Allow DispVMs to inherit netvm without inheriting firewall rules

[andrewdavidwong]

One of the most common ways ordinary users are attacked today is via malicious links in emails. Therefore, it makes sense to create an email VM with restrictive firewall rules (e.g., allow only POP3S/IMAPS and URD traffic to email servers). However, then it becomes cumbersome for users to open links in emails.

Solution: Allow users to open links in DispVMs. Qubes currently allows users to open links in DispVMs and to set the netvm which the new DispVM will have. However, the new DispVM automatically inherits the restrictive firewall rules of its parent, making it useless for this pupose.

[marmarek]

Indeed useful feature.
I think this can be done as part of #866

For now, you can setup normal AppVM (mail-web) and open links there using qvm-open-in-vm. Not as good as DispVM, but in some cases good enough.

[marmarek]

Indeed useful feature.
I think this can be done as part of #866

For now, you can setup normal AppVM (mail-web) and open links there using qvm-open-in-vm. Not as good as DispVM, but in some cases good enough.

[andrewdavidwong]

For now, you can setup normal AppVM (mail-web) and open links there using qvm-open-in-vm. Not as good as DispVM, but in some cases good enough.

Yes, this is what I've been doing instead, and it's actually quite a good solution. The main drawback is potential cross-contamination from opening all the links in same persistent browser/VM.

[andrewdavidwong]

For now, you can setup normal AppVM (mail-web) and open links there using qvm-open-in-vm. Not as good as DispVM, but in some cases good enough.

Yes, this is what I've been doing instead, and it's actually quite a good solution. The main drawback is potential cross-contamination from opening all the links in same persistent browser/VM.