Merge branch 'disposablevm-term-fixes'

This commit is contained in:
Andrew David Wong 2018-12-08 21:50:31 -06:00
commit 057f607c94
No known key found for this signature in database
GPG Key ID: 8CE137352A019A17
26 changed files with 144 additions and 138 deletions

View File

@ -85,7 +85,7 @@ Qubes also supports secure file copying between AppVMs.
[![r2b2-open-in-dispvm-1.png](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-1.png)](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-1.png) [![r2b2-open-in-dispvm-3.png](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-3.png)](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-3.png) [![r2b2-open-in-dispvm-1.png](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-1.png)](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-1.png) [![r2b2-open-in-dispvm-3.png](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-3.png)](/attachment/wiki/QubesScreenshots/r2b2-open-in-dispvm-3.png)
Qubes' unique Disposable VMs (DispVMs) allow the user to open any file in a disposable VM in a matter of seconds! A file can be edited in a disposable VM, and any changes are projected back onto the original file. Currently, there is no way to mark files to be automatically opened in a disposable VM (one needs to right-click on the file and choose the "Open in Disposable VM" option), but this is planned for the R2 Beta 3 release. Qubes' unique DisposableVMs (DispVMs) allow the user to open any file in a disposable VM in a matter of seconds! A file can be edited in a disposable VM, and any changes are projected back onto the original file. Currently, there is no way to mark files to be automatically opened in a disposable VM (one needs to right-click on the file and choose the "Open in DisposableVM" option), but this is planned for the R2 Beta 3 release.
* * * * * * * * * *

View File

@ -116,7 +116,7 @@ would override all the user changes there). More details:
- ability to deploy the template into various storage mechanisms (sparse - ability to deploy the template into various storage mechanisms (sparse
files, LVM thin volumes etc). files, LVM thin volumes etc).
- template metadata, templates repository - enable the user to browse - template metadata, templates repository - enable the user to browse
available templates (probably should be done in dedicated VM, or Disposable VM) available templates (probably should be done in dedicated VM, or DisposableVM)
- Implement the above mechanism: - Implement the above mechanism:
- tool to download named template - should perform download operation in - tool to download named template - should perform download operation in
some VM (as dom0 have no network access), then transfer the data to dom0, some VM (as dom0 have no network access), then transfer the data to dom0,
@ -285,7 +285,7 @@ details: [#1552](https://github.com/QubesOS/qubes-issues/issues/1552),
**Expected results**: **Expected results**:
- Extend existing Thunderbird extension to decide on action (where to open/save attachments) based on message sender - recognized as email address, or signing key - Extend existing Thunderbird extension to decide on action (where to open/save attachments) based on message sender - recognized as email address, or signing key
- Add Firefox extension to open links in Disposable VM / selected VM (right-click option and a default action for not-whitelisted URLs/domains) - Add Firefox extension to open links in DisposableVM / selected VM (right-click option and a default action for not-whitelisted URLs/domains)
- The same for Chrome - The same for Chrome
- Add tests for above enhancements - Add tests for above enhancements
- Update user documentation - Update user documentation

View File

@ -141,7 +141,7 @@ A full list is available in the [Common Tasks](/doc/#common-tasks) section of th
* [Updating Software in dom0](/doc/software-update-dom0/) * [Updating Software in dom0](/doc/software-update-dom0/)
* [Updating and Installing Software in VMs](/doc/software-update-vm/) * [Updating and Installing Software in VMs](/doc/software-update-vm/)
* [Backup, Restoration, and Migration](/doc/backup-restore/) * [Backup, Restoration, and Migration](/doc/backup-restore/)
* [Using Disposable VMs](/doc/dispvm/) * [Using DisposableVMs](/doc/disposablevm/)
* [Using and Managing USB Devices](/doc/usb/) * [Using and Managing USB Devices](/doc/usb/)
Running an application Full Screen Running an application Full Screen

View File

@ -213,7 +213,7 @@ technical details have been omitted here for the sake of presentation.
* Ready to give Qubes a try? Head on over to the [downloads] page. * Ready to give Qubes a try? Head on over to the [downloads] page.
[disposable qube]: /doc/dispvm/ [disposable qube]: /doc/disposablevm/
[networking]: /doc/networking/ [networking]: /doc/networking/
[firewalls]: /doc/firewall/ [firewalls]: /doc/firewall/
[USB]: /doc/usb/ [USB]: /doc/usb/

View File

@ -1,48 +1,49 @@
--- ---
layout: doc layout: doc
title: Disposable VMs title: DisposableVMs
permalink: /doc/dispvm/ permalink: /doc/disposablevm/
redirect_from: redirect_from:
- /doc/dispvm/
- /en/doc/dispvm/ - /en/doc/dispvm/
- /doc/DisposableVms/ - /doc/DisposableVms/
- /wiki/DisposableVMs/ - /wiki/DisposableVMs/
--- ---
Disposable VMs (DispVMs) DisposableVMs
======================== =============
A Disposable VM (DispVM) is a lightweight VM that can be created quickly and will disappear when closed. A DisposableVM (previously known as a "DispVM") is a lightweight VM that can be created quickly and will disappear when closed.
Disposable VMs are usually created in order to host a single application, like a viewer, editor, or web browser. DisposableVMs are usually created in order to host a single application, like a viewer, editor, or web browser.
From inside an AppVM, choosing the `Open in Disposable VM` option on a file will launch a DispVM for just that file. From inside an AppVM, choosing the `Open in DisposableVM` option on a file will launch a DisposableVM for just that file.
Changes made to a file opened in a DispVM are passed back to the originating VM. Changes made to a file opened in a DisposableVM are passed back to the originating VM.
This means that you can safely work with untrusted files without risk of compromising your other VMs. This means that you can safely work with untrusted files without risk of compromising your other VMs.
DispVMs can be launched either directly from Dom0's Start Menu or terminal window, or from within AppVMs. DisposableVMs can be launched either directly from dom0's Start Menu or terminal window, or from within AppVMs.
While running, DispVMs will appear in Qubes VM Manager with the name `disp####`. While running, DisposableVMs will appear in Qubes VM Manager with the name `disp####`.
See [this article](https://blog.invisiblethings.org/2010/06/01/disposable-vms.html) for more on why one would want to use a Disposable VM. See [this article](https://blog.invisiblethings.org/2010/06/01/disposable-vms.html) for more on why one would want to use a DisposableVM.
Security Security
-------- --------
If a [DVM Template] becomes compromised, then any DisposableVM based on that DVM Template could be compromised. If a [DVM Template] becomes compromised, then any DisposableVM based on that DVM Template could be compromised.
In particular, the *default* DVM Template is important because it is used by the "Open in DispVM" feature. In particular, the *default* DVM Template is important because it is used by the "Open in DisposableVM" feature.
This means that it will have access to everything that you open with this feature. This means that it will have access to everything that you open with this feature.
For this reason, it is strongly recommended that you base the default DVM Template on a trusted TemplateVM. For this reason, it is strongly recommended that you base the default DVM Template on a trusted TemplateVM.
### Disposable VMs and Local Forensics ### ### DisposableVMs and Local Forensics ###
At this time, DispVMs should not be relied upon to circumvent local forensics, as they do not run entirely in RAM. At this time, DisposableVMs should not be relied upon to circumvent local forensics, as they do not run entirely in RAM.
For details, see [this thread](https://groups.google.com/d/topic/qubes-devel/QwL5PjqPs-4/discussion). For details, see [this thread](https://groups.google.com/d/topic/qubes-devel/QwL5PjqPs-4/discussion).
When it is essential to avoid leaving any trace, consider using [Tails](https://tails.boum.org/). When it is essential to avoid leaving any trace, consider using [Tails](https://tails.boum.org/).
Disposable VMs and Networking (R4.0 and later) DisposableVMs and Networking (R4.0 and later)
----------------------------- -----------------------------
Similarly to how AppVMs are based on their underlying [TemplateVM](https://www.qubes-os.org/doc/glossary/#templatevm), DispVMs are based on their underlying [DVM Template](https://www.qubes-os.org/doc/glossary/#dvm-template). Similarly to how AppVMs are based on their underlying [TemplateVM](https://www.qubes-os.org/doc/glossary/#templatevm), DisposableVMs are based on their underlying [DVM Template](https://www.qubes-os.org/doc/glossary/#dvm-template).
R4.0 introduces the concept of multiple DVM Templates, whereas R3.2 was limited to only one. R4.0 introduces the concept of multiple DVM Templates, whereas R3.2 was limited to only one.
On a fresh installation of Qubes, the default DVM Template is called `fedora-XX-dvm` (where `XX` is the Fedora version of the default TemplateVM). On a fresh installation of Qubes, the default DVM Template is called `fedora-XX-dvm` (where `XX` is the Fedora version of the default TemplateVM).
@ -53,27 +54,27 @@ You can set any AppVM to have the ability to act as a DVM Template with:
qvm-prefs <vmname> template_for_dispvms True qvm-prefs <vmname> template_for_dispvms True
The default system wide DVM Template can be changed with `qubes-prefs default_dispvm`. The default system wide DVM Template can be changed with `qubes-prefs default_dispvm`.
By combining the two, choosing `Open in Disposable VM` from inside an AppVM will open the document in a DispVM based on the default DVM Template you specified. By combining the two, choosing `Open in DisposableVM` from inside an AppVM will open the document in a DisposableVM based on the default DVM Template you specified.
You can change this behaviour for individual VMs: in the Application Menu, open Qube Settings for the VM in question and go to the "Advanced" tab. You can change this behaviour for individual VMs: in the Application Menu, open Qube Settings for the VM in question and go to the "Advanced" tab.
Here you can edit the "Default DispVM" setting to specify which DVM Template will be used to launch DispVMs from that VM. Here you can edit the "Default DisposableVM" setting to specify which DVM Template will be used to launch DisposableVMs from that VM.
This can also be changed from the command line with: This can also be changed from the command line with:
qvm-prefs <vmname> default_dispvm <dvmtemplatename> qvm-prefs <vmname> default_dispvm <dvmtemplatename>
For example, `anon-whonix` has been set to use `whonix-ws-dvm` as its `default_dispvm`, instead of the system default. For example, `anon-whonix` has been set to use `whonix-ws-dvm` as its `default_dispvm`, instead of the system default.
You can even set an AppVM that has also been configured as a DVM Template to use itself, so DispVMs launched from within the AppVM/DVM Template would inherit the same settings. You can even set an AppVM that has also been configured as a DVM Template to use itself, so DisposableVMs launched from within the AppVM/DVM Template would inherit the same settings.
NetVM and firewall rules for DVM Templates can be set as they can for a normal VM. NetVM and firewall rules for DVM Templates can be set as they can for a normal VM.
By default a DispVM will inherit the NetVM and firewall settings of the DVM Template on which it is based. By default a DisposableVM will inherit the NetVM and firewall settings of the DVM Template on which it is based.
This is a change in behaviour from R3.2, where DispVMs would inherit the settings of the AppVM from which they were launched. This is a change in behaviour from R3.2, where DisposableVMs would inherit the settings of the AppVM from which they were launched.
Therefore, launching a DispVM from an AppVM will result in it using the network/firewall settings of the DVM Template on which it is based. Therefore, launching a DisposableVM from an AppVM will result in it using the network/firewall settings of the DVM Template on which it is based.
For example, if an AppVM uses sys-net as its NetVM, but the default system DispVM uses sys-whonix, any DispVM launched from this AppVM will have sys-whonix as its NetVM. For example, if an AppVM uses sys-net as its NetVM, but the default system DisposableVM uses sys-whonix, any DisposableVM launched from this AppVM will have sys-whonix as its NetVM.
**Warning:** The opposite is also true. This means if you have changed anon-whonix's `default_dispvm` to use the system default, and the system default DispVM uses sys-net, launching a DispVM from inside anon-whonix will result in the DispVM using sys-net. **Warning:** The opposite is also true. This means if you have changed anon-whonix's `default_dispvm` to use the system default, and the system default DisposableVM uses sys-net, launching a DisposableVM from inside anon-whonix will result in the DisposableVM using sys-net.
A Disposable VM launched from the Start Menu inherits the NetVM and firewall settings of the DVM Template on which it is based. A DisposableVM launched from the Start Menu inherits the NetVM and firewall settings of the DVM Template on which it is based.
Note that changing the "NetVM" setting for the system default DVM Template *does* affect the NetVM of DispVMs launched from the Start Menu. Note that changing the "NetVM" setting for the system default DVM Template *does* affect the NetVM of DisposableVMs launched from the Start Menu.
Different DVM Templates with individual NetVM settings can be added to the Start Menu. Different DVM Templates with individual NetVM settings can be added to the Start Menu.
**Important Notes:** **Important Notes:**
@ -87,42 +88,42 @@ To launch a DVM from the command line, in dom0 please type the following:
Disposable VMs and Networking (R3.2 and earlier) DisposableVMs and Networking (R3.2 and earlier)
----------------------------- -----------------------------
NetVM and firewall rules for Disposable VMs can be set as they can for a normal VM. NetVM and firewall rules for DisposableVMs can be set as they can for a normal VM.
By default a DispVM will inherit the NetVM and firewall settings of the VM from which it is launched. By default a DisposableVM will inherit the NetVM and firewall settings of the VM from which it is launched.
Thus if an AppVM uses sys-net as its NetVM, any DispVM launched from this AppVM will also have sys-net as its NetVM. Thus if an AppVM uses sys-net as its NetVM, any DisposableVM launched from this AppVM will also have sys-net as its NetVM.
You can change this behaviour for individual VMs: in Qubes VM Manager open VM Settings for the VM in question and go to the "Advanced" tab. You can change this behaviour for individual VMs: in Qubes VM Manager open VM Settings for the VM in question and go to the "Advanced" tab.
Here you can edit the "NetVM for DispVM" setting to change the NetVM of any DispVM launched from that VM. Here you can edit the "NetVM for DisposableVM" setting to change the NetVM of any DisposableVM launched from that VM.
A Disposable VM launched from the Start Menu inherits the NetVM of the [DVM Template](/doc/glossary/#dvm-template). A DisposableVM launched from the Start Menu inherits the NetVM of the [DVM Template](/doc/glossary/#dvm-template).
By default the DVM template is called `fedora-XX-dvm` (where `XX` is the Fedora version of the default TemplateVM). By default the DVM template is called `fedora-XX-dvm` (where `XX` is the Fedora version of the default TemplateVM).
As an "internal" VM it is hidden in Qubes VM Manager, but can be shown by selecting "Show/Hide internal VMs". As an "internal" VM it is hidden in Qubes VM Manager, but can be shown by selecting "Show/Hide internal VMs".
Note that changing the "NetVM for DispVM" setting for the DVM Template does *not* affect the NetVM of DispVMs launched from the Start Menu; only changing the DVM Template's own NetVM does. Note that changing the "NetVM for DisposableVM" setting for the DVM Template does *not* affect the NetVM of DisposableVMs launched from the Start Menu; only changing the DVM Template's own NetVM does.
Opening a file in a Disposable VM via GUI Opening a file in a DisposableVM via GUI
----------------------------------------- -----------------------------------------
In an AppVM's file manager, right click on the file you wish to open in a Disposable VM, then choose "Open in Disposable VM". In an AppVM's file manager, right click on the file you wish to open in a DisposableVM, then choose "Open in DisposableVM".
Wait a few seconds and the default application for this file type should appear displaying the file content. Wait a few seconds and the default application for this file type should appear displaying the file content.
This app is running in its own dedicated VM -- a Disposable VM created for the purpose of viewing or editing this very file. This app is running in its own dedicated VM -- a DisposableVM created for the purpose of viewing or editing this very file.
Once you close the viewing application the whole Disposable VM will be destroyed. Once you close the viewing application the whole DisposableVM will be destroyed.
If you have edited the file and saved the changes, the changed file will be saved back to the original AppVM, overwriting the original. If you have edited the file and saved the changes, the changed file will be saved back to the original AppVM, overwriting the original.
![r1-open-in-dispvm-1.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-1.png) ![r1-open-in-dispvm-2.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-2.png) ![r1-open-in-dispvm-1.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-1.png) ![r1-open-in-dispvm-2.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-2.png)
Opening a fresh web browser instance in a new Disposable VM Opening a fresh web browser instance in a new DisposableVM
----------------------------------------------------------- -----------------------------------------------------------
Sometimes it is desirable to open an instance of Firefox within a new fresh Disposable VM. Sometimes it is desirable to open an instance of Firefox within a new fresh DisposableVM.
This can be done easily using the Start Menu: just go to **Application Menu -\> DisposableVM -\> DispVM:Firefox web browser**. This can be done easily using the Start Menu: just go to **Application Menu -\> DisposableVM -\> DisposableVM:Firefox web browser**.
Wait a few seconds until a web browser starts. Wait a few seconds until a web browser starts.
Once you close the viewing application the whole Disposable VM will be destroyed. Once you close the viewing application the whole DisposableVM will be destroyed.
![r1-open-in-dispvm-3.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-3.png) ![r1-open-in-dispvm-3.png](/attachment/wiki/DisposableVms/r1-open-in-dispvm-3.png)
Opening a file in a Disposable VM via command line (from AppVM) Opening a file in a DisposableVM via command line (from AppVM)
--------------------------------------------------------------- ---------------------------------------------------------------
Use the `qvm-open-in-dvm` command from a terminal in your AppVM: Use the `qvm-open-in-dvm` command from a terminal in your AppVM:
@ -131,24 +132,24 @@ Use the `qvm-open-in-dvm` command from a terminal in your AppVM:
[user@work-pub ~]$ qvm-open-in-dvm Downloads/apple-sandbox.pdf [user@work-pub ~]$ qvm-open-in-dvm Downloads/apple-sandbox.pdf
~~~ ~~~
Note that the `qvm-open-in-dvm` process will not exit until you close the application in the Disposable VM. Note that the `qvm-open-in-dvm` process will not exit until you close the application in the DisposableVM.
Starting an arbitrary program in a Disposable VM from an AppVM Starting an arbitrary program in a DisposableVM from an AppVM
-------------------------------------------------------------- --------------------------------------------------------------
Sometimes it can be useful to start an arbitrary program in a DispVM. This can be done from an AppVM by running Sometimes it can be useful to start an arbitrary program in a DisposableVM. This can be done from an AppVM by running
~~~ ~~~
[user@vault ~]$ qvm-run '$dispvm' xterm [user@vault ~]$ qvm-run '$dispvm' xterm
~~~ ~~~
The created Disposable VM can be accessed via other tools (such as `qvm-copy-to-vm`) using its `disp####` name as shown in the Qubes Manager or `qvm-ls`. The created DisposableVM can be accessed via other tools (such as `qvm-copy-to-vm`) using its `disp####` name as shown in the Qubes Manager or `qvm-ls`.
Starting an arbitrary application in a Disposable VM via command line (from Dom0) Starting an arbitrary application in a DisposableVM via command line (from Dom0)
--------------------------------------------------------------------------------- ---------------------------------------------------------------------------------
The Start Menu has shortcuts for opening a terminal and a web browser in dedicated DispVMs, since these are very common tasks. The Start Menu has shortcuts for opening a terminal and a web browser in dedicated DisposableVMs, since these are very common tasks.
However, it is possible to start an arbitrary application in a DispVM directly from Dom0 by running However, it is possible to start an arbitrary application in a DisposableVM directly from Dom0 by running
R4.0 (border colour will be inherited from that set in the `dispvm-template`) R4.0 (border colour will be inherited from that set in the `dispvm-template`)
~~~ ~~~
@ -160,14 +161,14 @@ R3.2 (border colour can be specified in the command)
[joanna@dom0 ~]$ echo xterm | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red [joanna@dom0 ~]$ echo xterm | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red
~~~ ~~~
(The Disposable VM appmenu used for starting Firefox runs a very similar command to the one above.) (The DisposableVM appmenu used for starting Firefox runs a very similar command to the one above.)
Customizing Disposable VMs Customizing DisposableVMs
-------------------------- --------------------------
You can change the template used to generate the Disposable VMs, and change settings used in the Disposable VM savefile. You can change the template used to generate the DisposableVMs, and change settings used in the DisposableVM savefile.
These changes will be reflected in every new Disposable VM based on that template. These changes will be reflected in every new DisposableVM based on that template.
Full instructions can be found [here](/doc/dispvm-customization/). Full instructions can be found [here](/doc/disposablevm-customization/).
[DVM Template]: /doc/glossary/#dvm-template [DVM Template]: /doc/glossary/#dvm-template

View File

@ -76,7 +76,7 @@ If you only want to create a shortcut for a single AppVM, you can create a custo
What about applications in DispVMs? What about applications in DispVMs?
----------------------------------- -----------------------------------
[See here](/doc/dispvm-customization/#adding-arbitrary-programs-to-disposable-vm-application-menu). [See here](/doc/disposablevm-customization/#adding-arbitrary-programs-to-disposablevm-application-menu).
Behind the scenes Behind the scenes
----------------- -----------------

View File

@ -327,7 +327,7 @@ But, of course, the problem of finding malware hooks in general is hard, so this
Also note that the user filesystem's metadata might got maliciously modified by malware in order to exploit a hypothetical bug in the AppVM kernel whenever it mounts the malformed filesystem. Also note that the user filesystem's metadata might got maliciously modified by malware in order to exploit a hypothetical bug in the AppVM kernel whenever it mounts the malformed filesystem.
However, these exploits will automatically stop working (and so the infection might be cleared automatically) after the hypothetical bug got patched and the update applied (via template update), which is an exceptional feature of Qubes OS. However, these exploits will automatically stop working (and so the infection might be cleared automatically) after the hypothetical bug got patched and the update applied (via template update), which is an exceptional feature of Qubes OS.
Also note that Disposable VMs do not have persistent user filesystem, and so they start up completely "clean" every time. Also note that DisposableVMs do not have persistent user filesystem, and so they start up completely "clean" every time.
Note the word "clean" means in this context: the same as their template filesystem, of course. Note the word "clean" means in this context: the same as their template filesystem, of course.
RPMFusion for a Fedora TemplateVM RPMFusion for a Fedora TemplateVM

View File

@ -30,7 +30,7 @@ As a result, installation of such third-party RPMs in a default template VM expo
(Again, it's not buggy or malicious drivers that we fear here, but rather malicious installation scripts for those drivers). (Again, it's not buggy or malicious drivers that we fear here, but rather malicious installation scripts for those drivers).
In order to mitigate this risk, one might consider creating a custom template (i.e. clone the original template) and then install the third-party, unverified drivers there. In order to mitigate this risk, one might consider creating a custom template (i.e. clone the original template) and then install the third-party, unverified drivers there.
Such template might then be made a DVM template for [Disposable VM creation](/doc/dispvm/), which should allow one to print any document by right-clicking on it, choosing "Open in Disposable VM" and print from there. Such template might then be made a DVM template for [DisposableVM creation](/doc/disposablevm/), which should allow one to print any document by right-clicking on it, choosing "Open in DisposableVM" and print from there.
This would allow to print documents from more trusted AppVMs (based on a trusted default template that is not poisoned by third-party printer drivers). This would allow to print documents from more trusted AppVMs (based on a trusted default template that is not poisoned by third-party printer drivers).
However, one should be aware that most (all?) network printing protocols are insecure, unencrypted protocols. However, one should be aware that most (all?) network printing protocols are insecure, unencrypted protocols.

View File

@ -428,7 +428,7 @@ Vault AppVM with no NetVM enabled.
#### `qvm.default-dispvm` #### `qvm.default-dispvm`
Default Disposable VM template - fedora-26-dvm AppVM Default DisposableVM template - fedora-26-dvm AppVM
#### `qvm.anon-whonix` #### `qvm.anon-whonix`
@ -436,7 +436,7 @@ Whonix workstation AppVM.
#### `qvm.whonix-ws-dvm` #### `qvm.whonix-ws-dvm`
Whonix workstation AppVM for Whonix Disposable VMs. Whonix workstation AppVM for Whonix DisposableVMs.
#### `qvm.updates-via-whonix` #### `qvm.updates-via-whonix`

View File

@ -1,15 +1,16 @@
--- ---
layout: doc layout: doc
title: Disposable VM Customization title: DisposableVM Customization
permalink: /doc/dispvm-customization/ permalink: /doc/disposablevm-customization/
redirect_from: redirect_from:
- /doc/dispvm-customization/
- /en/doc/dispvm-customization/ - /en/doc/dispvm-customization/
- /doc/DispVMCustomization/ - /doc/DispVMCustomization/
- /doc/UserDoc/DispVMCustomization/ - /doc/UserDoc/DispVMCustomization/
- /wiki/UserDoc/DispVMCustomization/ - /wiki/UserDoc/DispVMCustomization/
--- ---
Disposable VM Customization DisposableVM Customization
============================ ============================
Security Security
@ -17,24 +18,24 @@ Security
If a DVM Template becomes compromised, then any DisposableVM based on that DVM Template could be compromised. If a DVM Template becomes compromised, then any DisposableVM based on that DVM Template could be compromised.
Therefore, you should not make any risky customizations (e.g., installing untrusted browser plugins) in important DVM Templates. Therefore, you should not make any risky customizations (e.g., installing untrusted browser plugins) in important DVM Templates.
In particular, the *default* DVM Template is important becuase it is used by the "Open in DispVM" feature. In particular, the *default* DVM Template is important becuase it is used by the "Open in DisposableVM" feature.
This means that it will have access to everything that you open with this feature. This means that it will have access to everything that you open with this feature.
For this reason, it is strongly recommended that you base the default DVM Template on a trusted TemplateVM and refrain from making any risky customizations to it. For this reason, it is strongly recommended that you base the default DVM Template on a trusted TemplateVM and refrain from making any risky customizations to it.
Qubes 4.0 Qubes 4.0
---------- ----------
Disposable VM (DispVM) in Qubes 4.0 can be based on any TemplateBasedVM. You can also choose to use different AppVMs for different Disposable VMs. To prepare AppVM to be a base for Disposable VM, you need to set `template_for_dispvms` property, for example: A DisposableVM (previously known as a "DispVM") in Qubes 4.0 can be based on any TemplateBasedVM. You can also choose to use different AppVMs for different DisposableVMs. To prepare AppVM to be a base for DisposableVM, you need to set `template_for_dispvms` property, for example:
[user@dom0 ~]$ qvm-prefs fedora-26-dvm template_for_dispvms True [user@dom0 ~]$ qvm-prefs fedora-26-dvm template_for_dispvms True
Additionally, if you want to have menu entries for starting applications in Disposable VM based on this AppVM (instead of in the AppVM itself), you can achieve it with `appmenus-dispvm` feature: Additionally, if you want to have menu entries for starting applications in DisposableVM based on this AppVM (instead of in the AppVM itself), you can achieve it with `appmenus-dispvm` feature:
[user@dom0 ~]$ qvm-features fedora-26-dvm appmenus-dispvm 1 [user@dom0 ~]$ qvm-features fedora-26-dvm appmenus-dispvm 1
### Creating new Disposable VM base AppVM ### ### Creating new DisposableVM base AppVM ###
In Qubes 4.0, you're no longer restricted to a single DVM Template. Instead, you can create as many as you want. Whenever you start a new Disposable VM, you can choose to base it on whichever DVM Template you like. In Qubes 4.0, you're no longer restricted to a single DVM Template. Instead, you can create as many as you want. Whenever you start a new DisposableVM, you can choose to base it on whichever DVM Template you like.
To create new DVM Template, lets say `custom-dvm`, based on `debian-9` template, use following commands: To create new DVM Template, lets say `custom-dvm`, based on `debian-9` template, use following commands:
[user@dom0 ~]$ qvm-create --template debian-9 --label red custom-dvm [user@dom0 ~]$ qvm-create --template debian-9 --label red custom-dvm
@ -45,30 +46,30 @@ Additionally you may want to set it as default DVM Template:
[user@dom0 ~]$ qubes-prefs default_dispvm custom-dvm [user@dom0 ~]$ qubes-prefs default_dispvm custom-dvm
The above default is used whenever a qube request starting a new Disposable VM and do not specify which one (for example `qvm-open-in-dvm` tool). This can be also set in qube settings and will affect service calls from that qube. See [qrexec documentation](/doc/qrexec3/#extra-keywords-available-in-qubes-40-and-later) for details. The above default is used whenever a qube request starting a new DisposableVM and do not specify which one (for example `qvm-open-in-dvm` tool). This can be also set in qube settings and will affect service calls from that qube. See [qrexec documentation](/doc/qrexec3/#extra-keywords-available-in-qubes-40-and-later) for details.
If you wish to use the `fedora-minimal` template as a DVM Template, see the "DVM Template" use case under [fedora-minimal customization](/doc/templates/fedora-minimal/#customization). If you wish to use the `fedora-minimal` template as a DVM Template, see the "DVM Template" use case under [fedora-minimal customization](/doc/templates/fedora-minimal/#customization).
### Customization of Disposable VM ### ### Customization of DisposableVM ###
It is possible to change the settings for each new Disposable VM (DispVM). This can be done by customizing the base AppVM: It is possible to change the settings for each new DisposableVM. This can be done by customizing the base AppVM:
1. Start a terminal in the `fedora-26-dvm` qube (or another base for DispVM) by running the following command in a dom0 terminal. (If you enable `appmenus-dispvm` feature (as explained at the top), applications menu for this VM (`fedora-26-dvm`) will be "Disposable: fedora-26-dvm" (instead of "Domain: fedora-26-dvm") and entries there will start new DispVM based on that VM (`fedora-26-dvm`). Not in that VM (`fedora-26-dvm`) itself). 1. Start a terminal in the `fedora-26-dvm` qube (or another base for DisposableVM) by running the following command in a dom0 terminal. (If you enable `appmenus-dispvm` feature (as explained at the top), applications menu for this VM (`fedora-26-dvm`) will be "Disposable: fedora-26-dvm" (instead of "Domain: fedora-26-dvm") and entries there will start new DisposableVM based on that VM (`fedora-26-dvm`). Not in that VM (`fedora-26-dvm`) itself).
[user@dom0 ~]$ qvm-run -a fedora-26-dvm gnome-terminal [user@dom0 ~]$ qvm-run -a fedora-26-dvm gnome-terminal
2. Change the qube's settings and/or applications, as desired. Some examples of changes you may want to make include: 2. Change the qube's settings and/or applications, as desired. Some examples of changes you may want to make include:
- Changing Firefox's default startup settings and homepage. - Changing Firefox's default startup settings and homepage.
- Changing default editor, image viewer. - Changing default editor, image viewer.
- Changing the DispVM's default NetVM. For example, you may wish to set the NetVM to "none." Then, whenever you start a new DispVM, you can choose your desired ProxyVM manually (by changing the newly-started DispVMs settings). This is useful if you sometimes wish to use a DispVM with a Whonix Gateway, for example. It is also useful if you sometimes wish to open untrusted files in a network-disconnected DispVM. - Changing the DisposableVM's default NetVM. For example, you may wish to set the NetVM to "none." Then, whenever you start a new DisposableVM, you can choose your desired ProxyVM manually (by changing the newly-started DisposableVMs settings). This is useful if you sometimes wish to use a DisposableVM with a Whonix Gateway, for example. It is also useful if you sometimes wish to open untrusted files in a network-disconnected DisposableVM.
4. Shutdown the qube (either by `poweroff` from qube's terminal, or `qvm-shutdown` from dom0 terminal). 4. Shutdown the qube (either by `poweroff` from qube's terminal, or `qvm-shutdown` from dom0 terminal).
### Using static Disposable VMs for sys-* ### ### Using static DisposableVMs for sys-* ###
You can use a static DispVM for `sys-*` as long as it is stateless. You can use a static DisposableVM for `sys-*` as long as it is stateless.
For example, a `sys-net` using DHCP or `sys-usb` will work. For example, a `sys-net` using DHCP or `sys-usb` will work.
In most cases `sys-firewall` will also work, even if you have configured AppVM firewall rules. In most cases `sys-firewall` will also work, even if you have configured AppVM firewall rules.
The only exception is if you require something like VM to VM communication and have manually edited `iptables` or other items directly inside the firewall AppVM. The only exception is if you require something like VM to VM communication and have manually edited `iptables` or other items directly inside the firewall AppVM.
@ -97,7 +98,7 @@ qvm-service <sys-VMName> meminfo-writer off
qvm-pci attach --persistent <sys-VMName> dom0:<BDF> qvm-pci attach --persistent <sys-VMName> dom0:<BDF>
qvm-prefs <sys-VMName> autostart true qvm-prefs <sys-VMName> autostart true
qvm-prefs <sys-VMName> netvm '' qvm-prefs <sys-VMName> netvm ''
# optional, if this DispVM will be providing networking # optional, if this DisposableVM will be providing networking
qvm-prefs <sys-VMName> provides_network true qvm-prefs <sys-VMName> provides_network true
~~~ ~~~
@ -118,31 +119,31 @@ qvm-prefs sys-firewall netvm sys-net2
qubes-prefs clockvm sys-net2 qubes-prefs clockvm sys-net2
~~~ ~~~
Note that these types of DispVMs will not show in the Application menu, but you can still get to a terminal if needed with `qvm-run <sys-VMName> gnome-terminal`. Note that these types of DisposableVMs will not show in the Application menu, but you can still get to a terminal if needed with `qvm-run <sys-VMName> gnome-terminal`.
### Adding programs to Disposable VM Application Menu ### ### Adding programs to DisposableVM Application Menu ###
For added convenience, arbitrary programs can be added to the Application Menu of the Disposable VM. For added convenience, arbitrary programs can be added to the Application Menu of the DisposableVM.
In order to do that, select "Qube settings" entry in selected base AppVM, go to "Applications" tab and select desired applications as for any other qube. In order to do that, select "Qube settings" entry in selected base AppVM, go to "Applications" tab and select desired applications as for any other qube.
Note that currently only applications whose main process keeps running until you close the application (i.e. do not start a background process instead) will work. One of known examples of incompatible applications is GNOME Terminal (shown on the list as "Terminal"). Choose different terminal emulator (like XTerm) instead. Note that currently only applications whose main process keeps running until you close the application (i.e. do not start a background process instead) will work. One of known examples of incompatible applications is GNOME Terminal (shown on the list as "Terminal"). Choose different terminal emulator (like XTerm) instead.
### Create Custom sys-net sys-firewall and sys-usb DispVMs ### ### Create Custom sys-net sys-firewall and sys-usb DisposableVMs ###
Users have the option of creating customized DispVMs for the `sys-net`, `sys-firewall` and `sys-usb` VMs. In this configuration, a fresh VM instance is created each time a DispVM is launched. Functionality is near-identical to the default VMs created following a new Qubes installation, except the user benefits from a non-persistent filesystem. Users have the option of creating customized DisposableVMs for the `sys-net`, `sys-firewall` and `sys-usb` VMs. In this configuration, a fresh VM instance is created each time a DisposableVM is launched. Functionality is near-identical to the default VMs created following a new Qubes installation, except the user benefits from a non-persistent filesystem.
Functionality is not limited, users can: Functionality is not limited, users can:
* Set custom firewall rule sets and run Qubes VPN scripts. * Set custom firewall rule sets and run Qubes VPN scripts.
* Set DispVMs to autostart at system boot. * Set DisposableVMs to autostart at system boot.
* Attach PCI devices with the `--persistent` option. * Attach PCI devices with the `--persistent` option.
Using DispVMs in this manner is ideal for untrusted qubes which require persistent PCI devices, such as USB VMs and NetVMs. Using DisposableVMs in this manner is ideal for untrusted qubes which require persistent PCI devices, such as USB VMs and NetVMs.
>_**Note:**_ Users who want customized VPN or firewall rule sets must create a separate dvm for use by each DispVM. If dvm customization is not needed, then a single dvm is used as a template for all DispVMs. >_**Note:**_ Users who want customized VPN or firewall rule sets must create a separate dvm for use by each DisposableVM. If dvm customization is not needed, then a single dvm is used as a template for all DisposableVMs.
#### Create and configure the dvm from which the DispVM will be based on #### #### Create and configure the dvm from which the DisposableVM will be based on ####
1. Create the dvm 1. Create the dvm
@ -152,13 +153,13 @@ Using DispVMs in this manner is ideal for untrusted qubes which require persiste
Firewall rules sets and Qubes VPN scripts can be added just like any other VM Firewall rules sets and Qubes VPN scripts can be added just like any other VM
3. Set the dvm as template for DispVMs 3. Set the dvm as template for DisposableVMs
[user@dom0 ~]$ qvm-prefs <dvm_name> template_for_dispvms true [user@dom0 ~]$ qvm-prefs <dvm_name> template_for_dispvms true
#### Create the sys-net DispVM #### #### Create the sys-net DisposableVM ####
1. Create `sys-net` DispVM based on the dvm 1. Create `sys-net` DisposableVM based on the dvm
[user@dom0 ~]$ qvm-create --template <dvm_name> --class DispVM --label red disp-sys-net [user@dom0 ~]$ qvm-create --template <dvm_name> --class DispVM --label red disp-sys-net
@ -190,9 +191,9 @@ Using DispVMs in this manner is ideal for untrusted qubes which require persiste
[user@dom0 ~]$ qubes-prefs clockvm disp-sys-net [user@dom0 ~]$ qubes-prefs clockvm disp-sys-net
#### Create the sys-firewall DispVM #### #### Create the sys-firewall DisposableVM ####
1. Create `sys-firewall` DispVM 1. Create `sys-firewall` DisposableVM
[user@dom0 ~]$ qvm-create --template <dvm_name> --class DispVM --label green disp-sys-firewall [user@dom0 ~]$ qvm-create --template <dvm_name> --class DispVM --label green disp-sys-firewall
@ -216,7 +217,7 @@ Using DispVMs in this manner is ideal for untrusted qubes which require persiste
[user@dom0 ~]$ qubes-prefs default_netvm disp-sys-firewall [user@dom0 ~]$ qubes-prefs default_netvm disp-sys-firewall
#### Create the sys-usb DispVM #### #### Create the sys-usb DisposableVM ####
1. Create the `disp-sys-usb` 1. Create the `disp-sys-usb`
@ -247,9 +248,9 @@ Using DispVMs in this manner is ideal for untrusted qubes which require persiste
7. Users should now follow instructions on [How to hide USB controllers from dom0](/doc/usb/#how-to-hide-all-usb-controllers-from-dom0) 7. Users should now follow instructions on [How to hide USB controllers from dom0](/doc/usb/#how-to-hide-all-usb-controllers-from-dom0)
#### Starting the DispVMs #### #### Starting the DisposableVMs ####
Prior to starting the new VMs, users should ensure that no other VMs such as the old `sys-net` and `sys-usb` VMs are running. This is because no two VMs can share the same PCI device while both running. It is recommended that users detach the PCI devices from the old VMs without deleting them. This will allow users to reattach the PCI devices if the newly created DispVMs fail to start. Prior to starting the new VMs, users should ensure that no other VMs such as the old `sys-net` and `sys-usb` VMs are running. This is because no two VMs can share the same PCI device while both running. It is recommended that users detach the PCI devices from the old VMs without deleting them. This will allow users to reattach the PCI devices if the newly created DisposableVMs fail to start.
Detach PCI device from VM Detach PCI device from VM
@ -263,7 +264,7 @@ The `disp-sys-usb` VM does not start
If the `disp-sys-usb` does not start, it could be due to a PCI passthrough problem. For more details on this issue along with possible solutions, users can look [here](/doc/assigning-devices/#pci-passthrough-issues) If the `disp-sys-usb` does not start, it could be due to a PCI passthrough problem. For more details on this issue along with possible solutions, users can look [here](/doc/assigning-devices/#pci-passthrough-issues)
### Deleting Disposable VM ### ### Deleting DisposableVM ###
Deleting disposable VM is slightly peculiar. While working in a VM or disposable VM, you may want to open a document in another disposable VM. For this reason, the property `default_dispvm` may be set to the name of your disposable VM in a number of VMs: Deleting disposable VM is slightly peculiar. While working in a VM or disposable VM, you may want to open a document in another disposable VM. For this reason, the property `default_dispvm` may be set to the name of your disposable VM in a number of VMs:
@ -291,15 +292,15 @@ Qubes 3.2
You may want to use a non-default template the [DVM Template](/doc/glossary/#dvm-template). One example is to use a less-trusted template with some less trusted, third-party, often unsigned, applications installed, such as e.g. third-party printer drivers. You may want to use a non-default template the [DVM Template](/doc/glossary/#dvm-template). One example is to use a less-trusted template with some less trusted, third-party, often unsigned, applications installed, such as e.g. third-party printer drivers.
In order to regenerate the Disposable VM "snapshot" (called 'savefile' on Qubes) one can use the following command in Dom0: In order to regenerate the DisposableVM "snapshot" (called 'savefile' on Qubes) one can use the following command in Dom0:
[user@dom0 ~]$ qvm-create-default-dvm <custom-template-name> [user@dom0 ~]$ qvm-create-default-dvm <custom-template-name>
This would create a new Disposable VM savefile based on the custom template. This would create a new DisposableVM savefile based on the custom template.
For example `<custom-template-name>` could be the name of the existing `debian-8` vm, which creates the disposable vm `debain-8-dvm`. For example `<custom-template-name>` could be the name of the existing `debian-8` vm, which creates the disposable vm `debain-8-dvm`.
Now, whenever one opens a file (from any AppVM) in a Disposable VM, a Disposable VM based on this template will be used. Now, whenever one opens a file (from any AppVM) in a DisposableVM, a DisposableVM based on this template will be used.
One can easily verify if the new Disposable VM template is indeed based on a custom template (in the example below the template called "f17-yellow" was used as a basis for the Disposable VM): One can easily verify if the new DisposableVM template is indeed based on a custom template (in the example below the template called "f17-yellow" was used as a basis for the DisposableVM):
[user@dom0 ~]$ ll /var/lib/qubes/dvmdata/ [user@dom0 ~]$ ll /var/lib/qubes/dvmdata/
@ -311,19 +312,19 @@ One can easily verify if the new Disposable VM template is indeed based on a cus
If you wish to use the `fedora-minimal` template as a DVM Template, see the "DVM Template" use case under [fedora-minimal customization](/doc/templates/fedora-minimal/#customization). If you wish to use the `fedora-minimal` template as a DVM Template, see the "DVM Template" use case under [fedora-minimal customization](/doc/templates/fedora-minimal/#customization).
### Customization of Disposable VM ### ### Customization of DisposableVM ###
It is possible to change the settings of each new Disposable VM (DispVM). This can be done by customizing the DispVM template: It is possible to change the settings of each new DisposableVM. This can be done by customizing the DVM Template:
1. Start a terminal in the `fedora-23-dvm` TemplateVM by running the following command in a dom0 terminal. (By default, this TemplateVM is not shown in Qubes VM Manager. However, it can be shown by selecting "Show/Hide internal VMs.") 1. Start a terminal in the `fedora-23-dvm` TemplateVM by running the following command in a dom0 terminal. (By default, this TemplateVM is not shown in Qubes VM Manager. However, it can be shown by selecting "Show/Hide internal VMs.")
[user@dom0 ~]$ qvm-run -a fedora-23-dvm gnome-terminal [user@dom0 ~]$ qvm-run -a fedora-23-dvm gnome-terminal
2. Change the VM's settings and/or applications, as desired. Note that currently Qubes supports exactly one DispVM template, so any changes you make here will affect all DispVMs. Some examples of changes you may want to make include: 2. Change the VM's settings and/or applications, as desired. Note that currently Qubes supports exactly one DVM Template, so any changes you make here will affect all DisposableVMs. Some examples of changes you may want to make include:
- Changing Firefox's default startup settings and homepage. - Changing Firefox's default startup settings and homepage.
- Changing Nautilus' default file preview settings. - Changing Nautilus' default file preview settings.
- Changing the DispVM's default NetVM. For example, you may wish to set the NetVM to "none." Then, whenever you start a new DispVM, you can choose your desired ProxyVM manually (by changing the newly-started DispVM's settings). This is useful if you sometimes wish to use a DispVM with a Whonix Gateway, for example. It is also useful if you sometimes wish to open untrusted files in a network-disconnected DispVM. - Changing the DisposableVM's default NetVM. For example, you may wish to set the NetVM to "none." Then, whenever you start a new DisposableVM, you can choose your desired ProxyVM manually (by changing the newly-started DisposableVM's settings). This is useful if you sometimes wish to use a DisposableVM with a Whonix Gateway, for example. It is also useful if you sometimes wish to open untrusted files in a network-disconnected DisposableVM.
3. Create an empty `/home/user/.qubes-dispvm-customized` file in the VM (not in dom0): 3. Create an empty `/home/user/.qubes-dispvm-customized` file in the VM (not in dom0):
@ -331,11 +332,11 @@ It is possible to change the settings of each new Disposable VM (DispVM). This c
[user@fedora-23-dvm ~]$ touch /home/user/.qubes-dispvm-customized [user@fedora-23-dvm ~]$ touch /home/user/.qubes-dispvm-customized
4. Shutdown the VM (either by `poweroff` from VM terminal, or `qvm-shutdown` from dom0 terminal). 4. Shutdown the VM (either by `poweroff` from VM terminal, or `qvm-shutdown` from dom0 terminal).
5. Regenerate the DispVM template using the default template: 5. Regenerate the DVM Template using the default template:
[user@dom0 ~]$ qvm-create-default-dvm --default-template [user@dom0 ~]$ qvm-create-default-dvm --default-template
Or, if you're [using a non-default template](#changing-the-dvm-template), regenerate the DispVM using your custom template: Or, if you're [using a non-default template](#changing-the-dvm-template), regenerate the DVM Template using your custom template:
[user@dom0 ~]$ qvm-create-default-dvm <custom-template-name> [user@dom0 ~]$ qvm-create-default-dvm <custom-template-name>
@ -343,9 +344,9 @@ It is possible to change the settings of each new Disposable VM (DispVM). This c
**Note:** All of the above requires at least qubes-core-vm \>= 2.1.2 installed in template. **Note:** All of the above requires at least qubes-core-vm \>= 2.1.2 installed in template.
### Adding arbitrary programs to Disposable VM Application Menu ### ### Adding arbitrary programs to DisposableVM Application Menu ###
For added convenience, arbitrary programs can be added to the Application Menu of the Disposable VM. In order to do that create (e.g.) `arbitrary.desktop` file in `/usr/local/share/applications` in Dom0. That file will point to the desired program. Use the following template for the file: For added convenience, arbitrary programs can be added to the Application Menu of the DisposableVM. In order to do that create (e.g.) `arbitrary.desktop` file in `/usr/local/share/applications` in Dom0. That file will point to the desired program. Use the following template for the file:
[Desktop Entry] [Desktop Entry]
Version=1.0 Version=1.0
@ -368,4 +369,4 @@ Add a `<Filename>arbitrary.desktop</Filename>` line so that your modified file l
<Filename>arbitrary.desktop</Filename> <Filename>arbitrary.desktop</Filename>
</Include> </Include>
After saving the changes the new shortcut should appear in the Disposable VM Applications menu. After saving the changes the new shortcut should appear in the DisposableVM Applications menu.

4
doc.md
View File

@ -66,7 +66,7 @@ Common Tasks
* [Installing and Updating Software in dom0](/doc/software-update-dom0/) * [Installing and Updating Software in dom0](/doc/software-update-dom0/)
* [Installing and Updating Software in VMs](/doc/software-update-vm/) * [Installing and Updating Software in VMs](/doc/software-update-vm/)
* [Backup, Restoration, and Migration](/doc/backup-restore/) * [Backup, Restoration, and Migration](/doc/backup-restore/)
* [Using Disposable VMs](/doc/dispvm/) * [Using DisposableVMs](/doc/disposablevm/)
* [Using and Managing USB Devices](/doc/usb/) * [Using and Managing USB Devices](/doc/usb/)
* [Recording Optical Discs](/doc/recording-optical-discs/) * [Recording Optical Discs](/doc/recording-optical-discs/)
* [Managing Application Shortcuts](/doc/managing-appvm-shortcuts/) * [Managing Application Shortcuts](/doc/managing-appvm-shortcuts/)
@ -249,7 +249,7 @@ Services
* [Inter-domain file copying](/doc/qfilecopy/) (deprecates [`qfileexchgd`](/doc/qfileexchgd/)) * [Inter-domain file copying](/doc/qfilecopy/) (deprecates [`qfileexchgd`](/doc/qfileexchgd/))
* [Dynamic memory management in Qubes](/doc/qmemman/) * [Dynamic memory management in Qubes](/doc/qmemman/)
* [Implementation of DisposableVMs](/doc/dvm-impl/) * [Implementation of DisposableVMs](/doc/dvm-impl/)
* [Article about disposable VMs](http://theinvisiblethings.blogspot.com/2010/06/disposable-vms.html) * [Article about DisposableVMs](http://theinvisiblethings.blogspot.com/2010/06/disposable-vms.html)
* [Dom0 secure update mechanism](/doc/dom0-secure-updates/) * [Dom0 secure update mechanism](/doc/dom0-secure-updates/)
Debugging Debugging

View File

@ -140,7 +140,7 @@ Important Notes (R4.0)
(1) Upon creation (1) Upon creation
(2) Following shutdown (2) Following shutdown
(3) Including [DVM Templates](/doc/dispvm/#disposable-vms-and-networking-r40-and-later) (3) Including [DVM Templates](/doc/disposablevm/#disposablevms-and-networking-r40-and-later)
Important Notes (R3.2 and earlier) Important Notes (R3.2 and earlier)
--------------- ---------------

View File

@ -235,4 +235,4 @@ In this case, you have several options:
[resize-disk-image]: /doc/resize-disk-image/ [resize-disk-image]: /doc/resize-disk-image/
[Additional Information]: #additional-information [Additional Information]: #additional-information
[Compacting the Upgraded Template]: #compacting-the-upgraded-template [Compacting the Upgraded Template]: #compacting-the-upgraded-template
[DispVM]: /doc/dispvm/ [DispVM]: /doc/disposablevm/

View File

@ -238,4 +238,4 @@ In this case, you have several options:
[resize-disk-image]: /doc/resize-disk-image/ [resize-disk-image]: /doc/resize-disk-image/
[Additional Information]: #additional-information [Additional Information]: #additional-information
[Compacting the Upgraded Template]: #compacting-the-upgraded-template [Compacting the Upgraded Template]: #compacting-the-upgraded-template
[DispVM]: /doc/dispvm/ [DispVM]: /doc/disposablevm/

View File

@ -382,5 +382,5 @@ In this case, you have several options:
[resize-disk-image]: /doc/resize-disk-image/ [resize-disk-image]: /doc/resize-disk-image/
[Additional Information]: #additional-information [Additional Information]: #additional-information
[Compacting the Upgraded Template]: #compacting-the-upgraded-template [Compacting the Upgraded Template]: #compacting-the-upgraded-template
[DispVM]: /doc/dispvm/ [DispVM]: /doc/disposablevm/

View File

@ -358,5 +358,5 @@ In this case, you have several options:
[Compacting the Upgraded Template]: #compacting-the-upgraded-template [Compacting the Upgraded Template]: #compacting-the-upgraded-template
[switching-3.2]: /doc/templates/#how-to-switch-templates-32 [switching-3.2]: /doc/templates/#how-to-switch-templates-32
[switching-4.0]: /doc/templates/#how-to-switch-templates-40 [switching-4.0]: /doc/templates/#how-to-switch-templates-40
[DispVM]: /doc/dispvm/ [DispVM]: /doc/disposablevm/

View File

@ -385,5 +385,5 @@ In this case, you have several options:
[Compacting the Upgraded Template]: #compacting-the-upgraded-template [Compacting the Upgraded Template]: #compacting-the-upgraded-template
[switching-3.2]: /doc/templates/#how-to-switch-templates-32 [switching-3.2]: /doc/templates/#how-to-switch-templates-32
[switching-4.0]: /doc/templates/#how-to-switch-templates-40 [switching-4.0]: /doc/templates/#how-to-switch-templates-40
[DispVM]: /doc/dispvm/ [DispVM]: /doc/disposablevm/

View File

@ -111,28 +111,32 @@ Firewall Virtual Machine.
A type of [ProxyVM](#proxyvm) that is used to enforce network-level policies (a.k.a. "firewall rules"). A type of [ProxyVM](#proxyvm) that is used to enforce network-level policies (a.k.a. "firewall rules").
A FirewallVM called `sys-firewall` is created by default in most Qubes installations. A FirewallVM called `sys-firewall` is created by default in most Qubes installations.
DisposableVM
------------
[Disposable Virtual Machine]. A temporary [AppVM](#appvm) based on a [DVM Template](#dvm-template) that can quickly be created, used, and destroyed.
DispVM DispVM
------ ------
[Disposable Virtual Machine]. A temporary [AppVM](#appvm) based on a [DVM Template](#dvm-template) that can quickly be created, used, and destroyed. An older term for [DisposableVM](#disposablevm).
DVM DVM
--- ---
An abbreviation of [DispVM](#dispvm), typically used to refer to [DVM Templates](#dvm-template). An abbreviation of [DisposableVM](#disposablevm), typically used to refer to [DVM Templates](#dvm-template).
DVM Template DVM Template
------------ ------------
A type of [TemplateBasedVM](#templatebasedvm) on which [DispVMs](#dispvm) are based. A type of [TemplateBasedVM](#templatebasedvm) on which [DisposableVMs](#disposablevm) are based.
By default, a DVM Template named `fedora-XX-dvm` is created on most Qubes installations (where `XX` is the Fedora version of the default TemplateVM). By default, a DVM Template named `fedora-XX-dvm` is created on most Qubes installations (where `XX` is the Fedora version of the default TemplateVM).
DVM Templates are not [TemplateVMs](#templatevm), since (being TemplateBasedVMs) they do not have root filesystems of their own to provide to other VMs. DVM Templates are not [TemplateVMs](#templatevm), since (being TemplateBasedVMs) they do not have root filesystems of their own to provide to other VMs.
Rather, DVM Templates are complementary to TemplateVMs insofar as DVM Templates provide their own user filesystems to the DispVMs based on them. Rather, DVM Templates are complementary to TemplateVMs insofar as DVM Templates provide their own user filesystems to the DisposableVMs based on them.
There are two main kinds of DVM Templates: There are two main kinds of DVM Templates:
* **Dedicated** DVM Templates are intended neither for installing nor running software. * **Dedicated** DVM Templates are intended neither for installing nor running software.
Rather, they are intended for *customizing* or *configuring* software that has already been installed on the TemplateVM on which the DVM Template is based (see [DispVM Customization]). Rather, they are intended for *customizing* or *configuring* software that has already been installed on the TemplateVM on which the DVM Template is based (see [DisposableVM Customization]).
This software is then intended to be run (in its customized state) in DispVMs that are based on the DVM Template. This software is then intended to be run (in its customized state) in DisposableVMs that are based on the DVM Template.
* **Non-dedicated** DVM Templates are typically [AppVMs](#appvm) on which DispVMs are based. * **Non-dedicated** DVM Templates are typically [AppVMs](#appvm) on which DisposableVMs are based.
For example, an AppVM could be used to generate and store trusted data. For example, an AppVM could be used to generate and store trusted data.
Then, a DispVM could be created based on the AppVM (thereby making the AppVM a DVM Template) so that the data can be analyzed by an untrusted program without jeopardizing the integrity of the original data. Then, a DisposableVM could be created based on the AppVM (thereby making the AppVM a DVM Template) so that the data can be analyzed by an untrusted program without jeopardizing the integrity of the original data.
PV PV
-- --
@ -188,6 +192,6 @@ QWT
---- ----
An abbreviation of Qubes [Windows Tools](#windows-tools). An abbreviation of Qubes [Windows Tools](#windows-tools).
[Disposable Virtual Machine]: /doc/dispvm/ [Disposable Virtual Machine]: /doc/disposablevm/
[DispVM Customization]: /doc/dispvm-customization/ [DisposableVM Customization]: /doc/disposablevm-customization/

View File

@ -88,7 +88,7 @@ netvm
dispvm_netvm dispvm_netvm
Accepted values: netvm name, ``default``, ``none`` Accepted values: netvm name, ``default``, ``none``
Which NetVM should be used for Disposable VMs started by this one. Which NetVM should be used for DisposableVMs started by this one.
``default`` is to use the same NetVM as the VM itself. ``default`` is to use the same NetVM as the VM itself.
maxmem maxmem

View File

@ -44,7 +44,7 @@ OPTIONS
This argument, can contain VM name, or one of special values: This argument, can contain VM name, or one of special values:
* ``$dispvm`` - new Disposable VM * ``$dispvm`` - new DisposableVM
This field is limited to 31 characters (alphanumeric, plus ``-_.$``). This field is limited to 31 characters (alphanumeric, plus ``-_.$``).

View File

@ -43,9 +43,9 @@ OPTIONS
* ``$default`` or empty string - let Qubes RPC policy decide, without giving any preference * ``$default`` or empty string - let Qubes RPC policy decide, without giving any preference
* ``$dispvm`` - new Disposable VM * ``$dispvm`` - new DisposableVM
* ``$dispvm:dispvm-template`` - new Disposable VM based on *dispvm-template* * ``$dispvm:dispvm-template`` - new DisposableVM based on *dispvm-template*
This field is limited to 31 characters (alphanumeric, plus ``-_.$``). This field is limited to 31 characters (alphanumeric, plus ``-_.$``).

View File

@ -20,7 +20,7 @@ Known issues
- Some keyboard layout set by KDE System Settings can cause [keyboard not working at all](https://groups.google.com/group/qubes-devel/browse_thread/thread/77d076b65dda7226). If you hit this issue, you can switch to console (by console login option) and manually edit `/etc/X11/xorg.conf.d/00-system-setup-keyboard.conf` (and `/etc/sysconfig/keyboard`) and place correct keyboard layout settings (details in linked thread). You can check if specific keyboard layout settings are proper using `setxkbmap` tool. - Some keyboard layout set by KDE System Settings can cause [keyboard not working at all](https://groups.google.com/group/qubes-devel/browse_thread/thread/77d076b65dda7226). If you hit this issue, you can switch to console (by console login option) and manually edit `/etc/X11/xorg.conf.d/00-system-setup-keyboard.conf` (and `/etc/sysconfig/keyboard`) and place correct keyboard layout settings (details in linked thread). You can check if specific keyboard layout settings are proper using `setxkbmap` tool.
- On systems with more than 8GB of RAM there is problem with Disposable VM. To fix it, limit maximum memory allocation for DispVM to 3GB - On systems with more than 8GB of RAM there is problem with DisposableVM. To fix it, limit maximum memory allocation for DispVM to 3GB
~~~ ~~~
qvm-prefs -s fedora-17-x64-dvm maxmem 3072 qvm-prefs -s fedora-17-x64-dvm maxmem 3072

View File

@ -16,7 +16,7 @@ New features since 3.2
* Renaming VM directly is prohibited, there is GUI to clone under new name and remove old VM * Renaming VM directly is prohibited, there is GUI to clone under new name and remove old VM
* Use [PVH][qsb-37] and [HVM][hvm-switch] by default to [mitigate Meltdown & Spectre][qsb-37] and lower the [attack surface on Xen][qsb-24] * Use [PVH][qsb-37] and [HVM][hvm-switch] by default to [mitigate Meltdown & Spectre][qsb-37] and lower the [attack surface on Xen][qsb-24]
* Create USB VM by default * Create USB VM by default
* [Multiple Disposable VMs templates support][dispvm-ticket] * [Multiple DisposableVMs templates support][dispvm-ticket]
* New [backup format][backup-format] using scrypt key-derivation function * New [backup format][backup-format] using scrypt key-derivation function
* Non-encrypted backups no longer supported * Non-encrypted backups no longer supported
* [split VM packages][packages-split], for better support minimal, specialized templates * [split VM packages][packages-split], for better support minimal, specialized templates

View File

@ -71,7 +71,7 @@ details and plans how to get around this problem, as well as the section on
- It doesn't solve the problem of allowing the user to know what is to be - It doesn't solve the problem of allowing the user to know what is to be
signed before the operation gets approved. Perhaps the GPG backend domain signed before the operation gets approved. Perhaps the GPG backend domain
could start a Disposable VM and have the to-be-signed document displayed could start a DisposableVM and have the to-be-signed document displayed
there? To Be Determined. there? To Be Determined.
- The Split GPG client will fail to sign or encrypt if the private key in the - The Split GPG client will fail to sign or encrypt if the private key in the

View File

@ -14,7 +14,7 @@ InterVM file copy design
There are two cases when we need a mechanism to copy files between VMs: There are two cases when we need a mechanism to copy files between VMs:
- "regular" file copy - when user instructs file manager to copy a given files/directories to a different VM - "regular" file copy - when user instructs file manager to copy a given files/directories to a different VM
- DispVM copy - user selects "open in DispVM" on a file; this file must be copied to a Disposable VM, edited by user, and possibly a modified file copied back from DispVM to VM. - DispVM copy - user selects "open in DispVM" on a file; this file must be copied to a DisposableVM, edited by user, and possibly a modified file copied back from DispVM to VM.
Prior to Qubes Beta1, for both cases, a block device (backed by a file in dom0 with a vfat filesystem on it) was attached to VM, file(s) copied there, and then the device was detached and attached to target VM. In the DispVM case, if a edited file has been modified, another block device is passed to requester VM in order to update the source file. Prior to Qubes Beta1, for both cases, a block device (backed by a file in dom0 with a vfat filesystem on it) was attached to VM, file(s) copied there, and then the device was detached and attached to target VM. In the DispVM case, if a edited file has been modified, another block device is passed to requester VM in order to update the source file.

View File

@ -173,7 +173,7 @@ AppVMs, thus wise usage of it increases security.
In Qubes 4.0, target VM can be specified also as `$dispvm:DISP_VM`, which is In Qubes 4.0, target VM can be specified also as `$dispvm:DISP_VM`, which is
very similar to `$dispvm` but forces using a particular VM (`DISP_VM`) as a base very similar to `$dispvm` but forces using a particular VM (`DISP_VM`) as a base
VM to be started as Disposable VM. For example: VM to be started as DisposableVM. For example:
anon-whonix $dispvm:anon-whonix-dvm allow anon-whonix $dispvm:anon-whonix-dvm allow