Skip to content

Add VirtualBox host software

Rationale: running a proprietary OS in a virtual machine inside Tails would be useful by folks who cannot afford doing without their preferred Windows-only piece of software but still want to work in a relatively secure environment.

Next steps

  1. Install VirtualBox packages from our APT repository instead of from config/chroot_local-includes/usr/share/amnesia/packages/.
  2. Rewrite history of feature/virtualbox-host to not include the host binary packages.
  3. Try just deleting the VirtualBox networking drivers files (vboxnetadp and vboxnetflt) to disable network support altogether, see if it breaks anything else, (proposed in January 2013 in the "Tails 0.14 rc1 virtualization testing & howto install virtualbox and vmplayer" thread)

Later / maybe

  1. Research how to disable VirtualBox network modes that bypass the Tails firewall: see discussion on tails-dev (2012Q4, "Tails 0.14 rc1 virtualization testing & howto install virtualbox and vmplayer" and "VirtualBox host software vs. networking" threads).

Resources

  • How To Set Up A TOR Middlebox Routing All VirtualBox Virtual Machine Traffic Over The TOR Network (Using an adaptation of this we could instruct users to set up each guest with Bridged Adapter on vnet0 and then it should magically rout all traffic from the VM through Tor. Identity correlation could be dealt with by using a dedicated TransPort with the IsolateDestAddr option set.)
  • Whonix (back in times where it still was called TorBOX) implemented something very similar: https://sourceforge.net/p/whonix/wiki/OneVM/
    • Tor was running on the host = Tails in this case.
    • Some operating system was running inside the Virtual Machine.
    • iptables / bridging was used to route all VM traffic through Tor.
    • It was probable affected by identity correlation through circuit sharing.

Feature Branch: feature/virtualbox-host

Related issues

Original created by @tails on 5606 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information