Lock Screen qrexec service

[maltfield]

The problem you're addressing (if any)

Physical security devices running in AppVMs currently have no way to lock the screen in QubesOS. As it is now, installing/using such a device requires the user to install code in dom0.

Describe the solution you'd like

I think the community would benefit from a new Lock Screen qrexec service built-into Qubes so that users can install apps in AppVMs that have the ability to lock the screen (for some security reason)--without the user having to also install code in dom0.

Where is the value to a user, and who might that user be?

My use case is for USB peripheral hardware "panic buttons" or tripwires that would trigger the screen to lock. For example:

• https://www.buskill.in
• https://github.com/dekuNukem/daytripper

But I'm sure there's other use-cases where only software running in an AppVM would need to lock the screen for when some user-defined security-related condition is met.

Describe alternatives you've considered

The only other way to do this is for the user to install code in dom0, which should be avoided.

Additional context

Relevant documentation you've consulted

• https://www.qubes-os.org/doc/qrexec/

[maltfield]

Please see relevant PR. This is my first PR for QubesOS, so please let me know if there's any issues

• adding new qubes.LockScreen and cooresponding policy file for issue: qubes-core-admin#349

[marmarek]

Similar thing is already documented here: https://www.qubes-os.org/doc/yubi-key/#locking-the-screen-when-yubikey-is-removed

[andrewdavidwong]

I suppose the question is whether we want to ship Qubes with such a qrexec service by default, or whether we think the documentation is sufficient (and that users who want this should create the qrexec service themselves).

[maltfield]

In addition to the YubiKey example, another use-case for this is the BusKill project, which is almost the same as the "lock your screen on YubiKey removal," except it uses a magnetic breakaway and includes actions other than lockscreen, such as shutdown and a self-destruct script that wipes the LUKS Header.

More info on this here:

• https://www.buskill.in/qubes-os/

Please consider making the lockscreen built-into qrexec by default to make installation & use of such tools easier.