All right, so next, we're going to be talking about Cisco tracing and
resolutions aboard.
Good afternoon.
Okay, good afternoon to everybody.
The talk is, the data for system called tracing every
totalization support.
It's causes, by me, into the University of Bologna,
virtuosquera, and David Belarde, from virtuosquera, too.
Okay, why we have decided to present this paper, this presentation.
Because tracing is very useful, and it's used for many, for many
purposes.
The main, I think, everybody uses some daily basis as trace, for example,
which is based on tracing methods, GDB, but tracing can be used also for
virtualization.
Let us remember, use them at Linux, for example, use them at Linux, is able to
create a Linux kernel as a process, and you can run it as it requires a virtual machine.
We have a project, it's a scale.
If you want to visit the way of this process, you can download the QR code on
my tie, or wiki virtuosquera.org, as well as three flags of projects.
One is virtuosquera data, and it's a sign of the Internet thread, and the status of U.S.
U.S., the idea to create an operating system, entirely new space, able to implement
what we name multiple layer operating system, which is not a layer to operate in system.
If you started the THA, the kernel, education, a kernel, by DAX, that's layer.
It means that each layer is using a different API, a different language.
Instead, the idea is to create a multi-layer operating system, so models that are using
the same language, the language of system calls, but as the lawyer, the lawyer, the lawyer,
the lawyer, and as the app is there, what's an operating system that are many definition,
you can see it from many perspective.
For example, you can say that it's the entity able to give an answer to implement the
system calls. In another operating system, a process can be done by itself, just a numerical
operation, a new operation, can access the memory given by the kernel, for everything else,
it needs to call to decide to sign the request of the kernel.
System calls can be exact. We can, if we have the kernel, speaking, it's language.
The percentage is this pattern. You can have your process running on this layer, and you
can see what the kernel is giving. You can add a layer and your process can speak the same language,
but can see different things. For example, you can mount a five-system at use of level. You can use a
different network in stack at use of level. There's the role of UIS, please.
OK, this picture shows us how UIS works. If I try to ask the issue, a system called a
kernel, the system call goes to the kernel, but there is some way to trace the system call
actually use the trace, and it out to the request to the hypervisor, actually, for performance
point of view, we don't have a just one thread of the hypervisor, but it's thread in the user environment,
has a thread of the hypervisor that is utilizing the thread. We named those guardian answers,
the guardian answers of processes, and then it asks to the module, implement the virtualization,
can be a fields module. Using UIS, you can mount, you can use fields executable,
fields a five-system in use of space, and exactly what you do with the fields implementation
in the kernel, and tell it at use of level. So you could delete, you could exclude the fields
support from the kernel, if you would continue to work. Then the mother replies, and there's
other standards to the thread. Actually, we have an implementation of UIS named UIMVU based on
the trace, but we are working to the site, which is the best implementation, we are not sure,
and so we have started a review, a survey of all the support in the kernel to trace
the schools, and now I'm going to show you all these ways. It means that
Cisco tracing is very useful, given that many different implementation have been added. At the same
point, it seems that there is no silver ballet, so there's not a complete solution. There are
actually, we have moved on the axis of features. UIS gives you the power to do several
stuff, to mount the system to regardless or taking into the second consideration security and
performance. Let me talk about security, and that means split the world security in two parts,
security and safety. Security one there is a big guy, which is trying to do something better,
but there is also safety. Safety means that we can do mistakes. For example, any time I try to
configure a file disc image for a virtual machine, I'm writing into a file, which is mine,
but to in order to have a very simple support, I became root,
to modify system, but all the times I'm afraid, if I type STA in set of STB, I can drop
and tell a system. So this is safety, so you can, if you do the same things, at the user level,
you have no risk of this kind of safety. And performance is the third axis.
We are not the only one seeking for a system of tracing. Fake root is based on the
trick, wine, divisor, and so on. Okay, I think I have already presented this slide. What do you want to
update inside? I think you can hear me. Okay, so let's talk about security. We can try to
describe a program that's a get-it-jacked, the system could get-it-jacked, so a program that
opened ATC-patch fully, so for instance, it brings the list of users, and then get redirected to ATC
so this program is secure when it executed inside some kind of wrapper that I jacked the
system called, I jacked the request. I mean, and move that to ATC-else. There are some cases,
in which we will see that, like PULIPC, which is based on, which can be based on a deprodo, in which
if you do something like a variety calling, the system called, for instance, in assembly, in this case,
you can circumvent the sandbox, because you can escape the sandbox and so on, look at the reality
C-patch fully. So this is the problem of security. For instance, it's difficult to
ensure that a program gets to the real sandbox design we've done.
Yeah, exactly. So you're trying to open ATC-patch WT, and you said that the virtualization
code code opens ATC host name is the problem that we have used as an example, and at the
very last line of the slides, there is a GitHub repo in which you can see this functionality
implemented in using all the system called tracing methods we are introducing now.
So even during the presentation, you want to download and try, please do it, so we can
because trying to do the command pages of code on the slides is useless.
You can try by yourself if you want to see the methods.
So there is another problem which is speed, because if the three axes are features of speed
and security, the problem of speed, in this case, of hypervisor-based virtualization, is that
it's low, like Renzo was saying, that one program that wants to open ATC-patch WT for instance
and get hijacked to another file, gets to the kernel, and then another process get waked up,
and this project come back to the kernel and then the control is returns to the main application.
So it's low, because for one single system called, you get into the kernel basically two times
and then the return, so it's released low because you increment the times you are getting the
context which is and this kind of changes. So we basically done a benchmark for every method,
so in this case is the benchmark which is like one second and something for the
Carteticy of the name, so you get just the file and this is the cases and we have five techniques
may. The first one is P-trace, P-trace is the thing that your debugger does, so when you are just
looking at the system call, for instance in this case we virtualizing Carteticy P-trace with
E and we hijacking it to an hypervisor and in this case you see that the time is the real concern,
you see that it's like seven seconds and so on, so it's it's really low and if you're
visualizing a real application, I don't know chrome or something like this, it gets real slow, so in
this case because you're passing the kernel another additional time, but it gets to some
pros, like I should limit that, it's extremely well tested, it's easy to implement, so it comes with
pros and cons, it has some difficulty in multi-fraining also, because if you do some P-trace tracinger,
you block some time on, you block some time to get the application of the hijacking of some
system calls, that's for instance the case for select and pull, there are some problems in which you
need to have multi-tradding and it's difficult to implement, there are also some problems with
the information of the process, so when you're getting the system call, you want to get the
information on the system call, like which are the six register I using the nine register,
I'm using, so you need to get the register and implement like a dispatcher for your system call
and choose where you're going with your request. To do so, there are some some way to do that,
so like a P-trace peak user, in which you can get all the registers and more or less by time,
and then it's really slow, it's really architectural dependent, and to overcome to this problem,
there is some some request you can, you can ask to P-trace, like P-trace gets this call info,
which you get the system call information like a register, and so on in an architectural
independent way, something like this, but there is no P-trace set, it's colorful, so if you want
to Isaac the system call, you can basically directly change the register, change the values you
have in that, so for instance you have the open and you want to alter the file you open with it,
you need to have something to write the system call values, so you have this slow interface,
which is P can focus a terminology of P-trace, but if you have P-trace set, it's calling for
it will be a lot faster. Fortunately, this is currently discussed in the kernel, in the kernel
in English, and that's basically one-to-back. This is a very ancient sport, it was in system
in the sixth version, so in around the middle of the seventies, and it's during the time,
different supports have been added, P-Qs, P-Qs, P-Qs, and then get the x, now P-trace gets the
scrolling for at the main point, which is architecture independent. If you use P-trace gets the
scrolling for you, you have not to remember which register, in which register you have the number
of the system calling, which other the arguments. Now they are going to tell you the discussion
to add P-trace set, this is calling for. Then the other point on P-trace is that for one system call,
you don't need just four options to come to switch, but it's set for, because P-trace
creates an event at the moment of the system call, and when the kernel responds. So you have two
elements, think to the S-trace. The first seven is to read the arguments, and then the second
element is to read the time value of the error number. Okay. Another technique is based on
second. So P-trace gets a little bit of speed, and this under this scenario, because you avoid
the second return. So you have that in this case, you have second to process it, and yeah,
it gets a little bit of speed. So in this case, like 5 seconds, 6 seconds. But it has the same
problem as a P-trace. So like architectural dependent, difficulty to multitrad, and so on.
So that's another technique, maybe the newest one, is the second to notify.
Basically, it's different, because in P-trace, you modify the trace and process,
and that the trace and process execute a new system call, as a different system call, and so on.
In this case, which is a computer notify, you're as a hypervisor, you're executing the
system call, and returning the result. So it's a different view on how you alter the system call
of flow. So for instance, in this case, you have that the hypervisor has the trace process here,
and the hypervisor doesn't change the trace process system. So the trace process
execute opens the P-trace, and then the hypervisor opens the real P-trace, and execute the
system call, and get the result back. So if directly the hypervisor does that.
Quickly, it's different that the error in signal involved, because it is at the weight,
the state change of the process. Instead of here, there is a final script, so you can use
a pulse, a vector, and other stuff to perceive, there is an error.
There is also a problem, not a problem, as P-dup, which we can get, is that a second, just use BPF,
not BPF, in this case. And so in this case, we need to trace, for instance, all the file
the script or based system calls. So for instance, every read, every write, in the case,
we have ABPF, we can create maps with the VPS. So we can basically create a map of what we want
to trace in term of file descriptor. So there are some cases in which you mix,
real file descriptor, and real file descriptor, because the open, maybe get traced, or some
open, doesn't get traced, so pass directly to the kernel. But in this case, we need to trace
all the read request. Otherwise, if we can have ABPF maps, we can basically decide which read
gets into the kernel, and which read gets into the hypervisor. This is pure overhead, obviously,
the two in red, so the system wake up, the hypervisor for the real file descriptor, not the
virtual one. And also, there are some order to solutions, which are not based on hypervisor.
So you don't need to have another process. This is called an auto-menology service organization.
So for instance, one of this is PRCTL. PRCTL, this is a tricky way to do hijacking of
system calls, because it's mainly designed for an emulation, like wine, like limbo, so you use
that to emulate system calls, which are not the one of the operating systems. And it's extremely
our dependent, and it's difficult, really difficult if you want to read the read me of the repo,
there is a explaining that, it's really difficult to pass the system call in that.
The last one, I want to present to you, maybe, is the simple one, because maybe you use that
in an order form, because it's based on repo load and can be uploaded. It's that delipsy,
basically, is a two-faced library that does the system calls and provides some wrapper for the
system calls. Like the open is not a real open, it's like a wrapper for the open, then get to,
this is the call-and, to the real operating system. And with that, you can basically
hijack the layer at level of libraries, and which you request the open to the library.
With that, you can basically get a native C-School interface in which you can do the
system call and the proof of that is that, obviously, is a library function, doesn't pass to the
kernel two times. So you have this speed, which is basically the same of cut, in this case, not,
you don't have the switch. So we use that. If you are loading several layers,
and we loaded using a view in small, so it's like you are inserting some modern intercarnal.
So these modules are trusted. So we can, instead of having kernel tracing at each layer,
here inside the virtualization program, the hypervisor, we use self-authorization in order to
gain speed. So in conclusion, there are not civil bullets, we saw that there are not civil bullets,
and there are different techniques to adjust system calls, which are collectively implemented
in the Linux system, the kernel and the user interface. There are some of these data, which are not
really adopted at this time, and we can create a layer to virtualize system call,
which is flexible, it's more flexible than container, because container just emulates some part of
the system. In this case, we emulate all the interface facing with the system. I can do a demo,
if you want, yeah, I can show you, if it works, the repository. So for instance, let's do the
P-trace hijacking. I compiled the software. So for instance, we can say P-trace vector,
cap, etichy OS release, and obviously OS release is not hijacked. It is the same as the picture.
So it hijacks only, etichy, passwordier request. But if I say cap, etichy, passwordier, in this case,
it's kept with relies. And get with relies to host name. So you can see that it's not
printing the real, etichy, passwordier, it can show you that there is no tricks in the real
passwordier there, but if you passing through the hypervisor, you get your system call hijacked.
This isn't going to get hijacked to the request of etichy off name. So it's always the same,
the only one I want to show you, which is different is the VOS, VOS method. So you can just start
your MVU bash. As you can see from the prompt, I am inside, I am the big prompt, but I am inside
a virtual machine based on P-trace, in this case. And so I can say VOS in this case, and cut,
etichy, plus VD. If there is no demo effect, I am just hijacking the process that
cataclycuted inside the virtual machine. So it sounds like a container in this case, but it's
not, it's just for a single system call. In this case, a single request to assist a call.
So thank you for your attention, and I don't know if Renzi wants to add something.
If you use a system called tracing your projects, and not happy for the actual support, please contact us,
that will be fine together.
Any questions? All right, thanks.