diff --git a/customization/disposablevm-customization.md b/customization/disposablevm-customization.md index c35228fb..361243a0 100644 --- a/customization/disposablevm-customization.md +++ b/customization/disposablevm-customization.md @@ -147,7 +147,7 @@ Using DisposableVMs in this manner is ideal for untrusted qubes which require pe 1. Create the dvm - [user@dom0 ~]$ qvm-create --class AppVM --label gray + [user@dom0 ~]$ qvm-create --class AppVM --label gray 2. _(optional)_ In the dvm, add custom firewall rule sets, Qubes VPN scripts etc @@ -155,95 +155,95 @@ Using DisposableVMs in this manner is ideal for untrusted qubes which require pe 3. Set the dvm as template for DisposableVMs - [user@dom0 ~]$ qvm-prefs template_for_dispvms true + [user@dom0 ~]$ qvm-prefs template_for_dispvms true #### Create the sys-net DisposableVM #### 1. Create `sys-net` DisposableVM based on the dvm - [user@dom0 ~]$ qvm-create --template --class DispVM --label red disp-sys-net + [user@dom0 ~]$ qvm-create --template --class DispVM --label red disp-sys-net 2. Set `disp-sys-net` virtualization mode to [hvm](/doc/hvm/) - [user@dom0 ~]$ qvm-prefs disp-sys-net virt_mode hvm + [user@dom0 ~]$ qvm-prefs disp-sys-net virt_mode hvm 3. Set `disp-sys-net` to provide network for other VMs - [user@dom0 ~]$ qvm-prefs disp-sys-net provides_network true + [user@dom0 ~]$ qvm-prefs disp-sys-net provides_network true 4. Set `disp-sys-net` NetVM to none - [user@dom0 ~]$ qvm-prefs disp-sys-net netvm "" + [user@dom0 ~]$ qvm-prefs disp-sys-net netvm "" 5. List all available PCI devices to determine the correct _backend:BDF_ address(es) to assign to `disp-sys-net` - [user@dom0 ~]$ qvm-pci + [user@dom0 ~]$ qvm-pci 6. Attach the network PCI device(s) to `disp-sys-net`: Finding and assigning PCI devices can be found [here](/doc/assigning-devices/) - [user@dom0 ~]$ qvm-pci attach --persistent disp-sys-net : + [user@dom0 ~]$ qvm-pci attach --persistent disp-sys-net : 7. _(recommended)_ Set `disp-sys-net` to start automatically when Qubes boots - [user@dom0 ~]$ qvm-prefs disp-sys-net autostart true + [user@dom0 ~]$ qvm-prefs disp-sys-net autostart true 8. _(optional)_ Set `disp-sys-net` as the dom0 time source - [user@dom0 ~]$ qubes-prefs clockvm disp-sys-net + [user@dom0 ~]$ qubes-prefs clockvm disp-sys-net #### Create the sys-firewall DisposableVM #### 1. Create `sys-firewall` DisposableVM - [user@dom0 ~]$ qvm-create --template --class DispVM --label green disp-sys-firewall + [user@dom0 ~]$ qvm-create --template --class DispVM --label green disp-sys-firewall 2. Set `disp-sys-firewall` to provide network for other VMs - [user@dom0 ~]$ qvm-prefs disp-sys-firewall provides_network true + [user@dom0 ~]$ qvm-prefs disp-sys-firewall provides_network true 3. Set `disp-sys-net` as the NetVM for `disp-sys-firewall` - [user@dom0 ~]$ qvm-prefs disp-sys-firewall netvm disp-sys-net + [user@dom0 ~]$ qvm-prefs disp-sys-firewall netvm disp-sys-net 4. Set `disp-sys-firewall` as NetVM for other AppVMs - [user@dom0 ~]$ qvm-prefs netvm disp-sys-firewall + [user@dom0 ~]$ qvm-prefs netvm disp-sys-firewall 5. _(recommended)_ Set `disp-sys-firewall` to auto-start when Qubes boots - [user@dom0 ~]$ qvm-prefs disp-sys-firewall autostart true + [user@dom0 ~]$ qvm-prefs disp-sys-firewall autostart true 6. _(optional)_ Set `disp-sys-firewall` as the default NetVM - [user@dom0 ~]$ qubes-prefs default_netvm disp-sys-firewall + [user@dom0 ~]$ qubes-prefs default_netvm disp-sys-firewall #### Create the sys-usb DisposableVM #### 1. Create the `disp-sys-usb` - [user@dom0 ~]$ qvm-create --template --class DispVM --label red disp-sys-usb + [user@dom0 ~]$ qvm-create --template --class DispVM --label red disp-sys-usb 2. Set the `disp-sys-usb` virtualization mode to hvm - [user@dom0 ~]$ qvm-prefs disp-sys-usb virt_mode hvm + [user@dom0 ~]$ qvm-prefs disp-sys-usb virt_mode hvm 3. Set `disp-sys-usb` NetVM to none - [user@dom0 ~]$ qvm-prefs usb-disp netvm "" + [user@dom0 ~]$ qvm-prefs usb-disp netvm "" 4. List all available PCI devices - [user@dom0 ~]$ qvm-pci + [user@dom0 ~]$ qvm-pci 5. Attach the USB controller to the `disp-sys-usb` >_**Note:**_ Most of the commonly used USB controllers (all Intel integrated controllers) require the `-o no-strict-reset=True` option to be set. Instructions detailing how this option is set can be found [here](/doc/assigning-devices/#r40-1). - [user@dom0 ~]$ qvm-pci attach --persistent disp-sys-usb : + [user@dom0 ~]$ qvm-pci attach --persistent disp-sys-usb : 6. _(optional)_ Set `disp-sys-usb` to auto-start when Qubes boots - [user@dom0 ~]$ qvm-prefs disp-sys-usb autostart true + [user@dom0 ~]$ qvm-prefs disp-sys-usb autostart true 7. Users should now follow instructions on [How to hide USB controllers from dom0](/doc/usb/#how-to-hide-all-usb-controllers-from-dom0)