Whonix live mode / amnesia / amnesic / non-persistent / anti-forensics

Algernon:

Certainly not impossible, but would at least require an initramfs hook. However, I’d stick to what it is in there by default. Every other script in there also uses those programs.

Ok.

You could maybe use a fallback option for systemd-detect-virt in case it does not detect a hypervisor to automatically assume bare metal.

Ok. But how would you figure out the root disk? Read it from kernel options?

Or you get rid of it at all

How? Read it from kernel options? Why do we have to detect it by detecting the virtualizer anyhow? How would the system figure it out by itself later on? Can we use the same mechanism?

You could always parse the underlying stuff directly from /proc or /sys which more or less each virtualization detection tool does and virt-what even suggests in the man page.

Sure.

More recent versions of the kernel can see very early in the boot process if the disk is write protected which could maye also be used instead. It is under /sys/block/vda/ro or similar path depending on the disk driver.

I like that much more than mounting and parsing /proc/mounts. Seems the much more appropriate way than custom parsing code.

I can try to contact upstream,

Yes, please! I am curious what they say. They might have some good comments.