be a secure feature just something to prevent user error,
> > but it has to work at the qubes level so a
> > "bad" block device doesn't compromise the appvm.
>
> I believe there will be some type of block device isolation (a "sys-block"
> maybe) coming in Qubes 4.1, so fine grained controls might be part of that.

You can also use udev to set policies to restrict what devices can be
attached to particular qubes. If you are concerned you could restrict
access to particular specific devices. Not ideal but it would mitigate
against user error.

>
> > Similarly, is there something in sys-net I can use to white-list? I
> > tried the network connections manager but I cant seem to stop it from
> > connecting to unknown ethernets, after its known I can set “don't
> > automatically connect” though.
>
> This might vary by the distribution you are using for sys-net. Try searching
> for what you are trying to accomplish with the distribution name e.g.
> "Debian", instead of "Qubes". Most should apply the same way, just make your
> changes in sys-net instead.

NetworkManager is designed to keep your network connection up and
running automatically. That's what it is there for.
If you don't want this behaviour you can either disable NetworkManager so
it wont automatically start and therefore wont try to make connections,
or set a parameter in a config file:
[main]
no-auto-default=*

You can put this in /etc/NetworkManager/NetworkManager.conf or as a
fragment in /etc/NetworkManager/conf.d

unman

[frozen...@gmail.com]

For some reason Im not receiving emails from my own thread lol? Luckily I googled the group to see if the post made it.
Cool on qubes 4.1 sounds good.

Thanks, I'll look into udev config.

Will this no auto default setting for network manager stop new connections or just stop network manager? Ideally I want it to allow me to config new networks before connecting or ask me confirmation before connecting, basically to prevent user error.

[unman]

man networkmanager.conf

Those were alternatives I gave - either disable NetworkManager OR
configure so as not to create default connections.