Rootless virtual machines with KVM and QEMU

KVM
41
2 Likes
42

Libvirt session require coredumps to be enabled. It is not a hardware issue. You get this error when core dumps are disabled (see the link I shared on the Github PR). fix:

max_core = 0

The following two settings from the wiki are not required. I did not check if they have other benefits. I think they do? We donā€™t want the VM to be able to create files on the host. Are there more settings like this?

max_processes = 0
max_files = 0

For the wiki: QEMU session requires namespaces to be enabled on the host

kernel.unprivileged_userns_clone=1

I test the PR on a Arch Linux host and the Whonix VMs are working. Tor is working.

$ virsh version --daemon
Compiled against library: libvirt 12.4.0
Using library: libvirt 12.4.0
Using API: QEMU 12.4.0
1 Like
43

I have the same question. The defined XML files on my computer do not have this ipv4 family. Host is Arch Linux.

Gateway

$ cat /home/user/.config/libvirt/qemu/Whonix-Gateway.xml
    <interface type='user'>
      <mac address='[REDACTED]'/>
      <model type='virtio'/>
      <backend type='passt'/>
      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
    </interface>
    <interface type='udp'>
      <mac address='[REDACTED]'/>
      <source address='127.0.0.1' port='5577'>
        <local address='127.0.0.1' port='6688'/>
      </source>

Workstation

$ cat /home/user/.config/libvirt/qemu/Whonix-Workstation.xml
    <interface type='udp'>
      <mac address='[REDACTED]'/>
      <source address='127.0.0.1' port='6688'>
        <local address='127.0.0.1' port='5577'/>
      </source>

I donā€™t have <ip family='ipv4' address='172.17.5.4' prefix='24'/>. VM/Whonix connection works without it

1 Like
44

Didnt work, you need to test that on Kicksecure as a host. So i added the rest then it worked out.

Not something coming disabled in debian/KS (Though its horrible).

Instructions are based on hulahoop feed:

1 Like
45

This is only for KickSecure and not for Whonix? Iā€™m going to test it

1 Like
46

and GW:

Change GW network to:



  <interface type='user'>
    <backend type='passt'/>
    <ip family='ipv4' address='172.17.5.4' prefix='24'/>
  </interface>

  <interface type="udp">
    <source address="127.0.0.1" port="5577">
    <local address="127.0.0.1" port="6688"/>
    </source>
    <model type="virtio"/>
  </interface>
47

I fixed it to represent the user level configs.

What we dont need anymore are:

Remove them? these wont be needed anymore in the images nor in the wiki instructions.

cc @Patrick @HulaHoop

48 
  <blkiotune>
    <weight>250</weight>
  </blkiotune>

Why remove?

      <source file='/home/user/.local/share/libvirt/images/Whonix-Workstation.qcow2'/>

This was solved better by HulaHoop with storage pools. You can see that here: port to rootless and unix domain sockets by adrelanos Ā· Pull Request #119 Ā· Kicksecure/libvirt-dist Ā· GitHub

    <disk type="volume" device="disk">
      <driver name="qemu" type="qcow2"/>
      <source pool="default" volume="Whonix-Gateway.qcow2"/>
      <target dev="vda" bus="virtio"/>
    </disk>

GitHub web editor, 3 pull requests is confusing. There are 4 competing pull requests now.

Whatā€™s wrong with port to rootless and unix domain sockets by adrelanos Ā· Pull Request #119 Ā· Kicksecure/libvirt-dist Ā· GitHub and can you suggest 1 PR on top of that?

49

virt-manager wont start (verified), mentioned as well by hulahoop instructions:

I know about it but how will ā€œdefaultā€ is actually gonna represent /home/user/.local/share/libvirt/images/Whonix*.qcow2? unless i need another step to define default storage pool to point to that directory which is extra step/s. Check old GW for example:

Whonix-Gateway.xml

 <devices>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/Whonix-Gateway.qcow2'/>
      <target dev='vda' bus='virtio'/>
    </disk>

path already defined from the .xml

So unless im missing something, the source pool="default" doesnt point to the user level path we created automatically.

Sure i can do that.

1 Like
50

@nurmagoz Please close your pull requests. They are redundant and are creating confusion as I had already committed the changes directly to the 119 branch. Also the wiki changes to the main KVM page will be made when the new version is released as stable.

51

The ip family section was unnecessary and was not included in my final changes. Iā€™ll check and see if I had erroneously included for KS. It is inhert and doesnā€™t affect the self determined subnet and the VM addresses on the VMā€™s interfaces anyway.

Please make your proposed PR to my and Patrickā€™s branches so they make it into mainline

52

The one from the QEMU dev ML documents the socket arguments that are otherwise not posted anywhere else.

The second highlights that there is a need for further action to bind TCP ports to UNIX sockets createdby a VM ad suggests some workarounds that we can use

It must be changing something on the inside

Will do

1 Like
53

@nurmagoz documented the fix on the wiki

54

I got Mullvad VPN and disabled local network in the firewall. Internet on KS and Whonix works. I do not see leaks. That issue is solved.

I did not check for Whonix VM to VM traffic leaks

55

Good to keep it documented for the users that want to use qemu://system.

I like <dns enable="no"/> that was set. @HulaHoop can we disable dns in user-mode networking too? There is no reason to support host dns in Whonix.

1 Like
56

New documentation has been written on the Testers_Only_Version versions by @nurmagoz.

Looks good? Promising? Edit on top? @HulaHoop

Once new version is ready, the testers only version wiki pages could probably be copy/pasted to the stable version. (Unless meanwhile there is hopefully no news/drift on the stable version, which would then need to be re-applied/merged.)

1 Like
57

Done

Will add my commits on top of it.

Instructions related to .xml user level import already done. The extra sections which are unrelated to the installation, needs a review. Yeah can be done later.

2 Likes
58

If you mean by leaks its unencrypted and can be viewed by the host, then yes it is check:

1 Like
59

port to rootless and unix domain sockets by adrelanos Ā· Pull Request #119 Ā· Kicksecure/libvirt-dist Ā· GitHub merged.

Presumably - I didnā€™t test - I donā€™t maintain KVM version - $HOME/.local/share/libvirt/images is the default storage pool. Since itā€™s the default folder, no need for absolute file paths.

Please test and report if it works.

1 Like
60

Great, thought default is the only linked to /var/lib/libvirt/images/, but default path changes if you change qemu:///system to qemu:///session.

1 Like