Compartmentalizing with AppVMs

Hello! Welcome back to your course on building a secure ThinkPad.

Introduction

In our last lesson, you learned the essential skill of installing software in Qubes OS by adding it to a TemplateVM. This ensures applications are available to your AppVMs in a secure, read-only fashion. We established that this is the "how" of software management.

Today, we shift our focus to the "why" and "what" of system organization. The core principle of Qubes OS is security by compartmentalization, and this lesson is where you put that principle into practice. By the end of our session, you will be able to create and label at least two separate AppVMs (e.g., 'work', 'personal-banking') to practice the principle of compartmentalization.

We will begin by exploring different philosophies for organizing your digital life into secure domains. Then, we will walk through the practical steps of creating and configuring your first set of specialized AppVMs, using both the graphical interface and the more powerful command-line tools.

1. The Philosophy of Compartmentalization: Personas and Strategies

There is no single "correct" way to organize your qubes. The optimal setup is highly personal and depends on your specific activities, workflow, and threat model. To help you think about your own structure, the Qubes OS documentation provides several illustrative personas.

Given your background in finance, software, and as a founder, the "Alice, the software developer" and "Carol, the investor" personas will be particularly relevant.

Key Insights from the Personas:

• Alice (The Developer): Alice isolates each client project into its own set of qubes (e.g., clientA-code, clientA-build). This prevents cross-contamination of code, credentials, and dependencies. This strategy of isolating distinct professional projects is a powerful model for any founder or consultant.
• Carol (The Investor): Carol's approach is a masterclass in compartmentalizing financial risk. She creates a separate qube for each financial institution, treating it as a dedicated, single-site browser. Notice her risk assessment: she combines all credit card accounts into one qube because the consumer protections are stronger and the potential for damage is lower, whereas bank and brokerage accounts, with their potential for catastrophic loss, get maximum isolation.

These examples demonstrate that effective compartmentalization is about defining boundaries based on trust, risk, and function. A breach in a 'general-browsing' qube should have no impact on your 'personal-banking' qube.

Before we move on, take a moment to reflect: What are two or three distinct "compartments" you can immediately identify for your own digital life? (e.g., startup-dev, vc-comms, personal-finance, untrusted-browsing).

2. Creating AppVMs: From Theory to Practice

Now that we have the conceptual framework, let's see how this is implemented. The following videos demonstrate the creation of new AppVMs and, more importantly, the result of that separation.

First, let's watch a clear, step-by-step demonstration of creating a new banking AppVM using the graphical interface.

Next, let's reinforce the purpose of this separation. This second video clearly illustrates the isolation that results from using different AppVMs for different tasks.

These demonstrations show that AppVMs are not just organizational labels; they are distinct virtual machines with their own private storage and state, ensuring that activities in one cannot affect another.

3. Hands-On Activity: Building Your First Compartments

It's time to create your own compartments. We will create two AppVMs that reflect common use cases: work and personal-banking.

Activity 1: Create a 'work' Qube

This qube will be for your general work-related tasks.

1. Open the Qube Manager (the blue 'Q' icon in the notification area) or the Application Menu and select Create Qube.
2. Name and label:
   • Name: work
   • Label: blue
3. Type and template:
   • Type: AppVM
   • Template: fedora-XX-xfce (or your default Fedora template)
4. Networking: Leave as default (sys-firewall).
5. Click OK.

You have now created a basic, general-purpose AppVM. You can add applications to it via its TemplateVM as you learned in the previous lesson.

Activity 2: Create a 'personal-banking' Qube

This qube will be a high-security compartment, locked down for accessing only your bank.

1. Open the Create Qube dialog again.
2. Name and label:
   • Name: personal-banking
   • Label: red (to signify high importance/risk)
3. Type and template:
   • Type: AppVM
   • Template: fedora-XX-xfce-minimal if you have it installed. If not, the standard fedora-XX-xfce is acceptable. A minimal template is preferred as it reduces the attack surface.
4. Networking: Leave as default (sys-firewall).
5. Click OK.

Now, let's apply the principle from the "Carol, the investor" persona by restricting this qube's network access.

6. Open the Qube Settings for your new personal-banking qube.
7. Go to the Firewall rules tab.
8. Select Limit outgoing internet connections to....
9. Click the + button and add the domain name of your bank (e.g., yourbank.com). Do not include https:// or other prefixes.
10. Click OK.

Your personal-banking qube can now only communicate with your bank's website, dramatically reducing its exposure to any other network-based threats.

4. The Power User's Path: Command-Line Creation

As someone comfortable with scripting and automation, you will appreciate that the entire VM creation and configuration process can be done from the dom0 terminal. This is far more efficient for setting up multiple qubes or rebuilding a system. The primary tool is qvm-create.

Here are the commands to create the two AppVMs from our activity:

To create the work qube:

qvm-create --template fedora-XX-xfce --label blue work

To create and configure the personal-banking qube:

# Step 1: Create the AppVM
qvm-create --template fedora-XX-xfce-minimal --label red personal-banking

# Step 2: Set the firewall rule (in dom0 terminal)
qvm-firewall personal-banking reset
qvm-firewall personal-banking add accept dns
qvm-firewall personal-banking add accept dsthost=yourbank.com

(Note: The qvm-firewall commands first reset any existing rules, then explicitly allow DNS requests, and finally allow connections to your bank's domain.)

Using the command line is not only faster but also makes your setup reproducible, a principle you'll recognize from infrastructure-as-code practices.

Conclusion

Today you have bridged the gap between the theory of compartmentalization and its practical application. You've learned to think strategically about organizing your digital life and have created your first purpose-built AppVMs.

Key Takeaways:

• Effective compartmentalization is personal and based on your unique workflow and threat model. Personas like "Alice the developer" and "Carol the investor" provide excellent strategic templates.
• Creating AppVMs is straightforward using either the GUI wizard or the more powerful qvm-create command in dom0.
• You can significantly enhance the security of a qube by using firewall rules to restrict its network access to only the services it absolutely needs.
• You now have a foundational structure (work, personal-banking) upon which you can build out the rest of your secure digital life.

The AppVMs we created are persistent, meaning their private storage (/home, /rw, /usr/local) endures across reboots. However, many tasks—like opening a suspicious email attachment or clicking a strange link—are best handled in an environment that is guaranteed to be clean and leaves no trace.

In our next lesson, we will explore a powerful Qubes OS feature designed for exactly these scenarios: you will learn how to use a DisposableVM to safely open a potentially malicious document downloaded from the internet.