mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-05-02 06:46:11 -04:00
replaced all github flavored code blocks with fenced kramdown code blocks
This commit is contained in:
Jeepler
parent
df467baf1c
commit
39ef7373fd
58 changed files with 609 additions and 609 deletions
|
|
@ -10,21 +10,21 @@ Assigning Devices to VMs
|
|||
|
||||
In order to assign a whole PCI(e) device to a VM, one should use `qvm-pci` tool. E.g.
|
||||
|
||||
```
|
||||
~~~
|
||||
lspci
|
||||
```
|
||||
~~~
|
||||
|
||||
Find the BDF address of the device you want to assign, and then:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-pci -a <vmname> <bdf>
|
||||
```
|
||||
~~~
|
||||
|
||||
E.g. assuming 00:1a.0 is a BDF of the device I want to assign to the "personal" domain:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-pci -a personal 00:1a.0
|
||||
```
|
||||
~~~
|
||||
|
||||
Note that one can only assign full PCI or PCI Express devices. This means one cannot assign single USB devices -- only the whole USB controller with whatever USB devices connected to it. This limit is imposed by PC and VT-d architecture.
|
||||
|
||||
|
|
@ -40,33 +40,33 @@ Finding the right USB controller
|
|||
|
||||
If you want assign certain USB device to a VM (by attaching a whole USB controller), you need to figure out which PCI device is the right controller. First check to which USB bus the device is connected:
|
||||
|
||||
```
|
||||
~~~
|
||||
lsusb
|
||||
```
|
||||
~~~
|
||||
|
||||
For example I want assign a broadband modem to the netvm. In lsusb output it can be listed as something like this (in this case device isn't fully identified):
|
||||
|
||||
```
|
||||
~~~
|
||||
Bus 003 Device 003: ID 413c:818d Dell Computer Corp.
|
||||
```
|
||||
~~~
|
||||
|
||||
The device is connected to the USB bus \#3. Then check which other devices are connected to the same bus - all of them will be assigned to the same VM. Now is the time to find right USB controller:
|
||||
|
||||
```
|
||||
~~~
|
||||
readlink /sys/bus/usb/devices/usb3
|
||||
```
|
||||
~~~
|
||||
|
||||
This should output something like:
|
||||
|
||||
```
|
||||
~~~
|
||||
../../../devices/pci-0/pci0000:00/0000:00:1a.0/usb3
|
||||
```
|
||||
~~~
|
||||
|
||||
Now you see BDF address in the path (right before final usb3). Strip leading "0000:" and pass the rest to qvm-pci tool:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-pci -a netvm 00:1a.0
|
||||
```
|
||||
~~~
|
||||
|
||||
Possible issues
|
||||
---------------
|
||||
|
|
@ -75,11 +75,11 @@ Possible issues
|
|||
|
||||
VMs with assigned PCI devices in Qubes have allocated a small buffer for DMA operations (called swiotlb). By default it is 2MB, but some devices need a larger buffer. To change this allocation, edit VM's kernel parameters (this is expressed in 512B chunks):
|
||||
|
||||
```
|
||||
~~~
|
||||
# qvm-prefs netvm |grep kernelopts
|
||||
kernelopts : iommu=soft swiotlb=2048 (default)
|
||||
# qvm-prefs -s netvm kernelopts "iommu=soft swiotlb=4096"
|
||||
```
|
||||
~~~
|
||||
|
||||
This is [known to be needed](https://groups.google.com/group/qubes-devel/browse_thread/thread/631c4a3a9d1186e3) for Realtek RTL8111DL Gigabit Ethernet Controller.
|
||||
|
||||
|
|
@ -87,7 +87,7 @@ This is [known to be needed](https://groups.google.com/group/qubes-devel/browse_
|
|||
|
||||
Sometimes PCI arbitrator is too strict. There is a way to enable permissive mode for it. Create `/etc/systemd/system/qubes-pre-netvm.service`:
|
||||
|
||||
```
|
||||
~~~
|
||||
[Unit]
|
||||
Description=Netvm fixup
|
||||
Before=qubes-netvm.service
|
||||
|
|
@ -99,7 +99,7 @@ RemainAfterExit=yes
|
|||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
~~~
|
||||
|
||||
Then enable it with `systemctl enable qubes-pre-netvm.service`
|
||||
|
||||
|
|
@ -118,11 +118,11 @@ or
|
|||
|
||||
1. Go to the sysfs (`/sys/bus/pci`), find the right device, detach it from the pciback driver and attach back to the original driver. Replace `<BDF>` with your device, for example `00:1c.2`:
|
||||
|
||||
```
|
||||
~~~
|
||||
echo 0000:<BDF> > /sys/bus/pci/drivers/pciback/unbind
|
||||
MODALIAS=`cat /sys/bus/pci/devices/0000:<BDF>/modalias`
|
||||
MOD=`modprobe -R $MODALIAS | head -n 1`
|
||||
echo <BDF> > /sys/bus/pci/drivers/$MOD/bind
|
||||
```
|
||||
~~~
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -14,11 +14,11 @@ Those files are placed in /rw, which survives VM restart, so can be used to cust
|
|||
|
||||
- `/rw/config/rc.local` - script run at VM startup. Good place to change some service settings, replace config files with its copy stored in /rw/config etc. Example usage:
|
||||
|
||||
```
|
||||
~~~
|
||||
# Store bluetooth keys in /rw to keep them across VM restarts
|
||||
rm -rf /var/lib/bluetooth
|
||||
ln -s /rw/config/var-lib-bluetooth /var/lib/bluetooth
|
||||
```
|
||||
~~~
|
||||
|
||||
- `/rw/config/qubes-ip-change-hook` - script run in NetVM after external IP change (or connection to the network)
|
||||
- `/rw/config/qubes-firewall-user-script` - script run in ProxyVM after firewall update. Good place to write own custom firewall rules
|
||||
|
|
@ -31,7 +31,7 @@ GUI and audio configuration in dom0
|
|||
|
||||
GUI configuration file `/etc/qubes/guid.conf` in one of few not managed by qubes-prefs nor Qubes Manager tool. Sample config (included in default installation):
|
||||
|
||||
```
|
||||
~~~
|
||||
# Sample configuration file for Qubes GUI daemon
|
||||
# For syntax go http://www.hyperrealm.com/libconfig/libconfig_manual.html
|
||||
|
||||
|
|
@ -55,7 +55,7 @@ VM: {
|
|||
#allow_fullscreen = true;
|
||||
};
|
||||
};
|
||||
```
|
||||
~~~
|
||||
|
||||
Currently supported settings:
|
||||
|
||||
|
|
|
|||
|
|
@ -11,23 +11,23 @@ To enable TRIM in dom0 you need:
|
|||
|
||||
1. Get your LUKS device UUID:
|
||||
|
||||
```
|
||||
~~~
|
||||
ls /dev/mapper/luks-*
|
||||
```
|
||||
~~~
|
||||
|
||||
2. Add entry to `/etc/crypttab` (replace luks-\<UUID\> with the device name and the \<UUID\> with UUID alone):
|
||||
|
||||
```
|
||||
~~~
|
||||
luks-<UUID> UUID=<UUID> none allow-discards
|
||||
```
|
||||
~~~
|
||||
|
||||
3. Add `rd.luks.allow-discards=1` to kernel cmdline (`/etc/default/grub`, GRUB\_CMDLINE\_LINUX line)
|
||||
4. Rebuild grub config (`grub2-mkconfig -o /boot/grub2/grub.cfg`)
|
||||
5. Rebuild initrd **in hostonly mode**:
|
||||
|
||||
```
|
||||
~~~
|
||||
dracut -H -f
|
||||
```
|
||||
~~~
|
||||
|
||||
6. Add "discard" option to `/etc/fstab` for root device
|
||||
7. Reboot the system, verify that allow-discards is really enabled (`dmsetup table`)
|
||||
|
|
|
|||
|
|
@ -22,16 +22,16 @@ First you need to identify an user VM dedicated to audio and [assign a device](/
|
|||
|
||||
In a terminal of the template from which you user VM depends, install pavucontrol with:
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo yum install pavucontrol
|
||||
```
|
||||
~~~
|
||||
|
||||
Close the template and start or restart your user VM, insert your external audio device, open a terminal and prepare pulseaudio to use it with:
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo chmod a+rw /dev/snd/*
|
||||
pactl load-module module-udev-detect
|
||||
```
|
||||
~~~
|
||||
|
||||
Start the audio application that is going to use the external audio device.
|
||||
|
||||
|
|
@ -39,8 +39,8 @@ Launch pavucontrol, for example using "run command in VM" of Qubes Manager and s
|
|||
|
||||
If you detach your external audio device, then want to insert it again, or change it with another one, you need to repeat the previous commands in terminal, adding an other line at the beginning:
|
||||
|
||||
```
|
||||
~~~
|
||||
pactl unload-module module-udev-detect
|
||||
sudo chmod a+rw /dev/snd/*
|
||||
pactl load-module module-udev-detect
|
||||
```
|
||||
~~~
|
||||
|
|
|
|||
|
|
@ -7,8 +7,8 @@ redirect_from: /wiki/ExternalDeviceMountPoint/
|
|||
|
||||
All external storage devices connected to an AppVM using the Fedora template can be found under
|
||||
|
||||
```
|
||||
~~~
|
||||
/run/media/user/
|
||||
```
|
||||
~~~
|
||||
|
||||
...of that AppVM's filesystem.
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ Assuming you have more than one account (safe assumption these days), you need t
|
|||
|
||||
In TemplateVM create `/etc/systemd/system/fetchmail@.service`:
|
||||
|
||||
```
|
||||
~~~
|
||||
[Unit]
|
||||
Description=Mail Retrieval Agent
|
||||
After=network.target
|
||||
|
|
@ -34,11 +34,11 @@ Requires=postfix.service
|
|||
User=user
|
||||
ExecStart=/bin/fetchmail -f /usr/local/etc/fetchmail/%I.rc -d 60 -i /usr/local/etc/fetchmail/.%I.fetchids --pidfile /usr/local/etc/fetchmail/.%I.pid
|
||||
RestartSec=1
|
||||
```
|
||||
~~~
|
||||
|
||||
Then shutdown TemplateVM, start AppVM and create directory `/usr/local/etc/fetchmail`. In it, create one `.rc` file for each instance of fetchmail, ie. `personal1.rc` and `personal2.rc`. Sample configuration file:
|
||||
|
||||
```
|
||||
~~~
|
||||
set syslog
|
||||
set no bouncemail
|
||||
#set daemon 600
|
||||
|
|
@ -57,13 +57,13 @@ user woju pass supersecret
|
|||
idle
|
||||
|
||||
# vim: ft=fetchmail
|
||||
```
|
||||
~~~
|
||||
|
||||
Then `chown -R user:user /usr/local/etc/fetchmail` and `chmod 600 /usr/local/etc/fetchmail/*.rc`. **This is important**, fetchmail will refuse to run with wrong permissions on its rc-file.
|
||||
|
||||
Next, add this to `/rw/config/rc.local`:
|
||||
|
||||
```
|
||||
~~~
|
||||
#!/bin/sh
|
||||
|
||||
for rc in /usr/local/etc/fetchmail/*.rc; do
|
||||
|
|
@ -71,6 +71,6 @@ for rc in /usr/local/etc/fetchmail/*.rc; do
|
|||
instance=${instance##*/}
|
||||
echo systemctl --no-block start fetchmail@${instance}
|
||||
done
|
||||
```
|
||||
~~~
|
||||
|
||||
Now reboot your AppVM and you are done.
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ Mutt generally works out of the box. This configuration guide discusses only Qub
|
|||
|
||||
First, paste this to `/etc/Muttrc.local` in TemplateVM:
|
||||
|
||||
```
|
||||
~~~
|
||||
# specify your key or override in ~/.mutt/muttrc in AppVM
|
||||
set pgp_sign_as="0xDEADBEEF"
|
||||
|
||||
|
|
@ -105,11 +105,11 @@ send-hook "~A" set pgp_autoinline=no crypt_autoencrypt=no
|
|||
send-hook "~t @invisiblethingslab\.com" set crypt_autoencrypt=yes
|
||||
|
||||
# vim:ft=muttrc
|
||||
```
|
||||
~~~
|
||||
|
||||
Then shutdown your TemplateVM. Next open your AppVM, create file `/home/user/.mutt/muttrc` and adjust for your needs:
|
||||
|
||||
```
|
||||
~~~
|
||||
#
|
||||
# accounts
|
||||
#
|
||||
|
|
@ -134,14 +134,14 @@ subscribe (qubes-(users|devel)|othergroup)@googlegroups\.com
|
|||
fcc-save-hook qubes-users@googlegroups\.com =list/qubes-users/
|
||||
fcc-save-hook qubes-devel@googlegroups\.com =list/qubes-devel/
|
||||
fcc-save-hook othergroup@googlegroups\.com =list/othergroup/
|
||||
```
|
||||
~~~
|
||||
|
||||
You may also create `/home/user/.signature`:
|
||||
|
||||
```
|
||||
~~~
|
||||
regards,
|
||||
Wojciech Porczyk
|
||||
```
|
||||
~~~
|
||||
|
||||
Some additional useful settings
|
||||
-------------------------------
|
||||
|
|
|
|||
|
|
@ -22,20 +22,20 @@ Qubes manager patch (Qubes R2B2)
|
|||
|
||||
The following patches can be applied to the Qubes Manager GUI in order to add an option to easily bridge a VM. Use it at your own risk. If the patch breaks the Qubes Manager, you can try to restore the qubes packages:
|
||||
|
||||
```
|
||||
~~~
|
||||
# qubes-dom-update qubes-core-dom0 qubes-manager
|
||||
# yum reinstall qubes-core-dom0
|
||||
# yum reinstall qubes-manager
|
||||
```
|
||||
~~~
|
||||
|
||||
First, retrieve the attachment of this Wifi article in dom0. Then apply the three patches the following way after installing the patch tool :
|
||||
|
||||
```
|
||||
~~~
|
||||
# qubes-dom0-update patch
|
||||
# patch /usr/lib64/python2.7/site-package/qubes/qubes.py < qubes.py-bridge.diff
|
||||
# patch /usr/lib64/python2.7/site-package/qubesmanager/settings.py < settings.py-bridge.diff
|
||||
# patch /usr/lib64/python2.7/site-package/qubesmanager/ui_settingsdlg.py < ui_settingsdlg.py-bridge.diff
|
||||
```
|
||||
~~~
|
||||
|
||||
Finally restart the qubes manager GUI.
|
||||
|
||||
|
|
@ -50,7 +50,7 @@ Modify manually the Template you use for your NetVM (not the NetVM itself). This
|
|||
|
||||
- Starting from the line -A POSTROUTING -j MASQUERADE that you need to comment :
|
||||
|
||||
```
|
||||
~~~
|
||||
# Bridge support
|
||||
# Comment the following line
|
||||
#-A POSTROUTING -j MASQUERADE
|
||||
|
|
@ -59,26 +59,26 @@ Modify manually the Template you use for your NetVM (not the NetVM itself). This
|
|||
# Allow redirection of bridge packets (optional as POSTROUTING default is ACCEPT)
|
||||
#-A POSTROUTING -o bridge+ -j ACCEPT
|
||||
# End Bridge support
|
||||
```
|
||||
~~~
|
||||
|
||||
- Starting from the line -A FORWARD -i vif+ -j ACCEPT:
|
||||
|
||||
```
|
||||
~~~
|
||||
-A FORWARD -i vif+ -o vif+ -j DROP
|
||||
-A FORWARD -i vif+ -j ACCEPT
|
||||
# Bridge Support
|
||||
-A FORWARD -i bridge+ -j ACCEPT
|
||||
# End Bridge Support
|
||||
-A FORWARD -j DROP
|
||||
```
|
||||
~~~
|
||||
|
||||
Ensure that the IP addresses used by default in qubes are in the form 10.137.1.\* or 10.137.2.\* by running ifconfig. Of course, this setup won't work with IPv6.
|
||||
|
||||
Now you need to restart the NetVM and FirewallVM or only iptables in both VMs if you prefer:
|
||||
|
||||
```
|
||||
~~~
|
||||
# systemctl restart iptables
|
||||
```
|
||||
~~~
|
||||
|
||||
Create a Bridge inside the NetVM
|
||||
--------------------------------
|
||||
|
|
@ -96,7 +96,7 @@ The bridge edition GUI is somehow buggy as it does not remember all the paramete
|
|||
|
||||
- Bridge-DHCP
|
||||
|
||||
```
|
||||
~~~
|
||||
[connection]
|
||||
id=Bridge-DHCP
|
||||
uuid=fd68198b-313a-47cb-9155-52e95cdc67f3
|
||||
|
|
@ -113,13 +113,13 @@ The bridge edition GUI is somehow buggy as it does not remember all the paramete
|
|||
[bridge]
|
||||
interface-name=bridge0
|
||||
stp=false
|
||||
```
|
||||
~~~
|
||||
|
||||
Note: Do not forget to put stp=false if you bridge only eth0 because sending BPDUs could make your admins angry :)
|
||||
|
||||
- bridge0-eth0
|
||||
|
||||
```
|
||||
~~~
|
||||
[802-3-ethernet]
|
||||
duplex=full
|
||||
mac-address=88:AE:1D:AE:30:31
|
||||
|
|
@ -132,12 +132,12 @@ Note: Do not forget to put stp=false if you bridge only eth0 because sending BPD
|
|||
timestamp=1363601650
|
||||
master=fd68198b-313a-47cb-9155-52e95cdc67f3
|
||||
slave-type=bridge
|
||||
```
|
||||
~~~
|
||||
|
||||
If you do not manager to start your bridge, you can start it manually from a NetVM terminal:
|
||||
|
||||
```
|
||||
~~~
|
||||
$ nmcli con up id bridge0-eth0
|
||||
```
|
||||
~~~
|
||||
|
||||
Now that the bridge is ready, the bridged AppVM can be started...
|
||||
|
|
|
|||
|
|
@ -22,9 +22,9 @@ Configuration
|
|||
|
||||
In TemplateVM open `/etc/aliases` and add line:
|
||||
|
||||
```
|
||||
~~~
|
||||
root: user
|
||||
```
|
||||
~~~
|
||||
|
||||
and run `newaliases`.
|
||||
|
||||
|
|
@ -36,7 +36,7 @@ Now shutdown TemplateVM, start AppVM. Create directory `/usr/local/etc/postfix`
|
|||
|
||||
Postfix keeps its lookup tables in bdb hash databases. They need to be compiled from source files. Postfix admins like to keep track of them by means of `/usr/local/etc/postfix/Makefile`:
|
||||
|
||||
```
|
||||
~~~
|
||||
all: $(addsuffix .db,$(shell sed -n -e '/^[^#].*hash:\/etc\/postfix/s:.*/::p' main.cf))
|
||||
newaliases
|
||||
clean:
|
||||
|
|
@ -45,13 +45,13 @@ clean:
|
|||
|
||||
%.db: %
|
||||
/usr/sbin/postmap hash:$<
|
||||
```
|
||||
~~~
|
||||
|
||||
### Postfix main configuration
|
||||
|
||||
`/usr/local/etc/postfix/main.cf` (`/etc/postfix` is intentional, don't correct it):
|
||||
|
||||
```
|
||||
~~~
|
||||
mydestination = $myhostname, $myhostname.$mydomain, $myhostname.localdomain, localhost, localhost.$mydomain, localhost.localdomain, $mydomain, localdomain
|
||||
mynetworks_style = host
|
||||
|
||||
|
|
@ -84,36 +84,36 @@ sendmail_path = /usr/sbin/sendmail
|
|||
newaliases_path = /usr/bin/newaliases
|
||||
mailq_path = /usr/bin/mailq
|
||||
alias_maps = hash:/etc/aliases
|
||||
```
|
||||
~~~
|
||||
|
||||
### Lookup tables
|
||||
|
||||
`/usr/local/etc/postfix/generic` (put there your primary address):
|
||||
|
||||
```
|
||||
~~~
|
||||
@localhost your.mail@example.com
|
||||
```
|
||||
~~~
|
||||
|
||||
`/usr/local/etc/postfix/sender_relay`. This is important file. Put there all your SMTP servers. Pay attention to port (smtp/submission). Square brackets have their special meaning, they are almost certainly needed. For more info consult Postfix manual.
|
||||
|
||||
```
|
||||
~~~
|
||||
your.mail@exmaple.com [mail.example.com]:submission
|
||||
your.other@mail.com [smtp.mail.com]:smtp
|
||||
```
|
||||
~~~
|
||||
|
||||
`/usr/local/etc/postfix/saslpass`. Here you put passwords to abovementioned servers. It depends on provider if you need to put whole email as username or just the part before `@`.
|
||||
|
||||
```
|
||||
~~~
|
||||
[mail.example.com]:submission your.mail:y0urP4ssw0rd
|
||||
[smtp.mail.com]:smtp your.other@mail.com:supers3cret
|
||||
```
|
||||
~~~
|
||||
|
||||
`/usr/local/etc/postfix/sender_access`. I use it to nullroute known spam domains. If you do not need it, comment respective line in `main.cf`.
|
||||
|
||||
```
|
||||
~~~
|
||||
spamdomain1.com DISCARD
|
||||
spamdomain2.com DISCARD
|
||||
```
|
||||
~~~
|
||||
|
||||
Now run `make` in `/usr/local/etc/postfix`. It will hopefully compile four abovementioned lookup tables (`generic.db`, `sender_relay.db`, `saslpass.db` and `sender_access`).
|
||||
|
||||
|
|
@ -121,7 +121,7 @@ Now run `make` in `/usr/local/etc/postfix`. It will hopefully compile four above
|
|||
|
||||
Don't start postfix or fetchmail yet, first create `/home/user/.procmailrc`:
|
||||
|
||||
```
|
||||
~~~
|
||||
MAILDIR = "${HOME}/.maildir"
|
||||
ORGMAIL = "${MAILDIR}/"
|
||||
DEFAULT = "${MAILDIR}/"
|
||||
|
|
@ -133,18 +133,18 @@ list/qubes-users/
|
|||
:0
|
||||
* ^List-Id:.*qubes-devel\.googlegroups\.com
|
||||
list/qubes-devel/
|
||||
```
|
||||
~~~
|
||||
|
||||
Run
|
||||
---
|
||||
|
||||
Open `/rw/config/rc.local` and add those two lines (before fetchmail lines, if you have them):
|
||||
|
||||
```
|
||||
~~~
|
||||
#!/bin/sh
|
||||
|
||||
mount --bind /usr/local/etc/postfix /etc/postfix
|
||||
systemctl --no-block start postfix
|
||||
```
|
||||
~~~
|
||||
|
||||
Reboot your AppVM and you are done.
|
||||
|
|
|
|||
|
|
@ -17,17 +17,17 @@ There are several disk images which can be easily extended.
|
|||
|
||||
To grow the private disk image of a AppVM beyond this limit [qubes-grow-private](/doc/Dom0Tools/QvmGrowPrivate/) can be used:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-grow-private <vm-name> <size>
|
||||
```
|
||||
~~~
|
||||
|
||||
Note: Size is the target size (i.e. 4096MB or 16GB, ...), not the size to add to the existing disk.
|
||||
|
||||
Note2: If once the VM is started, the disk is has not been increased, you can issue in the VM's terminal:
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo resize2fs /dev/xvdb
|
||||
```
|
||||
~~~
|
||||
|
||||
### Shrinking private disk image (Linux VM)
|
||||
|
||||
|
|
@ -40,14 +40,14 @@ The basic idea is to:
|
|||
|
||||
Ext4 does not support online shrinking, so can't be done as convenient as image grown. Note that we don't want to touch the VM filesystem directly in dom0 for security reasons. First you need to start VM without `/rw` mounted. One of the possibility is to interrupt its normal startup by adding `rd.break` kernel option:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-prefs -s <vm-name> kernelopts rd.break
|
||||
qvm-start --no-guid <vm-name>
|
||||
```
|
||||
~~~
|
||||
|
||||
And wait for qrexec connect timeout (or simply press Ctrl-C). Then you can connect to VM console and shrink the filesystem:
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo xl console <vm-name>
|
||||
# you should get dracut emergency shell here
|
||||
mount --bind /dev /sysroot/dev
|
||||
|
|
@ -59,19 +59,19 @@ umount /proc
|
|||
exit
|
||||
umount /sysroot/dev
|
||||
poweroff
|
||||
```
|
||||
~~~
|
||||
|
||||
Now you can resize the image:
|
||||
|
||||
```
|
||||
~~~
|
||||
truncate -s <new-desired-size> /var/lib/qubes/appvms/<vm-name>/private.img
|
||||
```
|
||||
~~~
|
||||
|
||||
**It is critical to use the same (or bigger for some safety margin) size in truncate call compared to resize2fs call. Otherwise you will loose your data!** Then reset kernel options back to default:
|
||||
|
||||
```
|
||||
~~~
|
||||
qvm-prefs -s <vm-name> kernelopts default
|
||||
```
|
||||
~~~
|
||||
|
||||
Done.
|
||||
|
||||
|
|
@ -97,12 +97,12 @@ First, stop/shutdown the HVM.
|
|||
|
||||
Then, from a Dom0 terminal (in KDE: System Tools -\> Terminal Emulator) do the following:
|
||||
|
||||
```
|
||||
~~~
|
||||
cd /var/lib/qubes/appvms/<yourHVM>/
|
||||
ls -lh root.img (<--verify current size of disk image)
|
||||
truncate -s 30GB root.img
|
||||
ls -lh root.img (<--verify new size of disk image)
|
||||
```
|
||||
~~~
|
||||
|
||||
The partition table and file-system must be adjusted after this change:
|
||||
|
||||
|
|
@ -117,9 +117,9 @@ No reboot required.
|
|||
|
||||
#### FreeBSD
|
||||
|
||||
```
|
||||
~~~
|
||||
gpart recover ada0
|
||||
sysctl kern.geom.debugflags=0x10
|
||||
gpart resize -i index ada0
|
||||
zpool online -e poolname ada0
|
||||
```
|
||||
~~~
|
||||
|
|
|
|||
|
|
@ -16,14 +16,14 @@ template between reboots didn't exceed 10G).
|
|||
|
||||
Replace the size and the path (name) of the template as wished and run your
|
||||
modified command:
|
||||
```
|
||||
~~~
|
||||
truncate -s 20G /var/lib/qubes/vm-templates/fedora-21/root.img
|
||||
```
|
||||
~~~
|
||||
|
||||
Then start your template or standalone VM and run:
|
||||
```
|
||||
~~~
|
||||
sudo resize2fs /dev/mapper/dmroot
|
||||
```
|
||||
~~~
|
||||
|
||||
after that shutdown the template.
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ Xresources
|
|||
|
||||
In TemplateVM create file `/etc/X11/Xresources.urxvt` and paste config below. `!`-lines are comments and may be left out. `#`-lines are directives to CPP (C preprocessor) and are neccessary. This shouldn't go to `/etc/X11/Xresources`, because that file is not preprocessed by default.
|
||||
|
||||
```
|
||||
~~~
|
||||
! CGA colour palette
|
||||
|
||||
!*color0: #000000
|
||||
|
|
@ -123,15 +123,15 @@ URxvt.insecure: False
|
|||
|
||||
! some termcap-aware software sometimes throw '$TERM too long'
|
||||
!URxvt.termName: rxvt-256color
|
||||
```
|
||||
~~~
|
||||
|
||||
Then create script to automatically merge those to xrdb. File `/etc/X11/xinit/xinitrc.d/urxvt.sh`:
|
||||
|
||||
```
|
||||
~~~
|
||||
#!/bin/sh
|
||||
|
||||
[ -r /etc/X11/Xresources.urxvt ] && xrdb -merge /etc/X11/Xresources.urxvt
|
||||
```
|
||||
~~~
|
||||
|
||||
Shortcuts
|
||||
---------
|
||||
|
|
|
|||
|
|
@ -20,14 +20,14 @@ Install DKMS style packages for Fedora <sup>(defunct\\ in\\ 0.6.2\\ due\\ to\\ s
|
|||
|
||||
Fetch and install repository for DKMS style packages for your Dom0 Fedora version [http://zfsonlinux.org/fedora.html](http://zfsonlinux.org/fedora.html):
|
||||
|
||||
```
|
||||
~~~
|
||||
disp1# wget http://archive.zfsonlinux.org/fedora/zfs-release-1-1$(rpm -E %dist).noarch.rpm
|
||||
dom0# qvm-run --pass-io disp1 'cat /home/user/zfs-release-1-1.fc18.noarch.rpm' > /home/user/zfs-release-1-1.fc18.noarch.rpm
|
||||
dom0# sudo yum localinstall /home/user/zfs-release-1-1.fc18.noarch.rpm
|
||||
dom0# sudo sed -i 's/$releasever/18/g' /etc/yum.repo.d/zfs.repo
|
||||
dom0# sudo qubes-dom0-update @development-tools
|
||||
dom0# sudo qubes-dom0-update zfs
|
||||
```
|
||||
~~~
|
||||
|
||||
Install DKMS style packages from git-repository
|
||||
-----------------------------------------------
|
||||
|
|
@ -38,57 +38,57 @@ Build and install your DKMS or KMOD packages as described in [http://zfsonlinux.
|
|||
|
||||
Checkout repositories for SPL and ZFS:
|
||||
|
||||
```
|
||||
~~~
|
||||
mkdir ~/repositories && cd ~/repositories
|
||||
git clone https://github.com/zfsonlinux/spl.git
|
||||
git clone https://github.com/zfsonlinux/zfs.git
|
||||
```
|
||||
~~~
|
||||
|
||||
Revert changes in SPL repository due to this bug: [https://github.com/zfsonlinux/spl/issues/284](https://github.com/zfsonlinux/spl/issues/284)
|
||||
|
||||
```
|
||||
~~~
|
||||
cd ~/repositories/spl
|
||||
git config --global user.email "user@example.com"
|
||||
git config --global user.name "user"
|
||||
git revert e3c4d44886a8564e84aa697477b0e37211d634cd
|
||||
```
|
||||
~~~
|
||||
|
||||
### Installation steps in Dom0
|
||||
|
||||
Copy repositories over to Dom0:
|
||||
|
||||
```
|
||||
~~~
|
||||
mkdir ~/repositories
|
||||
qvm-run --pass-io disp1 'tar -cf - -C ~/repositories/ {spl,zfs}' | tar -xpf - -C ~/repositories/
|
||||
```
|
||||
~~~
|
||||
|
||||
Installing build requirements for SPL and ZFS DKMS modules:
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo qubes-dom0-update dkms kernel-devel zlib-devel libuuid-devel libblkid-devel lsscsi bc autoconf automake binutils bison flex gcc gcc-c++ gdb gettext libtool make pkgconfig redhat-rpm-config rpm-build strace
|
||||
```
|
||||
~~~
|
||||
|
||||
Configure and build SPL DKMS packages:
|
||||
|
||||
```
|
||||
~~~
|
||||
cd ~/repositories/spl
|
||||
./autogen.sh
|
||||
./configure --with-config=user
|
||||
make rpm-utils rpm-dkms
|
||||
```
|
||||
~~~
|
||||
|
||||
Configure and build ZFS DKMS packages:
|
||||
|
||||
```
|
||||
~~~
|
||||
cd ~/repositories/zfs
|
||||
./autogen.sh
|
||||
./configure --with-config=user
|
||||
make rpm-utils rpm-dkms
|
||||
```
|
||||
~~~
|
||||
|
||||
Install SPL and ZFS packages (i.e. version 0.6.2):
|
||||
|
||||
```
|
||||
~~~
|
||||
sudo yum localinstall \
|
||||
~/repositories/spl/spl-0.6.2-1.qbs2.x86_64.rpm \
|
||||
~/repositories/spl/spl-dkms-0.6.2-1.qbs2.noarch.rpm \
|
||||
|
|
@ -96,7 +96,7 @@ sudo yum localinstall \
|
|||
~/repositories/zfs/zfs-dkms-0.6.2-1.qbs2.noarch.rpm \
|
||||
~/repositories/zfs/zfs-dracut-0.6.2-1.qbs2.x86_64.rpm \
|
||||
~/repositories/zfs/zfs-test-0.6.2-1.qbs2.x86_64.rpm
|
||||
```
|
||||
~~~
|
||||
|
||||
Configure ZFS
|
||||
=============
|
||||
|
|
@ -106,13 +106,13 @@ Automatically load modules
|
|||
|
||||
/etc/sysconfig/modules/zfs.modules
|
||||
|
||||
```
|
||||
~~~
|
||||
#!/bin/sh
|
||||
|
||||
for module in spl zfs; do
|
||||
modprobe ${module} >/dev/null 2>&1
|
||||
done
|
||||
```
|
||||
~~~
|
||||
|
||||
Make this file executable.
|
||||
|
||||
|
|
@ -123,9 +123,9 @@ Tame the memory-eating dragon (i.e. 512 Mb zfs\_arc\_max):
|
|||
|
||||
/etc/modprobe.d/zfs.conf
|
||||
|
||||
```
|
||||
~~~
|
||||
options zfs zfs_arc_max=536870912
|
||||
```
|
||||
~~~
|
||||
|
||||
Setup a zpool with ZFS datasets
|
||||
-------------------------------
|
||||
|
|
@ -138,7 +138,7 @@ Beware: VMs on a ZFS dataset aren't working, if your ZFS installation deserts yo
|
|||
|
||||
So keep netvm, firewallvm and your templates on your root file-system (preferably on a SSD).
|
||||
|
||||
```
|
||||
~~~
|
||||
zpool create -m none -o ashift=12 -O atime=off -O compression=lz4 qubes mirror /dev/mapper/<cryptname1> /dev/mapper/<cryptname2>
|
||||
zfs create -p qubes/appvms
|
||||
zfs create -m /var/lib/qubes/backup-zfs qubes/backup
|
||||
|
|
@ -146,7 +146,7 @@ zfs create -m /var/lib/qubes/appvms/banking qubes/appvms/banking
|
|||
zfs create -m /var/lib/qubes/appvms/personal qubes/appvms/personal
|
||||
zfs create -m /var/lib/qubes/appvms/untrusted qubes/appvms/untrusted
|
||||
zfs create -m /var/lib/qubes/appvms/work qubes/appvms/work
|
||||
```
|
||||
~~~
|
||||
|
||||
Have fun with zpool and zfs.
|
||||
|
||||
|
|
@ -161,28 +161,28 @@ You're depending on an huge amount of code for this file system, keep this in mi
|
|||
Encrypt underlying devices
|
||||
--------------------------
|
||||
|
||||
```
|
||||
~~~
|
||||
dom0# cryptsetup -c aes-xts-plain64 luksFormat <device1>
|
||||
dom0# cryptsetup luksOpen <device1> <cryptname1>
|
||||
```
|
||||
~~~
|
||||
|
||||
With the use of cryptsetup a keyfile can be specified to decrypt devices.
|
||||
|
||||
```
|
||||
~~~
|
||||
dom0# head -c 256 /dev/random > /root/keyfile1
|
||||
dom0# chmod 0400 /root/keyfile1
|
||||
dom0# cryptsetup luksAddKey <device1> /root/keyfile1
|
||||
```
|
||||
~~~
|
||||
|
||||
Decrypt devices on boot
|
||||
-----------------------
|
||||
|
||||
Add your devices to /etc/crypttab.
|
||||
|
||||
```
|
||||
~~~
|
||||
<cryptname1> <device1> <keyfile1>
|
||||
<cryptname2> <device2> none
|
||||
```
|
||||
~~~
|
||||
|
||||
Specifying a keyfile is especially useful, if ZFS should be ready during boot.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue