Introducing Qubes 3.0 LiveUSB (alpha)

[Joanna Rutkowska]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

We have built and uploaded the first ever working Qubes Live USB image! :)

It's based on the recently released 3.0-rc2 release. Now you should be able to
run and try Qubes OS of any laptop without needing to install it anywhere! And
perhaps run Qubes HCL reporting tool and send us some more data? [1]

We have faced several challenges when making this Live USB edition of Qubes OS,
which traditional Linux distro don't need to bother with:

1. We needed to ensure Xen is properly started when booting the stick. In fact
we still don't support UEFI boot for the sitck for this reason, even though the
Fedora liveusb creator we used does support it. Only legacy boot for this
version, sorry.

2. We discovered that the Fedora liveusb-create does _not_ verify signatures on
downloaded packages -- we have temporarily fixed that by creating a local repo,
verifying the signatures manually (ok, with a script ;) and then building from
there. Sigh.

3. We had to solve the problem of Qubes too easily triggering Out Of Memory
condition in Dom0 when running as Live OS.

This last problem has been a result of Qubes using the copy-on-write backing for
the VM's root filesystems, which is used to implement our cool Template-based
scheme [2]. Normally these are backed by regular files on disk -- even though
these files are discardable upon VM reboots, they must be preserved during the
VM's life span, and they can easily grow to a few tens of MBs per VM, sometimes
even more. Also, each of the VM's private image, which essentially holds just
the user home directory, typically starts with a few tens of MBs for an "empty
VM". Now, while these represent rather insignificant numbers on a disk-basked
system, in case of a LiveUSB scenarios all these files must be stored in RAM,
which is always a scare resource on any OS, and especially Qubes.

We have implemented some quick optimizations in order to minimize the above
problem, but this is still far from a proper solution. We're planning to work
more on this next.

Now, there are three directions in how we want to work further on this Qubes
Live USB variant:

1. Introduce easily clickable "install to disk" option, merging this with the
Qubes installation ISO. So, e.g. make it possible to first see if the given
hardware is compatible with Qubes (run the hcl reporting tool) and only then
install on the main disk. Also, ensure UEFI boot works well.

2. Introduce options for persistence while still running this out of a USB
stick. This would be achieved by allowing (select) VMs' private images to be
stored on the r/w partition (or on another stick).

2a. A nice variant of this persistence option, especially for frequent
travellers, I think, would be to augment our backup tools so that it was
possible to create a LiveUSB-hosted backups of select VMs. One could then pick a
few of their VMs, necessary for a specific travel, back them to a LiveUSB stick,
and take this stick when traveling to a hostile country (not risking taking
other, more sensitive ones for the travel). This should make life a bit simpler
for some ... [3]

3. Introduce more useful preconfigured VMs setup, especially including
Whonix/Tor VMs.

[1] https://www.qubes-os.org/doc/HCL/
[2] https://www.qubes-os.org/doc/SoftwareUpdateVM/
[3] https://twitter.com/rootkovska/status/541980196849872896


Current limitations
- --------------------

0. It's considered an alpha currently, so meter your expectations
accordingly...

1. Currently just the 3 exemplary VMs (untrusted, personal, work), plus the
default net and firewall VMs are created automatically,

2. The user has an option to manually (i.e. via command line) create an
additional partition, e.g. for storing GPG keyring, and then mounting it to a
select VMs. This is to add poor-man's persistence. We will be working on
improving/automating that, of course,

3. Currently there is no option of "install to disk". We will be adding this
in the future,

4. The amount of "disk" space is limited by the amount of RAM the laptop
has. This has a side effect of e.g. not being able to restore (even few) VMs
from a large Qubes backup blob,

5. It's ease to generate Out Of Memory (OOM) in Dom0 rather easily by creating
lots of VMs are writing a lot into the VMs filesystem... (Alpha, right?)

6. There is no DispVM savefile, so if one starts one the savefile must be
regenerated which takes about 1-2 mins.

7. UEFI boot doesn't work, and if you try booting it via UEFI Xen will not be
started, rendering the whole experiment unusable.

We're planning to release an updated version sometime in September.

Download and burning
- ---------------------

Get the ISO (and its signature for verification):

http://ftp.qubes-os.org/iso/Qubes-R3.0-rc2-x86_64-LIVE.iso
http://ftp.qubes-os.org/iso/Qubes-R3.0-rc2-x86_64-LIVE.iso.asc

Then "burn" onto a USB stick (replace /dev/sdX with your USB stick device):

$ sudo dd if=Qubes-R3.0-rc2-x86_64-LIVE.iso of=/dev/sdX

Note that you should specify the whole device, (e.g. /dev/sdc, not a single
partition, e.g. /dev/sdc1).

And, please, please, make sure to use caution and not overwrite your HDD or
other important device. And in case you do, please, please, do not email
qubes-users complaining about ;P

Happy Live-Qubesing! ;)

joanna.
-----BEGIN PGP SIGNATURE-----

iQIcBAEBAgAGBQJVyMIeAAoJEDOT2L8N3GcYSi0P/jeG6/4M5Ux6BjKDXP3+OrRC
YM+vL+JZcbn3vPOYifgl+LndMEmwYEBLrSMnqmj/Ze5iC9qLYzOM33032xL2GJBu
NLUujS9Y1Z4xocLQ6sgmeXbvxsqPGQ4CE79UWA438mqGcjkFd85IamEijyYaj/fY
Wz1TnK2Lwys5gMrCArPpqPL1dmQuGW4uZTABIw3wxyIlqLZ7HSTLVNIiiCOIfklG
xbMBB1l71WUgLfTxA14AUJI02R65mg3B/kkMq9I3pZCXhdE9G7dd8s3nH/wV7mrA
5nOM0slZ9Q+IXPPu6UbfHt7kHQ+qHToSUURF14nmsbftaWsjBvIOsCNZ2njCQQIH
yXvsSp8J+kpiy57C/7i261qlp3O0/L6jsvLBwovOTlHzrM2KUj7XRfmTguj8QMUk
R3LQC+dXr7wgg7f31jiAgkKR3LkPuFEJ9y/8+esnMCg5JjMoYvU68Gl2RUoXynDX
bCXZ0cW+rxcD1hIEDef9WwUa3Drx3aquVfAUGZ4WGj+TNRFKxmqY/CUTTr8nShfO
rsoHctHsmWDWqgfM0RqUnFi8fzj/mGTr11Y9I/gdTrdOheQdxIYkKCW+naBht7jr
dS0xB1cOl/Xhqngorkt6vaqbXny8TmH7vG7PNiQdARAKrFKFW3Qmp3si3t21OtaW
seNGJL/0vJpo3CkV7Agc
=2CxZ
-----END PGP SIGNATURE-----

[nicolas wagrez]

That's very good news!  You and your team are doing an awesome job!

Is there a minimum recommended amount of ram for this alpha since you mention the out of memory concerns?

Nicolas

[Vít Šesták]

Cool. Having both a live system and installer on one media will be great.

Regards,
Vít Šesták 'v6ak'

[Franz]

Thanks

[Outback Dingo]

welp tried it on a laptop after burning the image to an 8Gb usb stick, 10 mins to boot and failed with 

Warning: /dev/disk/by-label/qubes-R3-rc2-x86_64-LIVE does not exist

Warning: /dev/mapper/live-rw does not exist

so i guess... FAIL! has anyone else attempted to boot this ?

 

Thanks

--
You received this message because you are subscribed to the Google Groups "qubes-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/CAPzH-qCNJMtLTV9u3thSS%2BNYXTfj%3DkX9d%3Dd_5dFKTKCXH4zpow%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

[Markus Kilås]

On 08/11/2015 09:58 AM, Outback Dingo wrote:
> welp tried it on a laptop after burning the image to an 8Gb usb stick,
> 10 mins to boot and failed with
>
> Warning: /dev/disk/by-label/qubes-R3-rc2-x86_64-LIVE does not exist
> Warning: /dev/mapper/live-rw does not exist
>
>
> so i guess... FAIL! has anyone else attempted to boot this ?

I also get this failure (actually mine says "R3.0" but I guess that's
the same). Before it there is also some errors from nouveau and this:
mce: Unable to init device /dev/mcelog (rc: -16)

I verified that the USB-stick was fine by reading back the data and
diffing it with the original image (which I verified the signature of)
and tried again but still with the same result.


Cheers,
Markus

[XO...@riseup.net]

Just an thought, are you by chance using UNetbootin to create your USB stick? I recall similar issues with archlinux ISO and UNetbootin where UNetbootin would overwrite the syslinux.cfg file. The archlinux wiki has a good description of the issue and fix with their ISO, and how mismatching "label" or UUID would prevent booting from a USB stick.

I could be completely off here, just throwing it out there as a thought to try and help you two...

[Outback Dingo]

On Thu, Aug 13, 2015 at 2:26 PM, XO...@riseup.net <XO...@riseup.net> wrote:

Just an thought, are you by chance using UNetbootin to create your USB stick? I recall similar issues with archlinux ISO and UNetbootin where UNetbootin would overwrite the syslinux.cfg file. The archlinux wiki has a good description of the issue and fix with their ISO, and how mismatching "label" or UUID would prevent booting from a USB stick.

I could be completely off here, just throwing it out there as a thought to try and help you two...

Nope as always i used straight dd if=image of=sdX  bs=1024k and as per the instructions

 

On 08/12/2015 01:06 PM, Markus Kilås wrote:

On 08/11/2015 09:58 AM, Outback Dingo wrote:

welp tried it on a laptop after burning the image to an 8Gb usb stick,
10 mins to boot and failed with 

Warning: /dev/disk/by-label/qubes-R3-rc2-x86_64-LIVE does not exist
Warning: /dev/mapper/live-rw does not exist


so i guess... FAIL! has anyone else attempted to boot this ?

I also get this failure (actually mine says "R3.0" but I guess that's
the same). Before it there is also some errors from nouveau and this:
mce: Unable to init device /dev/mcelog (rc: -16)

I verified that the USB-stick was fine by reading back the data and
diffing it with the original image (which I verified the signature of)
and tried again but still with the same result.


Cheers,
Markus

--
You received this message because you are subscribed to the Google Groups "qubes-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/55CC1C60.1090403%40riseup.net.

[Manuel Amador (Rudd-O)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 08/10/2015 08:24 AM, Joanna Rutkowska wrote:
> Hello, > > We have built and uploaded the first ever working Qubes Live USB image! :) > [...] > Happy Live-Qubesing! ;) > > joanna.

Thank you!  This rocks.  It will help get Qubes many more users to have the ability to try it.

- --
    Rudd-O
    http://rudd-o.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVzt+/AAoJEFmZwbV7vYQ2oA8P/2ugFKQ1yGbNkzBgTE1VkVCJ
uk6jann09zV3rwz9G/0lS+GrljbywKf/txhbU7HDTOaSbgZX1y4paOmPHOnw3HeZ
H+hPfaVUQit6CaZh8mgRpKkkW8sTlEegIdQztza85mv+cYO59lQBCDfjPWMGoV35
zot0Tebi56gJBEOKwYiUBBR8z9YRa+9AVIZ9lk2v8NQo2YNBUkcEQ4Sar1aO+FtX
mTBwSqQAZ/VsVouBiW2jbygWW8RjOuEvcXLa4+gY9/DrmOIYviBywoerrdyRH0Md
d7O+ihuRCXR8bHQw4tHRCjVnfm8OYSI63j2A3Acy8EYHShkivQbxb7itOg9n4EnO
J6awicihAro2Th8bMiGTeSwTyc5C79oY325MM6Vs6Wb9GfwYIaF22c8WaJ+cS4Vv
7kiSWoCGsTe/1m6evEPMk921KhrZ+DXYxaJTkDcOEdbPNULIvC7rKxOw24vjzvsM
hX5LstcRU0xmBWbbjMZgAz7/dghfxMk1o2XqMX+TYvlklbJy0Rt8q/PaTUmdPrFr
i6zKwWaNV9AavQZl5/X4xSfUHb9/zbtzkjkjRWAwRN+alP+ZW/Ssg05xsESWJvBS
NVwAIwaRnmD3htoSl2N2RmbYyfr8c+c4wKinDGmmEB+O3u89i/+Z/hU2BpeK2g54
xIHQulvIhBn3q5PZT7HB
=qgo9
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

USB2 or USB3?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV3SofAAoJENuP0xzK19csKmgH/iGak4y8qw3Ihu1y2n3DlAHV
pJj5tD27cRELpgxfrV91upmDDCrbst0wpHKwWCo964YYHzbB4QBm8yw9f07EOya4
mWFmqWhG5b1jj70PyHqtQijxWRSg2liOdGPQ4sYBpNdlX9VhtZ9C1NXTHwZPVJnF
i/uzcQUy87NCxVkfq9TqobygSP9UuXfyHUbdileMLeeITIIaYRL76DhWHhvcKqqd
tJue3uUlj4ilGQGdRhwKo5i4QroiA88CgilBdMQ3eIc5zrKFSUUYCGBzq3PqaYF+
Q9UWJ+HbvcQyYZbDP7ltHvrw/M9aNSGpvTsA7EbizoJBu9+L67vB7O3cOuRduzY=
=Enlo
-----END PGP SIGNATURE-----

[Andre Soileau]

Where are you writing the temporary AppVM files to on the USB stick? I'd like to modify this so the USB stick (or sd card) is read only, with changes only in RAM. You had mentioned RAM being the limitation, and I'd like to try to make a version that only uses RAM.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Actually this version uses only RAM for it.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV6HpqAAoJENuP0xzK19csx6YIAIMhbXzB3iZjsUrX5+tL3ZB7
xZys2GsW1HED7L/AHnBzF7o4eq6SwolulpCe44w/0wHpJh5Skx+k6FkYPpoEfMxD
iVENA3PXfPu7LBmXdXJQ9HE3txrJ8ypfL1ObZi9rN2s6yFnNVq4NKBkLZTuju4eO
/iCGUz4k3wbt/1xYDT8GQ6HrrdpQaNeHCWNyRHuWhDGAE3kWLCR+CKSCCJQ7Uca2
WHyMH+RAhfSDUL11XKgYdAb6URM8czRT3pZD7K/wZnoYcsgJHwUkSOCTiYIPb+SX
B7nr/+cOCBCvmFSgHr0RhEP58zp7aJN1nJaz+ndYnt+QkVNB13/cMvZNBus5Lho=
=tqp3
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, Sep 03, 2015 at 06:50:50PM +0200, Marek Marczykowski-Górecki wrote:
> On Thu, Sep 03, 2015 at 09:24:59AM -0700, Andre Soileau wrote:
> > Where are you writing the temporary AppVM files to on the USB stick? I'd
> > like to modify this so the USB stick (or sd card) is read only, with
> > changes only in RAM. You had mentioned RAM being the limitation, and I'd
> > like to try to make a version that only uses RAM.
>
> Actually this version uses only RAM for it.

Take a look at the message "Live USB warning" on qubes-users ML[1]. It isn't exactly true
that "only" word in the above sentence.

[1]
https://groups.google.com/d/msgid/qubes-users/20150903213020.GC1040%40mail-itl

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV6L7pAAoJENuP0xzK19csWY0H+wYcv/LFR84NJbLpNY4+sIik
tSoK5hxTClHNhN8RlckRyV3SMkUJmGuGXySnbuC/DBezA6dqsR3qqRHLtQnB2MAW
SfGSRM0+ZBZ+hmxHOSwIoWMEnafkIBFggsNtbRyHfLKFKvQGLD35jB+gg4CE32d9
k/tlsLxoY39PDpxoAuMVfu0xU48Q89IhZsN4PInMLJkNUs3/tqBf3dcSQzhFPNGK
fE4fdj7LFJtyQ5GQozfwbCYQAku45LaGmAMGmM4n6hPHRE9DekWqKGZhVO69fUMc
CQeuUc4Qbtcbr5Sbnw0Vm4N7iqNJpoHhq5JhmWZvHvGgeqp55E5mEhxfyvnFKto=
=TUXi
-----END PGP SIGNATURE-----

[blzal...@gmail.com]

Can we edit the Qubes ISO somehow? I'm interested in burning this onto a Blu-ray along with all my development tools.

[obert...@gmail.com]

Bios -
I have two laptops , they both ahd UEFI ..
the lenovo, has a secure boot button, when I power that up, i don't see the USB drive to boot from, on the ASUS laptop, also do not see this,
did you manually add this in the bios ? can you say how, or
you used an old PC without UEFI bios

Thanks

On Wednesday, August 12, 2015 at 5:59:32 PM UTC+2, edwin...@gmail.com wrote:
> I've just tried the Live USB (see other email 'HCL - M5A99FX PRO R2.0') and it booted fine (in legacy BIOS mode, on an otherwise UEFI BIOS).
>
> I had to update /etc/resolv.conf in the VMs, because I got this by default which didn't work:
> [user@untrusted ~]$ cat /etc/resolv.conf
> nameserver 10.137.2.1
> nameserver 10.137.2.254
>
> After I updated /etc/resolv.conf to this then Firefox and ping worked:
> [user@untrusted ~]$ cat /etc/resolv.conf
> nameserver 10.137.1.1
> nameserver 10.137.1.254
>
> Any idea why I got the wrong DNS server for the VMs?

[Outback Dingo]

also i noticed that it claims UEFI boot wount work, however Im curious if you configured grub properly to boot XEN / Fedora uunder UEFI.. i have Fedora23 loaded with XEN on another laptop boots from UEFI fine... my config is

 cat /boot/efi/EFI/XEN/xen.cfg                                                                                        

[global]

default=xen    
[xen]  
options=console=vga,com1 com1=57600 loglvl=all noreboot placeholder root=/dev/mapper/fedora-root ro rd.lvm.lv=fedora/root rd.luks.uuid=luks-
a0621303-807a-448b-bbdc-d9da4edd5af6 rd.lvm.lv=fedora/swap rhgb quiet    
kernel=vmlinuz-4.2.6-300.fc23.x86_64 placeholder root=/dev/mapper/fedora-root ro rd.lvm.lv=fedora/root rd.luks.uuid=luks-a0621303-807a-448b-
bbdc-d9da4edd5af6 rd.lvm.lv=fedora/swap rhgb quiet ramdisk=initramfs-4.2.6-300.fc23.x86_64.img    

mind you Im using the recommended grub.cfg for XEN UEFI boot.

is Qubes setup the same way ?

--
You received this message because you are subscribed to the Google Groups "qubes-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/b0e47c12-c05f-4156-ac43-f17e6b076e06%40googlegroups.com.

[Stefano M.]

Same here with Dell Latitude E5440...
Then changed USB port and worked! :)
(worked on the one on the back of the portable pc, while not worked on the right side)
I think ok was usb2 key on usb2 port.

@Joanna&QubeOS team: thank you for your efforts, great job!!!

Happy hacking!
_Stefano


Il giorno domenica 11 ottobre 2015 22:01:00 UTC+2, andrea...@snikt.net ha scritto:

On Sunday, 11 October 2015 17:56:21 UTC+2, talex5...@gmail.com  wrote:
> On Tuesday, August 11, 2015 at 10:58:35 AM UTC+1, Outback Dingo wrote:
> [...]

> > Happy Live-Qubesing! ;)
> >
> >
> > welp tried it on a laptop after burning the image to an 8Gb usb stick, 10 mins to boot and failed with 
> >
> >
> > Warning: /dev/disk/by-label/qubes-R3-rc2-x86_64-LIVE does not exist
> >
> > Warning: /dev/mapper/live-rw does not exist
> >
> >
> > so i guess... FAIL! has anyone else attempted to boot this ?
>

> Same here. Long wait, then a Dracut prompt. The USB stick doesn't seem to be recognised at all (it would be really nice if Qubes could disable Plymouth, so we didn't have to wait so long to see why the boot failed).
>
> Is it worth trying again with the 3.1-alpha, or will the same thing happen? (I am trying to investigate my problem with slow window rendering by trying other versions of Qubes).

Same here on a Dell Latitude E7440. The USB drive is not detected (haven't found it within dmesg when grepping for the vendor or usb-id). Maybe it's related to the internal USB-connected devices (modem, etc.)?

Stored log files (rdsosreport.txt, dmesg and lspci output) if this helps you.

cheers, Andreas