Combine Kicksecure™ Live VMs with Read-only Mode for Virtual Hard Drives

Set virtual machine (VM) hard drives to read only. Prevent write access to VM drives.
Introduction[edit]
It is possible to optionally set the virtual machine (VM) disks to read-only. This increases the security of Live Mode in the VM, because otherwise malware running as root in the VM could theoretically mount the image read-write and gain persistence in this way.
Read-only Mode Configuration[edit]
Qubes[edit]
grub-live
is currently unsupported on Qubes, but may become available in the future. Refer to the following forum discussion for further information.
In Qubes R4, Qubes DisposableVMs are a suitable alternative.
VirtualBox[edit]
1. Version specific notice.
- A) On Debian bullseye based Kicksecure
16
: This might still be functional. - B) On Debian bookworm based Kicksecure
17
(and above) / Newer VirtualBox versions:- VirtualBox might no longer support
VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly
. Settings set thorughVBoxManage setextradata
are not officially supported and might be gone at some time such as now. - VirtualBox documentation chapter Special Image Write Modes
mentions
immutable images
but this might not be as good asread-only images
. - An additional issue, see also: https://forums.kicksecure.com/t/livecheck-sh-script-broken-on-bookworm/269/2
- VirtualBox might no longer support
2. Set the VM disks to read-only.
Follow these steps:
- Power off the virtual machine (VM).
- Set the disk to read-only.
- The name of the VM in the following example below is
Kicksecure-Xfce
. It could be replaced with the name of any other VM such asKicksecure-Xfce
. - On the host command line, run.
- The name of the VM in the following example below is
VBoxManage setextradata Kicksecure-Xfce "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1
3. Remove VirtualBox virtual DVD drive.
This is only required if the VM has a virtual DVD drive. It is not required in Kicksecure version 15.0.1.2.7
and above since it no longer comes with a virtual DVD drive by default. See footnote for a Kicksecure build version lower than 15.0.1.2.7
. [1]
4. Launch the live system.
Following reboot, a second boot entry called "VM Live Mode-mode" will be visible. Select it and then press Enter
to boot the live system and use it as normal.
5. Optional: Revert the read-only change.
To boot into normal mode again, run this command on the host to revert the change.
VBoxManage setextradata Kicksecure-Xfce "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly"
The normal boot option can now be selected in the GRUB menu.
6. Optional: Re-add the virtual DVD.
Only when you need this; see footnotes. [2]
Troubleshooting: If the system does not boot, check the Recommended VirtualBox Version for Kicksecure VirtualBox is in use.
KVM[edit]
1. Set the VM disks to read-only.
Follow these steps:
- Power off the machine.
- Set the hard disk to read-only in the virt-manager GUI before booting into live mode.
2. Launch live-mode.
Following reboot, a second boot entry called "VM Live Mode-mode" will be visible. Select it and then press Enter
to boot the live system and use it as normal.
3. Optional: Revert the read-only change.
To boot into normal mode again, revert the change from step 1 and choose the normal boot option in the GRUB menu.
Alternative Configurations[edit]
Virtualbox and KVM:
VirtualBox only:
Footnotes[edit]
- ↑
Careful. If you remove the wrong drive, your VM will no longer boot. If you are worried, clone the VM first before proceeding.
- Power off the VM.
VirtualBox
→click a VM
→Settings
→Storage
→click on DVD device symbol
→click on disk removal symbol
- VirtualBox will ask
Are you sure you want to delete the optical drive?
You will not be able to insert any optical disks or ISO images or install the Guest Additions without it!
4.
click "Remove"
https://forums.whonix.org/t/no-longer-add-virtual-dvd-drive-to-vm-by-default/9337
- ↑
Careful. If you remove the wrong drive, your VM will no longer boot. If you are worried, clone the VM first before proceeding.
- Power off the VM.
VirtualBox
→click a VM
→Settings
→Storage
→click on DVD device add symbol
→click Leave Empty
→click OK
- Usual way to add DVD's to VirtualBox VMs can now be used such as
VirtualBox
→click a VM
→click on [Optical Drive]
Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 11 year success story and maybe DONATE!