A number of people are working on integrating OpenBSD into Qubes.

In particular, OpenBSD's hardening and mitigations are potentially very useful in talking to the NIC: Xen vulnerabilities have been repeatedly found that would allow a guest with PCI access to compromise the entire system, and on most machines the network card is a PCI device. Additionally, wireless drivers on Linux leave some things to be desired and the network stack is very exposed to the adversary compared to other aspects of the system.

The limited scope of the networking VM in Qubes (it does not need much in the way of bells and whistles, it simply talks to the NIC and passes on data) means that it's much easier to use OpenBSD here than it would be to use OpenBSD for e.g GUI applications.

Unfortunately, there are still significant issues (currently good integration requires patching /etc/rc, among other things):
https://github.com/QubesOS/qubes-issues/issues/5294#issuecomment-707278609

As the commenter notes, this would be much easier if an OpenBSD committer was interested in helping. Anyone?

Reply via email to