Partitioning Scheme
sevas
I am installing qubes on them together.
Does qubes automatically install dom0 to the m.2?
The boot partition is showing as m.2.
I will be qvm-pci attach-ing the ssd to 1 or two specific qubes.
Everything else should be m.2.
awokd
well but to make sure, you might want to temporarily disconnect unused
drives when installing the OS.
sevas
actively change... sizes or something for VMs.
I wasnt sure how to remove the drive before installation. Without having the
PC open while it was running and remove the hard drive after partitioning and
before installation. Which I suppose I could do. I doubt it would hurt anything.
But I didnt.
Heres what Im trying to do.
I had qubes installed without it. I wanted to install android. Android didnt
recognize the virtual machines. So, I plugged in a 2nd disk. I was able to
qvm-pci attach my SSD. Android recognized it and was able to install.
However, my disk was not encrypted and I wanted to move it into the qubes LVM
so it would be encrypted and then pci attach it.
So, I formatted it using Parted and fDisk, respectively. Then I tried to convert it into a Physical Volume. I was able to PVcreate the partition (sda1), but I think I need to grab the whole disk, right? PVcreate sda gave the error:
#device not found (or ignored by filter)
A quick search directed my attention to /etc/lvm.conf
where it said to comment out the line 'global_filter'
#global_filter = [ "a|./|" ]
Mine was already commented out. They also said add my device in there.
global_filter = [ "a|sda|" ]
Of course, restart machine.
Nothing.
They said to use Parted instead of fdisk.
And use partprobe
And check /proc/devices (still there)
And use PVcreate -vvv
...same info.
I gave up. Couldnt find the answer.
I installed again. And when attaching my SSD to the HVM, my machine crashed and
will not start again. So that bombed.
$fsck /dev/mapper/qubes-dom0-root seemed to have solved this.
My idea to fix this is one of two.
Either figure out how to PVCreate /dev/sda which means reinstalling everything again.
Or.
Figure out how to shrink the qubes 'pool' to not include sda and maybe create a
new Volume Group for sda which I can qvm-pci attach to specific qubes.
Or. qvm-pci attach usb controller and run android off usb. However this is not
ideal because my internet connectivity is hosted via usb and that removes all
tunneling.
One way or another, I do need to remove this ssd from dom0 and app/templateVMs.
Thanks for your patience with this.
sevas
install qubes twice. Once on each device. Then format the 2nd device from inside
the 1st qubes install. Keeping the LVM and LUKS while maintaining separation.
Then I should be able to mount the device without any issue...
sevas
vgreduce says theres no space.
Ubuntu says enable discard on root.
Fedora says discard is dangerous to enable.
Qubes says there is no current solution.
Confusious says make qube and dd if=/dev/random and delete qube.
A liar said fallocate would allocate all the memory.
awokd
> Heres what Im trying to do.
>
>
> I had qubes installed without it. I wanted to install android. Android
> didnt recognize the virtual machines. So, I plugged in a 2nd disk. I was
> able to qvm-pci attach my SSD. Android recognized it and was able to
> install.
> However, my disk was not encrypted and I wanted to move it into the qubes
> LVM
> so it would be encrypted and then pci attach it.
By PCI attaching it to a VM, you are effectively unplugging it from dom0
which means it can no longer manage or decrypt the drive, and I can see
why a surprise removal of it would crash your computer if you had it set
up for that.
The options I see for you are:
A) Go back to 3.2 with the emulated disk controller Android can detect
(see https://github.com/QubesOS/qubes-issues/issues/3651).
B) Wait for someone to add a feature to 4.0/4.1 to change the emulated
disk controller type per VM (or find out if there is a more direct means
to change it). This would let you add both your drives to the same LVM
pool and encryption, and use regular drive images for your HVM.
C) Dedicate and passthrough the single SSD only for your Android HVM
without encryption etc.
> My idea to fix this is one of two.
> Either figure out how to PVCreate /dev/sda which means reinstalling
> everything again.
might be the safest approach. Fdisk the SSD (assuming there's nothing you
need to keep on it), shutdown your computer, physically disconnect/remove
the SSD, power on and reinstall Qubes if needed. Then power back down and
reattach it. You can then use it with one of the above options. If option
B, suggest manually setting up cryptsetup on it with the same password and
then a separate LVM pool.
sevas
> On Sun, March 25, 2018 3:07 am, sevas wrote:
> > I had qubes installed without it. I wanted to install android. Android
> > didnt recognize the virtual machines. So, I plugged in a 2nd disk. I was
> > able to qvm-pci attach my SSD. Android recognized it and was able to
> > install.
>
> I'm surprised this actually worked without trouble!
lol!
> The options I see for you are:
>
> A) Go back to 3.2 with the emulated disk controller Android can detect
> (see https://github.com/QubesOS/qubes-issues/issues/3651).
Not a chance!
> B) Wait for someone to add a feature to 4.0/4.1 to change the emulated
> disk controller type per VM (or find out if there is a more direct means
> to change it). This would let you add both your drives to the same LVM
> pool and encryption, and use regular drive images for your HVM.
>
> C) Dedicate and passthrough the single SSD only for your Android HVM
> without encryption etc.
Im now thinking about doing this with an SD card. Do you think that would work?
Well, Im going to test it tomorrow.
> I'm not exactly sure I follow what you've done to this point, so that
> might be the safest approach. Fdisk the SSD (assuming there's nothing you
> need to keep on it), shutdown your computer, physically disconnect/remove
> the SSD, power on and reinstall Qubes if needed. Then power back down and
> reattach it. You can then use it with one of the above options. If option
> B, suggest manually setting up cryptsetup on it with the same password and
> then a separate LVM pool.
I could encrypt it from within qubes and decrypt it before use with VM, right?
Qubes manages encryption and android is none the wiser.
-With Qubes on 2 drives:
--Ive tried trimfs and
--allow-discard on root and luks
--shrinking the pool= no info on google about this
--qvm-create BIGVM && dd if=/dev/random of=/BIGFILE.img count=250GB && qvm-remove BIGVM >>shrink pool
----no cigar
>>I'm not exactly sure I follow what you've done to this point,
PVcreate: Qubes installation with one m.2 only.
Added SSD later.
$ sudo pvcreate /dev/sdb
#Error device not found (or ignored by filtering)
Am I supposed to use $ sudo pvcreate /dev/sdb1 ?
I wanted to PV the entire device and not just the partition(s).
$ nano /etc/lvm/lvm.conf
>#global-filtering = [devices] #No change.
>global-filtering = [sdb] #did not fix.
>global-filtering = [devices] #did not fix, of course. 'devices' is just generic for 'add your device here'. But I un-commented it anyway. And restarted.
Im pretty sure Im just misunderstanding the pvcreate tool. I will read up on the
correct methods tomorrow too. But some people were using 'global-filtering=sdb'
and they could suddenly 'pvcreate sdb' device without partition without errors.
sevas
device and is this necessary?
I think it is necessary because if you have x amount of bytes not in PV and therefore not encrypted then that is enough for a small attack intrusion, right?
awokd
> Im now thinking about doing this with an SD card. Do you think that would
> work? Well, Im going to test it tomorrow.
> I could encrypt it from within qubes and decrypt it before use with VM,
> right? Qubes manages encryption and android is none the wiser.
every time you want to use it which is not very practical.
> Im pretty sure Im just misunderstanding the pvcreate tool. I will read up
> on the correct methods tomorrow too. But some people were using
> 'global-filtering=sdb'
> and they could suddenly 'pvcreate sdb' device without partition without
> errors.
its default.