KCLUG

kclug@kclug.org

10 participants
3254 discussions

RE: chroot breakout (was: Xen 2.0 Virtual Machine)
by Garrett Goebel 09 Nov '04

09 Nov '04

Brian Densmore wrote: > >> Garrett Goebel wrote: >> >>> Have you tried to just chroot into another one? >> For _a_ test environment, that's fine. But not for running multiple >> simultaneous test environments, or giving away root accounts. > >Are you saying that you can't open up multiple CLIs and run chroot in >as many simultaneous instances as memory and diskspace allow? Sure, but instances of what? Processes not kernels. You couldn't for instance test the setup of a high availability cluster... >[somewhat OT: ] >Also if one can break out >of a chroot environment then they have the skill to own the machine >anyway. You need to be able to find and use a security flaw on the >machine that would give you root access and have access inside of >the chrooted environment to a compiler or perl interpreter. So the >fact that one could own a machine from inside a chroot environment >doesn't increase the possibility that someone could get root access. Unless of course you _want_ to give someone root access without fear that they can subvert their host. Chroot is fine for running services under a low privilege account in a jail. It isn't a cure-all. >Although what that has to do with wanting to run a VM, which is what >this thread is about, eludes me. In order to run a VM a user would >need an account on your box, and if they are going to crack your >system and have the knowledge to break out of a chrooted environment, >then they can own your box from their user account. In order to run a UML VM on a box, you need to run a UML instance which the end user could log into. They don't need _access_ to an account on the UML host. Except to the extent that UML instance would be running under some set of credentials. With UML I can give anyone I wish a root account on their own virtual Linux box... I still have to worry about them misusing it or being penetrated, but not so much about attempts to subvert the uml host. I think UML is promising choice for ISP's who offer co-hosting services. -- Garrett Goebel IS Development Specialist ScriptPro Direct: 913.403.5261 5828 Reeds Road Main: 913.384.1008 Mission, KS 66202 Fax: 913.384.2180 www.scriptpro.com garrett at scriptpro dot com

6 5

RE: chroot breakout (was: Xen 2.0 Virtual Machine)
by Brian Densmore 08 Nov '04

08 Nov '04

-----Original Message----- > From: Garrett Goebel > > Brian Densmore wrote: >> >>> Garrett Goebel wrote: >>> >>>> Have you tried to just chroot into another one? >>> For _a_ test environment, that's fine. But not for running multiple >>> simultaneous test environments, or giving away root accounts. >> >> Are you saying that you can't open up multiple CLIs and run chroot in >> as many simultaneous instances as memory and diskspace allow? > Sure, but instances of what? Processes not kernels. You couldn't for > instance test the setup of a high availability cluster... Well for high availability cluster emulation I would recommend using the King of VMs. IBM z390/Linux. ;') > Chroot is fine for running services under a low privilege account > in a jail. It isn't a cure-all. Very true. > With UML I can give anyone I wish a root account on their own virtual > Linux box... Sounds pretty good.

1 0

RE: Xen 2.0 Virtual Machine
by Garrett Goebel 08 Nov '04

08 Nov '04

Brian Kelsay wrote: > > I went and read most of the HOWTO on User-mode Linux and > I have to say, I'm not sure if it actually gives you a > good impression of a new kernel being able to run on your > hardware. The host kernel is still in the way. You use > virtual devices and filesystems. Sure, it's safe, but it > won't tell you definitively if the new kernel works on > your hardware. If you can boot to a UML kernel, you can work with whatever hardware the underlying kernel has compiled virtual device support for. The whole point is that UML doesn't work on hardware. It runs in usermode on top of a kernel which does. Actually, I'm lying ;) One of the directions UML is moving toward is the ability to compile support for selective direct hardware access. Certain hardware resources could be dedicated to different UML instances. This would allow you to decide where you want to place the virualization performance vs. security etc. tradeoffs. > Now if you want to test other software on a specific > kernel without risking crashing the system, then this > appears to be the answer you've been looking for. Or > if you want to test features of a new kernel, then this > would work. If you want to host an app like a webserver > in a controlled/limited environment, giving near root > privileges to a user, then this may work also, but a > chrooted jail might be better. Then again, I could be > wrong. Sure... use the right tool for the job. I just meant to underscore that chroot isn't always the right tool for the job. It depends on what you mean by a test environment, and whether or not the test environment needs root privileges. > User-mode appears to use less resources than a Xen, VMWare > or Bochs, as does chroot, but that is Linux on Linux only. > Each can have its place. You're preaching to the choir ;-) -- Garrett Goebel IS Development Specialist ScriptPro Direct: 913.403.5261 5828 Reeds Road Main: 913.384.1008 Mission, KS 66202 Fax: 913.384.2180 www.scriptpro.com garrett at scriptpro dot com

1 0

Re: Xen 2.0 Virtual Machine
by Brian Kelsay 08 Nov '04

08 Nov '04

I went and read most of the HOWTO on User-mode Linux and I have to say, I'm not sure if it actually gives you a good impression of a new kernel being able to run on your hardware. The host kernel is still in the way. You use virtual devices and filesystems. Sure, it's safe, but it won't tell you definitively if the new kernel works on your hardware. Now if you want to test other software on a specific kernel without risking crashing the system, then this appears to be the answer you've been looking for. Or if you want to test features of a new kernel, then this would work. If you want to host an app like a webserver in a controlled/limited environment, giving near root privileges to a user, then this may work also, but a chrooted jail might be better. Then again, I could be wrong. User-mode appears to use less resources than a Xen, VMWare or Bochs, as does chroot, but that is Linux on Linux only. Each can have its place. Brian Kelsay >>> "Brian Kelsay" <> 11/08/04 08:20AM >>> Are you possibly referring to User-Mode Linux? That is the only thing that comes close to the discussion at hand. http://user-mode-linux.sourceforge.net/ Not until I found that page did your post make sense. Brian Kelsay >>> David Nicol <davidnicol> 11/06/04 10:26PM >>> Isn't UML the preferred way to do that? On Fri, 05 Nov 2004 14:45:15 -0600, Thomas Bruno <crweb@> wrote: > It would be a better solution per cost, if all you wanted was to run > Linux on Linux.

1 0

RE: chroot breakout (was: Xen 2.0 Virtual Machine)
by Brian Densmore 08 Nov '04

08 Nov '04

-----Original Message----- > From: Garrett Goebel > >> Have you tried to just chroot into another one? > For _a_ test environment, that's fine. But not for > running multiple simultaneous test environments, > or giving away root accounts. Are you saying that you can't open up multiple CLIs and run chroot in as many simultaneous instances as memory and diskspace allow? [somewhat OT: ] Also if one can break out of a chroot environment then they have the skill to own the machine anyway. You need to be able to find and use a security flaw on the machine that would give you root access and have access inside of the chrooted environment to a compiler or perl interpreter. So the fact that one could own a machine from inside a chroot environment doesn't increase the possibility that someone could get root access. Although what that has to do with wanting to run a VM, which is what this thread is about, eludes me. In order to run a VM a user would need an account on your box, and if they are going to crack your system and have the knowledge to break out of a chrooted environment, then they can own your box from their user account.

1 0

RE: Xen 2.0 Virtual Machine
by Brian Densmore 08 Nov '04

08 Nov '04

> -----Original Message----- > From: jeremy(a)linuxwebguy.com > > ... I'd like to be able to use > linux test > environments without having to reboot. > Isn't that what chroot is for?

1 0

Re: Xen 2.0 Virtual Machine
by Brian Kelsay 08 Nov '04

08 Nov '04

Excuse me if I haven't kept up, but UML is Unified Modeling Language. Correct? I fail to see how a relative of XML and SGML can be helpful in this situation. http://www.uml.org/ http://www.google.com/search?hl=en&q=UML&btnG=Google+Search Are you possibly referring to User-Mode Linux? That is the only thing that comes close to the discussion at hand. http://user-mode-linux.sourceforge.net/ Not until I found that page did your post make sense. Brian Kelsay >>> David Nicol <davidnicol> 11/06/04 10:26PM >>> Isn't UML the preferred way to do that? On Fri, 05 Nov 2004 14:45:15 -0600, Thomas Bruno <crweb@> wrote: > It would be a better solution per cost, if all you wanted was to run > linux on linux.

2 1

chroot breakout (was: Xen 2.0 Virtual Machine)
by Garrett Goebel 08 Nov '04

08 Nov '04

Brian Kelsay wrote: >jeremy(a)linuxwebguy.com wrote: >> On Sat, Nov 06, 2004 at 10:26:55PM -0600, David Nicol wrote: >> >>>Isn't UML the preferred way to do that? >> >> >> Have you tried to set UML up? =) Yes. As long as you follow the docs and use the kosher kernel builds it isn't too painful. Time intensive, but not painful... >> I really liked VMware, but didn't seem to be very fast. I'm >> interested in trying out this Xen software. I'd like to be able to >> use linux test environments without having to reboot. >> > >Have you tried to just chroot into another one? For _a_ test environment, that's fine. But not for running multiple simultaneous test environments, or giving away root accounts. http://www.bpfh.net/simes/computing/chroot-break.html > To break out of a chroot()ed area, a program should do the following: > > o Create a temporary directory in its current working directory > o Open the current working directory > > Note: only required if chroot() changes the calling program's working > directory. > o Change the root directory of the process to the temporary directory > using chroot(). > o Use fchdir() with the file descriptor of the opened directory to > move the current working directory outside the chroot()ed area. > > Note: only required if chroot() changes the calling program's working > directory. > o Perform chdir("..") calls many times to move the current working > directory into the real root directory. > o Change the root directory of the process to the current working > directory, the real root directory, using chroot(".") -- Garrett Goebel IS Development Specialist ScriptPro Direct: 913.403.5261 5828 Reeds Road Main: 913.384.1008 Mission, KS 66202 Fax: 913.384.2180 www.scriptpro.com garrett at scriptpro dot com

1 0

Thank You! Need Ride for tonight's meeting
by Chris Bier 03 Nov '04

03 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All, ~ Many thanks out to all of you who have helped me and sent your well wishes after the motorcycle crash. I really, really appreciate it. I'm doing a lot better now, and hope to return to work soon. I've gotten a lot of movement back in my arm, but it's going to be quite a while before it's fully healed. It can get very boring and lonely in the hospital, and I appreciate your visits as well. ~ Also, a big thanks to the guys who stepped up and organized our booth at ITEC. ~ I am, currently, unable to drive myself to the meeting tonight, and was wondering if someone would be willing to drive me to tonight's meeting. I live in Liberty, MO. Thank you very, very much, Chris Bier P.S. I will try to have some pictures up soon. - -- I digitally sign my emails. If you see an attachment with .asc, then that means your email client doesn't support PGP digital signatures. http://www.gnupg.org/(en)/documentation/faqs.html#q1.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBiUCIE5xXU3JS1mQRAtMeAKDUzyt2kXmfi/3OG2Ny0VCWOALkvACg2Vbv gwAyyaYZ5QyaTbn7lLjP8Wk= =BHdJ -----END PGP SIGNATURE-----

1 0

thanks! // Linuxbios
by Bailey, Michael L [NTK] 03 Nov '04

03 Nov '04

(from dj goku) >Welcome to KCLUG, glad you joined us. -- dj_goku -www.djgoku.com- -www.tektronic.org- ------------------------------ Thank you! From: Duane Attaway <dattawaykclug(a)dattaway.org> >I'm happy to hear linux experiences like yours. I don't seem to hear >enough of the great things people do lately. What people enjoy seems to >put a better perspective of what we do in this world. >Thanks for sharing! -=Duane http://dattaway.org ------------------------------ Linux is a bright spot in the world, no doubt about it! Has anybody tried Linuxbios yet? I read that you have to flash your ROM, but you can get booted in 5 seconds. Of course, with Linux you don't have to reboot much to begin with, unless you have a dual-boot situation. www.linuxbios.org Michael Bailey **************************

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG