User-mode Linux kernel port

On Wed, Dec 27, 2006 at 06:49:43PM +0100, Christoph Scharnb?ck wrote:
> I am actually writing about UML. I also have to demonstrate how a 
> malicious user can break out of a UML-instance. My question is if there 
> exist tools which make breakouts available. E.g. to bypass ptrac() or 
> bad kernel-modules.

You need a kernel module.  AFAIK, there are no userspace breakouts from UML.

				Jeff

-- 
Work email - jdike at linux dot intel dot com

> I am actually writing about UML. I also have to demonstrate how a 
> malicious user can break out of a UML-instance. My question is if there 
> exist tools which make breakouts available. E.g. to bypass ptrac() or 
> bad kernel-modules.
Using code similar to hostfs makes it pretty easy to tamper with the
host with the privileges of the user running uml.
It is escaping those privileges / chroot / selinux / whatever else which
is hard.

Antoine

Jeff Dike describes in his book that there are some possibilities for 
breaking out of uml. My question is if there are some "howtos" in 
practise which I can use to break out. It is in my objection to publish 
breakouts in my thesis but I haven't found any way or tools therefore.

Christoph

On Fri, Dec 29, 2006 at 09:30:37PM +0100, Christoph Scharnb?ck wrote:
> Jeff Dike describes in his book that there are some possibilities for 
> breaking out of uml. My question is if there are some "howtos" in 
> practise which I can use to break out. It is in my objection to publish 
> breakouts in my thesis but I haven't found any way or tools therefore.

Any breakouts will involve adding code to the UML kernel, as in a kernel
module.  AFAIK, there aren't any extant breakouts.

If you want one, just make a kernel module that execs bash in its init
routine.

				Jeff

-- 
Work email - jdike at linux dot intel dot com

On Friday 29 December 2006 22:51, Jeff Dike wrote:
> On Fri, Dec 29, 2006 at 09:30:37PM +0100, Christoph Scharnb?ck wrote:
> > Jeff Dike describes in his book that there are some possibilities for
> > breaking out of uml. My question is if there are some "howtos" in
> > practise which I can use to break out. It is in my objection to publish
> > breakouts in my thesis but I haven't found any way or tools therefore.
>
> Any breakouts will involve adding code to the UML kernel, as in a kernel
> module.  AFAIK, there aren't any extant breakouts.
>
> If you want one, just make a kernel module that execs bash in its init
> routine.
Some sample code can be taken from the uml-mconsole-exec patch, which is part 
of the -bs patchset on my webpage. Even cut-&-paste coding requires special 
attention for kernel code, however...
-- 
Inform me of my mistakes, so I can add them to my list!
Paolo Giarrusso, aka Blaisorblade
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com