VM Live Mode: Immutable Disk Method on VirtualBox

From Kicksecure
Jump to navigation Jump to search

Step-by-step guide on implementing the Immutable Disk Method for Virtual Machine (VM) Live Mode in VirtualBox, focusing on secure, read-only VM configurations.

Introduction[edit]

For VirtualBox, there is also an alternate method to set the disks to read-only. This option is the official method for setting VMs to read-only in VirtualBox. It will only work with the grub-live package, which is installed by default. [1]

Warning: This is for testers-only!

This is not the preferred method. Hence this is for testers only. Kept only for reference in case other methods stop working.

VirtualBox documentation chapter Special Image Write Modesarchive.org mentions immutable images but this might not be as good as read-only images.

Procedure[edit]

1. Make the VirtualBox disk immutable / read-only.

This step is crucial. Otherwise, contents might be recoverable from the host drive. [2]

Follow these steps:

  1. Power off the VM.
  2. In the VirtualBox main window, navigate to: FileVirtual Media Manager.
  3. Select the disk to write protect and release it.
  4. Click on Modifyset it to Immutable.
  5. In the VirtualBox main window, navigate to the settings of the VM.
  6. Under storage, select the top controller and add the existing hard disk there.

2. Launch live-mode.

A second boot entry called "VM Live Mode-mode" will be visible. Select it and then press Enter to boot the live system and use it as normal.

3. Optional: Steps to revert changes.

Click on expand on the right.

  1. Power off the VM.
  2. Navigate to: FileVirtual Media Manager.
  3. Select the disk. It will now have a snapshot (~12.5 MB) attached to it.
  4. Release the snapshot and delete it.
  5. Click on Modify and set the hard disk to normal.
  6. In the VirtualBox main window, navigate to the settings of the VM.
  7. Under storage, select the top controller and add the existing hard disk there.

Footnotes[edit]

  1. This option will not work with the ro-mode-init package.
  2. VirtualBox implements hard disk write protection differently. If an immutable virtual machine is booted, VirtualBox will always create a snapshot where data is written. After shutting down and booting the VM again (a soft reboot is inadequate), the old snapshot will be deleted and a new one created. Consequently, data will not persist in the VM, even if Live-mode is not selected. However, since the data is written to the hard disk of the host (instead of memory), it is easily recoverable. Therefore, selecting Live-mode is essential for safety. A snapshot file is still created, but it will not store any altered content from the VM.

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!