Reading · My Sysadmin Cheatsheet

13 Mar 2020

Booting a Tails USB drive in a VirtualBox VM is rather complicated because VirtualBox is not able to boot from an USB drive directly. The workaround consists of using VirtualBox’ raw hard disk access and modifying the Tails boot command.

VirtualBox VM

Download the Tails VM ISO.
Create a new VM in VirtualBox:
- Type: Linux
- Version: Debian (64-bit)
- Do not add a virtual hard disk
Edit VM settings:
- Ports → USB → Enable USB 3.0
- Storage → Attach Tails ISO
Start VM & Boot Tails ISO.
Attach USB drive to VM (Devices → USB → …).

Tails Installation

Install Tails by cloning it to the connected USB drive (Applications → Tails → Tails Installer → Clone the current Tails).

Later, the Tails USB drive will be used in raw hard disk access mode. It will be connected as a hard disk to the virtual SATA controller. Booting from a hard disk is not intended by Tails, so it will fail to start.

The solution for this is modifying the boot command. The boot command can either be changed temporarily at boot time or permanently by writing the modification to the Tails USB drive boot partition.

Boot Command Workaround

Permanently

Open Terminal after finishing the Tails cloning process.

Run:

sudo mount /dev/sda1 /mnt
sudo sed -i 's/live-media=removable //g' /mnt/syslinux/live*.cfg
sudo umount /dev/sda1

Temporary

Boot VM.
Press TAB.
Remove live-media=removable from the boot command.
Continue booting.

Raw Hard Disk Access

The USB drive needs to be made available in raw disk access mode on the macOS host:

List available disks (e.g. /dev/disk2):
```
sudo diskutil list
```
Unmount USB disk:
```
sudo diskutil unmountDisk /dev/disk2
```
Own disk device:
```
sudo chown <$USERNAME> /dev/disk2
```

Create raw disk:

VBoxManage internalcommands createrawvmdk -filename ~/VirtualBox\ VMs/tails/usb.vmdk -rawdisk /dev/disk2

Boot Tails from USB Drive

Attach usb.vmdk to VM’s virtual SATA controller.
Detach Tails ISO.
Start VM.
Boot Tails.
At the welcome screen set an Administrator Password (Additional Settings → +).
Start Tails.

Encrypted Persistence

To enable the encrypted persistant volume, another workaround needs to be applied because Tails won’t enable the encrypted persistence on a “hard disk”.

Edit /usr/share/perl5/Tails/Persistence/Setup.pm.
Find & delete the foreach my $check (@checks) { loop block.
Applications → Tails → Configure persistent volume.

Boot Tails from USB Drive in VirtualBox on macOS