User-Mode Linux Merged Into 2.5 Kernel

An anonymous reader writes "With little fanfare, User Mode-Linux (UML) has been merged into Linus' BitKeeper tree. The merge followed a patch by UML author Jeff Dike, resynching UML with the 2.5.34 development kernel. From the UML homepage, User-Mode Linux provides you with a virtual machine that offers 'a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup.'" There's more UML resources available at the community site.

Comments

long time coming..

[stratjakt]

I'd imagine there are alot of "weekend warriors" who would dabble more, and possibly contribute, but hold back not wanting to screw up their system.

Maybe linux development will speed up a bit.

Re:long time coming..

[stratjakt]

No, why buy something just to tinker with it?

I was talking about all the highschool/college kids who can now more easily dissect and play with the linux kernel, in an 'approved' way.

Still wondering why I got modded down as "troll". Offtopic, overrated or redundant make more sense.

Oh well, I guess the elitist mentality of the linux zealot doesn't like the concept of "weekend warriors" daring to play with the same toys as him.

Re:long time coming..

[00_NOP]

Yes, I think the top poster was right in the general sense about the benefits of UML. That said I am a weekend warrior but I don't think I'd be interested in messing with the main tree. Just too difficult and competitive. I don't even have the time to look at lkml.

Messing about with smaller, less intensive, projects and architecures means I use the heavy lifting of those working on the main tree to assist me develop the Linux project in a niche here or there though.

However, it would be nice to mess about with a 2.5 series kernel just to see what it does and UML could give me that.

Good stuff.

[Lukey Boy]

I recently found a beautiful use for user mode linux - changing distributions with a minimum of downtime.

I have a RedHat box that's colocated that I wanted to move over to Debian - so I installed UML and loaded Debian onto one partition, got everything set up correctly and told LILO to boot off the new slice. After a few minutes of praying Debian came up running all the correct services.

Thanks to the UML team!

Re:Good stuff.

[jovlinger]

what about devices? Are they virtualised?

No I haven't done any research.

Re:Good stuff.

[Lukey Boy]

Devices are interesting - when you run the UML linux from the command line, you esentially alias ubd device names to your system device names (in the virtual context). So I map a loopback filesystem to the root partition of a UML kernel.

Apparently you can also use a copy-on-write methodology to share filesystems between UML kernels and the parent kernel - though you'll have to check their site for that since I haven't had the guts to try it out.

not for the humor impaired

[dboyles]

User-Mode Linux provides you with a virtual machine that offers 'a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup.'

Finally, something that will get Linux accepted as a viable desktop operating system for all levels of users!

Re:not for the humor impaired

[Bytal]

Actually this is just beautifull for network and system developers who don't want to spend money for vmware and others like it. The fact that it will be integrated into the kernel (and hopefully be usefully stable) will make Linux a very serious contender in the heavy duty enterprise level market and be a clear reason to prefer this over a puny Windows server environment or even heavy duty Unix giants. AFAIK no other OS will offer this functionality. I like the joke btw :)

Re:not for the humor impaired

[TheGreek]

AFAIK no other OS will offer this functionality.

Sorry, no.

Re:not for the humor impaired

[jbolden]

You forget MVS (even better than OS/400) which is based on running multiple virtual OSes of radically different types if needed all under extremely powerful management tools.

Still I agree 100% with your main point that while this is a big step up for Linux it ain't playing in the same ballpark yet.

Re:not for the humor impaired

[Cato]

MVS (which later became OS/390 and z/OS) does not have the ability to run other OSs. VM is the hypervisor that lets you run 'real' OSs such as MVS, CMS, Unix and Linux, using IBM mainframes, like VMware on x86. VM/VMware are something like UML but work at the hardware level and can run virtually any OS for the given hardware, whereas UML obviously is a version of Linux and can only run Linux apps, not OSs.

VM is very unlike OS/400 - one is a hypervisor, the other is an OS.

Re:not for the humor impaired

[Venotar]

> UML obviously is a version of Linux and can
> only run Linux apps, not OSs.

Correction - UML runs Linux OSes (distros, if you will), which, in turn, run Linux apps. A fine point, but critical.

Re:not for the humor impaired

[jbolden]

Agree with the clarification entirely. I used MVS rather than zOS because the point would be obvious (Multiple Versioning System).

Off topic question: Do you know why IBM changed the name to zOS?

Re:not for the humor impaired

[Zaak]

Multiple Versioning System

I believe you misspelled "Virtual".

TTFN

Windows emulation built-in?

[gilesjuk]

Well it does say "run buggy software" :)

Honeypot

[GigsVT]

I imagine there are honeypot applications for something like this. You could make a cracker totally believe they had broken in when in reality they are just in a UML.

For the ultra paranoid you could also make a backup copy of your whole UML partition and only run services in that, periodically restoring it from backup, and copying in the new data that is stored on the real OS. If you got broken into, it wouldn't really matter.

Re:Honeypot

[VC]

I just did this like 2 days ago. Im astounded that UML (bad name IMHO, been used already) is going into the main tree.
UML is awesome, dont just set up 1 honeypot, set up 5 let the hacker think theyve found a whole network..
Ive got my machine (no you cant have the IP ;-) so that ports 22 and 80 to to the *real* linux distro and all other exploitable ports goto my UML machine.
Except that ive got TCP wrappers set up so that when you connect to my virtual machine, it NMAPs you and logs it all to a file.
But probably the most fun thing you can do is test things like:

# rm -rf / ;-)

Re:Honeypot

[bigjocker]

# rm -rf / ;-)

Why would you want do delete the winky tree??

Re:Honeypot

[puff-d-dwaggie]

I've done the Honeypot from home, but filled mine with killer bees instead. I used vmware to setup a honeypot machine running linux with a nice little samba server setup, and semilocked down. It was, however, filled with hundreds of programs and bullsnot documents all infected with one or more windows or dos viruses. I actually had someone email me and complain that my web server was virus infected and that it had caused major problems on their network when an employee of theirs had visited my website. They were threatening legal action and such. I replied to them that I didnt run a web server and that someone from their IP had hacked my machine. Several days later I got an apologetic email that also said the offending employee was no longer in their employ. I love my honeypot!

"Get Moose and Squirrel!"

Re:Honeypot

[falzer]

bash: syntax error near unexpected token `;-)'

Re:Honeypot

[psamuels]

Im astounded that UML (bad name IMHO, been used already)

Good thing that's not its real name. The kernel tree has subdirectories for "um", not "uml".

Well, I guess since everyone (including Jeff Dike, the author) refers to it as UML, that probably is its real name. But I'm glad they dropped the redundant "l" from the in-kernel architecture name. Too bad the SysKonnect SK-98xx driver is still called "sk98lin" - I mean, duh, it's in the kernel tree, it's probably for Linux....

Re:Honeypot

[psamuels]

bash: syntax error near unexpected token `;-)'

I get the joke, but come on, get it right. bash won't complain about ';' because that's a statement separator. It also won't complain about the '-' until it can't find it in your path. The unbalanced ')' is what fails here.

(:

Re:Honeypot

[kasperd]

# rm -rf / ;-)
bash: syntax error near unexpected token `;-)'

Re:Honeypot

[falzer]

$ ls -R / ;-)
bash: syntax error near unexpected token `;-)'

That's what bash version 2.05a.0(3)-release (i686-pc-cygwin) gives me.

(Hey, I wasn't going to check with rm -rf / ! :-)

Re:Honeypot

[psamuels]

That's what bash version 2.05a.0(3)-release (i686-pc-cygwin) gives me.

Weird. Must be a cygwin thing. (Yes, I tried this, with bash 2.05b.0(2)-release (i386-pc-linux-gnu).)

I haven't used csh in years, but who can forget the classic:

% If I had a ( for every time Windows crashed, what would I have?
Too many ('s.
%

FINALLY!

[dextr0us]

any person who likes to poke around with linux knows how eternally annyoing it is to crash your main box. For this reason, i had set up a 486 for "poking". We all know how much we love to poke around on THE WORLDS SLOWEST MACHINE!!!!

UML is something that i haden't heard about, prolly because i havent kept up, but this sounds freaking awesome!

Re:FINALLY!

[antoinjapan]

AntoInJapan: (too lazy to log in)
I only learned about it..and a lot of other things by periodically going to sourceforge and anything on their top ten downloads or activities that I don't recognise I follow to see why its so popular...

I just bought the new Japanese Zaurus running linux ...I wonder can UML emulate the Zaurus environment so I don't break the very expensive real one when messing around...plus it has no keyboard :-( (unlike the foreign one)

Re:FINALLY!

[antoinjapan]

ooops cookie logged me in

Re:FINALLY!

[Khalid]

Consider yourself lucky to not have posted something embarassing :)

Re:FINALLY!

[antoinjapan]

like admitting I bought a zaurus in japanese and can't read the manuals...

FreeBSD's Linux emulation

[Istealmymusic]

Any word on how UML compares to the FreeBSD emulation of Linux? I've heard claims that FreeBSD can run Linux binaries faster than Linux, so it would be interesting for a one-on-one comparison of User-Mode Linux and FreeBSD Linux emulation.

Re:FreeBSD's Linux emulation

[sfraggle]

They are entirely different things. FreeBSD's emulation does translation of the system calls into the corresponding FreeBSD ones; UML is a full Linux kernel running in user space.

What Are Some Other Uses?

[MBCook]

Every time I've seen UML mentioned, it's in refrence to kernel programing/X programing/programing in general/software testing/etc. I understand how it would be incredibly usefull in this circumstances. But my question to you guys is this: how would it benifit Joe User to have this installed if he just surfs the web, does e-mail, plays games, GIMPs, etc? Other than just another layer of crash protection, what good is this to the masses?

Re:What Are Some Other Uses?

[aardvarkjoe]

The "good for the masses" part is that more people will be able to work on / test / debug new linux kernels, so that Joe User will end up with a more stable system. As far as Joe User who doesn't know what a kernel is, I doubt that there's much of a reason for him to be using it.

Re:What Are Some Other Uses?

[kgasso]

In our office (Wholesale/Virtual ISP), we've been experimenting with UML for a while as a decent alternative to trying to virtualize every service and allowing some of our reselling ISPs to have their own username space - something I don't even want to attempt with Apache and most FTP servers.

So far it's been fairly stable, after working out a few quirks. Definitely worth the trouble of getting everything set up. Makes backups on the UML servers stupidly-simple too.

Congrats to the UML developers on clearing this hurdle, and here's to hoping it betters future development on the project!

Re:What Are Some Other Uses?

[jsse]

It's good for setting up a secure box at home which has most services running in different loopback devices of UML and minimal firewalling functions running natively.

It's exactly like a honeypot project, except that you are not going to invite people to hack. :)

I was going to write a howto for it but since it's a duplicate effort of honeypot project. You may refer to it. It's really useful when you couldn't affort to spare an extra box for your firewall.

Re:What Are Some Other Uses?

[be-fan]

Um, who cares? Not everything has to help the masses. Some stuff is by hackers for hackers.

Re:What Are Some Other Uses?

[norton_I]

Aside from the fact that not everything has to be for the masses, there are lots of sandboxing applications that the masses could use -- not just a layer of crash-protection (which shouldn't be needed if the regular kernel does its job), but as a way of protecting agains malicious/trojan software. For instance, worried that the latest version of windows media player is going to send information about your computer to MS? Run it in a user-mode sandbox that can't access any of your files, and can only use the network to grab your MPEGs. Someone send you a cool program that might have a virus or trojan? Your mail client could just run it in a UML sandbox. No more telling people "don't click on .exe files!

Of course, the options above are much more useful in Windows than Linux, since Linux doesn't have much in the way of viruses, trojans, or spyware, but if it becomes more popular on the desktop, all those nasty things will come in full force, and we will be ready.

Another sandboxing application that Joe User might be interested in is for servers. Lots of people like to set up personal web servers for one reason or another, and this is frequently a big security risk. But if he can install it in UML (or preferably download a pre-made UML image with the web server installed) the rest of his computer will be pretty safe.

Another security possibility is for a personal firewall. If you ran your whole system in UML, and ran nothing but a firewall on the "real" machine, you could get many of the advantages of a firewall without a second computer. This is probably not particularly attractive, since you don't really need the firewall to be seperate from the workstation, but it is a possibility.

I personally would love to see UML ported to Windows as a way to run Linux apps under Windows.

Re:What Are Some Other Uses?

[jakedata]

Perhaps we could put a wrapper around the embedded certificate in the Banias processor? Call it project Cybil. 21 personalities in one box.

Re:What Are Some Other Uses?

[Lussarn]

Who cares. The very reason we run Linux is because you can do stuff that will never make it into a consumer OS.

Re:What Are Some Other Uses?

[WNight]

From what I've heard, some Linux distros aiming for the clueless-users market are implementing this sandbox mode with Wine to allow you to do things like open email attachments without hosing your other emulated programs.

The idea is that you install a bunch of applications and with each one, tell the system if it's a component of (ie, should share the filesystem and permissions of) another program, related to it (in which case they need or one two way access to the files of the other, though possibly read-only) or completely unrelated, where they can "scan the whole system" and not see each other. (Of course, the whole system would appear to be an empty windows install until you set otherwise.)

This way your virtual copy of Outlook (needed for calendaring in your company) would think it was the only thing installed, but your other apps could see Outlooks files, though in read-only mode to allow for importing of mail, or what-now. If you clicked on an email attachment it'd default to running it in a seperate filesystem unless told otherwise. If it's an .exe of the dancing baby, no harm done. If it's a virus, again, no harm done. (The exception being JS viruses where Outlook doesn't actually run an exe, where it is the security hole itself.)

With a system of hard-links you could make a "windows install" that you could have tons of copies of without taking more room, except for files modified by the program running in that particular partition.

This would also work in VMWare, if you could make it run from a Linux filesystem, but the overhead of running a new VM for each program is overkill.

Limitations

[deepchasm]

a safe, secure way of running Linux versions and Linux processes

Well, yes it is, but if you want to take advantage of the security, and debug processes in depth, then you might have some problems.

Many of you will probably remember the Reverse Challenge. One evening I downloaded the malicious binary, and decided that UML would be ideal to try running it in a tightly controlled enironment - using fenris to trace its execution and learn more about it.

Unfortunately, fenris doesn't work under UML (neither does strace if I remember correctly).

Shame. It's a lot cheaper than VMWare!

Re:Limitations

[Tom]

strace runs just fine.

I wanted to attach a few lines as proof here, but /. "junk filter" doesn't let me, no matter how much I try. Sorry, you'll have to verify for yourself.

Re:Limitations

[deepchasm]

Are you sure?

I know that it appears to work under UML, but when I did the same strace on two debian installs, one running normally and one UML, and piped the result to wc -l the one running under UML had a smaller number of calls reported.

Few things more deserving...

[Sheetrock]

UML is just so versatile. It works nicely as a honeypot. It can be used to partition one machine into several for webhosting providers to let customers run what they want. It goes one step beyond chroot for running daemons you need but don't particularly trust. It lets you safely try distributions you haven't used before or design new ones.

So, cool to see it gets the official seal of approval.

That Linux...

[trevinofunk]

So hot right now. Linux.

Re:That Linux...

[SixArmedJesus]

Linux is so Derelicte.

Re:That Linux...

[great throwdini]

Linux is so Derelicte.

Shameless. Simply shameless.

Re:That Linux...

[ICA]

You're right, it's a really, really ridiculously good OS.

Re:That Linux...

[An Onerous Coward]

There was this moment last night--when Tux was sandwiched between the two Finnish dwarves and the Maori tribesman...

Sorry.

Is there an parallel to FBSD's jail?

[pschmied]

I know that FreeBSD's jail allows for some level of virtualization. My question is, how technically does this differ from the jail mechanism or does it?

As a side note this sounds like a really cool idea, especially if you could virtualize multiple instances.

-Peter

Re:Is there an parallel to FBSD's jail?

[autocracy]

Jail doesn't spawn an entire new virtual machine as a single process.

And yes, you can run many instances of UML.

Re:Is there an parallel to FBSD's jail?

[Delta]

From the way I understand things the main differentce is that FreeBSDs jail() is implemented mostly like chroot(). A set of checks within the kernel, while UML is a linux kernel running inside linux.

It could be argued that if both ways are done right, the latter might offer a cleaner separation.

Another difference is that of how you work with the two. With UML I presume you start a new kernel and boot it, while FreeBSDs jail() allows for a much more lightweight model. On my systems I usually rewrite the applications which communicate over networks to jail themselves, to minimize the impact of an exploit against the application. You can't really do the same with UML.

It would however be very interesting to see a detailed comparison, including focus on performance.

Re:Is there an parallel to FBSD's jail?

[jelle]

UML is not the same as jail(), but the vservers/ctx kernel patch and programs is, and it's got more features too.

Great for trying out other distributions, safe tryout of 'apt-get dist-upgrade', etc, etc.

Re:Is there an parallel to FBSD's jail?

[PurpleBob]

With open source software the users are the ones making money with it not just the people that sell it.

Your sig strikes a tragic note: it's obvious that you have been hit hard by the sudden Sig Comma Shortage.

That is, I can see that you have quite enough commas for ordinary posting, but none of the kind that are durable enough to last in the harsh enviroment of a sig.

Out of pure generosity, I'll let you borrow my two sig commas. The TMBG lyrics will be temporarily ungrammatical, but I can take out the capital letters too and pretend it's Radiohead. That's a small price to pay so that a full statement can have the punctuation it deserves.

Use them wisely, my friend.

Re:Is there an parallel to FBSD's jail?

[Delta]

Quite simply, no.

UML works by starting another kernel, the jail() system of FreeBSD is more like a improved chroot(). You don't start a new kernel, just just make a syscall to tell the kernel to limit what you can access.

Re:Is there an parallel to FBSD's jail?

[jelle]

I found some cheap comma's, so you can keep them in your lyrics.

Re:all I have to say is....

[Soko]

Right. The quote I'm thinking of goes something like this....

"When you make something idiot-proof, the world just makes a better idiot".

Newbies will _find_ a way to hose thier machine, even with UML. You can bet on it. Me, I'm hoping I, er, they still can - there's no better way to learn how stuff _really_ works than by fixing it after you've "Blowed it up rreeaaaalll goooood!"

Soko

Re:Now to get MAC's merged in.

[dapantzman]

To comment on my own story. It looks like NSA has gotten some of its code merged into 2.5.27 and .29. Sorry for not looking first. I think this would have made a good story for Slashdot also.

http://www.nsa.gov/selinux/news.html

Imagine...

[stor]

A Beowu*smack* ow.

Cheers
Stor

Re:Imagine...

[adamjaskie]

/me gets the idea to set up a beowulf cluster of UML "boxes" to learn how to set up a cluster...

Re:FreeBSD's Linux "emulation"

[Anonymous Coward]

Comparing UML to FreeBSD's API redirector (usually misnamed "Linux emulation") is like comparing Windows running in VMware to WINE. VMWare runs the true full blown MS-Windows while WINE redirects the calls to approbate native calls/code. Likewise, UML runs the true full blown Linux kernel while FreeBSD just redirects the calls to native calls/code.

UML adds more layers before a system call makes it to the hardware than simple API redirection. For example, for a program running in UML to read from the CD-ROM, the real kernel only provides access to the block device and the UML kernel translates the block device/ISO9660 accordingly for the file access calls. In UML, reading of the structures as following ISO9660 is done is *user space*. FreeBSD's API redirector breaks the block device structures from ISO9660 to approbate formats for file system calls all in the FreeBSD kernel. FreeBSD's Linux "emulator" does not achieve the same redefination of what occures in user space as opposed to kernel space at all. If FreeBSD can't run Linux binaries faster than UML then something is very wrong. However, it would be interesting to see if FreeBSD's API redirector could run UML and see if UML runs faster on top of FreeBSD or on top of Linux.

UML = Unified Modeling Language

[WindowsTroll]

The use of TLA's (Three Letter Acronyms) has become so rampant that it is hard to find things which aren't referred to by their TLA. In many cases, the same TLA has more than one meaning, so the users of the acronym are able to keep the context straight. In this case, where the software sector has a standard definition of UML, reusing the acronyn will only spread confusion

If I were to create a software application called Great New Utility and referred to it as GNU, people would rightly be upset at me for trying to usurp an already common use of an acronym. In this case, I would probably be violating a trademark. The acronym of UML is already trademarked by Object Management Group, and has a common and well known usage.

Re:UML = Unified Modeling Language

[Anonymous Coward]

The problem you are referring to is otherwise known as TOS: "TLA Overload Syndrome". Yes, a TLA which includes a TLA.

Appropriately enough, TOS can also mean "Transfer Orbit Stage" amongst a host of other things.

Re:UML = Unified Modeling Language

[Wdomburg]

> In many cases, the same TLA has more than one
> meaning, so the users of the acronym are able to
> keep the context straight.

Hear, hear! People should really make more judicous use of ETLAs instead.

Matt

Re:UML = Unified Modeling Language

[Ziviyr]

GNU/GNU, sounds good to me!

Re:UML = Unified Modeling Language

[dvdeug]

In this case, where the software sector has a standard definition of UML, reusing the acronyn will only spread confusion

Why? I haven't seen the Unified Modeling Language used much in the OpenSource enviroments where UML will be used, and outside those enviroments, User Mode Linux will probably have to be written out (and probably explained) to have any meaning, whether or not UML is used there or not. There's a programming language named Icon; I don't see hoards of confusion over that.

Re:UML = Unified Modeling Language

[Skapare]

Since I don't do things that involve those kinds of higher level languages, my first encounter with "UML" actually was "User Mode Linux". So when I see "UML" that's what I think of. In fact it took a while for me to figure out why it all those developers seemed to be interested in using User Mode Linux.

I propose we adopt a new meaning for "UML" as "Ubiquitous Mysterious Logic" or "Ugly Men Lurking".

Re:UML = Unified Modeling Language

[sg_oneill]

Or even TIT -> Tos Is (a) TLA. And then you have a recursive TLA.

Re:UML = Unified Modeling Language

[sg_oneill]

Ugh,.. :/ .. Sorry Tos Is(a) Tit -> TLA is not recursive (Ok Shayne.. time for another cofee.. brain go cookoo). Um... How about TIT -> TIT Is(a) TLA... There. That works. Ok.. Now I'll get that cofee

Re:UML = Unified Modeling Language

[Arandir]

haven't seen the Unified Modeling Language used much in the OpenSource enviroments where UML will be used

In some ways, that's a pretty severe indictment of Open Source. UML is about software analysis and design. Most Open Source projects, sadly, do not design their software, but start coding from minute one. There are exceptions though, but by and large most Open Source hackers don't have the patience to design their software (or validate it, or write documentation, or do usability studies, yada, yada, yada).

To be fair, a heck of a lot of closed source software isn't designed either.

Re:UML = Unified Modeling Language

[mshiltonj]

VLM - Virtual Linux Machine?
UMK - User Mode Kernel?
LUM - Linux User Mode?
LVM - Linux Virtual Machine?
PUL - Partitioned User Linux?
LUK = Linux User Kernel? (pronounced Luck!)

Whatever. I do think an new acronym should be found for this.

Re:UML = Unified Modeling Language

[eatdave13]

UML is trademarked by Object Management Group? OMG!

Re:UML = Unified Modeling Language

[dvdeug]

haven't seen the Unified Modeling Language used much in the OpenSource enviroments where UML will be used

In some ways, that's a pretty severe indictment of Open Source. UML is about software analysis and design.

You don't quite come out and say it, but I'm getting the impression of

OpenSource doesn't use UML.
UML is about software analysis and design.
Therefore, OpenSource doesn't do software analysis and design.

That is to say, UML is not the only way to do software analysis and design. Bertrand Meyer has thrashed UML pretty hard: So, although UML willbe successful at first, because it has the right endorsements, it will be of little use to the actual process of developing software. (Unfortunately, I can't find the article where he let loose with both barrels.)

most Open Source hackers don't have the patience to design their software

Or the knowledge - I don't remember anything in any of my compsci classes about designing software. Open Source ad-hoc design, build, and redesign and rebuild seems to have worked pretty well in some cases.

or validate it

Money, perhaps? Spending several thousand dollars for a validation kit that I can only use on my machine is quite pricy.

or write documentation, or do usability studies

Serious user documentation in the commericial world is done by writers, not programmers. You can't expect people whose skills are programming to do everything.

Re:UML = Unified Modeling Language

[cleancut]

Reminds me of an incident at the .com I was at a few years ago.

Marketing Droid: Did you fix the DNS? It's wrong.
Me: I didn't know it wasn't working, hold on a second and let me check.
Marketing Droid: [Harvard MBA CEO] is really upset about it. We need to take care of it.
Me: Hold on...I'm checking as fast as I can.
[Droid hands me a piece of paper]
Marketing Droid: Here's the preliminary sketch for what we want to do.
[I look at the paper, and realize it has nothing to do with the Domain Name System, but rather something about Solociting]
Me: What exactly does DNS stand for?
Droid: Well duh! Do Not Solicit, of course!

WHACK!!!
Thousands of Droid parts are scattered by the force of my LART.

Re:UML = Unified Modeling Language

[Mawbid]

LVM is the Logical Volume Manager, so that's even worse. You could be running LVM and LVM on the same machine (and LVM's and LVM in the LVM's!)

Re:UML = Unified Modeling Language

[ivan256]

In some ways, that's a pretty severe indictment of Open Source. UML is about software analysis and design. Most Open Source projects, sadly, do not design their software, but start coding from minute one.

UML is hardly a necissary tool for designing software. In fact, if the task is simple enough source code can be the best design document. People that are too closed minded to consider more than one solution to a problem make poor software developers.

most Open Source hackers don't have the patience to design their software (or validate it, or write documentation, or do usability studies

You unfairly limit this to Open Source developers. Colsed source developers are just as lazy if not more, and typically the only reason such a programmer will think out a design before starting or write complete documentation is because it's company policy.

Re:UML = Unified Modeling Language

[Arandir]

UML is hardly a necissary tool for designing software.

No, it's not necessary. But it is common enough that Open Source developers should think UML == "Unified Modelling Language", instead of "User-Mode Linux". I may not need blueprints to build a house, but I should still know how to read them.

Re:UML = Unified Modeling Language

[Azog]

BTW, LVM is already taken, it's "Logical Volume Manager", used for managing big hard drives, resizing partitions, and stuff like that.

VLM for Virtual Linux Machine would have been good, but too late now I think. Oh well.

Re:UML = Unified Modeling Language

[psamuels]

UML is trademarked by Object Management Group? OMG!

Why is this not modded funny? Oh well, here's a ReplyMod, it'll have to do.

Re:UML = Unified Modeling Language

[sys$manager]

VLM
1. Very Large Memory.

2. Virtual Loadable Module.

Re:UML = Unified Modeling Language

[Flossymike]

You see people, we do need to use the ABBR and the ACRONYM html tags. People, it's not that hard to include them, and by including them we will increase the need for browsers to support them better!

If you're interested, here's the w3c low down on them:-
http://www.w3.org/TR/REC-html40/struct/tex t.html#h -9.2.1

Re:UML = Unified Modeling Language

[netsharc]

You missed the subtle joke.. Object Management Group shortens to OMG.

Re:UML = Unified Modeling Language

[psamuels]

You missed the subtle joke.. Object Management Group shortens to OMG.

No I didn't. You missed my point. I said, "Why is this not modded funny?" I thought it should have been, you see, but it wasn't. *sigh*, you really can't win in this game.

Re:Woah

[IIRCAFAIKIANAL]

You're not very funny, but I found this so I forgive you.

Sounds like the Hurd

[extrasolar]

Somehow, this seems similar to what the Hurd is supposed to do. Someone wiser want to clear this up?

I don't get it

[schlach]

I imagine there are honeypot applications for something like this. You could make a cracker totally believe they had broken in when in reality they are just in a UML.

Except for the 0.02% of people out there, and maybe 98% of businesses, that have anything on their computers that's more useful than the computer itself, I don't know why this would make a good honeypot. The cracker won't just think he's broken in... he will have really broken in.

Not so much a honey-pot as a pot-o-honey...

The UML website mentions applications as a sandbox, which makes sense, but if you're going to run vulnerable apps to lure hackers (i refuse to mistake hackers and crackers :) and give them unrestricted network access, you might be able to efficiently spy on what they're doing, maybe, but they've *still* taken over your network connection. They can now use it for a DDoS zombie, an IP bounce, or maybe just put some of their own filez on that wu-ftpd server you set up to get knocked over...

My $0.02

Re:I don't get it

[pabs]

$iptables -t filter -A FORWARD -i tap0 -j in-throttle
$iptables -t filter -A in-throttle -m limit --limit 5000/sec -j RETURN

Thank you, drive through.

Re:I don't get it

[GigsVT]

Honeypots are not for normal businesses to run. They are mostly of interest to security people who want to get insight into the latest tools and exploits.

Re:I don't get it

[Anonymous Coward]

but if you're going to run vulnerable apps to lure hackers (i refuse to mistake hackers and crackers :)

But you just have... Particually when combined with:

They can now use it for a DDoS zombie, an IP bounce, or maybe just put some of their own filez on that wu-ftpd server you set up to get knocked over...

Learn

Re:I don't get it

[schlach]

Sorry, I have the same reaction to people talking about "honeypots" as most people do "beowulf clusters". To use a honeypot for study, fine, UML should stand to be at least as useful as running a real system for the purpose, and at worst, no less useful than VMWare.

My objection comes when people (my impression of the first-poster's intent) use honeypots as a "shiny" box to distract them from other targets on the network. I do not believe that honeypots can be used effectively for this purpose, and while one might feel that he is playing a great trick on a hacker*, that hacker might be perfectly content with the proffered low-hanging fruit, depending whether their purpose is malicious or exploratory, or whether they're just looking for a certain number of machines to house files or cover their tracks against other targets.

One advantage is that one can easily restore a compromised honeypot from a single file with UML, which means that the hacker will just have to do the same thing again tomorrow to get back in.

My beef is with people and honeypots, not UML. Security through security, not insecurity, and all that.

New topic:
*to respond to the Anonymous Coward, using bold-face type and speaking in a terse second-person does not lend credence to your argument that one should confuse people who hack into other computer systems with people who professionally open locked safes, or remove the copy-protections from files. When I say "hack" to the /. crowd, approximately 0% of the effective population, they know enough to determine by context whether I mean a friendly hack or a malicoius hack; and when I say "hack" to the remaining (approx) 100% of the population, be they military, government, civilian, law-enforcement, student, flight-attendant, librarian, rap superstar, or miscellaneous, they know that I mean to subvert a computer system. If that is sloppy communication through language, sir, I do not want to be propa'.

Wow!

[hateddamntruth]

"User-Mode Linux provides you with a virtual machine that offers 'a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup."

Man! That's just some cool shit!

Could this be used like the NT Hal?

[yokem_55]

Could this be used ala the NT hardware abstraction layer? Specifically, could this be used to keep nasty drivers from hosing your system? I know that typically a bad module is likely just going to not load, spitting out unresolve symbols, causing no real harm, but there may be cases where third party drivers may properly load, but end up causing nasty problems.

Re:Could this be used like the NT Hal?

[psamuels]

Could this be used ala the NT hardware abstraction layer? Specifically, could this be used to keep nasty drivers from hosing your system?

What, like nasty drivers can't hose your system in NT? I thought that officially that was the only thing that caused NT to crash. (:

There is no magic bullet for what you want. In order to access hardware, drivers must be at a low enough level to, well, access hardware. At that level they can screw up your system.

UML does not have any direct hardware access - and, as a result, it doesn't support any real hardware drivers either. Everything is virtual. If you want to debug your 3Com network driver, you can't do so under UML....

That said, it is sometimes possible to move hardware drivers out of the kernel. Drivers for USB and SCSI devices, for example, can use raw packet interfaces from userspace, where there are limits on what they can screw up. Also, consider the X server - it pokes at your PCI bus / AGP port, and sets CPU MTRRs, without (for the most part) involving the kernel in its machinations. But note that while there are many failure modes the system is protected from in this situation, X can still ruin your whole day if it happens to turn off interrupts and forgets to turn them back on.

Port UML to Win32

[Troy H Parker]

If someone would finish a Win32 port of UML, I could ditch VMWare.

Re:Redhat bloatware

[zapfie]

First off, you are comparing two things not of similar function. Second, a lot of Word's functionality is also included in shared DLLs- that same winword.exe file won't run if you shove it on a bare machine. Third, you can rebuild the kernel to be as large or as small as you want (functionality-wise, which also affects kernel size). Red Hat's kernel is not the 'official' kernel, so it is misleading to say that the Linux kernel is now larger than the Microsoft Word executable.

RMS is right

[Anonymous Coward]

By calling it "User-Mode GNU/Linux" you get a four-letter-acronym ("UMGL") which does not spread confusion.

Re:RMS is right

[psamuels]

By calling it "User-Mode GNU/Linux" you get a four-letter-acronym ("UMGL") which does not spread confusion.

Sure it would. Anything that ends in -GL makes me think of graphics. HPGL, OpenGL, FireGL.

Really we should just start calling it by the acronym used as its architecture designation in the kernel tree itself: um.

"Larry, have you got that, um, sandbox set up yet?"

"No, I had a problem with the, um, network configuration. I'll try to finish, um, Monday."

Well documented.

[tshak]

One of the great things about UML - unlike a lot of other OSS projects - is that it's very well documented. Thanks to the UML diagrams on UML, there is no confusion as to what UML is or what it does.

More info here:

[cpaluc]

http://davidcoulson.net/writing/pcp/187/masterclas s-linuxexpert.pdf

Vservers/ctx patch can do this without overhead

[jelle]

Somebody has to mention the Virtual Private Servers (vservers) and security contexts (ctx) patch, which takes chroot(), and adds the good stuff from jail() and more to make completely separated contexts for process groups, without the overhead of another kernel.

I've been running Debian 2.2r7 and RedHat7.2 in parallel with Debian/Woody on the same box for months now with this patch.

Re:Vservers/ctx patch can do this without overhead

[WetCat]

A pity that vservers patch does not incorporated into kernel...

Re:Vservers/ctx patch can do this without overhead

[gimpboy]

i'm glad you brought this up. i was wondering if you or someone could explain the differences between vservers and uml mentioned above. it looks to me like they are trying to accomplish the same thing. a friend of mine really digs the vserver thing, and i was wondering how the two measure up.

Re:Vservers/ctx patch can do this without overhead

[hughk]

I would guess the other thing is resilience. If a UML kernel goes down, it shouldn't break the host. Howver with the Vservers patch, it really is one kernel across the 'virtual servers' so if server' kernel breaks, all break. VMware is different in that it forms a virtualisation layer under the host OS which allows the guest systems to run. It is somewhat more tricky, but it has a reputation for being quite good, but is only available commercially.

Re:Vservers/ctx patch can do this without overhead

[psamuels]

i was wondering if you or someone could explain the differences between vservers and uml mentioned above.

I hadn't heard of vservers, but if it's like BSD jail(), it is sort of an extension of chroot(). Basically, you can isolate a process (and its child processes) to a specific part of your directory tree which they now see as the root directory. BSD jail() adds the ability to give them access to only a specific IP address - obviously only useful if your machine has more than one, or if you want to prevent the jailed process from using the network at all. With Al Viro's semi-recent (a few months ago) kernel work, I believe it's possible to separate out the mounted filesystems per-process, which should let you protect the jailed process from the rest of the system, filesytem-wise, not just vice versa.

I don't know what else vservers offer.

UML gives you a whole new copy of the OS. New process list, new set of network servers, new filesystem tree, new everything. Devices are all virtualised - block devices have backing store on the host filesystem, network devices are tunneled, character devices are emulated. If you crack root in a chroot environment, you can get out of jail (there are several methods, one or two of which are trivial). If you crack root in UML, you can trash the UML instance, but it's much harder (though not impossible) to break out to the host Linux instance, and if you do, you're still a normal user there. And if UML is running in a small chroot with no setuid programs, cracking root outside the UML instance is impossible short of a kernel bug or a remote exploit on the host system.

Re:Vservers/ctx patch can do this without overhead

[jelle]

Additionally....

Inside a (numbered) context, vservers offer a root user that doesn't have all capabilities, such as for modifying the ifconfig, routing table, /dev/kmem, etc. You cannot break out of a vservers context, even if you are root.

Plus, processes inside a particular context can only see other processes that are in the same context (ps, top).

When you use vservers to give users virtual 'root' accounts, with each having their own complete Linux installation tree, you can make the standard files of the distributions hardlinks to only a single copy, and then chattr them immutable. That means you don't need as much diskspace, because all standard files share their diskspace. The 'vserver root' can then not modify the file (however, remove and replace with a self-compiled works fine if the directory is not made immutable).

There's probably more, this is what I could think of right now.

This is just like Windows' Task Manager.....

[Ride-My-Rocket]

... with one small difference, of course: WTM isn't safe. :)

server failover

[crywolf]

It's actually a thought I had earlier today. Imagine you're a small place with a few servers (but they're rackmount with hot-swap drives). All of a sudden, the motherboard on one bites the dust. No worries, slap the drives in another server, and...well, some creative planning would be required to get the working server hosting the stuff on the dead server. UML would certainly make this process much easier and doubtless quicker. You'd have two servers running a bit slower, but that sure beats one server not running at all.

Re:server failover

[Paranoid]

I'm not so sure. If your motherboard bites the dust, I'd think the parent Linux kernel is the one likely to crash and burn, since it's the one directly touching the hardware.

Re:server failover

[Mr Z]

Think a little more general: Some pool "N" of UML instances running on a smaller or same-sized pool "M" of physical machines. If you could migrate a UML from machine to machine, you'd be all set. You could even load-balance, so that "M" could be noticeably smaller than "N". You could also change "M" on the fly, say, for maintenence purposes (eg. backups).

--Joe

Re:server failover

[THEbwana]

One thing that surprises me is that VM's been around for years in mainframe environments while failing to become known to the "linux community". UML seems rather similar to the traditional mainframe functionality (having several VM's running os390/zOs images). For more info on how IBM does it (they've done this for years) and why - look into the redbooks downloadable from IBM's website. Why does IBM have 5 9's ? - because of sysplex enabling and VM. This is a REALLY Good Thing (tm). If we could combine mosix and UML with tons of administrative scripts and monitoring software - we would basically have an incredible environment that would rival that of zOs/os390. That would be cool. /m

Combine with DebianEdu

[Perdo]

To keep those little brilliant (bastard) children from wrecking your shiny new Linux lab.

Re:Combine with DebianEdu

[JohnFluxx]

Although it's marked funny, I agree.

I set up one so I could do kernel hacking without root access.

Amazing. Simply amazing.

[mcrbids]

So now, the little upstart "toy" operating system fully supports POSIX, full VM capabilities, and happily runs with some serious equipment and yet it also runs smoothly on
small, dedicated devices.

With each day that goes by, it seems that the folks in Redmond have a deeper hole to dig their way out of...

Re:On the other hand...

[ironfroggy]

Thats why we have "make config"

Linux supports old XT harddrives but you don't see that bloating my running kernel. Although, the source is another story and I'm a big believer that source should be much more modular. Run the config and THEN download the source that you need.

Re:Woah

[Ziviyr]

So who is gunna tell her that her panties are outdated?

Re:How fast is User Mode Linux?

[Lukey Boy]

Native speed - it basically passes all syscalls directly to the parent kernel (as far as I can tell). Very cool shit.

UML Windows port?

[Nicopa]

Now we need somebody porting UML to run under Windows, pehaps using cygwin. Then we could have easy "try-linux.exe" for windows users.. :)

Re:UML Windows port?

[sg_oneill]

Although I suspect it's probly a bit more to it than that (cygwin probly WONT be usefull in porting kernel patches!) it'd be cool to have sumfin like Knopix running as a "CLICK ME!" exe on windows. That'd be spooky to be sure!

fantastic

[ironfroggy]

This is an absolutely amazing thing. I'll be downloading the latest kernel tonight. I've been wanting to try out UML and now I can do so alot easier.

There have been alot of comments about UML and the other meanings of the TLA. Well, we're going to run out eventually, what then? Its all in context.

Also, other comments mention this will bring in new kernel developers. Well, thats right because I'll be working on some ideas very soon!

Re:fantastic

[psamuels]

This is an absolutely amazing thing. I'll be downloading the latest kernel tonight. I've been wanting to try out UML and now I can do so alot easier.

Make sure to use one of Jeff Garzik's Linus tree daily snapshots since 2.5.35 isn't released yet.

Re:fantastic

[ironfroggy]

I already had. :-)

Another important use

[fireboy1919]

There are several products that require a custom kernel, and this could certainly benefit all of them.

The one I'm thinking of right now is Win4lin, the cheapest, fastest Windows VM for Linux right now; it needs a kernel with its own patches, and they distribute patches for Debian, Slackware, Mandrake, and Vanilla kernels. My distro (Gentoo) makes a kernel which is known for its speed, but which I'm not using right now because of this (I can't even patch the Vanilla kernel to that level because it the Win4lin patch conflicts with Gentoo's patches).

Synopsis.

[mindstrm]

The news here is that it is merged into 2.5

UML is not new, though this will certainly make things better.

Just think of the neat firewalling you can do.
Run your DNS servers inside a UML session, with traffic to them filtered by firewalling on the host... even if someone breaches BIND, they are stuck in a machine, can't go anywhere, because all traffic to that machine is filtered.

Virtual linux machines for each service that is not performance critical.

SMP

[binney]

UML can emulate an SMP machine. It could be used for benchmarking multi-threaded code and teaching SMP programming without having to fork out big $$$ for SMP machines.

Re:SMP

[Anonymous Coward]

But since its only an emulator, it isnt always good enough. You dont get to test how the app uses the processor caches, you dont get true concurrency - which is where you find the nastiest bugs.

Well..

[mindstrm]

Consider a firewall where the only IP layer things that are seen are actually coming from instances of UML.
The host kernel is just running bridging (and filtering, of course) , and doens't even have an IP of it's own.

So your NAT device is actually a UML instance.
So hey manage to get root on it.. even so, the traffic to it is filtered at a layer they cannot even see. They just can't get there from, well, there.

Re:How fast is User Mode Linux?

[Anonymous Coward]

Actually, it's much slower than running on the "real" kernel, at least on a 233 MHz machine. On a 600MHz, I haven't yet noticed any large difference in speed.

It may have something to do with PMMX vs. P3, instead of clock speed.

It's called LINE

[Walles]

... and is available here. I have no idea about how far along they are.

i was confused...NOW I HAVE IT!

[mackstann]

If FreeBSD can't run Linux binaries faster than UML then something is very wrong. However, it would be interesting to see if FreeBSD's API redirector could run UML and see if UML runs faster on top of FreeBSD or on top of Linux.

RUNNING A DREAMCAST EMULATOR THAT RUNS LINUX AND RUNNING A GBA EMULATOR INSIDE OF THAT!!!!

WHEE!

[_Knots]

I've been fooling with UML as a potential container for grid computing applications..

Think about it - they get full ring3 native assembler optimization for the computation (none of this Java/emulation stuff) and only encounter a minor penalty when they need to talk to the net or a "disk" - virtual or no. And, with iptables on the real kernel one can set up arbitrary network access rules for the UML world. And since the disks are just files or real disks, you have near-perfect control there too. The only thing I can think of not working is device driver modules like NVdriver... but that shouldn't be a terribly big drawback.

Sorry if that's incoherent, it's 4:00 here and I'm really really tired.

--Knots;

Re:How fast is User Mode Linux?

[CreamsicleSeventeen]

I don't think this is correct. UML is a complete kernel that runs like a user-space application. It even has command line switches like "./linux --help". It's been a while since I played with it, but IIRC there's no reason why someone couldn't run UML-2.4.19 on a 2.4.10 host.

recursive wish

[aposch]

cool - if I had UML running, I could test this new kernel with UML ...

Too sad, as I need a running server, I cannot test a development kernel. As I don't (can't) follow the 2.5-development: Any guesses on when a 2.6.0 will see the light? 2003 or 2005?

--
still in search for a cool .sig

Re:recursive wish

[belg4mit]

Did you even look?
Past versions of UML are just standard processes,
that's the point. No reason to recompile your
kernel and reboot.

I wish ASUS would do this for BIOS

[Anonymous Coward]

settings. Just yesterday I was tweaking my memory settings on a K7M mobo and now I get a black screen. No boot, beep, or blinking lights! DAMN!

The only reset on the mobo is to erase the pw.

Really makes me appreciate this.

Re:I wish ASUS would do this for BIOS

[netsharc]

Too bad you're AC, on some motherboards you can hold a key when you turn the PC on that will reset it to safe settings and allow it to boot again. Google for it. Or do what I did, and set the jumpers to the correct settings, overriding the motherboard's. (I changed my BIOS to say I have a PC133 RAM when I didn't, and the thing didn't boot up. Got me panicked for awhile, the thing was a day old, and my bought-by-Dad first ATX after 5 years with a P-100.

Re:I wish ASUS would do this for BIOS

[UncleFluffy]

If all else fails, take the CMOS battery out overnight and it should reset to safe defaults.

LUK = Linux User Kernel?

[implex]

> LUK = Linux User Kernel? (pronounced Luck!)
How about "Luke"?

Use the Luke Force!

Re:How fast is User Mode Linux?

[Lukey Boy]

Huh. Like I said, as far as I know. In fact my system is running UML-2.4.19 on a 2.2.12 system - and apparently (according to the UML site) that kernel version requires a patch for UML to function. Works good so far though :-)

Kernel development

[ShawnX]

This will be great for kernel development because know I can test my kernel patches. Expect a new -shawn12 kernel patch soon =). On a side note, now that XFS is going (?) into the 2.5 kernel, I will continue to work on the 2.4 patches until 2.6 comes out. As always, you can find my patches at: http://xfs.sh0n.net/2.4 ShawnX

Not exactly

[XNormal]

LINE runs a single linux executable under Windows while UML runs an entire Linux kernel.

Re:PS/2

[Monkey]

Those units were built like brick shithouses ( performed about as fast as one too) and they ran forever. I remember we had a pile of about 20 of them, and although they all worked fine, were too slow to be of use for anything.

IBM actually bought them all back from us and the last I heard, they were going to ship them to Africa to be actively used again.

Re:How fast is User Mode Linux?

[h4x0r-3l337]

So in other words, your spiffy new debian is still running on top of the old version, with all its unfixed bugs and whatnot still in place.

I don't get it.

[LordNimon]

I've read the web site, but I still don't really understand what UML is. How is it different from something like VMWare?

Re:I don't get it.

[psamuels]

How is it different from something like VMWare?

Well ... it's free.

Seriously, VMware lets you run a regular OS on emulated hardware. UML lets you run an emulation OS on real hardware. Both run on top of a standard OS (with real hardware).

VMware is not itself an OS - it provides a virtual PC which your regular OS thinks it owns. UML is an OS, which knows full well it does not own any hardware. The processes running under UML do not necessarily know that, though, since UML provides a near-standard environment.

(Related point: for those of you who think you're going to set up a honeypot that the cracker will break into and think he 0wns the bare metal - keep in mind that UML was not really designed to hide its own nature, so it's not hard to check for. And if you crack root in the UML, it's possible to get out of it. So if you're using UML for security reasons, you probably should run it in its own chroot.)

UML-win32

[Dan Aloni]

There is currently a work in progress to port UML to the native Win32 platform.

See:
umlwin32.sourceforge.net

Re:How fast is User Mode Linux?

[Lukey Boy]

No - like I said, UML was a transition to get Debian replacing RedHat.

Re:How fast is User Mode Linux?

[h4x0r-3l337]

So your debian is running on an old redhat then? Or did you use UML only to install debian while running redhat, and then you rebooted into debian natively?

Re:On the other hand...

[psamuels]

I'm a big believer that source should be much more modular. Run the config and THEN download the source that you need.

So the knowledge of which config options are available for the Intel E100 network card needs to be in two places: the "base config" tarball and the "E100" tarball. No thanks.

This subject comes up often enough to have an entry in the kernel mailing list FAQ..

Re:How fast is User Mode Linux?

[Lukey Boy]

Longest thread ever :-) Yes, rebooted into the new OS, works great. I'm going to do it for a few other machines now.

Re:On the other hand...

[ironfroggy]

If done correctly, there wouldn't be that redundancy. Its a matter of approach, not to mention a damn good idea if you ask me.

Re:PS/2

[00_NOP]

ahhhh.... I remember them well.

I was the administrator of a very small Netware/286 network about a decade ago (a 286 fileserver and 6 XT machines, well Compaq clones actually).

They all ran Wordperfect 4.2 brilliantly, but we needed more, so I persuaded the boss to let me buy a 386 system at an auction - and the PS/2 was the cheapest, because nobody was interested in them because of the MCA architecture.

Sure was a good system though.