VM Live Mode: Alternative ro-mode-init Configuration

From Kicksecure
< VM Live Mode
Revision as of 17:43, 1 January 2022 by Patrick (talk | contribs) (Created page with "{{Header}} {{Title| title=VM Live Mode: Alternative ro-mode-init Configuration }} {{#seo: |description=VM Live Mode System |image=https://www.whonix.org/w/images/4/43/Alternat...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

About this VM Live Mode/ro-mode-init Page
Contributor maintained wiki page.
Support Status testing
Difficulty medium
Contributor Algernonarchive.org iconarchive.today icon
Support Support

Introduction

As an alternative [1] in Kicksecure VirtualBox or Kicksecure KVM, it is also possible to automatically detect if the disk is set to read-only and enable live mode automatically using the ro-mode-init package.

ro-mode-init is currently less tested than grub-live (Host Live Mode / VM Live Mode).

Preliminary Steps

1. Backup.

  • Option 1: Create a snapshot of your VM; or
  • Option 2: Alternatively backup the /boot folder.

Click = Copy Copied to clipboard! sudo cp -a /boot /boot.back

2. Install ro-mode-init.

Install package(s) ro-mode-init following these instructions

1 Platform specific notice.

2 Update the package lists and upgrade the systemOnion network Logo.

Click = Copy Copied to clipboard! sudo apt update && sudo apt full-upgrade

3 Install the ro-mode-init package(s).

Using apt command line --no-install-recommends optionOnion network Logo is in most cases optional.

Click = Copy Copied to clipboard! sudo apt install --no-install-recommends ro-mode-init

4 Platform specific notice.

  • Kicksecure: No special notice.
  • Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template ModificationOnion network Logo.

5 Done.

The procedure of installing package(s) ro-mode-init is complete.

3. Upate initial ramdisk. [2]

Click = Copy Copied to clipboard! sudo update-initramfs -u

4. Set the VM disk to read-only.

The read-only VM setting is necessary (see below), otherwise the VM disk will always boot into persistent mode.

Read-only VM Setting

VirtualBox

Read-only disk on VirtualBox

To boot into live mode, apply the following steps.

Set the VirtualBox virtual harddrive to read-only.

1. Power off the machine.

2. Open setting window of the machine and set the type of storage device controller from AHCI to LsiLogic SAS.

VirtualBox → Settings → Storage → Type: LsiLogic SAS → OK

3. Learn the syntax.

Do not run the following command. Only look at it.

TODO research: lsilogicsas might no longer work because nowadays using IntelAhci. So commands below need adjustment. How? This is difficult because undocumented by VirtualBox. 

VBoxManage setextradata vmname "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Replace vmname with the name of the actual VM name.

4. On the command line run.

Kicksecure Xfce example:

Click = Copy Copied to clipboard! VBoxManage setextradata Kicksecure-Xfce "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Kicksecure CLI example:

Click = Copy Copied to clipboard! VBoxManage setextradata Kicksecure-CLI "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Read-write disk on VirtualBox

To boot into read-write mode again, simply revert this change.

  1. Power off the machine.
  2. From the command line run.

Use the syntax below.

Click = Copy Copied to clipboard! VBoxManage setextradata vmname "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly"

Replace vmname with the name of the actual VM name.

KVM

Read-only disk on KVM

To boot into live mode, apply the following steps:

  1. Power off the machine.
  2. Set the hard disk to read-only in the virt-manager GUI.
  3. Power on the machine and select to boot into live mode.

Read-write disk on KVM

To boot into normal mode again, simply revert this change:

  1. Power off the machine.
  2. Set the hard disk to read-write in the virt-manager GUI.
  3. Power on the machine and boot into read-write mode.

Live Mode Indicator Systray

https://github.com/Whonix/whonix-xfce-desktop-config/blob/master/usr/share/livecheck/livecheck.sharchive.org iconarchive.today icon

Debugging

An inconsistent filesystem will likely result in errors during booting in live mode. For instance, inconsistencies can arise when the VM is killed instead of performing a normal shutdown in persistent mode. Therefore to ensure it is consistent, run fsck in persistent mode. Debian automatically does this during boot. VMs running in live mode can be killed without problems.

In the case of non-fsck related errors using ro-mode-init (like dropping to an initramfs shell), add the following to the kernel command line/GRUB menu for easier debugging:

Click = Copy Copied to clipboard! debug=1 break=init-premount

Footnotes

  1. ↑ To the default method documented on VM Live Mode.
  2. ↑ Required for now but not forever.
Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=VM_Live_Mode/ro-mode-init&oldid=53960"