Guide: Offline VM with Encrypted Disk on Qubes OS - V4 Setup: /dev/sdb1 - Internal Drive - Manual Unlock

[qubist]

@User.LinuxOne

I’m adding an additional security layer to my offline VM.
By using a separate encrypted storage device with its own LUKS passphrase, even if the offline VM were somehow compromised, it would not be able to access or enumerate anything on that storage. In other words, the VM remains functionally isolated from the underlying data.

How is a VM functionally isolated from the storage it:

1. Unlocks (knows the secret to)
2. Uses for read/write operation

Please also note that after this

sudo cryptsetup luksOpen /dev/sdb1 myencrypted

the unencrypted drive can be attached to any VM. All that is required is a user-side mistake to attach the device to the wrong VM.

I do consider this a security problem. We discussed it in this thread:

Can't access external LUKS drive correctly

I guess so. Although I don’t fully remember if/how that ever worked. To me that kind of composability feels elegant and Unix-y. A subsystem is explicitly granted access to the plaintext layer device, and it works in a transparent fashion without any special support. Sure it’s possible to grant this access by mistake, but that’s also true for other kinds of devices. Maybe it should be addressed on a general level if the device widget makes it too too easy by accident, e.g. by misclicking. IIR…