User-mode Linux

User-mode Linux (UML)[1] enables multiple virtual Linux kernel-based operating systems (known as guests) to run as an application within a normal Linux system (known as the host). As each guest is just a normal application running as a process in user space, this approach provides the user with a way of running multiple virtual Linux machines on a single piece of hardware, offering some isolation, generally without affecting the host environment's configuration or stability.

User-mode Linux
Written inC
TypeVirtualization
LicenseGNU General Public License
Websiteuser-mode-linux.sourceforge.net

Applications

Numerous things become possible through the use of UML.[2] One can run network services from a UML environment and remain totally sequestered from the main Linux system in which the UML environment runs.[3][4][5][6][7] Administrators can use UML to set up honeypots[8], which allow one to test the security of one's computers or network. UML can serve to test and debug new software without adversely affecting the host system. UML can also be used for teaching and research, providing a realistic Linux networked environment with a high degree of safety.

In UML environments, host and guest kernel versions don't need to match, so it is entirely possible to test a "bleeding edge" version of Linux in User-mode on a system running a much older kernel. UML also allows kernel debugging to be performed on one machine, where other kernel debugging tools (such as kgdb) require two machines connected with a null modem cable.

Some web hosting providers offer UML-powered virtual servers for lower prices than true dedicated servers. Each customer has root access on what appears to be their own system, while in reality one physical computer is shared between many people.

libguestfs has supported a UML backend since version 1.24[9] as an alternative to using QEMU or KVM.

Integration into the Linux kernel

The UML guest application (a Linux binary ELF) was originally available as a patch for some Kernel versions above 2.2.x, and the host with any kernel version above 2.2.x supported it easily in the thread mode (i.e., non-SKAS3).

As of Linux 2.6.0, it is integrated into the main kernel source tree. A method of running a separate kernel address space (SKAS) that does not require host kernel patching has been implemented. This improves performance and security over the old Traced Thread approach, in which processes running in the UML share the same address space from the host's point of view, which leads the memory inside the UML to not be protected by the memory management unit. Unlike the current UML using SKAS, buggy or malicious software inside a UML running on a non-SKAS host could be able to read the memory space of other UML processes or even the UML kernel memory.

Comparison with other technologies

User-mode Linux is generally considered to have lower performance than some competing technologies, such as Xen and OpenVZ. Future work in adding support for x86 virtualization to UML may reduce this disadvantage.

Often cited as a strength of Xen (a competing technology) is support for thread-local storage (TLS). This is now also supported in the latest UML kernels. Xen concentrates on virtualizing the whole machine, and thus all systems running on a Xen machine are really virtual machines. In UML, the host machine is not virtualized in any way, and only guest systems are true virtual machines. This allows UML guest direct access to host filesystems and hardware, where it is common to map a host directory (e.g. /uml/root → /).

Supported platforms

UML was originally designed for the x86 instruction set, but has also been ported to others including IA-64 and PowerPC.

gollark: > `import hashlib`Hashlib is still important!> `for entry, ubq323 in {**globals(), **__builtins__, **sys.__dict__, **locals(), CONSTANT: Entry()}.items():`Iterate over a bunch of things. I think only the builtins and globals are actually used.The stuff under here using `blake2s` stuff is actually written to be ridiculously unportable, to hinder analysis. This caused issues when trying to run it, so I had to hackily patch in the `/local` thing a few minutes before the deadline.> `for PyObject in gc.get_objects():`When I found out that you could iterate over all objects ever, this had to be incorporated somehow. This actually just looks for some random `os` function, and when it finds it loads the obfuscated code.> `F, G, H, I = typing(lookup[7]), typing(lookup[8]), __import__("functools"), lambda h, i, *a: F(G(h, i))`This is just a convoluted way to define `enumerate(range))` in one nice function.> `print(len(lookup), lookup[3], typing(lookup[3])) #`This is what actually loads the obfuscated stuff. I think.> `class iｎt(typing(lookup[0])):`Here we subclass `complex`. `complex` is used for 2D coordinates within the thing, so I added some helper methods, such as `__iter__`, allowing unpacking of complex numbers into real and imaginary parts, `abs`, which generates a complex number a+ai, and `ℝ`, which provvides the floored real parts of two things.> `class Mаtrix:`This is where the magic happens. It actually uses unicode homoglyphs again, for purposes.> `self = typing("dab7d4733079c8be454e64192ce9d20a91571da25fc443249fc0be859b227e5d")`> `rows = gc`I forgot what exactly the `typing` call is looking up, but these aren't used for anything but making the fake type annotations work.> `def __init__(rows: self, self: rows):`This slightly nonidiomatic function simply initializes the matrix's internals from the 2D array used for inputs.> `if 1 > (typing(lookup[1]) in dir(self)):`A convoluted way to get whether something has `__iter__` or not.
gollark: If you guess randomly the chance of getting none right is 35%ish.
gollark: Anyway, going through #12 in order:> `import math, collections, random, gc, hashlib, sys, hashlib, smtplib, importlib, os.path, itertools, hashlib`> `import hashlib`We need some libraries to work with. Hashlib is very important, so to be sure we have hashlib we make sure to keep importing it.> `ℤ = int`> `ℝ = float`> `Row = "__iter__"`Create some aliases for int and float to make it mildly more obfuscated. `Row` is not used directly in anywhere significant.> `lookup = [...]`These are a bunch of hashes used to look up globals/objects. Some of them are not actually used. There is deliberately a comma missing, because of weird python string concattey things.```pythondef aes256(x, X): import hashlib A = bytearray() for Α, Ҙ in zip(x, hashlib.shake_128(X).digest(x.__len__())): A.append(Α ^ Ҙ) import zlib, marshal, hashlib exec(marshal.loads(zlib.decompress(A)))```Obviously, this is not actual AES-256. It is abusing SHAKE-128's variable length digests to implement what is almost certainly an awful stream cipher. The arbitrary-length hash of our key, X, is XORed with the data. Finally, the result of this is decompressed, loaded (as a marshalled function, which is extremely unportable bytecode I believe), and executed. This is only used to load one piece of obfuscated code, which I may explain later.> `class Entry(ℝ):`This is also only used once, in `typing` below. Its `__init__` function implements Rule 110 in a weird and vaguely golfy way involving some sets and bit manipulation. It inherits from float, but I don't think this does much.> `#raise SystemExit(0)`I did this while debugging the rule 110 but I thought it would be fun to leave it in.> `def typing(CONSTANT: __import__("urllib3")):`This is an obfuscated way to look up objects and load our obfuscated code.> `return getattr(Entry, CONSTANT)`I had significant performance problems, so this incorporates a cache. This was cooler™️ than dicts.
gollark: The tiebreaker algorithm is vulnerable to any attack against Boris Johnson's Twitter account.
gollark: I can't actually shut them down, as they run on arbitrary google services.

See also

References
  1. "User-mode Linux Kernel Home Page". April 4, 2008.
  2. Landley, Rob (2009-12-16). "Rob's quick and dirty UML howto". Retrieved 2019-08-29.
  3. "Virtual Network User-Mode-Linux". 2012-02-13. Retrieved 2019-08-29.
  4. "Netkit: Features". 2009-12-03. Retrieved 2019-08-29.
  5. Jean-Vincent Loddo & Luca Saiu. "Marionnet: a virtual network laboratory". Retrieved 2019-08-29.CS1 maint: uses authors parameter (link)
  6. "Cloonix Documentation: v03-04". 2019-06-01. Retrieved 2019-08-29.
  7. "Welcome to GINI! A Toolkit for Constructing User-Level Micro Internets". McGill University. 2009-09-28. Retrieved 2019-08-29.
  8. "UML as a honeypot". 2007-07-13. Retrieved 2019-08-29.
  9. Richard WM Jones (August 11, 2013). "Experimental User-Mode Linux backend for libguestfs". Retrieved 2019-08-29.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.