Currently in progress...
Why is this necessary: Qubes OS prioritizes security over usability. This is especially noticeable on my Asus laptop, and I experienced a number of issues that couldn't be resolved otherwise: 1. Inefficient laptop performance and excessive heating. My laptop has an AMD integrated GPU (along with the CPU) and a separate NVIDIA GPU. The NVIDIA GPU was constantly running, even when hidden from dom0. Power was supplied to the GPU and it was actively heating up. The fans were humming like a jet, while the laptop remained at 80-90 degrees Celsius when idle. This significantly reduced the lifespan of almost all the laptop's components. There was no way to disable this behavior (except by physically removing the graphics card, which is not a very sensible solution). 2. Inability to control the maximum battery charge level. Modern laptops, to preserve battery life when constantly plugged in, limit the maximum charge level to 40-60%. 3. The banal discomfort of point 1, when a hot wind constantly blows from the laptop.
Security risks: There are only two. 1. Hotplug PCIe is disabled by the QubesOS developers for security reasons. Enabling it opens the door to attacks with physical access to the device via the Thunderbolt port. However, my personal opinion is that this is a huge sacrifice in convenience for a very small security gain. If an attacker has physical access to a running device, they have hundreds of other possible attacks, some more effective. + My laptop doesn't have this port.
Requirements: Proficiency in Linux console A device running x64 (preferably tested) with network access, 16GB RAM, and 20GB of free disk space. A GitHub account
This guide is designed for a build performed on a dedicated server/device, outside of QubesOS. In theory, it can easily be adapted for building in Qubes by simply changing a couple of lines (docker->dispvm).
Instructions: We will use tools from the QubesOS developers for the build. 1. git clone https://github.com/QubesOS/qubes-builderv2/
"verify = True if insecure_skip_checking: verify = False elif less_secure_signed_commits_sufficient: check = "signed-tag-or-commit" elif args.git_commit:
verify = False"
Change to " insecure_skip_checking = True verify = False "
As a result, the build won't check the signature of each Github commit (we can't sign our edits with the Qubes developers' keys).
"CONFIG_HOTPLUG_PCI_CPCI=y"
Go to the gen-config file in your repository and remove the behavior where the build fails due to the inability to apply the kernel flag:
Delete line 49. Remove lines 54-55 and replace them with "printf 'WARNING: Local config setting for %s didn't make it into the final config (ignored)' "$cfg""
Replace line 61 "exit $rc" with "exit 0"
This concludes the edits to GitHub.
backend-vmm: xen debug: true verbose: true qubes-release: r4.3
distributions: - host-fcrq
components: - builder-rpm: packages: False branch: main - linux-utils - dracut: branch: main - linux-kernel-latest: url: https://github.com/dill-shower/qubes-linux-kernel branch: main timeout: 21600 host-fc41: stages: - build: environment: MAKEFLAGS: "-j$(($(nproc) * 2))"
executor: type: docker options: image: "qubes-builder-fedora:latest" clean: True cpus: "0.000"
stages: - fetch - prep - build - post - verify - sign: executor: type: local - publish: executor: type: local"
This guide is based on personal experience. The text may look like llm due to Google Translate; English is not my native language. If you have difficulty editing with git, I'll try to attach all the modified files to this post or upload them to the hosting service if the Qubes forum doesn't allow file uploads.
https://transfer.it/t/6cKZT4pXFBLC edited files and builder.yml