Dug around on how to modify XML settings on the fly via cli. Other options were too messy or required manual editing which are useless for scripting.sudo virt-xml Whonix-Workstation --edit --disk readonly=on
readonly takes values on/off
I am not sure whonix-libvirt is the ideal place for detection of live mode and the adjustment of image write options. Perhaps the grub-live package is a better place.
However wouldn't doing this break VM usage since ro-mode-init is not our first choice for using it?
By default, the VMs do not start because the virtual disks are not set to readonly. This is only needed when using the ISO though. Might stay this way as long as the user is correctly advised to change to set the disk to readonly mode.
I can invent a systemd unit file which detects if being run in live mode, and if so, set VM disks to readonly mode. Will add to whonix-libvirt package unless better suggestions.
For the record, this is the diff being generated.
diff --git a/qemu/Whonix-Workstation.xml b/qemu/Whonix-Workstation.xml index edce9b1..749ae6e 100644 --- a/qemu/Whonix-Workstation.xml +++ b/qemu/Whonix-Workstation.xml @@ -52,7 +52,6 @@ or other application using the libvirt API. <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/Whonix-Workstation.qcow2'/> <target dev='vda' bus='virtio'/> - <readonly/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> <controller type='virtio-serial' index='0'>
Should work on manual invocation.
If it gets actually automatically started by systemd at boot is untested.
The pipe "|" in ConditionKernelCommandLine=|boot=live isn't a mistake. It means triggering condition.
In next build please try:
sudo systemctl status whonix-libvirt-set-live-to-readonly.service