Mirage-firewall DispVM Template

General Discussion
#1

Would it make sense to have the mirage-firewall be available as a template, which could operate as a
disposable VM in the event there is an exploitable vulnerability?

#2

Here’s a saltstack script which downloads and installs the mirage firewall:

Based on this bash script:

3 Likes
#3

How can I run this saltstack script? Would you be kind to share instructions? Thank you.

#4

AFAIK mirage-firewall itself is stateless. It won’t store data that is persistent across reboots.

1 Like
#5

:100: it doesn’t even onboard the concept of storage apart into memory :slight_smile:

1 Like
#6

If you want to get familiar with saltstack on qubes, I recommend this page:

If you don’t know how to use salt and still want to create a mirage firewall with a script, I’d rather recommend the bash script to be run in dom0:

1 Like
#7

Thanks. One more question. If you create a mirage firewall with a script in a Fedora Qube, is it expected that the sha512 checksum / hash of the output, the mirage-firewall.tar.bz2 file, to match the one posted here https://github.com/mirage/qubes-mirage-firewall/releases/download/v0.8.4/mirage-firewall.tar.bz2 ?

#8

I guess yes, because the built binary is reproducible.

#9

You have to use sha256sum vmlinuz (not 512, and not the archive tarbal), and yes it should :slight_smile:

EDIT: not sure if you think about compile it by yourself (it should with the build_with_docker script in the qubes-mirage-firewall github repo), or you want to check the vmlinuz hash sum after downloading (in that case it should if you download the latest release).

#10

I compiled the mirage-firewall twice following the qubes-mirage-firewall github repo instructions in fedora-37 Qube, and using build_with_docker script.

And I downloaded the mirage firwall pre-compiled twice using different internet sources.

sha256 for vmlinuz in both compiled versions is the same: 848714b3d8e1d06d83e77ee688c32796f353fcafa7d8643db0e4d889b568e36e.

sha256 for the vmlinuz pre-compiled downloaded from github is the same: 55a2f823d66473c7d0be66a93289d48b6557f18c9257c6f98aa5a4583663d3c2.

So no, vmlinuz is not the same in the pre-compiled published version and the compiled version. Does this mean there’s a problem somewhere?

#11

Yes, something isn’t clear here. I’ll check that tomorow.

#12

Oh I think we’re into Reproducibilty considerations and tweaks · Issue #165 · mirage/qubes-mirage-firewall · GitHub and 3 weeks ago some package has been updated leading into that bad hashsum.

I also have the same docker hashsum as yours into my github actions (Main workflow · palainp/qubes-mirage-firewall@609f529 · GitHub) and I’ll PR to update to the right hashsum.

Thanks for the report!

#13

The salt script fails if the check sum differs from the docker build according to this comment: Qubes R4.1 · Issue #173 · mirage/qubes-mirage-firewall · GitHub

#14

I realized there is a simpler way. You just create the template and then in the settings window → Advanced
tab, you can check disposable template. Way simpler :slight_smile: