Which case is correct by default in Qubes OS?:
When the USB flash is attached[1] and the partition is mounted read only, then unmounted and detached[2], and after that the USB is attached on other people’s compromised machine that tries to check if the USB flash was used on Qubes/Linux: what happens is:
- It can’t determine if it was even attached and read on some computer.
possible reason:
... because there's absolutely no changes made to the USB in the process.- It can determine it was attached and read on some computer, but can’t determine if it was Linux or default Windows.
possible reason:
... because the USB itself, once got electricity, and without any system code, it writes to itself that it is attached on some computer, while the system software itself never writes anything to the USB.- It can determine it was attached on Linux, but not specifically Qubes OS or any hardened.
possible reason:
... because the system low-level code (being general Linux and not specific to Qubes OS or a hardened system) automatically writes system info to the USB once it is attached. (if so, then what configuration can be made to avoid the system doing so? or is it technically a must, in order to do anything to a USB flash, that the system writes system info to it (even when would be only reading data?))- It can determine it was attached specifically on Qubes OS.
possible reason:
... because dom0 or sys-usb do some Qubes-specific operation to the USB that writes on it or makes it possible for another physical machine that checks the USB to know it was Qubes OS. This Qubes-specific operation can be taking place once the USB is put in the USB port (hence can avoid by modifying some system code - if technically possible), or once a `qvm-block` command is used (hence can avoid by using sys-usb itself to mount and read the data when no other USBs are attached), or once `mount` or `umount` command is used (hence can avoid by modifying the responsible code to avoid writing metadata / system info), or something else (mention it?)If (3) or (4) is the correct case, then the question would be: “Is there a possible configuration that will change it to be (2) or even (1)?”
I asked this question because it seems difficult to know what happens to the USB, since it might be that both dom0 and sys-usb are doing Qubes-specific operations to the USB, so must look at much code to know what do they write to the USB. Also the VM which the USB will be attached to - will mount -r or qvm-copy or umount command write anything about the system to the USB? etc.
[1] “attached” means the USB stick is put in a USB port then the command qvm-block attach VMNAME sys-usb:DEVICE_ID is run in dom0, then mount -r is run in VMNAME. The USB flash comprises only one partition formatted in FAT32 on some other computer (does the partition table type (GPT or MS-DOS or other) matter?). sys-usb is a new started DispVM based on a clone of the default-downloaded debian-13-minimal with only apt install qubes-usb-proxy run. VMNAME is also a new started DispVM based on a clone of the default-downloaded debian-13-minimal with only apt install dosfstools run. Disposable templates for these sys-usb and VMNAME are just created AppVMs with nothing done to them, not even started. VMNAME only does run mkdir /mnt/xvdi && mount -r /dev/xvdi /mnt/xvdi && qvm-copy /mnt/xvdi && umount /dev/xvdi && poweroff.
[2] “unmounted and detached” means umount is run in VMNAME, then qvm-block detach VMNAME sys-usb:DEVICE_ID is run in dom0, then USB stick is pulled.