Room full pack of people, so hello everyone, I am David Eberardi, I am here with my master
Renzo Davoli to present you this talk on what is still missing is system portraying all
Linux this time and yeah I have this slide here and you can see that in the bottom of
the slide there is a repository of it in which you can find the code of some example
and the patch is we will present today and yeah we will talk about system call, I assume
that you know what a system call is, that we will talk about system call tracing, so basically
we will talk about something which is similar to a trace in which is a program which
springs every system call where get executed by another program, so in the slide for instance
you can see at the bug procedure like in which we print every read done by cut
it see pass with it, so it is just the prints whatever read is done by the file by the program.
So following this features, basically we can create some kind of multiple layer operating system
in which you have the operating system which does some kind of services which offer services
like file systems like networking and so on, but then you can put some layer in it like
programs use a program use a space like whatever cut whatever you want, but over it you
can put another layer, so you can put some kind of multiple layer, so for instance you can
filter what a system call does, so for instance you ask for a read on a file, you can
alter the part of the file in transit, which is similar to what you can do with in a space
it's obviously because you can alter some part of the system, but on a more finer level
so for instance for every system call you have, this is the concept we will present today
so basically how to create virtual machines based on system calls, so have a system call
can be altered, lying to the user program, so basically you lie to the user program
what the system call is doing and you can change what the program see from its perspective
basically we have two techniques, we will present two techniques, so we will present two
two different set of patches, one is for the hypervisor mode, what we call hypervisor mode
so we have a user space program which hypervisor supervised another program, so basically
you say okay we have this program which manage a system call of the other, so for instance you can
say okay the read done by this program can be ejected to another one and this is done by
hypervisor supervising, we will call it the hypervisor mode, on the other side you
done it inside the program itself, so basically we brought the system call in a system
called wrapper and that is a little bit less secure because you can basically
hijack this wrapper and go outside this wrapper easily, but we will refer to this
like a self-virtualization mode and this is the link production, so I give
this is your screen so go, I'm returning back to this slide, so the operating system
fixed the language of system calls, so a process, running process can
open files and give path in and what the process sees is what is provided by the
kind of, but if you stack as a building blocks layer of
applications, so we can have at the top of layer one a program speaking the same language
so able to support able to run the system call, so the interfaces are the same,
but they can see different things, so why would you test for that you
can use a device project, you can find it as a deviant package even in
the table version, so just to save time I like, we can amount the
file system as if it is a level to save, because it is possible to do
amount a file system without any support in the kernel for few, because it is
completely use a space, so if you amount a file system in a layer, they
files will exist only for the process accessing layer one, so to do this, we use
the tracing system called tracing, there are many ways to do this,
the first, the most ancient way to do this, and upon the trace, for example, use
a motelinox was created, okay, the columns list features of those methods,
so available means to that exist now, skip means, there is the ability to
skip the access fields, p-tracer at this system call, interact with the
diverse types of twice, first at the entrance of the system call, such as
is possible to change the number of the columns in the arguments, one at the exit
after the kernel is executed, it is possible to have a second interaction
in order to change the results themselves, if skip means it is possible to
avoid the second call, that's like when you created use a motelinox given
that well, no possibilities, skip the call, use the two change the system call from
the system call to get p-tracer, because get p-tracer is quick and has no
effect, so that is the funnest problem, because the second round of
exchange was the atomizer, it's useless, the interacting nature with that
system call, it is a status change of the process, so if you want to wait for a
system call for the method of a system call, it must be used to wait, use
it's a conference, it is possible to avoid the second interaction, one
problem we have had, we are having, it's a problem to be potable, trust
constantly potable, so I mean that the exchange code can run on similar
interaction, that was impossible in a p-tracer and in p-tracer's a conference, because
the access to system call argument will make using the name of the single register,
I don't point, it's one point, an option of p-tracer, it was p-tracer, gets
calling for, it was very nice for people using, tracing for the bag, he likes
a straight, because in that way this program could be architectural independent, but p-tracer
is calling for, it was interesting, p-tracer is calling for, should provide the
support for architect, independent, tracing for, it's a last year, sometimes after
the first time, this feature entered the cabinet, and at the time, we started the
party and we discovered two problems, one problem was a performance problem, we had to
return back to the cabinet way, because it wasn't possible to avoid the second call to
the supervisor, because the trace gets calling for, it's trying to get it in three different
time or more, entry, access, access, and so on, and implementation once the, to use the same
off for the site, it means that the error identification as entry, it means that there are, there are
an envelopes to call it the accurate attention change, if there are in this way, there are data, there are
climas, we done with the same operation, so it's possible to change the system called number,
for example, set it to minus one, it's a comfort, it's to say it's a statistical, in this
way there wasn't no way to put, not feel to put the error number, okay, and the second problem was about
the, even if there is the program counter in the data from, from, from countries, it's not
important the way to change the program counter, so let us see this, then at a time
attack, the point is that, I'm, I'm going to propose a set, a set of five, five
sets, the first one is to resolve the problem of the, no skip of the system called, by
I think it's a, the stagger, the stagger, even if the playback through the entry phase can
set to, the time value and the time value and their number, that's number two, that's
it's a set, the test set for the testing of the kernel, but three is to add the function
for the, what the function for changes is the program counter and texture pointer, which is,
present in almost all the attacks of Linux, but some, and the fourth steps is to add the
flagger to set the section pointer, we had a, a main conversation with Dr. Levin and I think
the, the classes are in a very advanced state, so I'm going to propose, we're going
to propose it to crash as soon as possible, we had to architect a problem, blast the questions,
another problem, we had to, it's about to 30 new ways, and maybe more efficient to
trace this thing called, one method is about to set computer to five, so computer to
try, as a different concept, using this color unify, we get to, we get the notification
system called, but it's now, but not possible to change the system called number or to change
that arguments, the only thing we can, it's possible, the only possible interface is to,
why the system calls, calls, keeps the system called, and give, and give the, there's
answer to, there are ten values of the system called, or to ask the counter to run, there's
a thing called, but there is no way to have information after the time in value, so the idea
is to delegate to forward all the notification of system called to the hypervisor, and run
this is the coincidence that hypervisor at the time, just the access value, there are interfaces
to send open files, the creator from the, from the hypervisor to the, to the virtual
program, the event is case we found problems quickly, there is no way to support
the FM have to in a, in if we control, there is one task to do something similar to
two, or interrupt 3, but the file descriptor will be the first, the first, the lowest
I'm not fighting the script, I'm just fighting the script over a fixed number and it's been possible to implement more important.
It is not possible.
So if we open a file in the virtual environment, we send the file the script into the trustee.
The problem is that the file the script at one point will need to be closed and there is no way to close a file the script into the trustee.
And if we like the clause to be processed by the kernel, there is a risk condition because it's not impossible to know if other threads or other processes change the file the script at table.
It's closing, opening an after file at the same 5-6 steps and so on.
Even the scale in the, in the material published with this talker, you will see that a year has in the page of this talk.
We propose a patch to the sources problem.
The patch in this case is at an early stage, so we're working on it.
Okay?
So there is not so much to say.