Qubes OS

Mentors: Student: Jayant Saxena

The Qubes PDF converter safely sanitises untrusted PDFs by rendering them inside a disposable VM. However, other risky file types (documents, spreadsheets, images) lack equivalent protection. This project generalises the converter into a plugin-based architecture with per-format qrexec services and minimal DispVM templates. Key features: • New qvm-convert-file entry point with MIME-based routing • Document & spreadsheet conversion via LibreOffice → existing bitmap pipeline • Image sanitisation via decode + re-encode (metadata stripped) • Audio/video conversion via ffmpeg (stretch goal) • Full backward compatibility with qvm-convert-pdf Deliverables: D1: Plugin architecture + MIME dispatch D2–D3: Document & spreadsheet converters D4: Image sanitiser D5: Media converter (stretch)

Mentors: Student: I'mSofia

I believe Qubes is an easy and intuitive tool to achieve “reasonable” security, as it relies on explicit compartmentalization and force users to actively think about their actions. As massive cyberattacks are growing, Qubes is increasingly becoming an essential tool for the general public, reinforcing the need for UX- focused software. This project will make Qubes more accessible for people from diverse backgrounds by providing UX-focused GUI tools for software installation in templates.

Mentors: Student: nihalxkumar

Qubes OS uses TemplateVMs as the base for most application qubes. These templates track upstream operating system releases such as Fedora and Debian, which eventually reach end-of-life and must be upgraded. Today, users generally have two options: 1. Install a fresh template and manually recreate customizations and packages. 2. Perform an in-place upgrade manually by following a multi-step process across dom0 and the template terminal. The first option is safer but discards customization. The second preserves customization but is cumbersome, error-prone, and inaccessible to many users. This project proposes an automated template version upgrade workflow built on top of Qubes OS's existing update architecture. The primary deliverable is a dom0 command-line tool that performs distro version upgrades for Fedora- and Debian-based templates while preserving safeguards, reporting progress, and leaving a clear recovery path on failure. GUI integration is a stretch goal after the CLI workflow is stable and tested.

Mentors: Student: giulio

<p>Currently, Qubes OS lacks a centralized an easy way to forward ports to virtual machines. Although it is possible to forward ports by issuing iptables commands on both the NetworkVM and the FirewallVM, or by using the ConnectTCP service, it is a limited and error prone manual process. Furthermore, the lack of a GUI that shows the manual rules fives the user a lack of oversight on the firewall.</p> <p>The goal of the project is to mplement a GUI for automatic and persistent, eventually with a predefined timespan (ie: until reboot), port forwarding. The idea is to split horizontally the "Firewall Rules" tab in the "Qubes Settings" window and add another area below it.</p> <p>Additionally, discuss and verify the possibility to implement a secure NAT traversal system and GUI. A basic proposal could be a checkbox to enable NAT traversal requests. When the checkbox is selected, the FirwallVM will redirect NAT traversal requests to a local python daemon or a dedicated VM that will negotiate the NAT traversal and configure the network accordingly. In this case, prompt the user in Dom0 about the NAT traversal request.</p> <p>Of course the qvm-* set of tools must e able to achieve the same tasks via CLI.</p>

Mentors: Student: William Huang

<p>Designing a better mechanism for handling template installation and creating a user-facing application to deal with such mechanism and other template-related configuration, consolidating the management of templates.</p>