Utilizing Write-Blocked SD Card to Improve Security

[ProfessorManhattan]

Hey @tzwcfq

@tzwcfq

You can access the SD card registers only when it’s configured as MMC block device (/dev/mmcblk*) and can’t access them when device is configured as USB Mass Storage Device (/dev/sd*).

Can you link to a reader that mounts as mmcblc? The one I have mounts as sd. If possible, can you link to one that connects via USB?

@tzwcfq

If you have have non-persistent VMs on secondary storage that may be infected and they have a way to infect dom0 then there is no point in persistent dom0 as it will be infected again on every boot and in the end will be infected on your SD card when you’ll want to update dom0.

Yeah, I don’t expect it to be able to block any malware. But doesn’t it make sense to write-block any files on a system that don’t need to be dynamic? It could potentially block a malware that relies on a persistent modification to anything the write-block protects. Any idea on what other major components of Qubes we can write-block in addition to /boot?

Hey @slcoleman,

@slcoleman

If in your particular use case a real write protect is important then it is possible to use an Opal 2.0 SED drive with a write protected range defined over top of the partition containing your files. The range will be read-only and enforced by the drive itself so no software can bypass this enforcement.

This is cool. I didn’t realize these exist. I think this is the solution I would choose. Two concerns I would have are: Can I use RAID? And what would it look like to load as much from the partition as possible? tzwcfq mentioned that we should do this with /boot. What other areas of the file system can we lock down? Also, do you know if it would be possible to write-block only specific files on the partition? I’m trying to figure out how to use Ventoy to boot ISOs but allow persistent Live CD data.