Make use of custom-persist on app qubes

[deeplow]

• I have searched for duplicates or related issues

Description

Limit persistence on certain directories in the app qubes with custom-persist.

How will this impact SecureDrop/SecureDrop Workstation users?

No impact.

How would this affect the SecureDrop Workstation threat model?

It adds a security mitigation that makes malware persistence from something trivial to accomplish (writing to /rw/config/rc.local or ~/.config/autostart/) to something slightly more involved (using directories which execute on file dropping as opposed to machine restart, or compromising the /dev/xvdb disk itself). But it should not change the threat model itself.

User Stories