Whonix KVM dnsmasq - listen port on host operating system - attack surface reduction

KVM
41

Could you try please creating the dummy binary?

File content:

#!/bin/bash
sleep infinity

Place in /usr/sbin/dnsmasq and make executable.

sudo chmod +x /usr/sbin/dnsmasq
42

It will mess up KVM itself, commands wont run like “virsh” nor VMs gonna show up when you open “Virtual Machine Manager”, it will show instead “QEMU/KVM - Connecting…” and it will be stuck like this for indefinite.

1 Like
43

Thank you!

We now have maxed out what we can do wrt Whonix KVM dnsmasq hardening until Debian addresses this bug.

  • No more listen port on the host operating system.
  • No DNS server inside the libvirt network.

dnsmasq-base package on the host operating system (the program only) is not a big deal since no dnsmasq daemon (dnsmasq package) is installed. It’s just 1 extraneous package.

2 Likes
44

@Patrick Any news on this?
It has been several months, will they fix this ? What is timeframe for such bugs to get fixed ?

46

No.

I doubt it. Doesn’t look like it.

Doesn’t exist.

47

For some reason, this seems to break IPv6 support in KVM. Whonix-Gateway is able to send router solicitation packets just fine, but libvirt never responds with a router advertisement, which breaks SLAAC and thus the gateway never gets a usable IPv6 address on the external interface. As a result, IPv6 basically works out of the box on VirtualBox, but does not work on KVM without removing this line from the external network configuration.

Will document this, we can research it later.

1 Like
48

Warn users that this enables dnsmasq on host?

49

Already documented at:

50

Update: Disabling the default network on Libvirt disables dnsmasq instances and that can be seen using netstat -tulpen. Since we have moved to qemu:///session we are no longer forced to rely on network bridges nor have to deal with the problems they cause.

1 Like
51

For KS host scripting purposes:

To prevent libvirt from altering the firewall, stop and disable the default network. Make sure there are no active virtual machines (VMs) still using this network.

# virsh net-destroy default
# virsh net-autostart --disable default
1 Like