Qubes OS
| Company type | Open source software project |
|---|---|
| Industry | Operating systems, Computer security |
| Founded | 2012 |
| Headquarters | Not specified |
| Products | Desktop operating system |
| Website | www |
Qubes OS is a desktop operating system engineered with a primary focus on security by leveraging virtualization to isolate different tasks. It organizes applications into distinct virtual machines known as qubes, which are orchestrated through the Xen hypervisor.
The system relies on underlying OS templates that serve as unchangeable root file systems shared across multiple qubes. This approach enables seamless update propagation and significantly lowers storage requirements compared to installing full operating systems on each virtual machine.
Officially supported templates for Qubes OS include versions based on Fedora and Debian. Additionally, community-maintained templates encompass Whonix, Ubuntu, Arch Linux, CentOS, and Gentoo. Users have the flexibility to develop their own custom templates as well.
From an academic standpoint, Qubes OS falls under the category of a Converged Multi-Level Secure (MLS) System. Comparable architectures can be found in both research initiatives and commercial solutions such as SecureView and VMware vSphere.
Security goals
Qubes implements a Security by Isolation methodology. It recognizes that no desktop environment is entirely free from flaws, given the complexity of millions of lines of code and billions of interactions between software and hardware. A single vulnerability could enable malicious software to compromise the entire system.
To protect desktops, Qubes isolates different environments so that if one is breached, malware is confined to that specific domain’s data.
Isolation is applied on two fronts: hardware components are divided into functional domains (for example, separate domains for network controllers or USB devices), while user activities are segmented into security domains with distinct trust levels.
Typical security domains include categories like work (highest trust), shopping, and random use (lowest trust). Each domain functions within its own isolated qube.
By default, Qubes grants passwordless root privileges (such as passwordless sudo) within qubes. Although native support for UEFI Secure Boot is absent, the Qubes development team does not consider this a major security drawback. It should be noted that Qubes OS is not intended to serve as a multiuser platform.
Installation and System Requirements
Designed primarily for personal computers, especially laptops equipped with Intel or AMD CPUs, Qubes OS mandates the following:
- A 64-bit Intel or AMD processor supporting virtualization features
- At least 6 GB of RAM
- A minimum of 32 GB available storage space
User Experience
Interaction with Qubes OS resembles that of conventional graphical desktop operating systems, albeit with notable distinctions:
- Users create qubes—isolated security domains—that serve as streamlined, secure environments for applications, all linked to a shared root filesystem through templates.
- Each application launched within a qube is distinguished by a uniquely colored window border for easy recognition.
- The first time an application starts within a qube, there may be a brief delay depending on the hardware capabilities.
- Since qubes do not share a common clipboard or file system, specialized methods are employed for file transfers and clipboard sharing.
- Users have the flexibility to generate and manage an unlimited number of qubes tailored to their specific requirements.
Xen Hypervisor and Domains
The Xen hypervisor ensures robust isolation between virtual machines, referred to as domains. The initial domain is the privileged administrative domain known as dom0.
The Administrative Domain: dom0
In version 4.1.2 of Qubes OS, dom0 operates on Fedora Linux with a paravirtualized Linux kernel that manages all physical hardware through standard drivers. It hosts the graphical user interface and controls peripherals such as graphics cards, USB devices, storage drives, keyboard, and mouse. The desktop environment comprises the X server, Xfwm window manager, and XFCE desktop interface.
To minimize security risks, direct interaction between dom0 and qubes is kept to a minimum. Updates for dom0 and Template OS images are delivered via a secure process that avoids direct exposure to network connections.
User Domains: Qubes
App qubes offer secure and isolated execution environments for user applications such as web browser, email client, or text editor. These app qubes operate as sandboxed virtual machines managed through the Qube Manager, presenting their applications as standard windows on the dom0 desktop.
Qubes OS integrates all app qubes into a cohesive desktop experience, with each app qube visually identified by an immutable colored window border. To reduce disk usage in dom0, multiple app qubes share a common read-only template root filesystem; additional storage is allocated only for user-specific applications, data, and VM configurations.
Network Domain
Given its susceptibility to security threats, networking functions are isolated within an unprivileged qube termed the net qube.
A separate firewall Domain runs a Linux-kernel-based firewall in its own virtual machine to maintain protection. This design ensures that even if the network domain is compromised, the firewall remains isolated within its dedicated Linux kernel environment.
Reception
Esteemed figures in security and privacy such as Edward Snowden, Daniel J. Bernstein, and Christopher Soghoian have publicly praised Qubes OS.
In his review for DistroWatch Weekly, Jesse Smith emphasized that Qubes OS is most effective when considered as multiple isolated computers sharing one display rather than merely a traditional Linux desktop enhanced with security features. This conceptual shift greatly enhanced its usability.
Kyle Rankin from Linux Journal underscored Qubes OS’s superior security posture compared to conventional Linux desktops.
In 2014, Qubes was recognized as a finalist for the Access Innovation Prize for Endpoint Security awarded by the human rights group Access Now.
See also
Notes
- References