Dev/VirtualBox

From Kicksecure
< Dev
Revision as of 10:23, 8 March 2022 by Nurmagoz (talk | contribs)
Jump to navigation Jump to search

Is VirtualBox an Insecure Choice?

Update:

Although VirtualBox is not an ideal choice, fortunately other platforms are supported:

For greater security, users with suitable hardware and sufficient skill are recommended to [[Virtualization_Platform_Security#Type_1_vs_Type_2_Hypervisors|prefer Template:Q project name]] (a bare-metal hypervisor) over Type 2 hypervisors like VirtualBox.

The primary reason Kicksecure supports VirtualBox is because it is a familiar, cross-platform virtualizer which can attract more users to open source (free/Libre) software, Tor and Linux in general. By remaining highly accessible, Whonix:

  • Increases the scope of potential growth in the user base.
  • Attracts greater attention as a suitable anonymity-focused operation system.
  • Increases the likelihood of additional human resources and monetary contributions.
  • Allows novice users to easily test Kicksecure and learn more about security and anonymity practices.
  • Improves the relative security and anonymity of Tor / Tor Browser users by offering a virtualized solution.
  • See also Arguments for keeping VirtualBox Support.

Old statement:

If you would like to see the old statement, please press on expand on the right.

VirtualBox missing features

Tickets:

VirtualBox Unavailable in Debian stable and backports due to Debian Stable Security Maintenance Issues

Quote https://people.debian.org/~lucas/virtualbox-buster/archive.org iconarchive.today icon

Virtualbox is not available in Debian 10 (nor in backports). The reasons are discussed at length in https://bugs.debian.org/794466archive.org iconarchive.today icon and various other mailing list threads, but can be summarized as:

  • Virtualbox is not suitable for Debian stable releases because of the lack of cooperation of Oracle on security support (that’s the Debian security team decision).
  • Since it is not suitable for stable releases, it cannot be included in the testing suite (that’s the Debian release team decision).
  • It also cannot be included in official backports, as packages must be in testing before they get backported (that’s the Debian backports team’s decision).

There is hope this will improve in future: please add VirtualBox to fasttrackarchive.org iconarchive.today icon

VirtualBox Unavailable in Debian main due to Licensing Issues

Quote Whonix KVM:

The VirtualBox developer team have recently taken the decision to switch out the BIOS in their hypervisor. However, it now comes with one that requires compilation by a toolchain that does not meet the definition of Free Software as per the guidelines of the Free Software Foundation. This move is considered problematic for free and open source software projects like Debian, on which Kicksecure is based. The issues of the Open Watcom License are explained in this threadarchive.org iconarchive.today icon on the Debian Mailinglist. In summary, there are issues surrounding the contradictory language of the license, the assertion of patents against software that rely upon it, and the placing of certain restrictions on software uses. For these reasons, those who care about running FOSS and appreciate its ethical views are recommended to avoid running VirtualBox; also see avoid non-freedom software.

References:

  • VirtualBox Guest Additions and VirtualBox Oracle VM VirtualBox Extension Pack are different things.
  • This is unrelated to VirtualBox Oracle VM VirtualBox Extension Pack, which is proprietary, and which was never in Debian.

Does Debian build VirtualBox using Open Watcom? No. Quote debian/copyright filearchive.org iconarchive.today icon from Debian VirtualBox Repositoryarchive.org iconarchive.today icon: 

This package is not part of the Debian operating system.
It is in the "contrib" area of the Debian archive because it requires a
non-free compiler (Open Watcom) to build the BIOS.
Upstream provides pre-built BIOS images which is used instead.

Debian is already using VBoxBiosAlternative:

Quote https://bugs.launchpad.net/ubuntu/+source/virtualbox/+bug/1605337archive.org iconarchive.today icon / https://bugs.launchpad.net/ubuntu/+source/virtualbox/+bug/1605337/comments/3archive.org iconarchive.today icon 

<oracle> LocutusOfBorg: btw, there are no BIOS binaries in the vbox source tree. only the VBoxBiosAlternative.* files, which are used if you don't have OpenWatcom.

VirtualBox Guest Additions ISO Freedom vs Non-Freedom

A part of Guest Additions source code is the part of OSE repository and licensed under GPLv2. Guest Additions build also includes big list of 3rd party files under various permissive licenses

At the same time VirtualBox binary packages which are distributed freely includes Guest Additions ISO, and Licensing FAQ (https://www.virtualbox.org/wiki/Licensing_FAQarchive.org iconarchive.today icon) clearly states: Yes. The GPLv2 allows you to distribute the VirtualBox Guest Additions, in modified or unmodified form, as long as you adhere to the terms and conditions of the GPLv2.

I hope that answers your question.

VirtualBox Open Source vs Closed Source

  • VirtualBox is Open Source.
  • VirtualBox Guest Additions are Open Source.
  • VirtualBox Oracle VM VirtualBox Extension Pack is proprietary.
    • Not installed by default in Kicksecure VirtualBox.
    • Neither used nor required by most users.

Open Source here means, the full corresponding source code is released under Free Software Foundation (FSF), Open Source Initiative (OSI) and The Debian Free Software Guidelines (DFSG) approved licenses.

However the is a build toolchain issue elaborated in chapter VirtualBox Unavailable in Debian main due to Licensing Issues.

VirtualBox Integration

Issue

Goal: Installation of the VirtualBox host software with functional VirtualBox guest additions.

This was previously very difficult due to many issues of which none is caused by Kicksecure. The purpose of this chapter is to document the current implementation for those wondering why it has been implemented this way and perhaps hearing if there are any better alternatives. Here is a summary of these issues:

VirtualBox is unavailable in Debian stable and backports due to Debian stable security maintenance Issues.

Custom Debian backport building failing due to dependency issuesarchive.org iconarchive.today icon. Very difficultarchive.org iconarchive.today icon. Even if that was solved, there would still be the broken compilation from source code issuearchive.org iconarchive.today icon.

The Lucas Nussbaum Debian buster backport repositoryarchive.org iconarchive.today icon was not an option either at time of initial implementation. [3] In 23 July 2020 VirtualBox latest version in Lucas Nussbaum repository was
virtualbox_6.1.4-dfsg-1~~bpo10+1_amd64.deb 2020-02-22 07:52 while upstream virtualbox.org was at
virtualbox-6.1_6.1.12-139181~Debian~buster_amd64.deb.

VirtualBox was not available from Debian fasttrackarchive.org iconarchive.today icon at time of initial implementation during Kicksecure 15. VirtualBox from Debian fasttrack is used since Kicksecure 16.

VirtualBox Guest Additions Debian Packages are unavailable from upstream virtualbox.org Debian repositoryarchive.org iconarchive.today icon.

Previous call for help:

What is the importance VirtualBox in Debian buster? It is the base distribution which Kicksecure is based on and the distribution used to build Kicksecure for VirtualBox for Linux, Windows and macOS from source code.

Related:

Implementation

TODO: update for Kicksecure which uses Debian fasttrack repository to acquire VirtualBox.

To be able to continue providing Kicksecure for VirtualBox, from Kicksecure 15.0.1.4.8 and above the following implementation is in use:

  • VirtualBox Guest Additions
    • Kicksecure build script will download package virtualbox-guest-additions-isoarchive.org iconarchive.today icon from Debian sid (unstable) and upload to Kicksecure APT repository. That package provides file /usr/share/virtualbox/VBoxGuestAdditions.iso.
    • At time of initial implementation contained VirtualBox guest additions ISO version 6.1.12-1. In short, 6.1.12. Ignore the -1 which is a Debian package revision number and not the upstream (virtualbox.org) version number.
    • virtualbox.org homepage also advertised version 6.1.12.
    • Package virtualbox-guest-additions-iso will be installed by default in new Kicksecure VirtualBox builds.
    • Related: VirtualBox Guest Additions ISO Freedom vs Non-Freedom
    • Documented here: VirtualBox/Guest_Additions#VirtualBox_Guest_Additions
  • This is
    • to allow Kicksecure developers test newer versions of VirtualBox host software before these are installed on user's computer and,
    • to allow updating VirtualBox host software and VirtualBox guest additions at the same time, using compatible versions.
  • Package vm-config-distarchive.org iconarchive.today icon will run vbox-guest-installerarchive.org iconarchive.today icon (by Kicksecure developers) during upgrade (vm-config-dist.postinstarchive.org iconarchive.today icon) and therefore also during the Kicksecure VirtualBox ova build process.
  • Package vm-config-distarchive.org iconarchive.today icon has a dpkg trigger since Kicksecure 15.0.1.5.1 vm-config-dist.triggersarchive.org iconarchive.today icon which results in running vbox-guest-installer when package virtualbox-guest-additions-iso is upgraded.
  1. vbox-guest-installer (by Kicksecure developers) will check if any of the packages virtualbox-guest-x11, virtualbox-guest-utils or virtualbox-guest-dkms are still installed and recommend to uninstall those if still installed.
  2. And also check if package virtualbox-guest-additions-iso is installed and recommend to install it if not yet installed.
  3. If these two conditions are met it will continue.
  4. Next is deletion of folder /var/cache/vm-config-dist/vbox-guest-additions-extracted-iso and /var/cache/vm-config-dist/vbox-guest-additions-extracted-makeself if these are already existing from a previous run.
  5. It then follows extraction of /usr/share/virtualbox/VBoxGuestAdditions.iso to folder /var/cache/vm-config-dist/vbox-guest-additions-extracted-iso.
  6. Making /var/cache/vm-config-dist/vbox-guest-additions-extracted-iso/VBoxLinuxAdditions.run executable.
  7. Change directory into /var/cache/vm-config-dist/vbox-guest-additions-extracted-iso.
  8. Executing ./VBoxLinuxAdditions.run --check.
  9. Extracting ./VBoxLinuxAdditions.run to folder /var/cache/vm-config-dist/vbox-guest-additions-extracted-makeself.
  10. Change directory into folder /var/cache/vm-config-dist/vbox-guest-additions-extracted-makeself.
  11. Executing ./install.sh force force.
  12. Installation of VirtualBox guest additions from package virtualbox-guest-additions-iso should now be completed.
  13. Installation using this method also ships required hooks in folder /etc/kernel to rebuild VirtualBox guest additions during kernel upgrade thanks to VBoxGuestAdditions.iso.

Credits: Gratitude is expressed to VirtualBox developers for providing VBoxGuestAdditions.iso and to Debian Developers for providing package virtualbox-guest-additions-iso. The script to improve usability of this named vbox-guest-installer was created by the Kicksecure project.

Forum discussion: https://forums.whonix.org/t/challenges-upgrading-virtualbox-to-6-1-12-on-debian-buster-installation-from-upstream-virtualbox-org-apt-repository/9984archive.org iconarchive.today icon

Related: VirtualBox Generic Bug Reproduction

Fasttrack

Arguments for keeping VirtualBox Support

  • KVM is not available to Windows users.
  • Simplicity, as in: VirtualBox has a VM import GUI feature.
  • Available to users not owning computer providing hardware virtualization. (KVM requires that. QEMU may or may not but is unsupported.)
  • Due to Windows users and simplicity it leads to greater popularity, which in theory attracts more users, developers, auditors, payments, etc and is therefore good for the overall health of the project.
  • Some Windows/VirtualBox users experimenting with their first Linux (Kicksecure) will one day become users who mainly use Linux as their host operating system.
  • We have a Kicksecure Windows Installer which installs VirtualBox Kicksecure VirtualBox VMs because of these reasons.

VirtualBox Oracle VM VirtualBox Extension Pack

  • VirtualBox Guest Additions and VirtualBox Oracle VM VirtualBox Extension Pack are different things.
  • VirtualBox Oracle VM VirtualBox Extension Pack:
    • Is proprietary, nonfreedom software.
    • Was never in packages.debian.org.

Quote https://www.oracle.com/uk/virtualization/technologies/vm/downloads/virtualbox-downloads.htmlarchive.org iconarchive.today icon

Free for personal, educational or evaluation use under the terms of the VirtualBox Personal Use and Evaluation Licensearchive.org iconarchive.today icon on Windows, Mac OS X, Linux and Solaris x-86 platforms:

Quote https://www.virtualbox.org/wiki/Downloadsarchive.org iconarchive.today icon

Support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards. See this chapter from the User Manualarchive.org iconarchive.today icon for an introduction to this Extension Pack. The Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL)archive.org iconarchive.today icon.

Quote https://www.virtualbox.org/manual/ch01.html#intro-installingarchive.org iconarchive.today icon

The extension pack provides the following added functionality:

Storage Controller Setting

Since Kicksecure version 15.0.1.7.3: AHCI

Reasons:

Reason why Kicksecure previously used a different setting LsiLogic SAS was avoidance of VirtualBox host software bug, High I/O causing filesystem corruptionarchive.org iconarchive.today icon. See also old Whonix® issue tracker discussion, VirtualBox AHCIarchive.org iconarchive.today icon.

The current default setting AHCI might lead the to issue High Disk Usage Causing Filesystem Corruption on some (slower) hardware configurations due to VirtualBox host software bug, High I/O causing filesystem corruptionarchive.org iconarchive.today icon. It's speculation and unavoidable. There is no other solution at the moment. Wiki chapter High Disk Usage Causing Filesystem Corruption already contains approaches which might fix this issue in case it manifests.)

Bugs

[drm:vmw_host_log [vmwgfx]] ERROR Failed to send log

Confusing message but no bad effects.

https://www.virtualbox.org/ticket/19168archive.org iconarchive.today icon

[sda] Incomplete mode parameter data / Assuming drive cache: write through

Confusing error message due to our use of a SAS virtual hard drive controller no bad effects. Error message doesn't happen with SATA controller but we can't use that one

Core Dump

Quote https://www.virtualbox.org/wiki/Core_dumparchive.org iconarchive.today icon

VirtualBox core dump:

Note that this core dump can contain a memory dump of your guest which can include sensitive information.

Kernel core dump:

Privacy information: Also be aware that the above kernel dumps could contain unrelated sensitive and private information about you and your system, e.g. stored passwords in memory. Unfortunately this is unavoidable in those situations, as a kernel dump essentially is an unmodified and unfiltered part of your computer's RAM (main memory).

VirtualBox Bug Reports

VirtualBox (Guest Additions) have various issues. Often copy/paste from host to VM does not work or VMs are not automatically reized to optional size.

The internet is full of discussions that lead to no solution. Hard to find good information. It is unhelpful to ask in arbitrary places about it as this only leads to more discussions which go nowhere. The only option is to find out what information VirtualBox developers are asking for, to write a good bug report and to report to virtualbox.org developers.

  • Step 1) Research what information VirtualBox developers would be asking for.
  • Step 2) Write a good bug report.

What Should Be Included In Bug Report

Include as many information as possible.

Resize Issues

Notes

Non-Issues

  • https://www.virtualbox.org/ticket/17777archive.org iconarchive.today icon

    • (EE) Failed to load module "vboxvideo" (module does not exist, 0)

    • As of X.Org server 1.19 we use a kernel driver and the X.Org modesetting driver. See the log section you attached.

Bug Report Draft

user@host:~$ dpkg -l | grep x11
ii  libqt5x11extras5:amd64                        5.11.3-2                     amd64        Qt 5 X11 extras
ii  libva-x11-2:amd64                             2.4.0-1                      amd64        Video Acceleration (VA) API for Linux -- X11 runtime
ii  libx11-6:amd64                                2:1.6.7-1                    amd64        X11 client-side library
ii  libx11-data                                   2:1.6.7-1                    all          X11 client-side library
ii  libx11-xcb1:amd64                             2:1.6.7-1                    amd64        Xlib/XCB interface library
ii  libxkbcommon-x11-0:amd64                      0.8.2-1                      amd64        library to create keymaps with the XKB X11 protocol
ii  virtualbox-guest-x11                          6.1.4-dfsg-2                 amd64        x86 virtualization solution - X11 guest utilities
ii  x11-common                                    1:7.7+19                     all          X Window System (X.Org) infrastructure
ii  x11-utils                                     7.7+4                        amd64        X11 utilities
ii  x11-xkb-utils                                 7.7+4                        amd64        X11 XKB utilities
ii  x11-xserver-utils                             7.7+8                        amd64        X server utilities

ii  xserver-xorg                                  1:7.7+19                     amd64        X.Org X server
ii  xserver-xorg-core                             2:1.20.4-1                   amd64        Xorg X server - core server
ii  xserver-xorg-input-all                        1:7.7+19                     amd64        X.Org X server -- input driver metapackage
ii  xserver-xorg-input-libinput                   0.28.2-2                     amd64        X.Org X server -- libinput input driver
ii  xserver-xorg-video-fbdev                      1:0.5.0-1                    amd64        X.Org X server -- fbdev display driver
ii  xserver-xorg-video-qxl                        0.1.5-2+b1                   amd64        X.Org X server -- QXL display driver
ii  xserver-xorg-video-vesa                       1:2.4.0-1                    amd64        X.Org X server -- VESA display driver

Bug descriptions:

Broken:

1) Power off the VM. 2) Restart the VM. 3) Maximize the VM window after start of the VM as soon as possible. 4) VirtualBox VM Window → View → Virtual Screen 1 → Choose any, resize to another resolution 5) VirtualBox VM Window → View → Auto-resize Guest Display / Adjust Window Size

Also broken:

XFCE Start Menu → Settings → Display → Resolution: → Choose a higher resolution resolution → Apply

TODO: manual resize functional using xrandr

See Also

References

  1. ↑ In response to whether JanusVM was safe to use, Roger Dingledine of The Tor Project stated in 2011archive.org iconarchive.today icon: "No, not safe. Probably has been unsafe to use for years."
  2. ↑ VirtualBox bug report: clarify license of VBoxGuestAdditions ISO OSE or PUEL (free vs nonfree)archive.org iconarchive.today icon VirtualBox forums question: Is VBoxGuestAdditions_6.1.10.iso OSE or PUEL?archive.org iconarchive.today icon
  3. ↑
  4. ↑ manual instructions
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Dev/VirtualBox&oldid=54712"