Wickr Me vs Qubes-Whonix Persistence

Re: Wickr Me

Instructions are fine for non-Qubes-Whonix. Not practical (correct) for Qubes-Whonix:

  1. snapd must be installed in (separate) whonix-ws-15 templateVM
  2. wickrme can’t be installed in the templateVM with “snap install wickrme” (due to whatever restrictions Qubes puts on installations i.e. only from official repos or whatever). So, they have to run this in the AppVM, but that of course is not persistent.

Not feasible for Qubes-Whonix user to install this in the AppVM everytime they want to run it. Not sure what is the best solution - maybe we just note it is “non-Qubes-Whonix” users only at the minute?

1 Like

I see three options.

A) Install Software in a TemplateBasedVM is one way.

B) Another way would be adding folder /snap to bind-dirs.

C) Make use of snap proxy settings. Use snap to install Wickr Me in Qubes TemplateVM by setting the Qubes updates proxy. (Least secure - unless using a dedicated, separate TemplateVM.)

http_proxy=http://127.0.0.1:8082 snap install wickrme

A and B are untested but I speculate it has a good chance that would work.

Anyone feel free to test this. As for wiki, perhaps just add a comment and link to this forum thread.


This is known to work in Qubes:

curl --proxy http://127.0.0.1:8082/ --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc
1 Like

Those bind-dir instructions over on Qubes don’t look too difficult? (famous last words :slight_smile: )

1 Like

I thought this would work, but it doesn’t keep the root folder /snap persistent. So something is wrong with bind-dirs in Qubes presently, or their documentation is simply wrong.

FYI - the root /snap folder has inside of it /bin, /core18, /gtk-common-themes, /wickrme and README, with a bunch of those having sub-folders.

Hard to know what it necessary to bind i.e. would you have to add many multiples of sub-folders? (If so, a useless functionality.) Of if just having the bind-dirs for the root folder /snap is enough to cover off all files and sub-folders within it?

See: Clarify bind-dirs documentation · Issue #5862 · QubesOS/qubes-issues · GitHub here also. Any ideas? If not, your option C might be the only viable one.

{{Box|text=
‘’‘1.’‘’ Clone the anon-whonix AppVM.

Create a standalone anon-whonix-wickr AppVM with Qubes Manager.

‘’‘2.’‘’ Create a Qubes [How to make any file persistent (bind-dirs) | Qubes OS bind-dirs] folder for the Wickr Me application.

In the new AppVM, ensure folder /rw/config/qubes-bind-dirs.d exists.

{{CodeSelect|code=
sudo mkdir -p /rw/config/qubes-bind-dirs.d
}}

‘’‘3.’‘’ Create a user.conf file with root rights.

{{CodeSelect|code=
sudoedit /rw/config/qubes-bind-dirs.d/50_user.conf
}}

‘’‘4.’‘’ Append the necessary Wickr Me folder name to the binds variable.

Add.

{{CodeSelect|code=
binds+=( ‘/snap’ )
}}

‘’‘5.’‘’ Save the file and reboot the anon-whonix-wickr AppVM.

From now on any sub-folders and files within the folders above will persist across reboots.

Note: It is possible to make make many files or folders persist, simply by making multiple entries in the 50_user.conf file, each on a separate line. For example, if you added the file /etc/tor/torrc to the binds variable, any modifications to that file will persist across reboots.

‘’‘6.’‘’ Open a terminal.

{{Open_a _product_ws_terminal}}

‘’‘7.’‘’ Install dependencies.

{{Update}}

{{CodeSelect|code=
sudo apt-get update
}}

Install dependencies.

{{CodeSelect|code=
sudo apt install snapd
}}

‘’‘8.’‘’ Reboot.

A reboot is required so snap can add itself to the PATH environment variable. Otherwise, following installation it can be launched from the absolute path:

{{CodeSelect|code=
/snap/bin/wickrme
}}

‘’‘9.’‘’ Install Wickr Me.

{{CodeSelect|code=
snap install wickrme
}}

The installation process is now complete.
}}

1 Like

More likely documentation issue. bind-dirs is working. It’s what makes /var/lib/tor persistent in TemplateBased sys-whonix.

The folder /snap might have to exist inside TemplateVM to be able to use bind-dirs. Dunno. Try?

sudo mkdir /snap

Shutdown TemplateVM. Restart TemplateBasedVM.

Using bind-dirs might require existence of the folder in TempalteVM. Possibly a bug in bind-dirs.

No. Root folder (example here: /snap) alone will be enough. Works well for onion services inside /var/lib/tor when following Whonix /wiki/Onion_Services documentation which are stored in a sub folder under /var/lib/tor.

1 Like

FYI - Option C doesn’t work:

error: cannot install “wickrme”: Post
https://api.snapcraft.io/v2/snaps/refresh: dial tcp: lookup
api.snapcraft.io on 10.152.152.10:53: dial udp 10.152.152.10:53:
connect: network is unreachable

With option B, tried:

  1. Clone whonix-ws-15 to whonix-ws-15-wickr
  2. In TemplateVM, install snapd - sudo apt install snapd
  3. Check there is a root snap folder (/snap) - there is
  4. Shutdown the whonix-ws-15-wickr TemplateVM
  5. Clone the anon-whonix AppVM to anon-whonix-wickr
  6. Set the TemplateVM for that AppVM to whonix-ws-15-wickr
  7. In the new AppVM, ensure folder /rw/config/qubes-bind-dirs.d exists - sudo mkdir -p /rw/config/qubes-bind-dirs.d
  8. In the AppVM, create a user.conf file with root rights - sudoedit /rw/config/qubes-bind-dirs.d/50_user.conf
  9. Append the necessary Wickr Me folder name to the binds variable. Add - binds+=( ‘/snap’ ) and save the file.
  10. Reboot the anon-whonix-wickr AppVM since then technically any sub-folders and files within /snap should persist across reboots.
  11. Install Wickr Me in the AppVM terminal - snap install wickrme
  12. Launch Wickr Me in the AppVM terminal - /snap/bin/wickrme - works
  13. Restart the Wickr Me AppVM and pray the thing still exists and will relaunch with the same terminal command.

And… it doesn’t work. Only the README file exists in the /snap folder. (I note that when Wickr Me is installed it has files & folders everywhere e.g. /sbin etc. But this is a proof of concept that bind-dirs won’t keep that root folder even, so something is up with the existing documentation.)

Easy solution → I’ll note this as “Non-Qubes-Whonix” on the relevant wiki page :slight_smile: Besides, Qubes-Whonix users have far more secure options available, so they need to develop good habits instead of relying on security theater like Wickr Me.

1 Like

Would be interesting to have snapd functional and documented independent from wickrme as snapd is getting increasingly popular. Related: Snap Store / snaps / snapd / snapcraft.io - a new software source?

These instructions are sound. bind-dirs is functional for the “simple” use case. (Manually leaving any files in folder /snap or /arbitrary-folder-name.)

Problem might be snap itself uses mount. Also bind-dirs is based on mount.

mount | grep snap

This mount is by bind-dirs.

/dev/xvdb on /snap type ext4 (rw,relatime,discard)

This mount is by snapd:

/var/lib/snapd/snaps/core18_1754.snap on /snap/core18/1754 type squashfs (ro,nodev,relatime,x-gdu.hide)

Also /var/lib/snapd would need added to bind-dirs configuration.

I’ve tested that but now running into another issue.

internal error, please report: running “wickrme” failed: cannot find installed snap “wickrme” at revision 352: missing file /snap/wickrme/352/meta/snap.yaml

It’s probably because snapd did not set up its mount because something Qubes TempalteBasedVMs / bind-dirs is doing is interfering. Didn’t investigate further due to lack of time. Could be reported as a Qubes bug to Qubes.

1 Like