The user must select this option from the trusted window manager in dom0.

This functionality should still be considered safe, since a VM window still can’t voluntarily enter fullscreen mode.

You can always put a window into fullscreen mode in Xfce4 using the trusted window manager by right-clicking on a window’s title bar and selecting “Fullscreen” or pressing alt + f11. Those effects are enabled by default in KDE once Compositing gets enabled in KDE (System Settings -> Desktop -> Enable Desktop Effects), which is recommended anyway.īy default, they are triggered by Ctrl-F8 and Ctrl-F9 key combinations, but can also be reassigned to other shortcuts. Other examples such mechanisms are the KDE “Present Windows” and “Desktop Grid” effects, which are similar to Mac’s “Expose” effect, and which can be used to immediately detect potential “GUI forgery”, as they cannot be intercepted by any of the VM (as the GUID never passes down the key combinations that got consumed by KDE Window Manager), and so the VM cannot emulate those. The simplest example is the use of Alt+Tab for switching between windows, which is a shortcut handled by dom0. However, it is possible to deal with fullscreen mode in a secure way assuming there are mechanisms that can be used at any time to switch between windows or show the full desktop and that cannot be intercepted by the VM. to trick the user into entering a secret passphrase into a window that looks like belonging to some trusted domain). like other windows, belonging to other domains (e.g. to show a movie on a full screen, it might not be possible for the user to know if the applications/VM really “released” the full screen, or if it has started emulating the whole desktop and is pretending to be the trusted Window Manager, drawing shapes on the screen that look e.g. If one allowed one of the VMs to “own” the full screen, e.g. Why is fullscreen mode potentially dangerous? This allows the user to easily realize to which domain a specific window belongs. Normally, the Qubes GUI virtualization daemon restricts the VM from “owning” the full screen, ensuring that there are always clearly marked decorations drawn by the trusted Window Manager around each of the VMs window.

How to enter fullscreen mode What is fullscreen mode?

How to escape full screen mode