Swap-file-creator missing when in Qubes templates (morphing & official derivative templates)

Support
1

Hi,

I’ve been using Kicksecure and it’s derivatives for a good while by now in Qubes VMs and on servers (Kicksecure in Qubes and on server is morphed, Whonix 17 templates are official Qubes templates) and just realized that I have a seemingly plain, unencrypted swap partition on all Qubes templates. The morphed version on the server host looks correct, if I am not mistaken. Reading the documentation, my impression is that swap-file-creator should change this by default on Kicksecure systems.

Examples:

/etc/fstab entry in morphed Debian template on Qubes OS

/dev/xvdc1 swap swap defaults 0 0

/etc/fstab entry in my Whonix-Workstation AppVM installed from the official template on Qubes OS

/dev/xvdc1 swap swap defaults 0 0

Several command outputs from my morphed Kicksecure on a virtual server

swapon --show
/dev/dm-0 partition 5.7G 0B -2

More information on the device:
sudo dmsetup info /dev/dm-0
—snip—
UUID: CRYPT-PLAIN-swapfile

This looks correct I think?

The package is also not installed on any of the machines except for the morphed host (actually a VPS). It looks like I chose kicksecure-qubes-cli for the Kicksecure template on Qubes while morphing and, again, the Whonix templates were not built by myself. On the VPS, I chose kicksecure-cli-host. (Writing this… is there potentially a difference between the host and the qubes packages in regards to the package being installed/not installed?)

Trying to find an answer to this still left me with two related questions:

  • Is the documentation outdated? It states that it should be installed by default: /wiki/Swap-file-creator#Installation (posting the link resulted in an error, sorry)
    That said, I don’t know what cases “otherwise” covers or what history, intention or background the sentence has, though.
  • Is there any other countermeasure against potentially sensitive information being written to the disk via swapping, which I was not able to find in the wiki, or may, for instance, keys have ended up on my disk?
Unrelated

Big thanks for all you do!

2

I tend to have a promising idea for digging into something right after posting a question.

apt-cache rdepends swap-file-creator

swap-file-creator
Reverse Depends:
  non-qubes-enhancements-cli
  non-qubes-vm-enhancements-cli

I would interpret this as it being only relevant for non-qubes systems? Can someone point me towards some kind of documentation or explanation why this is?
Is it related to Qubes already being installed on an encrypted disk by default? Wouldn’t there be a benefit from a per-boot encrypted file still, which Qubes has been talking about for something close to a decade?

Just throwing around theories as to why this is, I might be missing something in the related docs.

3

At time of writing (and it’s unlikely this will change), swap-file-creator is for non-Qubes only. (Should that ever change, documentation would be updated.)

swap-file-creator for Qubes is unsupported.

Setting up swap and/or encryption of any kind is completely up to Qubes. Unspecific to Kicksecure.

Added to documentation just now.

1 Like