Opt-out logs cleanup on qube removal

[emanruse]

How to file a helpful issue

Qubes OS release

4.1

Brief summary

Dom0 keeps logs for non-existing qubes.

Steps to reproduce

Create a few VMs (easiest - DispVMs), then delete them.

Expected behavior

Logs for non-existing qubes should be deleted automatically (instantly or after configurable time).

Actual behavior

Logs are preserved for infinity and pile up in /var/log/... (related subdirs)

[h01ger]

On Fri, Oct 06, 2023 at 10:29:04AM -0700, emanruse wrote: ### Expected behavior Logs for non-existing qubes should be deleted automatically (instantly or after configurable time).

indeed! this is also a privacy issue. (as well as log bloat :) thank you for filing it!

…

-- cheers, Holger ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C ⠈⠳⣄ Very hard to relate to those who think the first three years of the pandemic were bad because they couldn’t go to bars for a while, as opposed to because 25 million people died, 400 million were disabled, and many more continue to be unable to access public space.

[emanruse]

You are welcome. Can you suggest a way for easy cleanup? (besides deleting files one by one which would take ages)

[kryptonik-os]

Hi,
As advised by qubist in the https://forum.qubes-os.org/, I'm sharing a bug with the script he's creating in the topic https://forum.qubes-os.org/t/really-disposable-ram-based-qubes/21532
concerning a DispVMs that completely erases itself without leaving any trace (files, folders, etc...).
As indicated in "Actual behavior" in your topic, there are indeed log traces in /var/log/... for all VMs created, even DispVMs.
His script does a good job of erasing all traces of DipsVMs created with its script in the /var/log/ folders (which is a good thing) however, it works ONLY if the DispVM is closed BEFORE the Qubes-OS shutdow otherwise all traces remain present...

Another thing, with script, there are files left in the ~/.config/menus/applications-merged/ folder.
Of course, his script is under construction:) But traces in /var/log can be deleted automatically under some conditions with this script. :)

[emanruse]

To clarify the actual additional info, @Tezeria found that not only logs of deleted qubes remain, but also files in ~/.config/menus/applications-merged/ and that is unrelated to the script discussed in the forum thread, i.e. it is purely Qubes OS issue.

[andrewdavidwong]

this is also a privacy issue.

Technically, this is only a privacy issue for Whonix disposables (if that*), since all non-Whonix qubes (including disposables) are explicitly out-of-scope regarding privacy:

https://www.qubes-os.org/faq/#what-about-privacy-in-non-whonix-qubes

Of course, it would be nice if, someday, we could also have some privacy guarantees regarding non-Whonix disposables, but that would be a separate issue (and an enhancement request rather than a bug report).

---

*(I say "if that" because it's not clear to me that Whonix disposables are intended to be amnesiac from dom0's perspective. Any opinion on this, @adrelanos?)

[emanruse]

Well, the current report is about incorrect software behavior, leaving unused files behind. Fixing it would naturally fix any additional negative effects it may cause. I hope we all agree on that.

[adrelanos]

I am not sure it would be possible, realistic to get all the local traces under control to withstand forensic analysis. Related:

• https://groups.google.com/g/qubes-devel/c/QwL5PjqPs-4
• DisposableVMs: support for in-RAM execution only (for anti-forensics) #904
• https://www.whonix.org/wiki/Dev/Technical_Introduction#Forensics

The related warnings, see "Amnesic Capability":
https://www.whonix.org/wiki/Qubes/Disposables#Warnings

What might work and what might be more realistic is the following:

• implement live boot by porting grub-live to Qubes - amnesia / non-persistent boot / anti-forensics #4982

*(I say "if that" because it's not clear to me that Whonix disposables are intended to be amnesiac from dom0's perspective. Any opinion on this, @adrelanos?)

Would be nice to have for sure. Would be a feature unspecific to Whonix. A general Qubes feature.

[emanruse]

Just in case this has somehow been misunderstood: This issue is about all kinds of qubes, not just disposables. Deleting any kind of qube leaves the traces described here. That has nothing to do with any goals related to forensics. It is just a bug. If anyone thinks that certain logs should remain for some reason (e.g. for testing things), that should be an explicit option somewhere.