search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
541 stars 48 forks source link

`_NET_WM_DESKTOP` support (jailing of qube windows to specific workspace) #9575

Open alimirjamali opened 5 days ago

alimirjamali commented 5 days ago

How to file a helpful issue

The problem you're addressing (if any)

User might want to force Windows belonging to specific qube to always open in dedicated Window Manager workspace rather than the focused one. For example user could have dedicated workspaces for trusted, untrusted, templates, disposables, ... and they want to be able to force new windows and/or popups belonging to specific qubes to always open in target workspace.

The solution you'd like

The above would effectively open new windows in target workspace rather than the current one. I have tested it already and it works well (see video below).

https://github.com/user-attachments/assets/62c1f100-2ed1-485b-9022-d5904a3b0a42

The value to a user, and who that user might be

All users. Users who need this for security enhancement as well as users who needs this feature for better organization of their workflow.

Completion criteria checklist

(This section is for developer use only. Please do not modify it.)

marmarek commented 5 days ago

This is already (quite easily) possibly with 3rd-party tools. Or if you have KDE, it has built-in arranging windows based on various properties, including WM_CLASS.

alimirjamali commented 5 days ago

This is already (quite easily) possibly with 3rd-party tools. Or if you have KDE, it has built-in arranging windows based on various properties, including WM_CLASS.

I was not aware of this. Could those tools work based on _QUBES_VMNAME? And what about XFCE? I know it was possible in i3 but did not know about KDE.

marmarek commented 5 days ago

Looks like devilspie2 (which should work in any environment) can use arbitrary property, but I think KDE built-in thing can use only few standard ones.

alimirjamali commented 5 days ago

When I looked for this back in March (and discussed this on forum), I found original devilspie (which was discontinued). And devilspie2 was not packaged for Fedora 37. Maybe it has changed and is available for Fedora 41.

DemiMarie commented 2 days ago

I think this is very much a useful feature request. WM_CLASS would work if and only if the GUI daemon can set it to a trusted value.

marmarek commented 2 days ago

WM_CLASS is already set by the GUI daemon, the first part of it is the qube name.