search

tasket / Qubes-VM-hardening

Fend off malware at Qubes VM startup
GNU General Public License v3.0
74 stars 11 forks source link

File change detection #4

Closed tasket closed 6 years ago

tasket commented 7 years ago

In parallel to the file-replacement feature in vm-sudo-protect.sh, it should be possible to detect when certain files have changed. The could be done by including a SHA manifest for 'vms.all' and/or individually-named VMs: /etc/default/vms/vms.all.SHA /etc/default/vms/sys-net.SHA

The hashes contained in these 'manifest' files would have absolute file paths and could be checked with sha256sum -c.

Detection could be reported via popup notification window and system logs.

tasket commented 7 years ago

Implementation now in systemd branch...

tasket commented 7 years ago

Detail:

When a check fails the service opens an xterm CLI for examining the VM. When xterm is closed the VM goes to shutdown.target -- though maybe another choice would be better such as emergency.target?