Whonix live mode / amnesia / amnesic / non-persistent / anti-forensics

[onion_knight]

@Patrick

Why are kernel boot paramaters (such as spectre_v2=on spec_store_bypass_disable=on tsx=off …) defined in both files:

• grub.cfg
• isolinux.cfg

One is for GRUB (when booting in EFI), the other is for Isolinux (when booting in BIOS).

[Patrick]

Whonix-Host: chainboot /boot/grub/grub.cfg to keep Whonix-Host ISO kernel boot parameters synchronized with Whonix-Host Installed

Goal: keep Whonix-Host ISO kernel boot parameters synchronized with Whonix-Host Installed with no manual code changes requires as kernel boot parameters change. In both cases… (isolinux → chainload grub?) Could we embed /boot/grub/grub.cfg to keep kernel boot parameters of Whonix-Host in ISO mode in sync with Whonix-Host Installed? What I mean by embed: grub supports a feature similar to bash’s source command (Or sh’s . command). https://www.gnu.org/software/grub/manual/grub/grub.html#Em…

[Patrick]

Long Wiki Edits Thread

Documentation regarding live mode is being revamped.

Live Mode for Kicksecure

Live Mode for Kicksecure

[Patrick]

Any idea how to debug this?

grub-live package doesnt boot plain debian

I have installed grub-live package on plain debian (netinstall xfce version) and i cant boot grub-live it will just show blinking dash - This is comparison of /boot/grub/grub.cfg between plain debian+grublive package (on the left) and kicksecure (on the right):

[Patrick]

Live-mode on host OS (debian 10)

The host system start in Live-mode. The swap is not loading. Swap file is not created (swap-file-creator)/ When starting guest-systems (other) in virtualbox, after a while the system freezes. No commands can be executed. Just a hard reboot. Is there a connection between this event (freeze os) and the launch in live-mode?

[sijhdooooaoao]

How now set Read-only Mode for VM?

This manual no longer work /wiki/VM_Live_Mode/Read_Only_Mode_Hard_Drive

It is also impossible to start VM with live mode on host. There is an error VERR_DISK_FULL

[nurmagoz]

@sijhdooooaoao

VERR_DISK_FULL

Not whonix issue:

VirtualBox Error: “ahci-0-0″ (rc=VERR_DISK_FULL)”

“I thought it was the VirtualBox’s vdi hard disk drive that was full, but it was much easier. Just a “df -h” and I realized that my host disk was full!”

---

cc @Patrick maybe we can add this to:

Kicksecure ™ in VirtualBox - Troubleshooting - Kicksecure ™ does not Start?

[sijhdooooaoao]

Anyone can use the live mod with the recent changes to AHCI? I can’t.

With VB 6.1.18 everything worked great. But wit VB 6.1.2 and with AHCI I can’t start a whonix VB in a live mode with live mode on host.

[sijhdooooaoao]

@nurmagoz

Not whonix issue:

My disk has enough free space. When I used VB 6.1.18 with LisLogic SAS live mode on the host worked well and I was able to start whonix VB with a live mode on the host. But now when live mode is on on the host I got this error - VERR_DISK_FULL
Also now is impossible to switch AHCI VB to read only.

[sijhdooooaoao]

Never mind VB issued version 6.1.22 with fixed LsiLogic SAS problem.

[nurmagoz]

Thanks for reporting the bug, Though im getting different error message:(Debian host)

and debian didnt yet upgraded vbox in sid yet to .22:

https://packages.debian.org/search?suite=default&section=all&arch=any&searchon=names&keywords=virtualbox

[Patrick]

Testing (to please myself) Live Mode User

Already some time since I tried Whonix. The feature I still use on a daily basis is the Live Mode (of the host) via Grub-Live. Now I got the idea that I want to verify for myself that the live mode is doing what I always hoped it was doing: preventing persistance of changes to my disk. So I want to make a system image, do a checksum, work on the system, re-image and recalculate the checksum and test for equality. Ideally I should not have to ask you how to go about this, on the other hand maybe …

[Patrick]

As noticed in above forum thread, /boot isn’t write protected. Any idea how /boot could also be covered?

Testing (to please myself) Live Mode User

mount time (time of last mounting of partition) is a pretty good guess. Maybe mount option in /etc/fstab noatime for /boot (and generally?) would help? Maybe there is a kernel boot parameter similar to noatime that we could set? Ideally in live mode mount times shouldn’t be recorded. It’s not a critical issue but for simplicity of dd whole encrypted disk and compare it would be much more handy if this issue wouldn’t exist. Non-Qubes-Whonix (and Kicksecure) VM images do not have a separate /b…

[Patrick]

grub-live ported to dracut would be great!

replacing initramfs-tools with dracut

If we want to implement a live boot option for Whonix we maybe need to change the default tool for generating the initramfs from the current initramfs-tools to dracut. Therefore, also some minor changes to the build scripts are required. Dracut is mostly used by everything Fedora based (RedHat, CentOS, Qubes) and OpenSuse. Initramfs-tools is used by Debian and derivatives by default. I couldn’t find any important differences between both, which doesn’t mean they don’t exist. Dracut is also in …

[Patrick]

Debian feature request
Boot existing Host Operating System or VM into Live Mode (grub-live)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991276

[Patrick]

@Patrick

grub-live ported to dracut would be great!

replacing initramfs-tools with dracut

grub-live dracut support has been implemented.

[MrKaos]

When this becomes available will it be used in very much the same way one would use tails? Burn onto usb or dvdr then use it as an OS like tails?

[Patrick]

This feature is already available. See links to wiki (edit) in initial post in this forum thread.

[MrKaos]

Thanks for getting back. But isn’t there something still in development where we would be able to boot a usb stick or DVD and it will take us straight into the whonix environment? Whonix live ISO or something…Without using any virtual machine? If so is it ready for end users yet? Thanks again for response