Page MenuHomePhabricator

Whonix Host Live - enable KVM readonly mode - virt-xml vm-name --edit --disk readonly=on
Testing in next build required, NormalPublic

Description

http://forums.whonix.org/t/whonix-host-operating-system/3931/80

@HulaHoop

Dug around on how to modify XML settings on the fly via cli. Other options were too messy or required manual editing which are useless for scripting.

sudo virt-xml Whonix-Workstation --edit --disk readonly=on

readonly takes values on/off
I am not sure whonix-libvirt is the ideal place for detection of live mode and the adjustment of image write options. Perhaps the grub-live package is a better place.
However wouldn't doing this break VM usage since ro-mode-init is not our first choice for using it?

Details

Impact
Normal

Event Timeline

Patrick triaged this task as Normal priority.Jun 14 2019, 11:27 AM
Patrick created this task.

@Onion_Knight :

https://forums.whonix.org/t/whonix-desktop-installer-with-calamares-field-report/7350/109

By default, the VMs do not start because the virtual disks are not set to readonly. This is only needed when using the ISO though. Might stay this way as long as the user is correctly advised to change to set the disk to readonly mode.

I can invent a systemd unit file which detects if being run in live mode, and if so, set VM disks to readonly mode. Will add to whonix-libvirt package unless better suggestions.

For the record, this is the diff being generated.

diff --git a/qemu/Whonix-Workstation.xml b/qemu/Whonix-Workstation.xml
index edce9b1..749ae6e 100644
--- a/qemu/Whonix-Workstation.xml
+++ b/qemu/Whonix-Workstation.xml
@@ -52,7 +52,6 @@ or other application using the libvirt API.
       <driver name='qemu' type='qcow2'/>
       <source file='/var/lib/libvirt/images/Whonix-Workstation.qcow2'/>
       <target dev='vda' bus='virtio'/>
-      <readonly/>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
     </disk>
     <controller type='virtio-serial' index='0'>
Patrick changed the task status from Open to testing-in-next-build-required.Wed, Aug 21, 9:13 AM

Implemented.

https://github.com/Whonix/whonix-libvirt/commit/bb7773e62850fdc76b794500e6bb0c282a55bb2b

Should work on manual invocation.

sudo /lib/systemd/system/whonix-libvirt-set-live-to-readonly.service

If it gets actually automatically started by systemd at boot is untested.

Does

cat /proc/cmdline

show boot=live?

The pipe "|" in ConditionKernelCommandLine=|boot=live isn't a mistake. It means triggering condition.

In next build please try:

sudo systemctl status whonix-libvirt-set-live-to-readonly.service