Whonix on Mac M1 (ARM) - Development Discussion

[Patrick]

The VM settings are of crucial importance. One would have to go through all of these options one by one, reading the man page and perhaps related materials.

Ideally UTM could use libvirt then UTM could share most of Whonix KVMs configuration more easily rather than using QEMU command line directly. That would simplify things, make different virtualizer support simpler, since these would be more similar.

@GavinPacini

Network

1. First Configuration: Configures two TAP devices for network connectivity, with explicit MAC addresses and vhost acceleration.
2. Second Configuration: Includes one user-mode network with NAT (netdev user) and one socket-based network, potentially for inter-VM communication or specific network setups.

This is very important, needs most attention to get right to avoid IP leaks.

From the UTM config files. Relevant options:

Whonix-Gateway

-device virtio-net-pci,netdev=external
-device virtio-net-pci,netdev=internal
-netdev user,id=external,ipv6=off,net=10.0.2.0/24
-netdev socket,id=internal,listen=:8010

Whonix-Workstation

-device virtio-net-pci,netdev=internal
-netdev socket,id=internal,connect=127.0.0.1:8010

Doesn’t look crazy. Related documentation:
https://wiki.qemu.org/Documentation/Networking

But it has the same issue that KVM has. VM internal traffic is visible on the host for network sniffers such as wireshark, tshark.

This has lead in the past to a failure of configuring corridor on a Debian host with Whonix KVM.

references:

GitHub - rustybird/corridor: Tor traffic whitelisting gateway

testing on Debian host

related:

Using corridor, a Tor traffic whitelisting gateway with Whonix ™

So it would be much better if KVM / QEMU (UTM) would hide this from the host operating system. I.e. encapsulate the internal networking better. ChatGPT says this is possible using the hubport option but ChatGPT unfortunately sometimes talkes nonsense. Could you look into it please?

https://chat.openai.com/share/8d7165c4-722a-4e06-8cfd-8b525c552784

@GavinPacini

USB Devices

1. First Configuration: Does not explicitly enable USB support.
2. Second Configuration: Explicitly enables USB support and includes devices like a USB tablet, mouse, keyboard, and uses USB redirection for advanced features, likely enhancing user interaction with the VM.

related:
USB Passthrough

@GavinPacini

Additional Hardware and Features

• First Configuration: Includes specific devices like isa-serial, rng-random, and security features through -sandbox options.
• Second Configuration: Adds an Intel HDA audio device with duplex support, several USB redirection devices, and uses the SPICE protocol for enhanced remote display capabilities, including OpenGL rendering.

rng-random would be important to add if that is possible somehow.

@GavinPacini

4. Storage

• First Config: Utilizes a QCOW2 file format for the VM’s disk (Whonix-Workstation.qcow2), which is a flexible and efficient format for QEMU VMs, supporting features like snapshots.
• Second Config: Opts for a raw disk image (Whonix-Workstation-Xfce.raw), which generally offers better performance at the cost of storage efficiency and advanced features like snapshots.

Not security related. Usability only. Low priority. Could QCOW2 be used too? (derivative-maker supports it. Just a question if UTM supports it too.)

---

Created Dev/UTM - Whonix just now.