Tails 0.21 introduces a more secure access control over the persistent volume settings. This also means that before Tails 0.21, an attacker who could run an exploit from inside your Tails session could corrupt the persistent volume settings. By doing this, an attacker could possibly gain persistent administrator rights or install malicious software.

For more technical details about the security of the persistent volume, read our design document.

Automatic upgrade

We designed a migration mechanism that allows, in most cases, to upgrade automatically to those more secure persistent volume settings. To do this upgrade, once and for all:

  1. Start Tails 0.21.
  2. Enable persistence without the read-only option. Activating the read-only option prevents Tails from starting correctly until the upgrade is made.
  3. If the upgrade is successful, Tails starts as usual and no notification appears.

But this automatic upgrade might not be sufficient in some cases.

  1. If you skipped the upgrade to Tails 0.21 and upgraded directly to Tails 0.22 or later, then follow the instructions to manually copy your persistent data to a new device. For security reasons the automatic upgrade is not available in Tails 0.22 or later.

  2. If you have custom persistence settings or use additional software packages, the corresponding settings are not upgraded automatically.

    A notification should appear when starting Tails that indicates which persistence settings are temporarily disabled. In that case, follow the instructions to enable again your custom persistence settings.

    If you have custom persistence settings or use additional software but no notification appear on the desktop, then your Tails system might be corrupted. In that case, follow the instructions to manually copy your persistent data to a new device.

  3. If you have good reasons to think that your persistence settings are corrupted or if you want to be extra careful, then follow the instructions to manually copy your persistent data to a new device.

Enabling again your custom persistence settings

Custom persistence settings and additional software are disabled during the automatic upgrade because, there is technically a possibility for these files to be corrupted.

These instructions explain how to verify the content of these files and enable again your custom persistence settings.

  1. Start Tails and set an administration password.

  2. Choose Applications ▸ System Tools ▸ Root Terminal to open a terminal with administration rights.

  3. Execute the nautilus command to open the file browser.

  4. In the file browser navigate to /live/persistence/TailsData_unlocked.

live-persistence.conf.old

If there is a file named live-persistence.conf.old in the TailsData_unlocked folder, then some of your persistence settings need to be enabled manually.

  1. In the file browser, right-click on the live-persistence.conf.old file and open it by choosing Open with Other Application... and then gedit.

  2. Switch back to the file browser, right-click on the persistence.conf file and choose Open with Other Application... and then gedit to open it in a new tab in gedit.

  3. Switch between the two tabs corresponding to those files in gedit and compare their content. Copy from live-persistence.conf.old to persistence.conf the lines corresponding to your custom settings that have not been upgraded automatically.

Those missing lines should correspond to your custom directories or other custom persistence settings.

If you detect unexpected lines in live-persistence.conf.old that do not correspond to any change that you have made, they might have been introduced by an attacker. In this case, do the following:

  1. Report a bug using WhisperBack and explain which are the lines that look suspicious to you.

  2. Keep that Tails device without modifying it in order to analyse it later if needed.

  3. Follow the instructions to manually copy your persistent data to a new device.

If you do not detect any suspicious line, close gedit and delete the live-persistence.conf.old file using the file browser.

live-additional-software.conf.disabled

If there is a file named live-additional-software.conf.disabled in the TailsData_unlocked folder, then your additional software need to be enabled manually.

  1. In the file browser, right-click on the live-additional-software.conf.disabled file and open it by choosing Open with Other Application... and then gedit.

  2. Right-click on the live-additional-software.conf file and choose Open with Other Application... and then gedit to open it in a new tab in gedit.

  3. Copy from live-additional-software.conf.disabled to live-additional-software.conf the lines corresponding to your additional software.

If you detect unexpected lines in live-additional-software.conf.disabled that do not correspond to any additional software added by you, they might have been introduced by an attacker. In this case, do the following:

  1. Report a bug using WhisperBack and explain which are the lines that look suspicious to you.

  2. Keep that Tails device without modifying it in order to analyse it later if needed.

  3. Follow the instructions to manually copy your persistent data to a new device.

If you do not detect any suspicious line, close gedit and delete the live-additional-software.conf.disabled file using the file browser.