Get rescue cli working

README.md

@@ -6,7 +6,7 @@ Leverage Qubes template non-persistence to enhance the guest operating system's
 
 ## vm-boot-protect.service
    * Protect /home (user) executable files as immutable
-   * Quarrantine /rw (root) configs & scripts, with Whitelisting
+   * Quarantine /rw (root) configs & scripts, with Whitelisting
    * SHA256 checksumming guards against unwanted changes
    * Re-deploy custom 'default' files to /rw on each boot
    * Runs at VM start before /rw mounts
@@ -35,12 +35,14 @@ Leverage Qubes template non-persistence to enhance the guest operating system's
 
 ### Usage
 
-Operation is automatic, although particular configuration options such as hash checks are possible.
+Operation is automatic and will result in either a normal process with full access to the private volume at /rw, or a rescue service mode with the private volume quarantined at /mnt/rwtmp.
 
 At the `vm-boot-protect` level, certain executable files in /home will be made immutable so PATH and `alias` cannot be used to hijack commands like `su` and `sudo`, nor can impostor apps autostart whenever a VM starts. This prevents normal-privilege attacks from gaining persistence at startup. 
 
 At the `vm-boot-protect-root` level, the $privdirs paths will be renamed as backups, effectively removing them from the VM startup. Then whitelisting, hash/checksumming and deployment are done (if configured). This protects VM startup from attacks that had previously achieved privilege escalation.
 
+The special `vm-boot-protect-cli` level unconditionally goes to the service shell.
+
 ### Configuration
 
 Files can be added to /etc/default/vms in the template to enable the following features...
@@ -67,6 +69,7 @@ Conversely, attacks which damage/exploit the private filesystem itself or quickl
 * All the user-writable startup files in /home should be protected by the immutable flag; See issue #9 if you notice an omission or other problem. An extra step of disabling the flag using `sudo chattr -i` whenever the user wants to modify these startup files.
  
 ## Releases
+- v0.8.1  Rescue service mode on error or request
 - v0.8.0  Adds protection to /rw, file SHA checksums, whitelists, deployment
 - v0.2.0  Protects /home/user files and dirs
 

vm-boot-protect.service

@@ -15,6 +15,7 @@ RemainAfterExit=no
 # privdirs must begin with /rw
 # Environment="privdirs=/rw/config /rw/usrlocal /rw/bind-dirs"
 ExecStart=/usr/lib/qubes/init/vm-boot-protect.sh
+Restart=no
 
 [Install]
 WantedBy=sysinit.target 

vm-boot-protect.sh

@@ -13,8 +13,10 @@ chfiles=".bashrc .bash_profile .bash_login .bash_logout .profile \
 .xprofile .xinitrc .xserverrc .xsession"
 chdirs="bin .local/bin .config/autostart .config/plasma-workspace/env \
 .config/plasma-workspace/shutdown .config/autostart-scripts"
+
 vmname=`qubesdb-read /name`
 rw=/mnt/rwtmp
+errlog=/var/run/vm-protect-error
 
 # Function: Make user scripts immutable.
 make_immutable() {
@@ -27,26 +29,56 @@ make_immutable() {
     #touch $rw/home/user/FIXED #debug
 }
 
+# Start rescue shell then exit/fail
+abort_startup() {
+    echo "$1" >>$errlog
+    cat $errlog
+
+    umount /dev/xvdb
+    mv -f /dev/xvdb /dev/badxvdb
+    mount -o ro /dev/badxvdb $rw
+    truncate --size=500M /root/dev-xvdb
+    loop=`losetup --find --show /root/dev-xvdb`
+    mv -f $loop /dev/xvdb
+
+    cat /etc/bashrc /etc/bash.bashrc >/etc/bashrc-insert
+    echo "echo '** VM-BOOT-PROTECT SERVICE SHELL'" >/etc/bashrc
+    echo "echo '** Private volume is located at' $rw" >>/etc/bashrc
+    echo "cat $errlog" >>/etc/bashrc
+    echo ". /etc/bashrc-insert" >>/etc/bashrc
+    ln -f /etc/bashrc /etc/bash.bashrc
+    echo '/usr/bin/nohup /usr/bin/xterm /bin/bash 0<&- &>/dev/null &' \
+        >/etc/X11/Xsession.d/98rescue
+    exit 1
+}
+
+
+# Don't bother with root protections in template or standalone
+if ! is_rwonly_persistent; then
+###    make_immutable
+    exit 0
+fi
+
+echo >$errlog # Clear
+
+if qsvc vm-boot-protect-cli; then
+    abort_startup "CLI requested."
+fi
+
 # Mount private volume in temp location
 mkdir -p $rw
-if [ -e /dev/xvdb ] && mount /dev/xvdb $rw ; then
+if [ -e /dev/xvdb ] && mount -o ro /dev/xvdb $rw ; then
-    echo Good rw mount.
+    echo "Good read-only mount."
 else
-    echo Mount failed!
+    abort_startup "Mount failed!"
-    xterm -hold -display :0 -title "VM PROTECTION: MOUNT FAILED!" \
--e "bash -i"
-    exit 1
-fi
-if qsvc vm-boot-protect-cli; then
-    xterm -hold -display :0 -title "VM PROTECTION: SERVICE PROMPT" \
--e "echo Private volume is mounted at $rw; bash -i"
 fi
 
 
+
 # Protection measures for /rw dirs:
 # Activated by presence of vm-boot-protect-root Qubes service.
 #   * Hashes in vms/vms.all.SHA and vms/$vmname.SHA files will be checked.
-#   * Remove /rw root startup files - except whitelist.
+#   * Remove /rw root startup files (config, usrlocal, bind-dirs).
 #   * Contents of vms/vms.all and vms/$vmname folders will be copied.
 defdir="/etc/default/vms"
 privdirs=${privdirs:-"$rw/config $rw/usrlocal $rw/bind-dirs"}
@@ -55,21 +87,24 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
 
     # Check hashes
     checkcode=0
-    echo >/tmp/vm-protect-sum-error
     echo "File hash checks:" >/tmp/vm-protect-sum-error
     for vmset in vms.all $vmname; do
         if [ -f $defdir/$vmset.SHA ]; then
-            sha256sum --strict -c $defdir/$vmset.SHA >>/tmp/vm-protect-sum-error 2>&1
+            sha256sum --strict -c $defdir/$vmset.SHA >>$errlog 2>&1
             checkcode=$((checkcode+$?))
         fi
     done
-    cat /tmp/vm-protect-sum-error # For logging
 
     # Stop system startup on checksum mismatch:
     if [ $checkcode != 0 ]; then
-        xterm -hold -display :0 -title "VM PROTECTION: CHECKSUM MISMATCH!" \
+        abort_startup "Hash check failed!"
--e "cat /tmp/vm-protect-sum-error; echo Private volume is mounted at $rw; bash -i"
+    fi
-        exit 1
+
+    # Begin write operations
+    if [ -e /dev/xvdb ] && mount -o remount,rw /dev/xvdb $rw ; then
+        echo Good rw remount.
+    else
+        abort_startup "Remount failed!"
     fi
 
     # Files mutable for del/copy operations
@@ -77,11 +112,13 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
     chattr -R -f -i $chfiles $chdirs $privdirs
     cd /root
 
+
     # Deactivate private.img config dirs
     mkdir -p $rw/vm-boot-protect
     for dir in $privdirs; do
-        bakdir=$rw/vm-boot-protect/BAK-`basename $dir`
+        echo "Deactivate $dir"
-        origdir=$rw/vm-boot-protect/ORIG-`basename $dir`
+        bakdir=`dirname $dir`/vm-boot-protect/BAK-`basename $dir`
+        origdir=`dirname $dir`/vm-boot-protect/ORIG-`basename $dir`
         if [ -d $bakdir ] && [ ! -d $origdir ]; then
             mv $bakdir $origdir
         fi
@@ -97,11 +134,12 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
         | while read wlfile; do
             # Must begin with '/rw/'
             if echo $wlfile |grep -q "^\/rw\/"; then #Was [ $wlfile =~ ^\/rw\/ ];
-                srcfile="`echo $wlfile |sed -r \"s|^/rw/(.+)$|$rw/vm-boot-protect/BAK-\1|\"`"
+                srcfile="`echo $wlfile |sed -r \"s|^/rw/(.+)$|$rw/BAK-\1|\"`"
                 dstfile="`echo $wlfile |sed -r \"s|^/rw/(.+)$|$rw/\1|\"`"
                 dstdir="`dirname \"$dstfile\"`"
                 if [ ! -e "$srcfile" ]; then
-                    echo "Whitelist entry not present in filesystem."
+                    echo "Whitelist entry not present in filesystem:"
+                    echo "$srcfile"
                     continue
                 # For very large dirs: mv whole dir when entry ends with '/'
                 elif echo $wlfile |grep -q "\/$"; then
@@ -113,12 +151,13 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
                     cp -a --link "$srcfile" "$dstdir"
                 fi
             elif [ -n "$wlfile" ]; then
-                echo "Whitelist path must begin with /rw/."
+                echo "Whitelist path must begin with /rw/. Skipped."
             fi
         done
 
         # Copy default files...
         if [ -d $defdir/$vmset/rw ]; then
+            echo "Copy files from $defdir/$vmset/rw"
             cp -af $defdir/$vmset/rw/* $rw
         fi