4 ms·

UML has been around for a very, very long time. I remember using it back in undergrad for one of my courses, but now I forget which one. It’s got great documen

UML has been around for a very, very long time. I remember using it back in undergrad for one of my courses, but now I forget which one. It’s got great documentation. See the kernel.org documentation here: https://www.kernel.org/doc/Documentation/virtual/uml/UserModeLinux-HOWTO.txt https://www.kernel.org/doc/Documentation/virtual/uml/UserMod... and a write up from the creator Jeff Dike (which includes a lot of technical detail on the inner workings) here: https://lwn.net/2001/features/OLS/pdf/pdf/uml.pdf https://lwn.net/2001/features/OLS/pdf/pdf/uml.pdf (from 2001!) slirp is the only _purely usermode_ way to do networking, but UML also supports TUN/TAP for something a little more sane. UML does a bunch of pretty crazy things in order to work, including a dedicated thread whose job it is to ptrace every other process for syscall and signal emulation (and, as a bonus, it even ptraces external debuggers to make them think they’ve successfully ptraced a process that’s already being traced!), and a full emulation of physical/virtual memory translation with paging (done by giving every virtual process under UML its own virtual address space). All in all, a super impressive project, and definitely one worth trying out.

svd4anything 7y ago
I’ve recently been using proot [1] as a way to have a fully controlled rootfs for jobs on a HPC cluster/grid service where I am a very regular unprivileged user. Is it theoretically possible I could run an entire linux kernel instead with this? Is there any setup on the host system that is required which needs administrative privileges? [1] https://proot-me.github.io/ https://proot-me.github.io/
- CameronNemo 7y ago
  I do not have much info on UML, but you may be interested in https://rootlesscontaine.rs/ https://rootlesscontaine.rs/
  - gnufx 7y ago
    Unless you're interested in OCI (?) containers, you're probably better off with straight proot, or charlecloud if you're allowed user namespaces. https://github.com/hpc/charliecloud https://github.com/hpc/charliecloud
- gnufx 7y ago
  Yes, Proot is useful, but limited. It will be somewhat slow in some cases and not do the right thing in others, like interpret shebangs as expected, as namespaces will. In most cases you can run HPC stuff by installing packages under proot and setting paths in the environment appropriately to use the resulting root. (I don't know if that's the case here, or if it means running under proot.) No, you certainly can't run your own kernel that way.
- ktpsns 7y ago
  The HPC usage scenario is exactly the reason why I played with UML a few years ago. Many HPC clusters nowadays completely lock down the network and only allow in/outbound SSH connections to whitelisted IP networks. On the other hand, users are only given an unpriviledged account. Typically, users set up proxies on a per-application level (i.e. for git, svn, to sync their codes with the outer world). I found this very frustrating and wanted to use any usual Linux command line tools. My idea was a UML based virtual machine (ie. running a Linux distribution within UML) and have it connected to the outer world by tunneling a single slirp and VDE connection. VDE is quite amazing because it marries unix pipes with ethernet-level networking. It even allows to run ethernet switches as processes and all that. My codes based on https://github.com/jpetazzo/sekexe https://github.com/jpetazzo/sekexe Turned out: It basically worked, but it was a bit painful to setup and to manage.
  - svd4anything 7y ago
    That is very helpful to know it has been done, thank you. I need to try UML out it seems. The SMP issue and any overhead are other big questions.
  - gnufx 7y ago
    I'd have thought it would be relatively unusual not to be able to use HTTP into a cluster login node, but I'm puzzled why you can't "sync code" with ssh otherwise. If you're prevented from doing things you need to work, it sounds like an institutional politics problem; subverting controls is likely to cause more friction as well as presumably wasting resources due to inefficiency.
- zoobab 7y ago
  Udocker also use Proot: https://github.com/indigo-dc/udocker https://github.com/indigo-dc/udocker I used it on a server where I was not root to be able to launch docker containers.
mcpherrinm 7y ago
It was probably the computer security course, assuming we took many of the same courses. It had students exploit a setuid binary to get root for an assignment. Done on UML so we could run the thing as our regular users.
- nneonneo 7y ago
  Yes! That was indeed it. You motivated me to go look into my archives - I took that course in 2010 and almost entirely forgot I had :)

svd4anything 7y ago

I’ve recently been using proot [1] as a way to have a fully controlled rootfs for jobs on a HPC cluster/grid service where I am a very regular unprivileged user. Is it theoretically possible I could run an entire linux kernel instead with this? Is there any setup on the host system that is required which needs administrative privileges? [1] https://proot-me.github.io/ https://proot-me.github.io/

CameronNemo 7y ago
I do not have much info on UML, but you may be interested in https://rootlesscontaine.rs/ https://rootlesscontaine.rs/
- gnufx 7y ago
  Unless you're interested in OCI (?) containers, you're probably better off with straight proot, or charlecloud if you're allowed user namespaces. https://github.com/hpc/charliecloud https://github.com/hpc/charliecloud
gnufx 7y ago
Yes, Proot is useful, but limited. It will be somewhat slow in some cases and not do the right thing in others, like interpret shebangs as expected, as namespaces will. In most cases you can run HPC stuff by installing packages under proot and setting paths in the environment appropriately to use the resulting root. (I don't know if that's the case here, or if it means running under proot.) No, you certainly can't run your own kernel that way.
ktpsns 7y ago
The HPC usage scenario is exactly the reason why I played with UML a few years ago. Many HPC clusters nowadays completely lock down the network and only allow in/outbound SSH connections to whitelisted IP networks. On the other hand, users are only given an unpriviledged account. Typically, users set up proxies on a per-application level (i.e. for git, svn, to sync their codes with the outer world). I found this very frustrating and wanted to use any usual Linux command line tools. My idea was a UML based virtual machine (ie. running a Linux distribution within UML) and have it connected to the outer world by tunneling a single slirp and VDE connection. VDE is quite amazing because it marries unix pipes with ethernet-level networking. It even allows to run ethernet switches as processes and all that. My codes based on https://github.com/jpetazzo/sekexe https://github.com/jpetazzo/sekexe Turned out: It basically worked, but it was a bit painful to setup and to manage.
- svd4anything 7y ago
  That is very helpful to know it has been done, thank you. I need to try UML out it seems. The SMP issue and any overhead are other big questions.
- gnufx 7y ago
  I'd have thought it would be relatively unusual not to be able to use HTTP into a cluster login node, but I'm puzzled why you can't "sync code" with ssh otherwise. If you're prevented from doing things you need to work, it sounds like an institutional politics problem; subverting controls is likely to cause more friction as well as presumably wasting resources due to inefficiency.
zoobab 7y ago
Udocker also use Proot: https://github.com/indigo-dc/udocker https://github.com/indigo-dc/udocker I used it on a server where I was not root to be able to launch docker containers.

mcpherrinm 7y ago

It was probably the computer security course, assuming we took many of the same courses. It had students exploit a setuid binary to get root for an assignment. Done on UML so we could run the thing as our regular users.

nneonneo 7y ago
Yes! That was indeed it. You motivated me to go look into my archives - I took that course in 2010 and almost entirely forgot I had :)