OK, I rebuilt sudo -E /home/user/Whonix/whonix_build --build --redistribute --target iso --flavor whonix-host-xfce --freedom false using git branch 15.0.0.2.7-developers-only and I am glad to report that it is working now, provided the following corrections:
File /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix breaks XFCE4, needs to be corrected (in the meantime I just did mv /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.dpkg-new /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml)
Package user-setup needs to be installed in the master whonix-host-xfce VM otherwise live-boot will fail to create a live user
Package squashfs-tools needs to be installed in the master whonix-host-xfce VM otherwise Calamares will fail to install (it needs it to unsquashfs the filesystem.squashfs file into the target)
Package live-config needs to be installed in the master whonix-host-xfce VM otherwise live user will not be created in live-boot mode (it may already be the case, just a reminder)
Furthermore, the following bugs/corrections need to be addressed (and probably more to come):
Theming is completely broken. Live user starts with a default environment, while root user and newly installed user in the target have broken panel launchers (see screenshots below). Probably related to missing config in /etc/skel
Live user by default still has passwordless root rights. It seems it can be easily corrected by creating /etc/sudoers.d/live with right syntax and permissions, as described in live-config script /lib/live/config/0040-sudo:
Config ()
{
# Skip sudo configuration if username is root
case “${LIVE_USERNAME}” in
root)
exit 0
;;
esac
# Checking if package is already configured differently
if grep -qs "^${LIVE_USERNAME}" /etc/sudoers.d/live
then
exit 0
fi
echo "${LIVE_USERNAME} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/live
chmod 0440 /etc/sudoers.d/live
Grub boot menu of install target still has the same parameters of default Whonix-Host grub boot menu, i.e. normal + Live Boot. The live boot option line should be suppressed since the install target does not have live-boot packages anymore (suppressed during install). Furthermore, Debian/GNU Linux should be replaced by Whonix/GNU Linux
Some branding work to be done on the default debian Calamares installer. Very easy (working in progress, will post suggestions soon).
Still having problems with getting the clock right both on the ISO and install target.
The master Whonix-XFCE VM has no apt sources other than whonix. Is it on purpose?
No live user is created. I think this due to the package user-setup not being installed, from cat /lib/live/config/0030-user-setup :
added in git master
Debugging this is long and very frustrating.
Would it help to debug this using --target qcow2 (or --target raw)?
Then only that would be created, and no ISO. That might make starting
the build in a VM more convenient? (These --target’s are implemented and
might already build as is.)
Any other suggestions to ease debugging? I am all for making debugging
as simple as possible.
I did another build of normal hardened raw debian to compare and try to understand what went wrong. ( version: 15.0.0.2.7-developers-only):
sudo ./whonix_build --flavor hardened-debian-xfce --target raw --build
Result: I have the same exact error…
Also, I noticed that the user user is also inexistent on the --target raw build (no iso). Isn’t he supposed to be skipped only in the iso build?
Currently user “user” creation is an open question for Whonix host and
hardened debian builds. It’s not created in either. Also target raw,
qcow2 or iso, all currently does not create user “user” by any packages
by Whonix. Let me know if you have suggestion show to implement this. I
was considering to add a systemd unit file that creates user “user” at
first - perhaps persistent-only (?) - boot. What do you think?
Another inconsistency (during debugging)… build-step
1700_install-packages currently uses:
## Weak recommended packages so calamares can remove them.
if [ "$WHONIX_BUILD_ISO" = "true" ]; then
pkg-install-maybe calamares
pkg-install-maybe calamares-settings-debian
pkg-install-maybe live-config
pkg-install-maybe rsync
pkg-install-maybe user-setup
fi
I.e. it installs these packages only when using --target iso. I’ve
changed this in git master to
(Stuff not mentioned: noticed, but not addressed yet.)
Would it help for debugging if VM files in ~/whonix_binary folder were
non-versioned? So greater Whonix host version than VM versions could be
used to build without need to adjust version number or Whonix version
variable manually?
onion_knight via Whonix Forum:
File /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix breaks XFCE4, needs to be corrected (in the meantime I just did mv /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.dpkg-new /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml)
That should also break regular Whonix-(Gateway|Workstation) XFCE VM
builds too? Move to /etc/xdg/xfce4/ folder was just added recently and
untested.
ls -la /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml
lrwxrwxrwx 1 root root 24 May 16 10:50
/etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml ->
xfce4-session.xml.whonix
Maybe symlinks are unsupported by XFCE?
ls -la /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/
total 44
drwxr-xr-x 2 root root 4096 May 16 10:50 .
drwxr-xr-x 3 root root 4096 Nov 17 05:17 ..
-rw-r--r-- 1 root root 1024 May 13 06:03 xfce4-desktop.xml
-rw-r--r-- 1 root root 5961 May 6 2015 xfce4-keyboard-shortcuts.xml
-rw-r--r-- 1 root root 2940 May 13 06:03 xfce4-panel.xml
lrwxrwxrwx 1 root root 24 May 16 10:50 xfce4-session.xml ->
xfce4-session.xml.whonix
-rw-r--r-- 1 root root 211 May 13 06:03 xfce4-session.xml.whonix
-rw-r--r-- 1 root root 1551 Oct 21 2017 xfce4-session.xml.whonix-orig
-rw-r--r-- 1 root root 246 May 13 06:03 xfwm4.xml
lrwxrwxrwx 1 root root 20 May 16 10:50 xsettings.xml ->
xsettings.xml.whonix
-rw-r--r-- 1 root root 316 May 13 06:03 xsettings.xml.whonix
-rw-r--r-- 1 root root 2610 Jul 9 2018 xsettings.xml.whonix-orig
Package user-setup needs to be installed in the master whonix-host-xfce VM otherwise live-boot will fail to create a live user
Done in git master.
Package squashfs-tools needs to be installed in the master whonix-host-xfce VM otherwise Calamares will fail to install (it needs it to unsquashfs the filesystem.squashfs file into the target)
Done in git master.
Package live-config needs to be installed in the master whonix-host-xfce VM otherwise live user will not be created in live-boot mode (it may already be the case, just a reminder)
Grub boot menu of install target still has the same parameters of default Whonix-Host grub boot menu, i.e. normal + Live Boot. The live boot option line should be suppressed since the install target does not have live-boot packages anymore (suppressed during install). Furthermore, Debian/GNU Linux should be replaced by Whonix/GNU Linux
This is because package whonix-base-files is not installed on Whonix
host (yet) which ships /etc/default/grub.d/30_whonix.cfg (because that
package would create user user) during installation. Once user “user”
creation is sorted, we probably want to install that package anyhow?
All fixed mentioned so far are untested and included in 15.0.0.2.8-developers-only.
This is what I do: I test everything in a (copied) version of the raw file that I boot in KVM. I test stuff in persistent/live-mode and one things seem clean, I make the needed adjustments in the master raw and then only the ISO file. Remastering the ISO file each time would be very long. This error was very difficult to debug because it was very generic, and can be caused by a ton of different things. Eventually, I just did a diff between all files installed in the previous hardened version and in the whonix-host to see what changed…
If we want a hardened-debian VM, I think user should be created. If we want an live ISO-installer, then no. So --flavor whonix-host should trigger the skipping of user creation, while all other flavours should create it as was the case before (don’t know if clear enough - easy to do?).
I read somewhere that they have to be deleted on debian during the install otherwise the install would not be bootable… Obviously needs some more testing/research.
Maybe, but I suspect that this file needs at least these settings:
Trying out the Calamares Installer on this new build (in KVM, not on real hardware).
Installation failed in job packages: Command 'apt-get --purge -q -y remove live-boot live-boot-doc...' returned non-zero exit status 100
-> it fails because it doesn’t find the packages live-config-doc, live-task-localisation and live-boot-doc in the ISO (and thus in the install target where it extracted the filesystem.squashfs image of the ISO file).
Did you remove them from the list of installed packages? Or they are in --no-install dependencies mode?
Anyway, removing these packages from the/etc/calamares/modules/packages.conf.whonix file solves the problem. So I guess that is sufficient.
File /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.whonix
breaks XFCE4, needs to be corrected (in the meantime I just did mv /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml.dpkg-new /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-session.xml)
I did undo all the port form /etc/skel to /etc/xdg.
If we want a hardened-debian VM, I think user should be created. If we want an live ISO-installer, then no. So --flavor whonix-host should trigger the skipping of user creation, while all other flavours should create it as was the case before (don’t know if clear enough - easy to do?).
Please kindly create tickets for any missing items.
It’s rather difficult to take action based on forum posts for me if it
is getting complex and convulsed with a bunch of tasks that require
different work such as research, implementation, build, testing that all
easily take more than 1 hour of time.
Didn’t see that until now becuase no one copied me. Seems that dnsmasq package is missing on Whonix Host which prevents the network from starting NAT successfully.
dnsmasq is a DHCP server. Security issue having it installed on the host? Can be reconfigured to serve KVM only? If yes, any alternative without dnsmasq?
If ok or no alternative, could you add to Depends: please here:
Scratch that, That was a wrong guess. Tested libvirt/KVM install on Buster and dnsmasq-base is one of the automatically installed deps of libvirt. There are no security problems with the way libvirt uses and confgures it. It is otherwise not active for external interfaces. (links about that will be posted shortly in the DHCP thread).
I have no idea what other reason causes Whonix-External to fail. Let’s deal with it when other blockers are solved.
-> Starting “Whonix-Desktop-with-Calamares-Installer” in live-mode: live-user is created on boot if correct kernel flags or appended (so already working)
-> Using Calamares-Installer: the user creates a user for his new machine he is installing Whonix-Desktop on (is this what you would like to suppress?)