mounting root TemplatVM partition in dom0 fails

[rss+...@armor-mail.com]

Hi,

I have some templates stored in a "file" pool where, for example, I
find the following files:

private.img
private-cow.img
root.img
root-cow.img

I can do this in dom0, no problem:

sudo mount private.img /mnt

But this fails:

sudo mount root.img /mnt

with a very common, uninformative error, ie.

mount: wrong fs type, bad option, etc. etc.

I would dearly love to mount the root.img and modify a file in /etc file
in a broken VM. Any hints would be welcome.

[Rusty Bird]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

rss+...@armor-mail.com:

It doesn't work for the 'root' volume because that contains multiple
partitions. The / filesystem is on the 3rd. You could use kpartx to
mount it, but mounting any VM or template filesystem in dom0 is
insecure! The kernel can not be assumed to be robust against a
potentially malicious filesystem. Better to attach your broken volume
to a e.g. a trusted DisposableVM for recovery:

https://github.com/QubesOS/qubes-issues/issues/4687#issue-396119132
https://github.com/QubesOS/qubes-issues/issues/4687#issuecomment-753492903

Rusty
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEhLWbz8YrEp/hsG0ERp149HqvKt8FAmEtPwBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDg0
QjU5QkNGQzYyQjEyOUZFMUIwNkQwNDQ2OUQ3OEY0N0FBRjJBREYACgkQRp149Hqv
Kt9EWw//SgfIibkUYNZzoidjiQgg7SSu9+jAFWFL3iBJU40el2hn6kiZ8cl/CGGg
RAz/3AIyw2dtb1uoFc9TafjoUXlzlfXhcMEIHylggwzTkD2cL3EglBnhVw5x9a54
CS24qWUee8BhP50inZOEV0vUYCjO34948AveOKhD9YoVlwL0DUdvpeX8AaxiZmyP
L+pl9jwvbdHE2DqhTle/vqL81lVHe3eM8ZQ798cm9q5pPbVH/x4nvmYdswmYgDN6
eSSNNblZ0BezuV7yuPpRSEOxxbkyhQMEfLqopvVEeFD8Ittv8z7C+jutp00RSmyT
aOTyjCTWMoBKnSSE/IOOJkA3D+i6xHsK/lkP6j0AegRNiTV8m9oLKc+n4i1HNgPp
MJz357hBF5Z8MPdfpNbT+hhpMpr7cVh2g1S3X01kO9Taom4QY3Mk+v1d61DgfgqO
jWZuP8qV+9P8o9ifY0XsSXbVdixivujwOJS6hiiUl98fM502uHz1kDqzvmqR5umd
Prb/c6yLRlCcBluM/cYIdBKcY6OhBx1eI/cUW2mmr/csICpjgwygVHsvJ82ou5yW
aKMn9M2LCrbRy9tjDcs+Yd1ckEm0L/VIhJRfCx1hm8+twIzhwHqg2MDY+mAqfBZz
bnykRv6i7YhaQXZ7Fy2ieaCDphFHnYOrAsi6FyVfnwmHZzL4Qc8=
=dUVg
-----END PGP SIGNATURE-----