Jump to: navigation, search

Qubes/Disposable VM

Advanced users only![edit]


What are Disposable VMs?[edit]

Under the Qubes TemplateVM model [3], any changes made to a TemplateBasedVM's root filesystem are lost upon reboot. This is advantageous for several reasons: it allows centralized (and therefore faster) updates for all applications (most) inside the root filesystem, saves time and disk space. However, certain directories are designed to persist between reboots in order to store files and settings. These directories are stored in /rw/ and include /home/user as well as additional directories defined by "bind directory" settings [4].

Qubes does not have a built-in snapshot capability like VirtualBox that can completely revert all changes back to a particular VM state. [5] [6] In other words, on AppVMs, there is no method to reverse changes to the persistent file system without implementing some type of custom solution. To ensure that all changes to the filesystem are discarded after a session, Qubes offers DisposableVMs. When a DisposableVM is shutdown, the VM is removed from Qubes and all related VM images are deleted from the host filesystem. This is not yet amnesic / should not be relied upon for anti-forensics yet!

On one hand, this system ensures that files do not persist without requiring any user intervention; on the other hand, the user can no longer decide between keeping or destroying the current VM state. You must choose whether to use a standard AppVM or a DisposableVM beforehand - this decision can not be modified after-the-fact.

The Two-Layered Disposable VM System[edit]

Qubes currently uses a two-layered approach to DisposableVMs. At the base of the system is a TemplateVM upon which a DisposableVM-Template is created. Every time a new DisposableVM is launched, it is based on the DisposableVM-Template - hence, two layers. For a standard Whonix installation, the base TemplateVM would be whonix-ws; the DisposableVM-Template would be called whonix-ws-dvm; and each new DisposableVM (disp1, disp2, ...) would be based on whonix-ws-dvm. Once a DisposableVM-Template is created, its /home/user/ directory can be customized [7] independently of the base TemplateVM. While it will continue to inherit changes to the base TemplateVM's root filesystem (for example, package updates), user files in /home/user/ will continue to persist independently.

Disposable VM Traffic is Stream Isolated from Other VMs[edit]

Disposable VMs work especially well with Whonix-Gateway because each VM is assigned a unique internal IP address. This ensures that all traffic from a DisposableVM is stream isolated from all other traffic from concurrently running VMs.


Warnings[edit]

Warning: Do not use Firefox from Qubes DisposableVM default start menu[edit]

Later under chapter #Setup you will be instructed in sub chapter #Edit Qubes DisposableVM start menu on how to prevent this.

Warning: Use caution when spawning DisposableVMs from other VMs[edit]

[11]

Warning: Disposable VMs are not amnesic[edit]

[12][13] [14] [15]

Warning: Disposable VMs may be linkable to other VMs connected to the same Whonix-Gateway[edit]

Warning: Check your Tor Browser Version[edit]


Setup[edit]

All examples are given in terms of GUI actions whenever possible. The equivalent CLI commands will be listed in the footnotes.

Creating a new DisposableVM-Template based on Whonix-Workstation[edit]

(Advanced users: If you wish to install a version of Tor Browser other than stable (ie alpha, hardened), click on expand on the right for instructions.)

Option #1: Set Whonix package tb-updater to always download the version you prefer in your TemplateVM

TODO: finish documentation. - https://forums.whonix.org/t/qubes-dispvm-technical-discussion/3232/33

Option #2: Use a customized DisposableVM-Template

Delete existing DisposableVM-Template.

In dom0 terminal: qvm-remove <oldDisposableVM-Template>

Create a new DisposableVM-Template based on whonix-ws TemplateVM.

In dom0 terminal: qvm-create-default-dvm whonix-ws

Configure Whonix-Gateway as the NetVM for the DisposableVM-Template.

In dom0 terminal: qvm-prefs -s whonix-ws-dvm netvm sys-whonix

Launch DisposableVM-Template terminal.

In dom0 terminal: qvm-run -a whonix-ws-dvm konsole

Enable customized flag in DisposableVM-Template.

In DisposableVM-Template terminal: touch /home/user/.qubes-dispvm-customized

Use update-torbrowser to download and install preferred TorBrowserBundle

In DisposableVM-Template terminal: noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Shutdown the DisposableVM-Template

In DisposableVM-Template terminal: sudo poweroff

Regenerate the DisposableVM-Template.

In dom0 terminal: qvm-create-default-dvm whonix-ws

Remember to check your Tor Browser version!


Create and Configure a DisposableVM-Template

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Create a DisposableVM-Template.

qvm-create-default-dvm whonix-ws

Enable showing your DisposableVM-Template in Qubes VM Manager (QVMM).

dom0 -> Qubes VM Manager -> (menu) View -> enable 'Show/Hide internal VMs'

dom0 -> Qubes VM Manager -> enable 'Show/Hide inactive VMs'

Configure Whonix-Gateway as your NetVM.[19]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> VM Settings -> NetVM -> sys-whonix

If you intend to spawn DisposableVMs from other VMs, configure your NetVM for DispVM setting, see Warning: Use caution when spawning DisposableVMs from other VMs.

Your DisposableVM is now ready for use and is configured with all of the applications present in your Whonix-Workstation template, including Tor Browser.

Also follow the next step #Edit Qubes DisposableVM start menu to make sure you will not be accidentally starting Firefox which is discouraged!

Edit Qubes DisposableVM start menu[edit]

Do the following to work around #Warning: Do not use Firefox from Qubes DisposableVM default start menu.

In Qubes dom0.

alt + F3 -> on the left side, click DisposableVM -> right click on 'Firefox' -> edit ->

  • Name: DispVM: Tor Browser
  • Command: sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

click 'Save'

While you are at it, you might want to also edit the xterm entry and change to konsole, however that is not important for security, that is just an optional matter of taste.

Deleting a DisposableVM-Template[edit]

Deleting a DisposableVM-Template is not usually necessary, since only one DisposableVM-Template is allowed (up to Qubes 3.2). Creating a new DisposableVM-Template will overwrite the existing one. However, if you've customized the template, you may need to delete the existing one to start with a fresh unmodified DisposableVM-Template.

A DisposableVM-Template can be deleted in the same manner as other VMs:

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Remove VM' [20]

Customizing a DisposableVM-Template[edit]

Extra caution must be exercised when customizing a DisposableVM-Template. [21] From a privacy perspective, one would ideally want to have a DisposableVM-Template that is indistinguishable from any other Whonix-Workstation. If changes are made to the DisposableVM-Template, such as the installation of obscure programs or the setting of unique configurations or the placement of unique data files, those may serve to link all of your DisposableVMs via a unique fingerprint should they be compromised independently. It is also good to remember that your DisposableVM will likely be exposed to your greatest threats.

Tor Browser specifically is largely designed to be used in its stock configuration in order to preserve as big an anonymity (fingerprint) set as possible. Many changes can result in the alteration of its fingerprint so it is advisable to only change what you are knowledgeable about. Some changes, like disabling JavaScript by default, may make sense to you in terms of trade-offs. Additionally, minor cosmetic changes, like the UI layout, or the placement of buttons, may be considered harmless to your privacy while enhancing your own personal usability.

Please remember that only files in /home/user/ can be customized in a DisposableVM-Template.[22]

As stated previously, the following steps to customize the DisposableVM are completely optional.

Tell Qubes to preserve your custom changes.

Open a terminal in the DisposableVM-Template.[23]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole'

touch /home/user/.qubes-dispvm-customized

Launch the application you would like to customize.[24]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Run command in VM'

Enter the name of the application. For example, torbrowser, libreoffice, konsole, dolphin, okular, kgpg, etc

Finalize the DisposableVM-Template

Once you are satisfied with your changes, shutdown the DisposableVM-Template.[25]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Shutdown VM'

Regenerate the DisposableVM-Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

qvm-create-default-dvm whonix-ws

All of your changes to /home/user/ in the DisposableVM-Template should now persist whenever you re-create the template.

Updating a DisposableVM-Template[edit]

Changes to the underlying TemplateVM (whonix-ws) are detected automatically and the DisposableVM-Template is updated without user intervention. That means package updates that are applied to whonix-ws are also applied to the whonix-ws-dvm.

Updating Tor Browser[edit]

Tor Browser presents a special situation because of the fact that it is installed in a user's home directory. As a result, the TemplateVM (whonix-ws) never updates existing Tor Browser installations.

For non-customized DisposableVM-Templates: The simplest method to obtain the latest Tor Browser is to use Whonix's built-in Tor Browser downloader functionality. Simply update Tor Browser Downloader by Whonix (tb-updater) in whonix-ws while performing your usual maintenance upgrading via sudo apt-get update and sudo apt-get dist-upgrade.

Then, create a new DisposableVM to overwrite the existing one.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

Create a new DisposableVM-Template using the updated whonix-ws TemplateVM.

qvm-create-default-dvm whonix-ws

For customized DisposableVM-Templates: Users may choose to use Tor Browser Downloader by Whonix (tb-updater) (update-torbrowser) or to use Tor Browser's internal updater.

Option #1: Use (update-torbrowser) and download a new copy of Tor Browser

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole' [26]

Launch Tor Browser Downloader by Whonix and follow the instructions. [27] [28] [29]

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Shutdown the DisposableVM-Template[30]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Shutdown VM'

Regenerate the DisposableVM-Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

qvm-create-default-dvm whonix-ws

Option #2: Use Tor Browser's internal updater and download new updates only

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'torbrowser'[31]

Use Tor Browser's Internal Updater by clicking TorButton and selecting Check for Tor Browser Update. Close and restart Tor Browser.

Shutdown the DisposableVM-Template[32]

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Shutdown VM'

Regenerate the DisposableVM-Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Konsole or Xfce Terminal

qvm-create-default-dvm whonix-ws


Usage[edit]

Disposable VMs lend themselves well to being used for risky, largely independent activities, like web browsing or opening untrusted files; while AppVMs might be better suited when file persistence is necessary (for example: an email client with local email storage). Qubes' VM integration tools, like secure file copy[33] and secure clipboard[34], mean that clean, trusted files and text can be easily transferred to your trusted VMs should it be necessary and safe.

Tips[edit]

  • Remember that a DisposableVM is shutdown when the first user-launched process is terminated. If you create a new DisposableVM by launching Tor Browser and then proceed to compose text in an editor, all of your work will be lost if you close Tor Browser. To avoid this, you may want to launch a DisposableVM via a terminal and launch additional applications from the command line. When you are ready to destroy the DisposableVM, you can simply exit from the terminal.
  • In Qubes, it is never a good idea to store valuable information in an untrusted VM. This is further enforced by the fact that Tor Browser doesn't remember bookmarks or credentials. A best practice for storing this type of information is to use a password manager in an offline vault VM. @rustybird has announced a new "split-tor-browser"[35] package that can retrieve urls and credentials from a trusted VM for use in a DisposableVM's web browser. (This package has not yet been tested or endorsed by Whonix.)
  • Sometimes it is useful to have a non-networked DisposableVM for opening untrusted files that may try to use the network maliciously. Like all Qubes VMs, the NetVM for a DisposableVM can be changed dynamically while the VM is running. Simply set the NetVM to 'none' using the Qubes VM Manager or the CLI.[36] Warning: If you decide to re-establish network connectivity, use utmost caution in doing so, since there is no mechanism in place to prevent you from connecting to a clearnet NetVM.

Adding desktop shortcut[edit]

Qubes 3.2 / XFCE4[edit]

To create a desktop shortcut that starts Tor Browser inside a DisposableVM, you could do the following.

Right click anywhere on the free space of the desktop. -> Create Launcher

  • Name: DispTB
  • Command: sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

Click Create

Double click the newly created desktop shortcut to start it.

At first start, you can safely click "Mark Executable".

You might like using XFCE workspace switcher to switch to another empty virtual desktop so you do not have to minimize existing windows in order to see the desktop shortcuts.

Start Tor Browser in a DisposableVM[edit]

For example use a shortcut above (or use some other way to start it). Then remember to check your Tor Browser version!

Adding shortcuts to application menus[edit]

[37]

Qubes 3.2 / XFCE4 (untested)[edit]

Install xfdesktop if it hasn't been installed already.

sudo dnf install xfdesktop

Make a .desktop file for every DisposableVM shortcut you would like to add to your menus.[38] These .desktop files must be placed in ~/.local/share/applications/.

Open a terminal in your DisposableVM-Template.

dom0 -> Qubes VM Manager -> right click on 'whonix-ws-dvm' -> click 'Run command in VM' -> type 'konsole' [39]

Use your favorite text editor to create and open each .desktop file. Name each one as you prefer.

kwrite ~/.local/share/applications/dvm-torbrowser.desktop

Add to the .desktop file the following entries and substitute fields as appropriate. In the Exec field, substitute torbrowser with the CLI command used to launch each application you would like a shortcut for. Examples: konsole, kwrite, libreoffice, kgpg, okular, dolphin

   [Desktop Entry]\
   Name=Tor Browser\
   Comment=Launch Tor Browser in Disposable VM
   Type=Application
   Terminal=false
   Exec=sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

Icon= & Category= are also useful fields. Feel free to research the .desktop specification using the footnote above.

Once the .desktop files have been created, they need to be added to your Applications menu. Use a text editor to edit the following file.

kwrite ~/.config/menus/xfce-applications.menu

Find the menu entry associated with your DisposableVM-Template. (Help!)

   <Menu>
       <Name>DispVMTemplate</Name>

In the <Include> subsection add the appropriately named .desktop file.

       <Filename>dvm-torbrowser.desktop</Filename>
Qubes 3.2 / XFCE4 - menulibre (untested)[edit]

Currently not recommended unless you want to experiment and know how to fix the application menu in case it breaks. Click on expland on the right if you are interested.

menulibre removes Qubes System Tools start menu entry

https://groups.google.com/forum/m/#!msg/qubes-users/rxI8lNOD7p0/p9Va5Vg9BwAJ

adrelanos: I was using git to manage my whole home folder so I was able to:

  • undo any changes menulibre is doing
  • remove any newly created files by menulibre

so I could restore my Qubes System Tools start menu entry.

sudo qubes-dom0-update menulibre

Qubes Start Menu -> System Tools -> Menu Editor

Qubes 3.1 / KDE4[edit]

dom0 -> right-click Application Launcher Menu -> click `Edit Applications`

Select DisposableVM from VM entries on the left panel. Press the arrow button to expand the menu.

Click New Item on the Toolbar.

Type in a Name for the shortcut.

Type in the Command to launch the program in the DisposableVM.

   Examples:
   Tor Browser
   sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'
   Konsole
   sh -c 'echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'
   Dolphin
   sh -c 'echo dolphin | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

Click on the square in the upper right if you'd like to choose an icon. (Custom application icons are stored in /var/lib/qubes/<type of vm>/<vm name>/apps.icons/)

Click Save.

cli[edit]

If you want for example to open konsole or Tor Browser in a DispVM.

Open a dom0 terminal.

echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red

echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red


Footnotes[edit]

  1. Because DisposableVMs will be improved a lot in Qubes 4.0. See: https://github.com/QubesOS/qubes-issues/issues/866#issuecomment-220495485
  2. We had a user running into the 'do not use Firefox from Qubes DisposableVM default start menu' issue.
  3. AppVMs (qubes) and TemplateVMs
  4. How to make any file in a TemplateBasedVM persistent using bind-dirs
  5. Apart from qvm-revert-template-changes which can only revert back prior the previous (not last) shutdown of the TemplateVM.
  6. Qubes VM snapshots using git / SVN
  7. https://www.qubes-os.org/doc/dispvm-customization/
  8. cli:domU: qvm-open-in-dvm
  9. cli:domU: qvm-run --dispvm
  10. cli:dom0: qvm-prefs -s vmname dispvm_netvm sys-whonix
  11. Whonix default NetVM settings fixes
  12. Whonix is not amnesic
  13. Is there a substitute for Whonix's lack of an Amnesic feature?
  14. Disposable VMs do not run entirely in RAM
  15. DispVMs: support for in-RAM execution only (for anti-forensics) #904
  16. source: https://lists.torproject.org/pipermail/tor-dev/2016-October/011591.html
  17. Multi GW Documentation
  18. home folder of template not inherited by DispVM #1335
  19. cli:dom0: qvm-prefs -s whonix-ws-dvm netvm sys-whonix
  20. cli:dom0: qvm-remove <vmname>
  21. Qubes documentation: DispVM Customization
  22. home folder of template not inherited by DispVM #1335
  23. cli:dom0: qvm-run -a whonix-ws-dvm konsole
  24. cli:dom0: qvm-run -a whonix-ws-dvm <name of application>
  25. cli:dom0: qvm-shutdown <vmname>
  26. cli:dom0: qvm-run -a whonix-ws-dvm konsole
  27. Using >/dev/null 2>&1 to hide some useless and confusing GTK warnings.
  28. Using noaskstart="true" to prevent Tor_Browser#Running_Tor_Browser_in_Qubes_TemplateVM.
  29. Or for CLI version, simply use.
    noaskstart="true" update-torbrowser
  30. cli:dom0: qvm-shutdown whonix-ws-dvm
    or
    DisposableVM-Template cli:domU: sudo poweroff
  31. cli:dom0: qvm-run -a whonix-ws-dvm torbrowser
  32. cli:dom0: qvm-shutdown whonix-ws-dvm
  33. Qubes documentation: Copying and Moving Files Between Domains
  34. Qubes documentation: Copying and Pasting Text Between Domains
  35. Github: Split Browser
  36. cli:dom0: qvm-prefs -s disp<1 | 2 | ...> netvm none
  37. Qubes feature request WIP: have DispVMs inherit launcher shortcuts like other TemplateBasedVMs #1339
  38. Official documentation: Desktop entry specifications
  39. cli:dom0: qvm-run -a whonix-ws-dvm konsole

Random News:

We are looking for video makers.


Impressum | Datenschutz | Haftungsausschluss

https | (forcing) onion
Share: Twitter | Facebook | Google+
This is a wiki. Want to improve this page? Help welcome, volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation. Whonix (g+) is a licensee of the Open Invention Network. Unless otherwise noted above, content of this page is copyrighted and licensed under the same Free (as in speech) license as Whonix itself.