VM Live Mode: Alternative ro-mode-init Configuration

From Kicksecure
Jump to navigation Jump to search

About this VM Live Mode/ro-mode-init Page
Support Status testing
Difficulty medium
Contributor Algernon
Support Support
Alternativeremode123123.jpg

Introduction[edit]

As an alternative [1] in Kicksecure ™ VirtualBox or Kicksecure ™ KVM, it is also possible to automatically detect if the disk is set to read-only and enable live mode automatically using the ro-mode-init package.

ro-mode-init is currently less tested than grub-live (Host Live Mode / VM Live Mode).

Preliminary Steps[edit]

1. Backup.

  • Option 1: Create a snapshot of your VM; or
  • Option 2: Alternatively backup the /boot folder.

sudo cp -a /boot /boot.back

2. Install ro-mode-init.

Install ro-mode-init.

1. Update the package lists.

sudo apt update

2. Upgrade the system.

sudo apt full-upgrade

3. Install the ro-mode-init package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends ro-mode-init

The procedure of installing ro-mode-init is complete.

3. Upate initial ramdisk. [2]

sudo update-initramfs -u

4. Set the VM disk to read-only.

The read-only VM setting is necessary (see below), otherwise the VM disk will always boot into persistent mode.

Read-only VM Setting[edit]

VirtualBox[edit]

Read-only disk on VirtualBox[edit]

To boot into live mode, apply the following steps.

Set the VirtualBox virtual harddrive to read-only.

1. Power off the machine.

2. Open setting window of the machine and set the type of storage device controller from AHCI to LsiLogic SAS.

VirtualBoxSettingsStorageType: LsiLogic SASOK

3. Learn the syntax.

Do not run the following command. Only look at it.

VBoxManage setextradata vmname "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Replace vmname with the name of the actual VM name.

4. On the command line run.

Kicksecure ™ XFCE example:

VBoxManage setextradata Kicksecure-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Kicksecure ™ XFCE example:

VBoxManage setextradata Kicksecure-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

Read-write disk on VirtualBox[edit]

To boot into read-write mode again, simply revert this change.

  1. Power off the machine.
  2. From the command line run.

Use the syntax below.

VBoxManage setextradata vmname "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly"

Replace vmname with the name of the actual VM name.

KVM[edit]

Read-only disk on KVM[edit]

To boot into live mode, apply the following steps:

  1. Power off the machine.
  2. Set the hard disk to read-only in the virt-manager GUI.
  3. Power on the machine and select to boot into live mode.

Read-write disk on KVM[edit]

To boot into normal mode again, simply revert this change:

  1. Power off the machine.
  2. Set the hard disk to read-write in the virt-manager GUI.
  3. Power on the machine and boot into read-write mode.

Live Mode Indicator Systray[edit]

https://github.com/Whonix/whonix-xfce-desktop-config/blob/master/usr/share/livecheck/livecheck.sh

Debugging[edit]

An inconsistent filesystem will likely result in errors during booting in live mode. For instance, inconsistencies can arise when the VM is killed instead of performing a normal shutdown in persistent mode. Therefore to ensure it is consistent, run fsck in persistent mode. Debian automatically does this during boot. VMs running in live mode can be killed without problems.

In the case of non-fsck related errors using ro-mode-init (like dropping to an initramfs shell), add the following to the kernel command line/GRUB menu for easier debugging:

debug=1 break=init-premount

Footnotes[edit]



Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.