Whonix Desktop Installer with Calamares - field report

Patrick · May 16, 2019, 9:23am

chroot changing of permissions should now be fixed but untested in
actual build.

Patrick · May 16, 2019, 9:38am

onion_knight via Whonix Forum:

Build complete.

Great!

Problems:

No live user is created. I think this due to the package user-setup not being installed, from cat /lib/live/config/0030-user-setup :

added in git master

Debugging this is long and very frustrating.

Would it help to debug this using --target qcow2 (or --target raw)?
Then only that would be created, and no ISO. That might make starting
the build in a VM more convenient? (These --target’s are implemented and
might already build as is.)

Any other suggestions to ease debugging? I am all for making debugging
as simple as possible.

Patrick · May 16, 2019, 9:46am

onion_knight via Whonix Forum:

I did another build of normal hardened raw debian to compare and try to understand what went wrong. ( version: 15.0.0.2.7-developers-only):

sudo ./whonix_build --flavor hardened-debian-xfce --target raw --build

Result: I have the same exact error…

Also, I noticed that the user user is also inexistent on the --target raw build (no iso). Isn’t he supposed to be skipped only in the iso build?

Currently user “user” creation is an open question for Whonix host and
hardened debian builds. It’s not created in either. Also target raw,
qcow2 or iso, all currently does not create user “user” by any packages
by Whonix. Let me know if you have suggestion show to implement this. I
was considering to add a systemd unit file that creates user “user” at
first - perhaps persistent-only (?) - boot. What do you think?

Another inconsistency (during debugging)… build-step
1700_install-packages currently uses:

   ## Weak recommended packages so calamares can remove them.
   if [ "$WHONIX_BUILD_ISO" = "true" ]; then
      pkg-install-maybe calamares
      pkg-install-maybe calamares-settings-debian
      pkg-install-maybe live-config
      pkg-install-maybe rsync
      pkg-install-maybe user-setup
   fi

I.e. it installs these packages only when using --target iso. I’ve
changed this in git master to

if [ "$WHONIX_BUILD_TYPE" = "whonix-host" ]; then

I.e. this will work for any --flavor whonix-host…

(Not implemented yet for hardened debian.)

Algernon · May 16, 2019, 10:57am

Alternatively install the required packages or just don’t remove them so you can also run the host live.

Patrick · May 16, 2019, 10:55am

(Stuff not mentioned: noticed, but not addressed yet.)

Would it help for debugging if VM files in ~/whonix_binary folder were
non-versioned? So greater Whonix host version than VM versions could be
used to build without need to adjust version number or Whonix version
variable manually?

onion_knight via Whonix Forum:

File /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix breaks XFCE4, needs to be corrected (in the meantime I just did mv /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.dpkg-new /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml)

That should also break regular Whonix-(Gateway|Workstation) XFCE VM
builds too? Move to /etc/xdg/xfce4/ folder was just added recently and
untested.

ls -la /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml
lrwxrwxrwx 1 root root 24 May 16 10:50
/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml ->
xfce4-session.xml.whonix

Maybe symlinks are unsupported by XFCE?

ls -la /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/
total 44
drwxr-xr-x 2 root root 4096 May 16 10:50 .
drwxr-xr-x 3 root root 4096 Nov 17 05:17 ..
-rw-r--r-- 1 root root 1024 May 13 06:03 xfce4-desktop.xml
-rw-r--r-- 1 root root 5961 May  6  2015 xfce4-keyboard-shortcuts.xml
-rw-r--r-- 1 root root 2940 May 13 06:03 xfce4-panel.xml
lrwxrwxrwx 1 root root   24 May 16 10:50 xfce4-session.xml ->
xfce4-session.xml.whonix
-rw-r--r-- 1 root root  211 May 13 06:03 xfce4-session.xml.whonix
-rw-r--r-- 1 root root 1551 Oct 21  2017 xfce4-session.xml.whonix-orig
-rw-r--r-- 1 root root  246 May 13 06:03 xfwm4.xml
lrwxrwxrwx 1 root root   20 May 16 10:50 xsettings.xml ->
xsettings.xml.whonix
-rw-r--r-- 1 root root  316 May 13 06:03 xsettings.xml.whonix
-rw-r--r-- 1 root root 2610 Jul  9  2018 xsettings.xml.whonix-orig

Package user-setup needs to be installed in the master whonix-host-xfce VM otherwise live-boot will fail to create a live user

Done in git master.

Package squashfs-tools needs to be installed in the master whonix-host-xfce VM otherwise Calamares will fail to install (it needs it to unsquashfs the filesystem.squashfs file into the target)

Done in git master.

Package live-config needs to be installed in the master whonix-host-xfce VM otherwise live user will not be created in live-boot mode (it may already be the case, just a reminder)

Wondering why you added “VM” here?

As per
https://github.com/Whonix/Whonix/blob/master/build-steps.d/1700_install-packages#L316-L322
this is the list of packages that now gets installed for Whonix host
flavors as per git master.

calamares
calamares-settings-debian
live-config
rsync
user-setup
squashfs-tools

Grub boot menu of install target still has the same parameters of default Whonix-Host grub boot menu, i.e. normal + Live Boot. The live boot option line should be suppressed since the install target does not have live-boot packages anymore (suppressed during install). Furthermore, Debian/GNU Linux should be replaced by Whonix/GNU Linux

This is because package whonix-base-files is not installed on Whonix
host (yet) which ships /etc/default/grub.d/30_whonix.cfg (because that
package would create user user) during installation. Once user “user”
creation is sorted, we probably want to install that package anyhow?

All fixed mentioned so far are untested and included in
15.0.0.2.8-developers-only.

onion_knight · May 16, 2019, 12:41pm

This is what I do: I test everything in a (copied) version of the raw file that I boot in KVM. I test stuff in persistent/live-mode and one things seem clean, I make the needed adjustments in the master raw and then only the ISO file. Remastering the ISO file each time would be very long. This error was very difficult to debug because it was very generic, and can be caused by a ton of different things. Eventually, I just did a diff between all files installed in the previous hardened version and in the whonix-host to see what changed…

If we want a hardened-debian VM, I think user should be created. If we want an live ISO-installer, then no. So --flavor whonix-host should trigger the skipping of user creation, while all other flavours should create it as was the case before (don’t know if clear enough - easy to do?).

I read somewhere that they have to be deleted on debian during the install otherwise the install would not be bootable… Obviously needs some more testing/research.

Patrick:

That should also break regular Whonix-(Gateway|Workstation) XFCE VM
builds too? Move to /etc/xdg/xfce4/ folder was just added recently and
untested.
ls -la /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml
lrwxrwxrwx 1 root root 24 May 16 10:50
/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml ->
xfce4-session.xml.whonix
Maybe symlinks are unsupported by XFCE?

Maybe, but I suspect that this file needs at least these settings:

<?xml version="1.0" encoding="UTF-8"?>

<channel name="xfce4-session" version="1.0">
  <property name="general" type="empty">
    <property name="FailsafeSessionName" type="string" value="Failsafe"/>
  </property>
  <property name="sessions" type="empty">
    <property name="Failsafe" type="empty">
      <property name="IsFailsafe" type="bool" value="true"/>
      <property name="Count" type="int" value="5"/>
      <property name="Client0_Command" type="array">
        <value type="string" value="xfwm4"/>
      </property>

And now:

<?xml version="1.0" encoding="UTF-8"?>

<channel name="xfce4-session" version="1.0">
  <property name="general" type="empty">
    <property name="SaveOnExit" type="bool" value="false"/>
  </property>
</channel>

Can’t we keep the default one?

Great!

OK would it be feasible to ship this particular file with another package? Or just writing it during build?

Great, I’ll try a build now!

onion_knight · May 16, 2019, 2:22pm

Just built Whonix-Host-XFCE 15.0.0.2.8-developers-only

XFCE still broken because of misconfigured xfce4-session.xml.whonix file.

Once corrected, everything seems to be fine. Debian Live User is created on boot.

Didn’t try out the installer yet, but should be fine too I guess.

Theming is still broken though, but I understand it is not a priority right now.

Other issues still need to be addressed (see my posts above, passwordless sudo rights for Live User, etc.).

Almost operational

onion_knight · May 16, 2019, 3:11pm

Trying out the Calamares Installer on this new build (in KVM, not on real hardware).

Installation failed in job packages:
Command 'apt-get --purge -q -y remove live-boot live-boot-doc...' returned non-zero exit status 100
-> it fails because it doesn’t find the packages live-config-doc, live-task-localisation and live-boot-doc in the ISO (and thus in the install target where it extracted the filesystem.squashfs image of the ISO file).

Did you remove them from the list of installed packages? Or they are in --no-install dependencies mode?

Anyway, removing these packages from the/etc/calamares/modules/packages.conf.whonix file solves the problem. So I guess that is sufficient.

This version works:

backend: apt

operations:
   - remove:
      - 'live-boot'
      - 'live-config'
      - 'live-config-systemd'
      - 'live-config-systemd'
      - 'live-tools'
      - 'calamares'
      - 'calamares-settings-debian'
EOF

Patrick · May 16, 2019, 8:08pm

onion_knight via Whonix Forum:

File /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix
breaks XFCE4, needs to be corrected (in the meantime I just did mv /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.dpkg-new /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml)

onion_knight via Whonix Forum:

Can’t we keep the default one?

I merged the Debian one, and Whonix modifications into one. The result
is here:
https://github.com/Whonix/whonix-xfce-desktop-config/blob/master/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix

Not sure if this is what you meant? Hopefully that works. The change by
Whonix looks of medium importance, disabling session saving. Not yet tested.

I’ll process a few more easy to add fixes in new posts to come soon, and
then create a new git tag.

Patrick · June 14, 2019, 12:50pm

No.

Yes. Have to use this.

Fixed.

Patrick · June 14, 2019, 1:21pm

Package xfce4-session also owns file

/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml

Package xfce4-settings also owns file:

/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xsettings.xml

/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml lxqt-common

etc.

I did undo all the port form /etc/skel to /etc/xdg.

If we want a hardened-debian VM, I think user should be created. If we want an live ISO-installer, then no. So --flavor whonix-host should trigger the skipping of user creation, while all other flavours should create it as was the case before (don’t know if clear enough - easy to do?).

Will be covered by ⚓ T913 bug: not all files form /etc/skel are copied to /home/user / create user "user" at boot time

Any idea how the systemd unit file would detect that we are booting into
calamares so it will skip and not create user user?

Maybe, but I suspect that this file needs at least these settings:

<?xml version="1.0" encoding="UTF-8"?>

<channel name="xfce4-session" version="1.0">
  <property name="general" type="empty">
    <property name="FailsafeSessionName" type="string" value="Failsafe"/>
  </property>
  <property name="sessions" type="empty">
    <property name="Failsafe" type="empty">
      <property name="IsFailsafe" type="bool" value="true"/>
      <property name="Count" type="int" value="5"/>
      <property name="Client0_Command" type="array">
        <value type="string" value="xfwm4"/>
      </property>

And now:

<?xml version="1.0" encoding="UTF-8"?>

<channel name="xfce4-session" version="1.0">
  <property name="general" type="empty">
    <property name="SaveOnExit" type="bool" value="false"/>
  </property>
</channel>

Can’t we keep the default one?

This should be solved by:

https://github.com/Whonix/whonix-xfce-desktop-config/commit/db388d4bdd5ecb35c57dcc6420749dbd1b230cee

Patrick:

This is because package whonix-base-files is not installed on Whonix
host (yet) which ships /etc/default/grub.d/30_whonix.cfg (because that
package would create user user ) during installation. Once user “user”
creation is sorted, we probably want to install that package anyhow?

OK would it be feasible to ship this particular file with another package? Or just writing it during build?

whonix-base-files can continue to ship
/etc/default/grub.d/30_whonix.cfg. User user creation will be sorted
out in ⚓ T913 bug: not all files form /etc/skel are copied to /home/user / create user "user" at boot time

Patrick · June 14, 2019, 1:31pm

onion_knight via Whonix Forum:

XFCE still broken because of misconfigured xfce4-session.xml.whonix file.

That should be fixed in
https://github.com/Whonix/whonix-xfce-desktop-config and in next Whonix
tag yet to be created.

Theming is still broken though, but I understand it is not a priority right now.

Not really anything sorted by priority yet. all needs implementation.

https://phabricator.whonix.org/project/board/145/

https://phabricator.whonix.org/project/view/26/

https://phabricator.whonix.org/project/view/132/

Other issues still need to be addressed (see my posts above, passwordless sudo rights for Live User, etc.).

I should have created tickets for all of that?

Please have a look at:

https://phabricator.whonix.org/feed/

Please kindly create tickets for any missing items.

It’s rather difficult to take action based on forum posts for me if it
is getting complex and convulsed with a bunch of tasks that require
different work such as research, implementation, build, testing that all
easily take more than 1 hour of time.

HulaHoop · June 14, 2019, 7:37pm

Didn’t see that until now becuase no one copied me. Seems that dnsmasq package is missing on Whonix Host which prevents the network from starting NAT successfully.

Patrick · June 15, 2019, 2:26am

Should dnsmasq then be part of the Whonix ™ for KVM guide?

dnsmasq is a DHCP server. Security issue having it installed on the host? Can be reconfigured to serve KVM only? If yes, any alternative without dnsmasq?

If ok or no alternative, could you add to Depends: please here:

github.com

Kicksecure/libvirt-dist/blob/master/debian/control#L16-L17


      
          Architecture: all
          Depends: adduser, qemu-kvm, libvirt-daemon-system, libvirt-clients,

HulaHoop · June 15, 2019, 4:23am

Scratch that, That was a wrong guess. Tested libvirt/KVM install on Buster and dnsmasq-base is one of the automatically installed deps of libvirt. There are no security problems with the way libvirt uses and confgures it. It is otherwise not active for external interfaces. (links about that will be posted shortly in the DHCP thread).

I have no idea what other reason causes Whonix-External to fail. Let’s deal with it when other blockers are solved.

Patrick · June 20, 2019, 6:16am

HulaHoop via Whonix Forum:

I have no idea what other reason causes Whonix-External to fail. Let’s deal with it when other blockers are solved.

Only start is failing inside chroot but start inside chroot is not
important at all as long as start works when the image gets actually booted.

Patrick · July 14, 2019, 7:25am

Could calamares be configured to somehow not create user user during boot instead? That would simplify implementation on the Whonix side a lot.

Then we might be able to use /usr/share/pam-configs/mkhomedir ( http://blog.dailystuff.nl/2012/07/create-home-directory-on-first-login/ ) which would also solve ⚓ T913 bug: not all files form /etc/skel are copied to /home/user / create user "user" at boot time / bug: not all files form /etc/skel are copied to /home/user - #4 by Patrick.

( sudo pam-auth-update --enable mkhomedir )

onion_knight · July 15, 2019, 11:44am

Hi @Patrick

I am not sure I understand what you ask.

Here is how it works last time I tested:

-> Starting “Whonix-Desktop-with-Calamares-Installer” in live-mode: live-user is created on boot if correct kernel flags or appended (so already working)
-> Using Calamares-Installer: the user creates a user for his new machine he is installing Whonix-Desktop on (is this what you would like to suppress?)

onion_knight · July 15, 2019, 12:07pm

Just to let you know that I am currently rebuilding from scratch with version 15.0.0.3.3.

Patrick · July 15, 2019, 2:40pm

Good question. If I remember right, you previously said, that calamares gets confused by user user already being created during live boot. Therefore you manually deleted account user user before creating the iso.

Therefore we concluded that user user should be created during first boot of Whonix rather than during build of Whonix. However, also in live mode user user creation should not be done by Whonix anon-base-files.postinst but by calamares.

I guess what I am asking is, is it possible to make calamares not get confused by an already existing user user account?

What’s the name of that user account? user user? I guess not? Probably live-something? That should not really matter since it does not interfere with anything.

Yes. Ideally that would also be left to anon-base-files.postinst?

Currently for non-live Whonix builds as per git master anon-base-files.postinst creates user user with --no-create-home, uses pam-auth-update --enable mkhomedir, thereby populates the home folder on first login.

Also anon-base-files.postinst locks root account as per Restrict root access for new builds by default so calamares don’t need to ask about root account either.

I don’t know the calamares requirements and how we could design this interaction. Should we support users choosing arbitrary user account names in the installer? Self-chosen passwords right in the installer or enough after they login first?

So the more calamares (except for live-something user in live mode perhaps?) can be configured to stay out, the easier it would be from the Whonix side. Otherwise anon-base-files.postinst user user creation part would have to be converted to a systemd unit file which is more complicated.