Forensics-proof DisposableVMs

[Rudd-O]

This is a feature request.

User requests DisposableVM via UX interacton.

dom0 script in charge of DisposableVM setup sets up the root file system as a device-mapper device. Then it sets up the swap device and the home directory device in the following manner:

• do the exact same thing being done right now to create the block devices
• generate cryptographically secure random key, 256 bits of entropy; this program must mlockall() to prevent that data being swapped
• luksFormat and luksOpen those devices using the secure random key (which will be held in RAM and will never be swapped to disk); check that the assumption holds that invocation of these programs won't leak to swap
• make the filesystems and swap devices atop those block devices

(To be honest, the swap devices of all VMs should be made atop that).

Teardown of devices is the exact opposite -- once the VM is dead, the devices must be luksClosed and then luksWiped.

Presto correcto mundo — unrecoverable devices associated with DisposableVMs, so long as the user does not write to anything other than /home.

This should not be too much of a complication compared to DisposableVM setup today.

[bnvk]

This seems like a duplicate of #904

[bnvk]

This seems like a duplicate of #904

[Rudd-O]

Yes, close as dupe please.

[Rudd-O]

Yes, close as dupe please.