Re: [Isolated-exec-devel] Security through Isolation in Xen

[Todd D. <des...@gm...>]

On Thu, Jan 29, 2009 at 6:39 AM, Passera, Pablo R
<pab...@in...> wrote:
>>I just built a Linux VM, but now I need to find the code that tells it
>>to run the command.
>
> The application that runs the executable in the sandbox is called Migration
> Module. You can find both the code and the executable in the release 0.0.1
>

Thanks, I think I have the general idea of where it is and hope to test out some
code changes later. I think I may have to cross compile with mingw32 and
then reinstall into the Linux guest.

>>When I go to send to the Linux Sandbox VM, it crashes the Linux VM
>>right after the file copy, but I assume that is because it is try to
>>run it without the wine command in front.
>
> I don't understand. Did you installed the Migration Module in the Linux
> Sandbox? Without that it won't work because the Decision Module that is in
> Dom0 communicates with the Migration Module to orchestrate the execution.
>

Yes, I installed the Migration Module in Linux with wine and run it on boot by
simply putting it in /etc/rc.local, the better way of course would be to write
an init script, but that can wait until later.

>>I'll look through the code to try to find it, but pointers and any
>>other things that I might run into would be helpful.
>
> The code that sends the file from the UserVM is called Delegation Module, it
> just copy the file to Dom0 and then notifies Dom0 that a file wants to be
> migrated. Then the Decision Module in Dom0 receives the message, it unpauses
> a Sandbox, copies the file and then commands the Migration Module in the
> Sandbox to run the application. You can find all the code that belong to the
> Windows modules under the ./windows folder in the repo and the code for the
> decision module can be found under the ./linux folder in the repo also. Let
> me know if you need more info.
>

I will look this over.

> Regarding the bug after closing the application in the Sandbox. The correct
> behavior is that the Decision Module closes the application, then it restart
> the Sandbox, pause it and put it again into the VM pool. There is a bug
> related to that that we need to fix. This should be easy because it was
> working and in one of our latest changes it got broken. You can see the bug
> at
> http://sourceforge.net/tracker/index.php?func=detail&aid=2372647&group_id=24
> 5240&atid=1126054. We will try to fix it so complete use case can be seen.
>

Thanks for the pointer, I will take a look later and I could even test when a
fix is released probably.

I hope to make some progress soon, but will be busy most of next month.

Thanks,
Todd

-- 
Todd Deshane
http://todddeshane.net
http://runningxen.com