diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..9ad6edd --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "qubes-sflc/shufflecake-c"] + path = qubes-sflc/shufflecake-c + url = https://codeberg.org/shufflecake/shufflecake-c.git diff --git a/qubes-sflc/.gitignore b/qubes-sflc/.gitignore new file mode 100644 index 0000000..f8a8962 --- /dev/null +++ b/qubes-sflc/.gitignore @@ -0,0 +1,2 @@ +shufflecake +dm-sflc.ko \ No newline at end of file diff --git a/qubes-sflc/BUILD.md b/qubes-sflc/BUILD.md new file mode 100644 index 0000000..b353d1c --- /dev/null +++ b/qubes-sflc/BUILD.md @@ -0,0 +1,31 @@ +# qubes-sflc + +To compile Shufflecake for QubesOS, you must first create a bootstrap qube. The template does not matter, but it will probably be easiest to use Fedora. Inside the bootstrap qube, you must install Git and Docker via + +```sh +sudo dnf install -y git docker +``` + +or using the relevant package manager for another distribution. Then, clone the reliant-system repository, + +```sh +git clone https://codeberg.org/andersonarc/reliant-system.git +cd reliant-system/qubes-sflc +git submodule update --init --recursive +``` + +and run the compilation script, + +```sh +./build.sh +``` + +This will place the binaries for `shufflecake` and `dm-sflc` inside the current folder. To install them, run the following commands inside dom0 as root + +```sh +qvm-run --pass-io bootstrap "cat /home/$USER/reliant-system/qubes-sflc/shufflecake" > /usr/bin/shufflecake +qvm-run --pass-io bootstrap "cat /home/$USER/reliant-system/qubes-sflc/dm-sflc.ko" > /usr/lib/modules/$(uname -r)/extra +depmod +``` + +where `bootstrap` is the name of your bootstrap qube. If successful, Shufflecake will now be available in your dom0 and could be used to mount secure volumes. Unfortunately, this is insufficient to securely operate the system while maintaining plausible deniability. Under normal conditions, the hidden qubes will inevitably leave some traces in the root filesystem of dom0. This is what reliant-system attempts to resolve by freezing the state of dom0. diff --git a/qubes-sflc/Dockerfile b/qubes-sflc/Dockerfile new file mode 100644 index 0000000..73673a2 --- /dev/null +++ b/qubes-sflc/Dockerfile @@ -0,0 +1,4 @@ +FROM fedora:37 +RUN dnf install -y gcc make device-mapper-devel libgcrypt-devel +WORKDIR /root/shufflecake-c +ENTRYPOINT make clean && make diff --git a/qubes-sflc/build.sh b/qubes-sflc/build.sh new file mode 100755 index 0000000..4d45b7d --- /dev/null +++ b/qubes-sflc/build.sh @@ -0,0 +1,6 @@ +#!/bin/sh +set -eu +sudo docker build -t qubes-sflc . +sudo docker run --rm -v /usr/lib/modules:/usr/lib/modules:ro -v $PWD/shufflecake-c:/root/shufflecake-c qubes-sflc +cp shufflecake-c/dm-sflc.ko $PWD/dm-sflc.ko +cp shufflecake-c/shufflecake $PWD/shufflecake diff --git a/qubes-sflc/shufflecake-c b/qubes-sflc/shufflecake-c new file mode 160000 index 0000000..96c1557 --- /dev/null +++ b/qubes-sflc/shufflecake-c @@ -0,0 +1 @@ +Subproject commit 96c1557cdde6d92c299592cbfcd39af1e51b7c29