Kicksecure Host - Shared folder not working with Whonix KVM

59mpci2GJ5xlHhY · January 10, 2020, 4:36am

Using Kicksecure as Host, and Whonix as a virtual machine running in KVM, the workstation does not launch due to error with shared folder.

"Error starting domain: internal error: qemu unexpectedly closed the monitor: […] qemu-system-x86_64: -device virtio-9p-pc,id=fs0,fdev=fsdev-fs0,mount_tag=shared,bus=pci.0,addr=0x8: cannot initialize fsdev ‘fsdev-fs0’: failed to open ‘/home/user/shared’: Permission denied

Traceback (most recent call last): File “/usr/share/virt-manager/virtManager/asyncjob.psy”, line 75 in cb_wrapper
callback(asyncjob, *args, **kwargs)
File “/usr/share/virt-manager/virtManager/asyncjob.psy”, line 111, in tmpcb
calback(*args, **kwargs)
File “/usr/share/virt-manager/virtManager/domain.py”,
line 1400, in startup
self._backend.create()
File “/usr/lib/python3/dist-packages/libvirt.py”, line 1080, in create
if ret == -1: raise libvirtError (‘virDomainCreate() failed’, dom=self)
libvirt.libvirtError: internal error: qemu unexpectedly closed the monitor: […] and then repeats the section from the start.
"

Kicksecure Host was installed like this: debian netinst with no desktop environment, then installing according to distro morphing documentation with Whonix Onion Repository.

sudo apt-get install --no-install-recommends kicksecure-xfce

Was used.

KVM and Whonix were installed according to whonix KVM documentation, and shared folder was also set up according to the documentation.

Patrick · January 11, 2020, 1:41pm

Does a linux user account named user exist?

Output of the following?

id user

59mpci2GJ5xlHhY · January 12, 2020, 12:30am

Yes

id user output:

uid=1000(user)
gid=1000(user)
groups=1000(user),
24(cdrom),
25(floppy),
27(sudo),
29(audio),
30(dip),
44(video),
46(plugdev),
106(kvm),
109(netdev),
113(console),
123(libvirt)

Patrick · January 12, 2020, 8:11am

User exists. Looks good.

I don’t think https://github.com/Whonix/shared-folder-help/blob/master/lib/systemd/system/mnt-shared-kvm.service causes this.

Please post output of these two commands:

ls -la /home/user/

ls -la /home/user/shared

You can redact most output. Only need to see permissions of that /home/user/shared folder.

Did you enable SELinux or any other mandatory access control (MAC) framework?

Try also this command. Does that help?

sudo chmod 777 /home/user/shared

Shows any output? If not: expected.

59mpci2GJ5xlHhY · January 13, 2020, 3:06am

total 232
drwxr-x— 19 user user 4096 [date&time] .
drwxr-xr-x 3 root root 4096 [date&time] . .
[ . . . ]
drwxrwxrwx 6 root root 4096 [date&time] shared
[ . . . ]

drwxrwxrwx 6 root root 4096 [date&time] .
drwxr-x— 19 user user 4096 [date&time] . .

Not that I’m aware of

No, same error, no output, and when watching journalctl when doing that command:

host sudo [1812]: user : TTY=pts/1 ; PWD=/home/user ; USER=root ; COMMAND=/usr/bin/chmod 777 /home/user/shared
host sudo [1812]: pam_unix (sudo:session): session opened for user root by (uid=0)
host sudo [1813]: pam_exec(sudo:session): Calling /usr/lib/security-misc/permission-lockdown . . .
host sudo [1812]: pam_unix(sudo:session): session closed for user root
host sudo [1817]: pam_exec(sudo:session): Calling /usr/lib/security-misc/permission-lockdown . . .

Patrick · January 13, 2020, 9:45am

/home/user/shared should not be owned by root. Did you create it using sudo mkdir shared?

To fix, try this:

sudo chown --recursive user:user /home/user

59mpci2GJ5xlHhY · January 14, 2020, 3:02pm

Yes “sudo mkdir /home/user/shared” as per the wiki

sudo chown --recursive user:user /home/user

Same error

I then did

sudo chown --recursive user:user /home/user/shared

Same error still

Patrick · January 14, 2020, 7:33pm

No idea. Suggestions:

“google”:

cannot initialize fsdev ‘fsdev-fs0’: failed to open

contact KVM support

HulaHoop · January 15, 2020, 12:02am

It could be caused by 9p modules not loading:

9p
9pnet
9pnet_virtio

Or the user account not belonging to the libvirtd group?

59mpci2GJ5xlHhY · January 15, 2020, 6:48am

I just tried installing vagrant-libvirt, same error.

I then tried

sudo nano /etc/modules

And added

9p
9pnet
9pnet_virtio

Restarted, still same error.

The libvirtd group did not exist, so I created it, then I added user to it, still same error.

Patrick · January 15, 2020, 8:02am

From https://www.whonix.org/wiki/KVM#Addgroup
Try run these commands. And post output here.

sudo addgroup "$(whoami)" libvirt
sudo addgroup "$(whoami)" kvm

Then reboot.

Then try run these commands

sudo modprobe 9p
sudo modprobe 9pnet
sudo modprobe 9pnet_virtio

And post output here.

Then try VM start. See if that helps.

Patrick · January 15, 2020, 8:03am

https://www.whonix.org/wiki/KVM#Addgroup says libvirt not libvirtd.

59mpci2GJ5xlHhY · January 16, 2020, 2:10am

The user ‘user’ is already a member of ‘libvirt’.
The user ‘user’ is already a member of ‘kvm’.

No output (and nothing interesting in journalctl either)
Did this, same error still.

libvirt was already used as per documentation, only additionaly created libvirtd as hula mentioned it

HulaHoop · January 16, 2020, 4:13pm

Strange because you are essentially using a Debian stable with our customizations that shouldn’t really interfere with this.

Try adding any other shred folder manually created in your home folder. Does it give the same error?

59mpci2GJ5xlHhY · January 17, 2020, 1:22am

Good idea, I made /home/shared and it worked, then I deleted and remade the shared folder in /home/user/shared the same way but it did not work (same error), so it has to do with the user directory and probably permissions, any idea to fix it in the user directory?

HulaHoop · January 17, 2020, 5:56pm

That’s great news. @Patrick are we shipping Kicksecure Host with a shared folder already? Perhaps the problem is caused by the mkdir command run as root?

github.com

Whonix/whonix-libvirt/blob/2fc6fc5318665db8bfb697d7d6b71495c7c8d229/usr/lib/whonix-libvirt/install

#!/bin/bash

## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

set -x
set -e

## {{ Taken from qemu-system-common.postinst.
# Add the kvm group unless it's already there
if ! getent group kvm >/dev/null; then
   addgroup --quiet --system kvm || true
fi
## }} Taken from qemu-system-common.postinst.

## {{ Taken from libvirt-bin.postinst.
if ! getent group libvirt >/dev/null; then
   addgroup --system libvirt
fi
## }} Taken from libvirt-bin.postinst.

This file has been truncated. show original

mkdir --parents /mnt/gateway-shared

mkdir --parents /mnt/workstation-shared

chmod 777 /mnt/gateway-shared

chmod 777 /mnt/workstation-shared

@59mpci2GJ5xlHhY have you used the shared folders on the host at these paths?

59mpci2GJ5xlHhY · January 18, 2020, 6:53am

Okay I just did that, but it had insufficient permissions without sudo, so I ran all those commands with sudo.

The machine launched successfully without error however, when testing by putting a file from the host, the file did not appear inside the vm shared folder.

Note, test file did show successfully up when mounting to /home/shared, but not /mnt/workstation-shared.

Going to reinstall everything from source next time I have some free time, so I will continue with more tests.

Patrick · January 18, 2020, 7:38pm

Kicksecure is NOT Whonix-Host.
Kicksecure Host is NOT Whonix-Host.
Whonix-Host and Kicksecure are separate projects.

HulaHoop via Whonix Forum:

That’s great news. @Patrick are we shipping Kicksecure Host with a shared folder already?

No, I don’t think so, because Kicksecure is NOT Whonix-Host. Package
whonix-libvirt is not installed on Kicksecure.

Please check:

dpkg -l | grep whonix-libvirt

Perhaps the problem is caused by the mkdir command run as root?

Could be in theory but chmod should fix that.

https://github.com/Whonix/whonix-libvirt/blob/2fc6fc5318665db8bfb697d7d6b71495c7c8d229/usr/lib/whonix-libvirt/install
mkdir --parents /mnt/gateway-shared

mkdir --parents /mnt/workstation-shared

chmod 777 /mnt/gateway-shared

chmod 777 /mnt/workstation-shared

Development of Whonix-Host didn’t progress as far yet as testing shared
folders.

http://permissions-calculator.org/decode/0777/

chmod 0777 means that user, group and others (everyone) can
read/write/execute. That doesn’t seem very appropriate anyhow.

What would be an appropriate way to set this up anyhow? What would be
the most secure and canonical location for these shared folders?
Somewhere in user’s home folder /home/user? Or under /mnt/ better? Group
owner user “user” and user/group “user” the only one allowed to
read/write but not execute?

HulaHoop · January 18, 2020, 5:54pm

I got confused by his thread title saying Kicksecure “Host”

I always did it under home folder. Seems more contained than using /mnt/? As for permissions I am open to more secure suggestions that don’t break functionality.

Patrick · January 18, 2020, 7:38pm

And Kicksecure Host is NOT Whonix-Host too.