VIEWOS: New features in rd235 experimental version (2012 Jan): virtual ptrace, hostcmd, remote console

From Virtualsquare
Revision as of 19:44, 27 December 2012 by Renzo (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search


Virtual Ptrace

Umview is based on ptrace and unfortunately ptrace does not support more than one tracer.

This means that it is impossible to use ptrace based programs inside umview:

 $ strace ls /
 strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted

The latest development version of umview (now=2012 January) includes a virtual implementation on ptrace. It is still incomplete, maybe buggy, but it is able to support strace and a nested activation of umview itself. Gdb is not supported yet.

This is a proof-of-concept to show that ptrace can be implemented at user level (but it has been useful for real debugging, indeed).

Virtual ptrace is not enabled by default, umview needs an extra option in the commandline "-t"

 $ umview -t bash
 viewos$ strace ls /
 --- SIGSTOP (Stopped (signal)) @ 0 (0) ---
 execve("/bin/ls", ["ls", "/"], [/* 28 vars */]) = 0
 brk(0)                                  = 0x8065000

If you like to test the nested umview:

 $ umview -t bash
 viewos$ um_add_service unreal
 viewos$ umview -r -t bash
 viewos-viewos$ um_add_service unreal
 viewos-viewos$ ls /unreal/unreal/unreal/unreal
 bin   etc         lib         mnt   root     srv  usr
 boot  home        lost+found  opt   sbin     sys  var
 dev   initrd.img  media       proc  selinux  tmp  vmlinuz

Note that virtualized ptrace provides a view on the virtualized system calls exactly as the user process sees them.

 viewos$ strace ls /unreal
 stat64("/unreal", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0

These feature has not been implemented on kmview yet. Ptrace works (and has always worked) also on kmview but in this case it is the real ptrace of the kernel (based on utrace or not depending on the kernel version and utrace patches applied). In this case ptrace provides the "view" of the real kernel.

 kmview-viewos$ strace ls /unreal 
 open("/tmp/.umview21090/lfd.unreal00", O_RDONLY) = 3

This inconsistency will be fixed when the virtual ptrace implementation is ported to kmview.

Host Command

In some applications it is likely to have the way to run programs directly on the hosting operating system from a shell running in view-os.

The new command um_hostcmd implements this feature. On the other hand, um_hostcmd could break security policies, thus this possibility must be activated by a specific command line argument of umview/kmview: -c

 $ umview -c bash
 viewos$ um_add_service unreal
 viewos$ ls /unreal
 bin  etc ...
 viewos$ um_hostcmd ls /unreal
 ls: cannot access /unreal: No such file or directory

It is possible to protect um_hostcmd by a password:

 viewos$ um_passwd
 old password: 
 new password: 
 retype new password: 

Now um_hostcmd requires the password to run a program outside viewos:

 viewos$ um_hostcmd su
 view-os host password: 

The first password is the password to run something outside view-os, the second is the root password of the hosting operating system.

Sometimes it is likely to set um_password from a startup script. um_passwd is able to generate a hash (including salt for extra security) and to set the password from a hash.

 viewos$ um_passwd -e

This is one encoding of the password "piripicchio". It is possible to use this hash for setting the password (typically in a script) in this way:

 viewos$ um_passwd 21282013e0a9695c330f00f0d065edb8347b52a956441bd3

Now the password has been set to "piripicchio" but it is quite hard to get it from the hash.

Remote Console

When using Kmview and Umview on a grephical user interface it is common to launch them using a graphical terminal emulator as the virtualized command.

 $ umview xterm

In this way viewos messages appear on the window where umview (or kmview) was launched.

When the virtualized session uses the same terminal, e.g. when the virtualized command is just a shell

 $ umview bash

warnings, info messages or debug output appear mixed with the output of the virtualized session and sometimes this can lead to a real mess.

When modules require input (for example passwords for a protected mount, e.g. sshfs or encfs), things are getting even worse as viewos manager does not have the focus, so it is not possible to type in that password.

Now it is possible to use the -k or -K parameter for umview/kmview and the command um_console. By lower case k message appear also on the external console, by capital K messages appear only on the external console.

 $ umview -K bash

In another terminal window (inside or outside the virtual machine) run the follwing command:

 $ um_console

Now run something inside the virtual machine which generates some output on the console e.g.

 viewos$ um_add_service unreal

you'll see the output on the external console instead mixed up with the virtualized bash session. This is extremely useful when running remote viewos sessions. In case you need to read the console output or type in a password it is possible to open a second terminal session (e.g. ssh) and join the console.

When there is more than one console available um_console provides a list:

 $ um_console$ um_console
 List of available View-OS consoles:

The user can then choose the one he/she wants to join, e.g.:

 $ um_console 22127


A tiny but useful new feature: Now um_add_module can add several modules in one command.

 um_add_module umproc umfuse umdev
Personal tools