Jump to: navigation, search

Qubes/DisposableVM

Advanced Users Only![edit]



What are DisposableVMs?[edit]

In the Qubes TemplateVM model, [3] any changes made to a TemplateBasedVM's root filesystem are lost upon reboot. This is advantageous for several reasons: it saves time and disk space, and allows faster, centralized updates for applications that are usually found inside the root filesystem. However, certain directories are designed to persist between reboots in order to store files and settings. These directories are stored in /rw/ and include /home/user as well as additional directories defined by "bind directory" settings. [4]

Qubes does not have a built-in snapshot capability like VirtualBox that can completely revert all changes back to a previous VM state. [5] [6] In other words, no method exists within AppVMs to reverse changes made to the persistent file system without implementing some type of custom solution. To ensure that all filesystem changes are discarded after a session, Qubes offers DisposableVMs. When a DisposableVM is shutdown, the VM is removed from Qubes and all related VM images are deleted from the host filesystem. This method is not yet amnesic and should not be relied upon for anti-forensics!

While DisposableVMs ensure that files do not persist without user intervention, the downside is the user can no longer decide whether or not the current VM state should be kept or destroyed. Users must choose beforehand to use a standard AppVM or a DisposableVM; this decision cannot be changed after the fact.

The Two-Layered DisposableVM System[edit]

Qubes currently uses a two-layered approach to DisposableVMs. At the core of the system is a TemplateVM upon which a DisposableVM-Template is based. Every time a new DisposableVM is launched, it is based on the DisposableVM-Template - hence, two layers. In a standard Qubes-Whonix installation:

  • The base TemplateVM is whonix-ws.
  • The DisposableVM-Template is called whonix-ws-dvm.
  • Each new DisposableVM (disp1, disp2, ...) is based on whonix-ws-dvm.


Once a DisposableVM-Template is created, its /home/user/ directory can be customized [7] independently of the base TemplateVM. In this special case, the DisposableVM-Template will continue to inherit changes from the base TemplateVM's root filesystem (for example, package updates), but user files in /home/user/ will persist independently.

DisposableVM Traffic is Stream Isolated from Other VMs[edit]

DisposableVMs work especially well with Whonix-Gateway because each VM is assigned a unique internal IP address. In this way, all traffic from a DisposableVM is stream isolated from all other traffic arising from VMs running in paralell.


Warnings[edit]

Warning: Do not Use Firefox from Qubes' DisposableVM Default Start Menu[edit]

Warning: Use Caution when Spawning DisposableVMs from Other VMs[edit]

[11]

Warning: DisposableVMs are not Amnesic[edit]

[12] [13] [14] [15]

Warning: DisposableVMs may be Linkable to other VMs Connected to the Same Whonix-Gateway[edit]

Warning: Check the Tor Browser Version[edit]


Setup[edit]


Note: All examples below reference GUI actions whenever possible. The equivalent command line interface commands are listed in the footnotes.

Creating a New DisposableVM-Template Based on Whonix-Workstation[edit]

Advanced users: If you wish to install the alpha or sandboxed version of Tor Browser, click on Expand on the right.

Option #1: Use a non-customized DisposableVM-Template

This template will use a stock image based on whonix-ws and will not preserve any changes that are made to it.

Step 1: Disable tb-updater's functionality which automatically updates during apt-get inside the Qubes TemplateVM. [19]

This prevents the preferred Tor Browser version being overwritten by the stable version.

In whonix-ws terminal, run.

echo "tb_install_follow=false" | sudo tee -a /etc/torbrowser.d/50_user.conf

Step 2: Install the preferred version of Tor Browser to TemplateVM by launching Tor Browser Downloader by Whonix and following the instructions. [20] [21] [22]

In whonix-ws terminal, run.

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Step 3: Create a DisposableVM-Template based on the whonix-ws TemplateVM.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

When a new version of Tor Browser is released, repeat the previous two steps to update the TemplateVM and DisposableVM-Template.

Option #2: Use a Customized DisposableVM-Template

Note: This template can be further customized by following the instructions below.

Step 1: Delete the existing DisposableVM-Template.

In dom0 terminal, run.

qvm-remove <oldDisposableVM-Template>

Step 2: Create a new DisposableVM-Template based on the whonix-ws TemplateVM.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

Step 3: Configure Whonix-Gateway as the NetVM for the DisposableVM-Template.

In dom0 terminal, run.

qvm-prefs -s whonix-ws-dvm netvm sys-whonix

Step 4: Launch a DisposableVM-Template terminal.

In dom0 terminal, run.

qvm-run -a whonix-ws-dvm konsole

Step 5: Enable a customized flag in the DisposableVM-Template.

In the DisposableVM-Template terminal, run.

touch /home/user/.qubes-dispvm-customized

Step 6: Use update-torbrowser to download and install the preferred TorBrowserBundle.

In the DisposableVM-Template terminal, run.

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Step 7: Shutdown the DisposableVM-Template.

In the DisposableVM-Template terminal, run.

sudo poweroff

Step 8: Regenerate the DisposableVM-Template.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

Do not forget to check your Tor Browser version!


Create and Configure a DisposableVM-Template

Step 1: Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Step 2: Create a DisposableVM-Template.

qvm-create-default-dvm whonix-ws

Step 3: Enable DisposableVM-Template presentation in the Qubes VM Manager (QVMM).

dom0 -> Qubes VM Manager -> (menu) View -> enable 'Show/Hide internal VMs'

dom0 -> Qubes VM Manager -> enable 'Show/Hide inactive VMs'

Step 4: Configure Whonix-Gateway as the NetVM. [23]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> VM Settings -> NetVM -> sys-whonix

If intending to spawn DisposableVMs from other VMs, configure the NetVM for the DisposableVM setting, see Warning: Use caution when spawning DisposableVMs from other VMs.

The DisposableVM is now ready for use and is configured with all of the applications present in the Whonix-Workstation template, including Tor Browser.

Also follow the next step #Edit Qubes DisposableVM start menu to make sure Firefox is not accidentally started, since this is discouraged!

Edit Qubes' DisposableVM Start Menu[edit]

Complete the following to work around #Warning: Do not use Firefox from Qubes DisposableVM default start menu.

In Qubes dom0.

alt + F3 -> on the left side, click 'DisposableVM' -> right-click on 'Firefox' -> edit ->

  • Name: DisposableVM: Tor Browser
  • Command: sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'


-> click 'Save'

While editing entries, it is also possible to edit the xterm entry and change it to konsole. This is not important for security, but may be a personal preference.

Deleting a DisposableVM-Template[edit]

Deleting a DisposableVM-Template is not usually necessary, since only one DisposableVM-Template is allowed (before Qubes 4.0). Creating a new DisposableVM-Template will overwrite the existing one. However, if a template has been customized, the existing one may need to be deleted to start with a fresh unmodified DisposableVM-Template.

A DisposableVM-Template can be deleted in the same manner as other VMs.

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Remove VM' [24]

Customizing a DisposableVM-Template[edit]

Extra caution must be exercised when customizing a DisposableVM-Template. [25] From a privacy perspective, one would ideally want to have a DisposableVM-Template that is indistinguishable from any other Whonix-Workstation. If changes are made to the DisposableVM-Template, these may link all of the DisposableVMs via a uniquely generated fingerprint should they be compromised independently. Risky changes include, but are not limited to: the installation of obscure programs, uncommon configuration settings, or the placement of unique data files. Always remember that the DisposableVM will likely be exposed to the greatest Internet threats.

Tor Browser is specifically designed to prevent websites from fingerprinting the user or identifying them based on the browser configuration. It should generally be used in its stock configuration in order to make the user's fingerprint less unique, due to commonality with the larger pool of Tor users. Each individual browser change can contribute to significant worsening of the fingerprint, so it is advisable to only make alterations if the expected impact is known.

Some changes, like disabling JavaScript by default, may make sense to users in terms of a usability-security trade-off. Additionally, minor cosmetic changes like the UI layout, or the placement of buttons, may be considered harmless to privacy while enhancing personal usability.

Please remember that only files in /home/user/ can be customized in a DisposableVM-Template. [26]

As stated earlier, the following steps to customize the DisposableVM are completely optional.

1. Configure Qubes to Preserve Customized Changes

Open a terminal in the DisposableVM-Template. [27]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole'

Instruct Qubes to preserve changes.

touch /home/user/.qubes-dispvm-customized

2. Launch the Application to Customize [28]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Run command in VM'

Enter the name of the application. For example. [29]

torbrowser

libreoffice

3. Finalize the DisposableVM-Template

Once satisfactory changes have been made, shutdown the DisposableVM-Template. [30]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Shutdown VM'

4. Regenerate the DisposableVM-Template

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Regenerate the template.

qvm-create-default-dvm whonix-ws

All of the changes to /home/user/ in the DisposableVM-Template should now persist whenever the template is re-created.

Updating a DisposableVM-Template[edit]

Changes to the underlying TemplateVM (whonix-ws) are detected automatically and the DisposableVM-Template is updated without user intervention. That means package updates that are applied to whonix-ws are also applied to the whonix-ws-dvm.

Updating Tor Browser[edit]

Tor Browser presents a special situation because it is installed in a user's home directory. As a result, the TemplateVM (whonix-ws) never updates existing Tor Browser installations.

Non-Customized DisposableVM-Templates Users

To obtain the latest Tor Browser, the simplest method is to use Whonix's built-in Tor Browser downloader functionality. Simply update using Tor Browser Downloader by Whonix (tb-updater) in whonix-ws when performing your usual maintenance upgrading.

Update and upgrade.

sudo apt-get update && sudo apt-get dist-upgrade

Then, create a new DisposableVM to overwrite the existing one.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Create a new DisposableVM-Template using the updated whonix-ws TemplateVM.

qvm-create-default-dvm whonix-ws

Customized DisposableVM-Template Users

Users have two choices:

  1. Tor Browser Downloader by Whonix (tb-updater) (update-torbrowser)
  2. Tor Browser's internal updater.


Option #1: Use update-torbrowser to download a new copy of Tor Browser

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole' [31]

Launch Tor Browser Downloader by Whonix and follow the instructions. [20] [21] [22]

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Shutdown the DisposableVM-Template. [32]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Shutdown VM'

Regenerate the DisposableVM-Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Then run.

qvm-create-default-dvm whonix-ws

Option #2: Use Tor Browser's internal updater and download new updates only

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'torbrowser' [33]

Use Tor Browser's Internal Updater by clicking TorButton and selecting Check for Tor Browser Update. Close and restart Tor Browser.

Shutdown the DisposableVM-Template. [34]

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Shutdown VM'

Regenerate the DisposableVM-Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Regenerate the template.

qvm-create-default-dvm whonix-ws


Usage[edit]

DisposableVMs are well-suited for risky and largely independent activities, like web browsing or opening untrusted files. In contrast, AppVMs might be better suited for activities necessitating file persistence, like email clients with local email storage. Qubes' VM integration tools, like secure file copy [35] and secure clipboard, [36] mean that clean, trusted files and text can be easily and safely transferred to trusted VMs should it be necessary.

User Tips[edit]

  • Remember that a DisposableVM is shutdown when the first user-launched process is terminated. If a new DisposableVM is created by launching Tor Browser and text is then composed in an editor, all of the work will be lost upon closing Tor Browser. To avoid this, it is prudent to launch a DisposableVM via a terminal and launch additional applications from the command line. In this scenario, the DisposableVM is destroyed by simply exiting the terminal.
  • In Qubes, it is inadvisable to store valuable information in an untrusted VM. This view is supported by the fact that Tor Browser doesn't remember bookmarks or credentials. A best practice for storing sensitive information is to use an offline vault VM and applications like password managers. @rustybird has announced a new "split-tor-browser" [37] package that can retrieve urls and credentials from a trusted VM for use in a DisposableVM's web browser. This package has not yet been tested or endorsed by Whonix, but it looks promising.
  • Sometimes a non-networked DisposableVM is useful for opening untrusted files that might otherwise try to use the network maliciously. Like all Qubes VMs, the NetVM for a DisposableVM can be changed dynamically while the VM is running. Simply set the NetVM to "none" using the Qubes VM Manager or the command line interface. [38] Warning: Use utmost caution if deciding to re-establish network connectivity. There is currently no mechanism in place to prevent connections to a clearnet NetVM.

Adding a Desktop Shortcut[edit]

Qubes 3.2 / XFCE4[edit]

To create a desktop shortcut that starts Tor Browser inside a DisposableVM, perform the following steps.

Right click anywhere on the free space of the desktop -> Create Launcher ->

  • Name: DispTB
  • Command: sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'


-> Click Create

Double-click the newly created desktop shortcut to start it. At first start, it is safe to click "Mark Executable".

In order to see the desktop shortcuts, users may prefer to use the XFCE workspace switcher to navigate to another empty virtual desktop so existing windows do not need to be minimized.


Start Tor Browser in a DisposableVM[edit]

Tor Browser can be started with a desktop shortcut like in the above example, or via another method. After launch, do not forget to check the Tor Browser version!


Adding Shortcuts to Application Menus[edit]

[39]

Qubes 3.2 / XFCE4 (Untested)[edit]

Make a .desktop file for every DisposableVM shortcut that will be added to the menu.[40] These .desktop files must be placed in ~/.local/share/applications/.

Open a terminal in the DisposableVM-Template.

dom0 -> Qubes VM Manager -> right-click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole' [41]

Create a local applications directory.

mkdir -p ~/.local/share/applications/

Use a text editor to create and open each .desktop file and logically name each one.

kwrite ~/.local/share/applications/dvm-torbrowser.desktop

As appropriate, add the following entries and substitute fields to each .desktop file. In the Exec field, substitute torbrowser with the command used to launch each relevant application matching the shortcut. For example: konsole, kwrite, libreoffice, kgpg, okular, dolphin and so on.

[Desktop Entry]
Name=Tor Browser
Comment=Launch Tor Browser in DisposableVM
Type=Application
Terminal=false
Exec=sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

Icon= & Category= are also useful fields. Feel free to research the .desktop specification using the footnote above.

Once the .desktop files have been created, they need to be added to the Applications menu. Use a text editor to edit the following file.

kwrite ~/.config/menus/xfce-applications.menu

Find the menu entry associated with the DisposableVM-Template. (Help!)

<Menu>
    <Name>DisposableVMTemplate</Name>

In the <Include> subsection, add the appropriately named .desktop file.

<Filename>dvm-torbrowser.desktop</Filename>

Qubes 3.2 / XFCE4: MenuLibre (Untested)[edit]

This is recommended for testers only! Users should know how to fix the application menu in case it breaks. If interested, click on Expand on the right.

Warning: Testers have previously experienced removal of the Qubes System Tools start menu entry when applying these changes! For greater safety, consider using git to manage the home folder so any MenuLibre changes can be reverted.

In dom0, run.

sudo qubes-dom0-update menulibre

The use the menu editor.

Qubes Start Menu -> System Tools -> Menu Editor

Qubes 3.1 / KDE4[edit]

dom0 -> right-click Application Launcher Menu -> click `Edit Applications` -> Select DisposableVM from the VM entries on the left panel -> Press the arrow button to expand the menu -> Click New Item on the Toolbar -> Type in a Name for the shortcut ->

Type in the specific command to launch the program in the DisposableVM. Tor Browser, konsole and dolphin are provided as examples below.

sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo dolphin | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

-> Click on the square in the upper right in order to choose an icon [42] -> Click Save.


Command Line Interface[edit]

It is simple to start applications like konsole or Tor Browser in a DisposableVM.

Open a dom0 terminal.

echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red

echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red


Footnotes[edit]

  1. Significant improvements are planned for DisposableVMs in Qubes R4.0. See: https://github.com/QubesOS/qubes-issues/issues/866#issuecomment-220495485
  2. At least one user has reported the "do not use Firefox from Qubes DisposableVM default start menu" issue when attempting to use Tor Browser.
  3. AppVMs (qubes) and TemplateVMs
  4. How to make any file in a TemplateBasedVM persistent using bind-dirs
  5. Apart from qvm-revert-template-changes which can only revert to the state existing before the last shutdown of the TemplateVM.
  6. Qubes VM snapshots using git / SVN.
  7. https://www.qubes-os.org/doc/dispvm-customization/
  8. Instructions are provided later under chapter #Setup.
  9. DisposableVMs are created in one of two ways:
    • Open in DisposableVM. On the command line (domU), run.
      qvm-open-in-dvm
    • Run in DisposableVM. On the command line (domU), run.
      qvm-run --dispvm
  10. On the command line (dom0), run.
    qvm-prefs -s vmname dispvm_netvm sys-whonix
  11. Whonix default NetVM settings fixes
  12. Whonix is not amnesic.
  13. Is there a substitute for Whonix's lack of an Amnesic feature?
  14. DisposableVMs do not run entirely in RAM.
  15. DisposableVMs: support for in-RAM execution only (for anti-forensics) #904
  16. https://lists.torproject.org/pipermail/tor-dev/2016-October/011591.html
  17. Multi GW Documentation.
  18. Home folder of template not inherited by DisposableVM #1335
  19. Tor_Browser#tb-updater_in_Qubes_TemplateVM
  20. 20.0 20.1 Using >/dev/null 2>&1 to hide some useless and confusing GTK warnings.
  21. 21.0 21.1 Using noaskstart="true" to prevent Tor_Browser#Running_Tor_Browser_in_Qubes_TemplateVM.
  22. 22.0 22.1 Or for command line interface version, simply use.
    noaskstart="true" update-torbrowser
  23. On the command line (dom0), run.
    qvm-prefs -s whonix-ws-dvm netvm sys-whonix
  24. On the command line (dom0), run.
    qvm-remove <vmname>
  25. Qubes documentation: DisposableVM Customization
  26. Home folder of template not inherited by DisposableVM #1335
  27. On the command line (dom0), run.
    qvm-run -a whonix-ws-dvm konsole
  28. On the command line (dom0), run.
    qvm-run -a whonix-ws-dvm <name of application>
  29. Other common applications launched from the command line are konsole, dolphin, okular, kgpg and so on.
  30. On the command line (dom0), run.
    qvm-shutdown <vmname>
  31. On the command line (dom0), run.
    qvm-run -a whonix-ws-dvm konsole
  32. On the command line (dom0), run.
    qvm-shutdown whonix-ws-dvm
    or
    DisposableVM-Template command line (domU), run.
    sudo poweroff
  33. On the command line (dom0), run.
    qvm-run -a whonix-ws-dvm torbrowser
  34. On the command line (dom0), run.
    qvm-shutdown whonix-ws-dvm
  35. Qubes documentation: Copying and Moving Files Between Domains
  36. Qubes documentation: Copying and Pasting Text Between Domains
  37. Github: Split Browser
  38. On the command line (dom0), run.
    qvm-prefs -s disp<1 | 2 | ...> netvm none
  39. Qubes feature request WIP: Have DisposableVMs inherit launcher shortcuts like other TemplateBasedVMs #1339
  40. Official documentation: Desktop entry specifications
  41. On the command line (dom0), run.
    qvm-run -a whonix-ws-dvm konsole
  42. Custom application icons are stored in /var/lib/qubes/<type of vm>/<vm name>/apps.icons/

Random News:

We are looking for help in managing our social media accounts. Are you interested?


Impressum | Datenschutz | Haftungsausschluss

https | (forcing) onion
Share: Twitter | Facebook | Google+

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix (g+) is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)