How can Opensnitch rules be made permanent in a disposable VM?
I tried without success:
* set bind-dirs to etc/opensnitchd/rules in the disposable template, restart, and set the rules
* setting the rules in the TemplateVM (not possible to set a node, so cant create rules)
* exporting rules from appVM to TemplateVM. Opensnitch in TemplateVM claimed import went fine, but in reality it did not
That’s the way it should work. Could you post everything you’ve configured and where?
This is what i did in the disposable template:
- sudo mkdir -p /rw/config/qubes-bind-dirs.d
- sudo touch /rw/config/qubes-bind-dirs.d/50_user.conf
- Add to 50_user.conf:
- binds+=( ‘/etc/opensnitchd/rules’ )
- Reboot the disposable template and set the rules in Opensnitch GUI (using duration=forever, obviously)
However the rules does not persist anywhere.
If bind-dirs is the way it should work, could it be that /etc/opensnitchd/rules is not the only required folder?
What you want does not work - a disposable vm at runtime, only inherits the state of its template.
Every change that happens while running is discarded - hence disposable.
Since opensnitch will write the rules within the disposable, they won’t survive the reboot.
Technically speaking and to no regards a recommendation. You could assign a secondary storage to that vm at boot, edit the systemd unit and change the exec line to use a different rules path…
If you also plan on going down the route of having a central opensnitch gui vm that aggregates the other instances, I would argue to find a different solution to your problem without using opensnitch. Personally I would deem that, by the usual use cases of disposables, as too risky.
The disposable node VM inherits rules from the /rw/bind-dirs/etc/opensnitchd/rules in its disposable template (also an appVM), not from the original template (e.g., debian or fedora). This does not happen automatically, unless one employs some form of syncing between the disposable and its disposable template. So, to achieve persistence, you will have to manually copy rules out of the dispVM and into the bind-dirs of the disposable template.
If I misunderstood what you want (rules persistent in Disposable Template, always discarded in DisposableVM) and instead you want what the others seem to be getting at (only OpenSnitch rules persistent in AppVM, no other files) then you’ll want to use custom-persist: How to make any file persistent (bind-dirs) — Qubes OS 4.3.1 documentation