Kicksecure Tuning

From Kicksecure
Jump to navigation Jump to search
Advanced Documentation Previous page: Nested Virtualization Index page: Advanced Documentation Next page: Threat Modeling Kicksecure Tuning

Making Kicksecure Faster. Tuning Kicksecure.

Choose your platform to get started.

VirtualBox

Virtualizer VirtualBox has been chosen.

KVM

Virtualizer KVM has been chosen.

See below.

Introduction[edit]

Info Everything in this chapter is entirely optional.

Applying steps in this chapter can improve Kicksecure performance, but often at the cost of reduced security or an increased fingerprinting risk. Earlier entries in this chapter are easier to apply, while later tuning entries require a greater skill level.

Tested Tuning Steps[edit]

Hardware-accelerated Graphics[edit]

VirtualBox

Warning: This procedure lessens security.

To enable hardware-accelerated graphics for Kicksecure, perform these steps on the host:

  1. Power off the VM.
  2. VirtualBoxclick a VMSettingsDisplayGraphics ControllerAcceleration: check Enable 3D AccelerationOK
  3. Restart the VM.

Also refer to the VirtualBox manual: Hardware-Accelerated Graphicsarchive.org iconarchive.today icon.

Forum discussion: VirtualBox 3D Accelerationarchive.org iconarchive.today icon

Optional: To check if enabled.

Install package(s) glmark2-x11 following these instructions

1 Platform specific notice.

2 Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

3 Install the glmark2-x11 package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends glmark2-x11

4 Platform specific notice.

  • Kicksecure: No special notice.
  • Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

5 Done.

The procedure of installing package(s) glmark2-x11 is complete.

Run glmark.

glmark2

Expected output if 3D is disabled:

 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
=======================================================
    glmark2 2023.01
=======================================================
    OpenGL Information
    GL_VENDOR:      Mesa/X.org
    GL_RENDERER:    llvmpipe (LLVM 15.0.6, 128 bits)
    GL_VERSION:     4.5 (Compatibility Profile) Mesa 22.3.6
    Surface Config: buf=32 r=8 g=8 b=8 a=8 depth=32 stencil=0 samples=0
    Surface Size:   800x600 windowed
=======================================================
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[build] use-vbo=false: FPS: 153 FrameTime: 6.575 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[build] use-vbo=true: FPS: 156 FrameTime: 6.420 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[texture] texture-filter=nearest: FPS: 179 FrameTime: 5.614 ms
 GLX does not support GLX_EXT_swap_control or GLX_MESA_swap_control!
 Failed to set swap interval. Results may be bounded above by refresh rate.
[texture] texture-filter=linear: FPS: 170 FrameTime: 5.910 ms
=======================================================
                                  glmark2 Score: 163
=======================================================

Expected output if 3D is enabled:

=======================================================
    glmark2 2023.01
=======================================================
    OpenGL Information
    GL_VENDOR:      VMware, Inc.
    GL_RENDERER:    SVGA3D; build: RELEASE;  LLVM;
    GL_VERSION:     4.1 (Compatibility Profile) Mesa 22.3.6
    Surface Config: buf=32 r=8 g=8 b=8 a=8 depth=24 stencil=0 samples=0
    Surface Size:   800x600 windowed
=======================================================
[build] use-vbo=false: FPS: 634 FrameTime: 1.578 ms
[build] use-vbo=true: FPS: 885 FrameTime: 1.131 ms
[texture] texture-filter=nearest: FPS: 855 FrameTime: 1.170 ms
[texture] texture-filter=linear: FPS: 861 FrameTime: 1.162 ms
[texture] texture-filter=mipmap: FPS: 851 FrameTime: 1.176 ms
=======================================================
                                  glmark2 Score: 816
=======================================================

Renderer[edit]

In some situations, softwarecontext renderer is set by default in Kicksecure.

  • Old: Package vm-config-dist prior to version 3:11.1-1:
    • Always unconditionally sets softwarecontext renderer. This is accomplished by setting the environment variable QMLSCENE_DEVICE=softwarecontext .
  • New: Package vm-config-dist version 3:11.1-1 and above:
    • Only sets softwarecontext renderer if hardware acceleration is unavailable. In technical terms, this means only if the OpenGL renderer string is llvmpipe according to glxinfo , then the environment variable QMLSCENE_DEVICE=softwarecontext is set.

This setting is particularly useful in cases where hardware acceleration is disabled (which is the default in Kicksecure VMs) for applications such as:

  • Monero [1]
  • signal-desktop, and potentially
  • wire-desktop, as well as
  • other electron-based applications. (Note: This setting is unrelated to electrum.)

However, this configuration has been reported to cause issues with:

General information:

  • Does this setting have any security impact? No.
  • When does it make sense to undo this setting? Likely when Hardware-accelerated Graphics is enabled.
  • Is the user encouraged to experiment with this setting? Yes.

Forum search:

How to test if issues are caused by QMLSCENE_DEVICE=softwarecontext?

Temporarily disable it.

Disable Softwarecontext Renderer[edit]

1. Notice.

  • A) VM: If intending starting application inside VM, change environment variables inside VM.
  • B) host operating system (OS): If intending starting application on host, change environment variables on the host.

2. Select a method.

Command Line Method

3. Temporarily unset the environment variable.

unset QMLSCENE_DEVICE

4. Launch the application from the command line.

5. Done.

Notes:

  • This method does not work if:
    • Applications are started from the start menu.
    • The unset command has not been run previously in different terminal emulator tabs.
  • This process needs to be repeated after a reboot.

Configuration File Deletion Method

3. Delete the configuration file that sets this environment variable.

sudo safe-rm -f /etc/profile.d/20_software_rendering_in_vms.sh

4. Reboot the system.

sudo reboot

5. Done.

6. To undo this change (optional, see footnote). [2]

Technical Information[edit]

Additional information for developers only:

Increase Virtual Machine RAM[edit]

VirtualBox

RAM available to Virtual Machines can be increased via VirtualBox settings.

To check how much RAM is free, use free -m in a Terminal. Consider the example below:

  1. Shutdown the VM.
  2. Assign more RAM: Virtual machineMenuSettingsAdjust Memory slider to 4096Hit: OK
  3. Restart the VM.

See also: Advice for Systems with Low RAM.

Additional CPU Cores[edit]

VirtualBox

Warning: this procedure may increase fingerprinting risks.

Do not use the maximum since that could lead to system instability! Always leave at least one CPU unassigned; for example, if you have four CPUs then assign a maximum of three CPUs to the VM. [3]

  1. Power off the VM.
  2. VirtualBoxclick a VMSettingsSystemProcessorReduce to 3OK
  3. Restart the VM.

Untested Tuning Steps[edit]

Disable CPU Mitigations[edit]

Warning: this procedure lessens security.

Untested!

Consider disabling the Spectre Meltdown mitigations. (Related forum discussionarchive.org iconarchive.today icon.)

This step should be performed in the VM intended for disabled CPU mitigations and on the host operating system if either Kicksecure or security-misc are in use.

1. Remove the relevant CPU mitigations file.

sudo rm /etc/default/grub.d/40_cpu_mitigations.cfg

2. Update grub.

sudo update-grub

3. Reboot.

4. Done.

Nested Paging and VPIDs[edit]

VirtualBox

It is possible to increase performance by using largepages and/or Virtual Processor Identifiers (VPIDs). It is unknown if this decreases security or stability. For further information refer to the VirtualBox manual: Nested Paging and VPIDsarchive.org iconarchive.today icon.

vboxmanage modifyvm Kicksecure-Xfce --largepages on

vboxmanage modifyvm Kicksecure-Xfce --largepages on

vboxmanage modifyvm Kicksecure-Xfce --vtxvpid on

vboxmanage modifyvm Kicksecure-Xfce --vtxvpid on

Memory Ballooning, Page Fusion and Memory Overcommitment[edit]

Warning: this procedure lessens security.

Memory ballooning worsens security because it is a vector for side channel attacks on memory; see Dev/KVM, memory balloonOnion network Logo for further information. [4]

For other security considerations, refer to the VirtualBox manual: Memory Overcommitmentarchive.org iconarchive.today icon.

Undocumented Tuning Settings[edit]

There are probably more tuning-related settings, but these are currently undocumented at Kicksecure. Interested readers can review the manual for relevant settings of their respective virtualizer, which are unlikely to be bundled under a "tuning" chapter.

VirtualBox

To view all settings, run.

vboxmanage showvminfo Kicksecure-Xfce

Next, learn about all of these settings by reviewing the VirtualBox manualarchive.org iconarchive.today icon.

PCI Passthrough[edit]

Warning: this procedure lessens security.

This setting can improve graphics performance dramatically, but it worsens security because VMs should not have direct access to physical hardware.

In simple terms, this feature allows the direct use of physical PCI devices on the host by the guest even if the host does not have drivers for the particular device.

VirtualBox

For further information, refer to VirtualBox Manual: PCI Passthrougharchive.org iconarchive.today icon.

See Also[edit]

Footnotes[edit]

  1. sudo apt-get-reset vm-config-dist (Refer to Reset Configuration Files to Vendor Default for more information.)
  2. VirtualBox ticket: VirtualBox should now prohibit assigning all physical CPUs to a VM and/or fix VirtualBox CPU assignment manualarchive.org iconarchive.today icon.
  3. This entry relates to KVM but the research similarly applies to other virtualizers unless they have implemented and documented specific protections.

Advanced Documentation Previous page: Nested Virtualization Index page: Advanced Documentation Next page: Threat Modeling

Notification image

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!