con­fine­drv

If you should ever wish to make a single partition read only (i.e. an lvm partition) simply do the following:

Note that losetup -r should already produce a read only device. Nonetheless tests have shown that the drive may still be writable this way. The blockdev --setro is thus most important. chmod gua-w /dev/loop7 finally completes our possibilities by setting the device node itself for user, group and all the others to read-only. Use losetup -d /dev/loop7 to detach the loop device.

disclaimer

You should still know what you do when you use confinedrv. Do not mount the same partition more than once at the same time except if the partition is mounted read-only two times at the same time. If the very same partition is written while being mounted read only on another host system that system will read stale data not knowing about the changes done to underlying partition by the other system. Note that sdx and sda are still the same drive, just the access rights do differ. Note also that the date and time of the last mount will be written to a non isofs partition on a mount with the -ro (read-only) option. Confine the access rights of this partition if you wanna avoid this information to be written to stable storage.

Qemu - virtual machines with kvm

Qemu is the new integrated virtualization technology of Linux. While the mere qemu is a hardware emulator that has to software-simulate every machine instruction qemu-kvm can directly execute native machine instructions. This works as long as host and guest os need the same hardware i.e. from x86_64 to x86_64 or i686. The only exception to direct machine code execution pose the so called privileged commands (protected mode commands of privilege level 0). If a user program tries to execute such an instruction an exception is raised. At this point virtualization technologies like VMWare emulate the requested privileged instruction. Modern processors with the VTx (Intel) or SVM (AMD) extension as provided by dual core machines have a special hardware mechanism for this that does not only speed up the execution of privileged command but also eases the implementation of virtual machines considerably. Relying on the new hardware mechanism a new, very slim and straight forward virtualization technology has emerged: kvm. Currently qemu-kvm is the only frontend to the kvm kernel module. To make use of kvm check whether the kvm and kvm-intel kernel modules are loaded:

If these kernel modules are present in /lib/modules/yourkernel (yourkernel: uname -r) but refuse to load (modprobe kvm, modprobe kvm_intel) then you may have a problem with the hardware support. Check out whether your processor supports VTx (Intel) or SVM (AMD) and whether these technologies are enabled by the BIOS (Intel, Dell). By having a look at dmesg or /var/log/messages you may find out about the reason why these modules do not load.

Concerning FreeBSD or OpenBSD kvm has been ported for AMD processors. Look here for the current program status.

For a full qemu-kvm experience you may additionally want to install and load (modprobe) the kqemu kernel module

Under Debian a simple /etc/init.d/qemu-kvm start will do the job and load all required kernel modules so that you can use qemu-kvm.

booting a virtual machine from a confined disk

Now let us enjoye confinedrv by booting one of our alternative operating systems on our hard disk with our current Linux installation or any qemu-kvm capable operating system. Only confinedrv can guarantee us in here that the second operating system will not access any of our partitions in use by the operating system we have already booted. In general it is a good idea to let writeable partitions only be accessed by a single operating system. That way you can safely boot a wracked Linux installation via qemu yielding quite a high confidence that possible malware on that system can not affect any other system on your computer. KQemu is directly maintained by kernel developers and offers good stability and security. Nonetheless there have already been known bugs that allow a sandbox escape for kqemu so check out the security mailing list of your distribution first.

Now let us fire up a console:

virtually replacing and verifying your bootloader

If you would like to have a different bootloader when booting from qemu you may use the mbr=./myfile.mbr command line arguemnt to blend in a file instead of the current Master Boot Record which needs to have the same size as the spare space before the first partition. Be aware that the space backuped by readout-mbr does also contain at least parts of the partition table. We recommend that you prefer to use a BIOS rather than an UEFI based bootloader like lilo when used with qemu only (grub can also be run in BIOS mode). You may also replace existing partitions by previous backups of these partitions provided that the partition and its image file do match in size.

remark: for good performance blocksize bs may default to the maximum physical block size of the source and target drive; that should work even if the file size is not a multiple of the block size.

You can also blank, reinstall and verify the bootloader against a previously taken image or zeroes. These commands only affect the first 440 bytes, i.e. the real master boot record but not the partition table. Blanking your bootloader may be useful for a hard disk you do not want to boot from by accident. It ascertains that no bootvirus or malware can reside in the bootloader of such a disk.

partition table images

confinedrv also allows to backup the whole partition table; i.e. you do not need to copy the whole disk but only the partition table and as needed individual partitions.

sparse files: backing up raw qemu partition images

At first let us create a sparse file with 4GB which only turns out to occupy 12KB on disk. Unused zeroed blocks are not stored in deed on disk for sparse files. You may use such a file with the -hda mydisk.img switch of qemu as disk image. Copy such files with cp --sparse=always.

However now when it comes to backup a sparse file on blue ray or if you want to copy it on an ntfs or vfat partition then you would need the whole 4GB on the target device when you simply copy the file. For this use case we have written the sparsefile-rescue and sparsefile-restore utilities:

other programs in drvtools (formerly diskutils): binary diff and replace, sha256sum lists & shredding the disk content

The programs bindiff and binpatch allow comparing two binary files block by block. Blocks that differ may be backed up to restore the target file from the source file later on. bindiff is also useful instead of cmp as it does not only show the first byte that differs but all blocks or the whole number of blocks that differ. The binreplace program can replace a portion of a binary file like the bootloader in a disk image. If you would try to use dd instead it would strip (i.e. delete) all the content of the file after the portion that has been replaced.

Some other utilities are included in drvtools like for generating sha256sum lists and for verifying an operating system installation against a previously generated sha256sum list. Furthermore some bash scripts for wiping the disk content based on used disk blocks are inlcuded. However these scripts have only been used once and you will need to read them if you want to apply them because they are neither documented nor extensively tested. They first overwrite all disk blocks once before attempting to overwrite them a second time. One or a few rewrites should be sufficient if an attacker would only access the content electronically. Otherwise you would need a whole lot of repetitions like the shred Linux utility does. It also has a script to generate random character combinations in the length of a file or lvm-volumegroup name in case that you want to delete with shred and thereby also obfuscate the file name.

enjoye.

By donating you leverage bug fixes, development and you help us pay the hosting costs.

here it is:

• Certain boot problems which have arised under respective circumstances with v1.2.1 due to err-ing out gap spaces needed by grub or other loaders rather than zeroing them out or making them available as read-only should now be resolved (default currently is to zero out). It is important for grub that the partition where grub resides (i.e. the menu.lst) is at least readable.
• choose for any of three modes for every partition: read, write, error or zero (sdx=sda:r1:e2,3:w5,6,7:z8); default is now to zero out any parition which has not been mentioned rather than letting any access err there (example makes a.o. partitions 5, 6, 7 writable and partitions 2, 3 err.).
• The --gap and --mbr options provide means for specifying the access rights for gaps between primary partitions or all the space before the first partition including the partition table and the MBR respectively.
• The [--noannot] --info sdx now provides a better readable map of the partition table annotated with symbolic references for the start and end of partitions by default. --loopusage shows all loop devices in use by confinedrv.
• preliminary GPT support given from v1.7.2 on

• the access protection is limited to the page size; ro-drive may mount as rw first but will then remount quickly as ro when non-readability of the non-boundary regions is discovered. Solution: align your partitions to multiples of the pagesize (as returned by getconf PAGE_SIZE).