A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 27th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. If you find an answer by browsing code, explain your search path (e.g., I searched for X, which led me to source file Y, where I found function Z.) Also, list any websites or individuals you consult.
* Do all of the following on a Linux system. Ubuntu Linux is guaranteed to work, but other Linux systems should work. Note that *BSD systems, including MacOS X, will produce different answers for several of the following questions.
* Note that the tools from Lab 2 in particular may be of use here...

==Part A==

# [3] Run <tt>ifconfig</tt>. For all configured interfaces except loopback, there should be an "inet" address, a "HWaddr" (hardware) address, and perhaps even an "inet6" address. Each of these addresses identifies the computer within a certain context. In what context are each of these addresses used? Specifically, for what protocol is the address used, and what other computers can access this one using this address? (Ignore NAT issues.)
# [2] What does MTU refer to in the output of <tt>ifconfig</tt>? Specifically, what does the acronym mean, and what does this value determine?
# How could you use netcat (<tt>nc</tt>) to listen on port 9200 and write received data to the file /tmp/foo?
# What does <tt>tracepath slashdot.org</tt> return?
# How can you get <tt>netstat</tt> to return a list of all current TCP connections and open ports, listed using numeric IP addresses (rather than DNS hostnames)?
# How could I use <tt>lsof</tt> to find all of the processes accessing the directory <tt>/home</tt>?
# [2] In <tt>/proc/<PID>/maps</tt>, each entry has four permission bits: r,w,x, & p. What do each of them indicate?

==Part B==
# [2] Why does <tt>tracepath</tt> return "no reply" sometimes?
# [3] <tt>nc</tt> uses very few system calls (three on Ubuntu 11.10) when actually receiving data on the network. (The other system calls are for setup and for ending the connection.) What are those few system calls, and what do each of them do?
# [2] What file does <tt>netstat</tt> access to find out about current TCP connections on Linux? And, what is the difference between this file and the output of <tt>netstat</tt>, in syntax and semantics? Be specific.
# [2] What does <tt>lsof</tt> sometimes get a "permission denied" error when run as a regular user? Specifically, what files is it trying to access, and why are these protected?
# [2] Can you tell from <tt>/proc/<PID>/maps</tt> which memory segments are shared for read-only access? What about read-write access? Explain briefly.

==Answers==
===Part A===
# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.
# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ).
# nc -l 9200 > /tmp/foo
# From a lambda machine, I got this :
1: 134.117.27.129 0.118ms pmtu 1500
1: 134.117.27.1 5.051ms
1: 134.117.27.1 5.660ms
2: 10.50.254.10 5.377ms
3: 10.30.33.1 5.561ms
4: 10.30.53.1 5.711ms
5: 134.117.254.242 114.264ms asymm 4
6: 134.117.254.243 4.572ms asymm 4
7: 10.30.56.1 4.442ms asymm 6
8: no reply
9: 154.54.40.137 7.099ms asymm 8
10: 154.54.42.85 19.135ms asymm 9
11: 154.54.44.218 19.609ms asymm 10
12: no reply
13: 204.70.198.17 20.179ms asymm 12
14: 204.70.196.241 30.987ms asymm 11
15: no reply
16: no reply
17: 64.27.160.194 35.202ms asymm 12
18: 216.34.181.45 31.924ms reached
5. netstat -ant
6. lsof +D /home
7. Read, Write, Execute (self-explanatory) and Private. A page can either be shared ( meaning - "Updates to the mapping are visible to other processes that map this file, and are carried through to the underlying file." ), or private (Updates to the mapping are not visible to other processes mapping the same file, and are not carried through to the underlying file - using copy-on-write).

===Part B ===
# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply".
# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor.
# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )
#

COMP 3000 Lab 7 2011

2011-12-05T04:28:58Z

Saran: Reverted edits by Saran (Talk) to last revision by Nhoda

COMP 3000 Lab 7 2011

2011-12-05T04:27:56Z

Saran:

===Part A===
# inet address is the IPv4 address of the host. The [http://en.wikipedia.org/wiki/Reserved_IP_addresses#Reserved_IPv4_addresses scope] is usually either a subnet or global, the former meaning other computers on the same subnet can talk, and the latter meaning any computer with an access to the Internet can talk to this one. HWaddr is the MAC address of the network card. Computers on the same local network (ethernet/wifi etc) connected via a switch or a hub or some such device can talk to it without having to use the Network layer. inet6 address, or the IPv6 address is a newer replacement for the aging IPv4 address. If it's [http://en.wikipedia.org/wiki/IPv6_address#IPv6_address_scopes scope] is only link, that means it doesn't have a globally routable address. Routers drop packets that originate with a [http://en.wikipedia.org/wiki/Link-local_address link-local] address. A global scope means a globally routable ipv6 address.
# MTU, or the Maximum Transmission Unit, is the maximum frame size of whatever layer 2 protocol is under use, ( e.g Ethernet ).
# nc -l 9200 > /tmp/foo
# From a lambda machine, I got this :
1: 134.117.27.129 0.118ms pmtu 1500
1: 134.117.27.1 5.051ms
1: 134.117.27.1 5.660ms
2: 10.50.254.10 5.377ms
3: 10.30.33.1 5.561ms
4: 10.30.53.1 5.711ms
5: 134.117.254.242 114.264ms asymm 4
6: 134.117.254.243 4.572ms asymm 4
7: 10.30.56.1 4.442ms asymm 6
8: no reply
9: 154.54.40.137 7.099ms asymm 8
10: 154.54.42.85 19.135ms asymm 9
11: 154.54.44.218 19.609ms asymm 10
12: no reply
13: 204.70.198.17 20.179ms asymm 12
14: 204.70.196.241 30.987ms asymm 11
15: no reply
16: no reply
17: 64.27.160.194 35.202ms asymm 12
18: 216.34.181.45 31.924ms reached
5. netstat -ant
6. lsof +D /home
7. Read, Write, Execute (self-explanatory) and Private. A page can either be shared ( meaning - "Updates to the mapping are visible to other processes that map this file, and are carried through to the underlying file." ), or private (Updates to the mapping are not visible to other processes mapping the same file, and are not carried through to the underlying file - using copy-on-write).

===Part B ===
# Tracepath/Traceroute either use ICMP echo requests, or simply send a UDP packet to a big port number, and wait for ICMP destination unreachable packet. In either case, if a server doesn't receive an ICMP packet as response, tracepath says "no reply".
# I see the following system calls : poll, read and write. Poll waits for the file descriptor status to change, until it is ready to perform I/O. read reads a fixed number of bytes into a buffer from a file descriptor, and write writes a given number of bytes to a file descriptor.
# /proc/net/tcp. Syntactically, the ip addresses and port numbers in netstat are human-readable and not in hex. The state values have been translated from numbers to words. Further, if used with flags, ( like --program ), netstat retrieves the application name related to the connection, by looking up inode info from /proc/net/tcp.
# When lsof recurses through a directory, and encounters a file that it cannot open, it says "permission denied". This is because ordinary users don't have access to some protected files ( for e.g /etc/shadow )
#

COMP 3000 Lab 7 2011

2011-12-05T03:03:56Z

Saran: /* Part A */

COMP 3000 Lab 7 2011

2011-12-05T03:03:23Z

Saran: /* Part A */

COMP 3000 Lab 7 2011

2011-12-05T03:02:54Z

Saran:

COMP 3000 Lab 6 2011

2011-12-05T02:22:01Z

Saran: /* Part B */

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 20th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. If you find an answer by browsing code, explain your search path (e.g., I searched for X, which led me to source file Y, where I found function Z.) Also, list any websites or individuals you consult.

==Part A==

For this section, you will need to refer to the source of the Linux kernel, version 3.1.1. You may download the source code [http://www.kernel.org/pub/linux/kernel/v3.0/linux-3.1.1.tar.bz2 here]; however, you will probably prefer to navigate the code through the [http://lxr.linux.no/#linux+v3.1.1/ Linux Cross Reference Project]. *** Students have found it easier to navigate this link ***

# Answer the following questions regarding <tt>[http://lxr.linux.no/linux+*/fs/exec.c#L1449 do_execve_common()]</tt> in fs/exec.c.
## What information does <tt>bprm</tt> hold?
## What are the many goto's for?
## What are the two lines immediately before this function returns with no error (i.e., the execve succeeds)?
# What function is the main consumer of <tt>[http://lxr.linux.no/linux+*/kernel/fork.c#L1042 copy_process()]</tt> in kernel/fork.c?
# In mm/mmap.c, what does the line <tt>[http://lxr.linux.no/linux+*/mm/mmap.c#L243 SYSCALL_DEFINE1(brk, unsigned long, brk)]</tt> do?
# What is the call <tt>[http://lxr.linux.no/linux+*/mm/mmap.c#L250 down_write(&mm->mmap_sem);]</tt> for?
# In what file is <tt>atl1e_tx_ring</tt> declared?

==Part B==
# [6 pts] Briefly explain what each statement does in <tt>[http://lxr.linux.no/linux+*/fs/read_write.c#L404 vfs_write()]</tt> in fs/read_write.c. Your explanation for each line should take up two lines at most.
# [3 pts] What is the purpose of each field in the struct <tt>atl1e_tx_ring</tt>? (Note: the last two fields are extra credit!)

==Solutions==
===Part A===
# In fs/exec.c
## bprm is a pointer to a structure of type linux_binprm. This structure is used to hold arguments that are used when loading binaries, like argc, filename, vm related structures.
## The goto's handle error messages, and provide the same functionality as a jump statement in assembly. The retval conditional statements before the goto calls determine what return value the program is providing to the function.
## if (displaced) put_files_struct(displaced);
# do_fork
# SYSCALL_DEFINE1 is a macro defined in syscall.h, used to define system calls. (In this case the brk system call )
# The brk system call modifies the data segment size, and down_write(&mm->mmap_sem) is used to acquire a read/write semaphore before performing the memory operation.
# In drivers/net/atl1e/atl1e.h

===Part B===
#
/* If the file descriptor is not opened with WRITE mode, returns an error. */
if (!(file->f_mode & FMODE_WRITE))
return -EBADF;

/* If file_operations is NULL, or if write or asynchronous write functions in it are NULL, returns an error */
if (!file->f_op || (!file->f_op->write && !file->f_op->aio_write))
return -EINVAL;

/* unlikely tells the compiler that the statement inside it is unlikely - so, the compiler can optimize in its jump statements. access_ok functions checks if memory range is withing bounds, i.e count bytes can be read from buf. Returns an error if any of these checks fail. */
if (unlikely(!access_ok(VERIFY_READ, buf, count)))
return -EFAULT;

/* Checks if "count" bytes can be written to the "file" starting at "pos". Returns how many bytes can be written. */
ret = rw_verify_area(WRITE, file, pos, count);

/* Writes using the write function provided in file_operations, which will, in general, depend on the filesystem type. */
if (file->f_op->write)
ret = file->f_op->write(file, buf, count, pos);

/* Writes using do_sync_write, which calls file's aio_write function. */
else
ret = do_sync_write(file, buf, count, pos);

/* If some bytes were written, it marks the file as "modified", so anyone listening for filesystem notifications could be called. add_wchar is for accounting - it adds, "ret" bytes to task_io_accounting structure of the current process. */
if (ret > 0) {
fsnotify_modify(file);
add_wchar(current, ret);
}
/* Again, accounting - Increments the number of "write" system calls for the current process */
inc_syscw(current);

/* Returns the number of bytes written. */
return ret;

2
/* A descriptor ring is a structure that a PCI device and the kernel have in common */
struct atl1e_tpd_desc *desc; /* descriptor ring virtual address */
/* Physical address of the ring for the Network card driver to use. */
dma_addr_t dma; /* descriptor ring physical address */
/* Number of transmit ring buffers */
u16 count; /* the count of transmit rings */
/* Transmit read/write lock */
rwlock_t tx_lock;
/* Next ring to use */
u16 next_to_use;
/* Next ring to clean up */
atomic_t next_to_clean;
/* Transmit buffer */
struct atl1e_tx_buffer *tx_buffer;

/* The CMB dma address of the ring initialized : [here http://lxr.linux.no/linux+v3.1.4/drivers/net/atl1e/atl1e_main.c#L853]
cmb is a pointer to the virtual address.
These are written into the registers of the network device as shown [here http://lxr.linux.no/linux+v3.1.4/drivers/net/atl1e/atl1e_main.c#L897]
Seems to be a device specific internal data structure.
*/
dma_addr_t cmb_dma;
u32 *cmb;

COMP 3000 Lab 6 2011

2011-12-05T01:52:00Z

Saran: /* Part B */

COMP 3000 Lab 6 2011

2011-12-05T01:17:26Z

Saran: /* Part B */

2011-12-05T00:22:26Z

Saran: /* Solutions */

COMP 3000 Lab 6 2011

2011-12-05T00:20:52Z

Saran: /* Part A */

2011-11-21T16:20:59Z

Saran: /* Part A */

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 6th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All submitted code and commands should compile and run. Partial code fragments or explanations may not be given credit. While code may use standard C and UNIX/Linux libraries, no code should rely on external binaries.
* '''The exercises in this lab require root access on a Linux system.''' Note that an Ubuntu Live CD should be a sufficiently powerful environment if you do not have an already installed system. Just boot the CD in the VM and select "Try Ubuntu."

==Part A==
Be sure to do the following questions in order.

# [0.5] Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
# [0.5] Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
# [0.5] Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
# [0.5] Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
# [0.5] Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
# [0.5] Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
# [0.5] Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
# [0.5] What command can you run to make foo mountable again?

==Part B==
# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

=Answers=
==Part A==
# Logical size is 2G. Physical size is 0.
# Logical size is 2G. Physical size is 65M.
# It links foo to an unused loop device and mounts it in /mnt.
# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
# After unmounting, files in that file system cannot be accessed, because /mnt is not linked to foo (where /bin/ls is actually stored as a file) anymore.
# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
# fsck.ext4 foo

==Part B==
# 1.c
# 2.c
# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

/* 1.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
int main()
{
int fd = open("helloemptyworld",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if(fd == -1)
exit(1);
write(fd,"Hello",5);
lseek(fd,1000000,SEEK_CUR);
write(fd,"World\n",6);
close(fd);
return 0;
}

/* 2.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main()
{
int fdi,fdo,ret;
char buf;
if( (fdi = open("inputfile",O_RDONLY)) == -1)
exit(1);
if( (fdo = open("outputfile",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1)
exit(1);
if(read(fdi,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
while(1)
{
if(buf == 0)
lseek(fdo,1,SEEK_CUR);
else {
if(write(fdo,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
}
ret = read(fdi,&buf,1);
if(ret == -1)
printf("Error = %s\n",strerror(errno));
else if(ret == 0) //indicates EOF
break;
}
close(fdi);
close(fdo);
return 0;
}

COMP 3000 Lab 7 2011

2011-11-21T16:13:00Z

Saran: /* Part B */

COMP 3000 Lab 5 2011

2011-11-07T21:31:20Z

Saran: /* Part A */

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 6th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All submitted code and commands should compile and run. Partial code fragments or explanations may not be given credit. While code may use standard C and UNIX/Linux libraries, no code should rely on external binaries.
* '''The exercises in this lab require root access on a Linux system.''' Note that an Ubuntu Live CD should be a sufficiently powerful environment if you do not have an already installed system. Just boot the CD in the VM and select "Try Ubuntu."

==Part A==
Be sure to do the following questions in order.

# Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
# Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
# Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
# Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
# Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
# Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
# Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
# What command can you run to make foo mountable again?

==Part B==
# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

=Answers=
==Part A==
# Logical size is 2G. Physical size is 0.
# Logical size is 2G. Physical size is 65M.
# It links foo to an unused loop device and mounts it in /mnt.
# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
# After unmounting, files in that file system cannot be accessed, because /mnt is not linked to foo (where /bin/ls is actually stored as a file) anymore.
# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
# fsck.ext4 foo

==Part B==
# 1.c
# 2.c
# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

/* 1.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
int main()
{
int fd = open("helloemptyworld",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if(fd == -1)
exit(1);
write(fd,"Hello",5);
lseek(fd,1000000,SEEK_CUR);
write(fd,"World\n",6);
close(fd);
return 0;
}

/* 2.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main()
{
int fdi,fdo,ret;
char buf;
if( (fdi = open("inputfile",O_RDONLY)) == -1)
exit(1);
if( (fdo = open("outputfile",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1)
exit(1);
if(read(fdi,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
while(1)
{
if(buf == 0)
lseek(fdo,1,SEEK_CUR);
else {
if(write(fdo,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
}
ret = read(fdi,&buf,1);
if(ret == -1)
printf("Error = %s\n",strerror(errno));
else if(ret == 0) //indicates EOF
break;
}
close(fdi);
close(fdo);
return 0;
}

COMP 3000 Lab 5 2011

2011-11-07T21:29:26Z

Saran: /* Part B */

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 6th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All submitted code and commands should compile and run. Partial code fragments or explanations may not be given credit. While code may use standard C and UNIX/Linux libraries, no code should rely on external binaries.
* '''The exercises in this lab require root access on a Linux system.''' Note that an Ubuntu Live CD should be a sufficiently powerful environment if you do not have an already installed system. Just boot the CD in the VM and select "Try Ubuntu."

==Part A==
Be sure to do the following questions in order.

# Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
# Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
# Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
# Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
# Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
# Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
# Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
# What command can you run to make foo mountable again?

==Part B==
# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

=Answers=
==Part A==
# Logical size is 2G. Physical size is 0.
# Logical size is 2G. Physical size is 65M.
# It links foo to an unused loop device and mounts it in /mnt.
# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
# fsck.ext4 foo

==Part B==
# 1.c
# 2.c
# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

/* 1.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
int main()
{
int fd = open("helloemptyworld",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if(fd == -1)
exit(1);
write(fd,"Hello",5);
lseek(fd,1000000,SEEK_CUR);
write(fd,"World\n",6);
close(fd);
return 0;
}

/* 2.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main()
{
int fdi,fdo,ret;
char buf;
if( (fdi = open("inputfile",O_RDONLY)) == -1)
exit(1);
if( (fdo = open("outputfile",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1)
exit(1);
if(read(fdi,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
while(1)
{
if(buf == 0)
lseek(fdo,1,SEEK_CUR);
else {
if(write(fdo,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
}
ret = read(fdi,&buf,1);
if(ret == -1)
printf("Error = %s\n",strerror(errno));
else if(ret == 0) //indicates EOF
break;
}
close(fdi);
close(fdo);
return 0;
}

COMP 3000 Lab 5 2011

2011-11-07T21:28:55Z

Saran: /* Part B */

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 6th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All submitted code and commands should compile and run. Partial code fragments or explanations may not be given credit. While code may use standard C and UNIX/Linux libraries, no code should rely on external binaries.
* '''The exercises in this lab require root access on a Linux system.''' Note that an Ubuntu Live CD should be a sufficiently powerful environment if you do not have an already installed system. Just boot the CD in the VM and select "Try Ubuntu."

==Part A==
Be sure to do the following questions in order.

# Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
# Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
# Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
# Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
# Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
# Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
# Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
# What command can you run to make foo mountable again?

==Part B==
# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

=Answers=
==Part A==
# Logical size is 2G. Physical size is 0.
# Logical size is 2G. Physical size is 65M.
# It links foo to an unused loop device and mounts it in /mnt.
# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
# fsck.ext4 foo

==Part B==
# 1.c
# 2.c
# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

/* 1.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
int main()
{
int fd = open("helloemptyworld",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if(fd == -1)
exit(1);
write(fd,"Hello",5);
lseek(fd,1000000,SEEK_CUR);
write(fd,"World\n",6);
close(fd);
return 0;
}

/* 2.c */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main()
{
int fdi,fdo,ret;
char buf;
if( (fdi = open("inputfile",O_RDONLY)) == -1)
exit(1);
if( (fdo = open("outputfile",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1)
exit(1);
if(read(fdi,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
while(1)
{
if(buf == 0)
lseek(fdo,1,SEEK_CUR);
else {
if(write(fdo,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
}
ret = read(fdi,&buf,1);
if(ret == -1)
printf("Error = %s\n",strerror(errno));
else if(ret == 0) //indicated EOF
break;
}
close(fdi);
close(fdo);
return 0;
}

COMP 3000 Lab 5 2011

2011-11-07T21:27:48Z

Saran:

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by Sunday, November 6th at 11:30 PM.
* Please answer using a single text file (with a .txt extension). Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.) '''Anything other than a single text file will receive -1 points'''
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All submitted code and commands should compile and run. Partial code fragments or explanations may not be given credit. While code may use standard C and UNIX/Linux libraries, no code should rely on external binaries.
* '''The exercises in this lab require root access on a Linux system.''' Note that an Ubuntu Live CD should be a sufficiently powerful environment if you do not have an already installed system. Just boot the CD in the VM and select "Try Ubuntu."

==Part A==
Be sure to do the following questions in order.

# Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
# Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
# Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
# Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
# Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
# Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
# Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
# What command can you run to make foo mountable again?

==Part B==
# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

=Answers=
==Part A==
# Logical size is 2G. Physical size is 0.
# Logical size is 2G. Physical size is 65M.
# It links foo to an unused loop device and mounts it in /mnt.
# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
# fsck.ext4 foo

==Part B==
#

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
int main()
{
int fd = open("helloemptyworld",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
if(fd == -1)
exit(1);
write(fd,"Hello",5);
lseek(fd,1000000,SEEK_CUR);
write(fd,"World\n",6);
close(fd);
return 0;
}

#

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main()
{
int fdi,fdo,ret;
char buf;
if( (fdi = open("inputfile",O_RDONLY)) == -1)
exit(1);
if( (fdo = open("outputfile",O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1)
exit(1);
if(read(fdi,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
while(1)
{
if(buf == 0)
lseek(fdo,1,SEEK_CUR);
else {
if(write(fdo,&buf,1) == -1)
printf("Error = %s\n",strerror(errno));
}
ret = read(fdi,&buf,1);
if(ret == -1)
printf("Error = %s\n",strerror(errno));
else if(ret == 0) //indicated EOF
break;
}
close(fdi);
close(fdo);
return 0;
}

# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

COMP 3000 Lab 5 2011

2011-11-07T21:23:41Z

Saran:

COMP 3000 Lab 5 2011

2011-10-31T14:56:22Z

Saran: /* Part B */

2011-10-27T18:51:41Z

Saran:

A few guidelines:
* Submit your solutions for both Part A and Part B via WebCT by '''Monday, October 24th at 11:30 PM''' (note the extension).
* Please answer using a single text file. Do not submit doc, docx, pdf, or other formats. Also, please do not submit an archive (zip, tarball, rar) of multiple text files, just upload one. (Please don't just cut and paste your work into a text box on webct.)
* Show all your work. Short answers are not sufficient; you should list any websites or individuals you consult and should document any experiments you conducted. For any question that you could just answer without any external reference or experiment, write "(no work required)" after your answer.
* All your codes should compile and run. Partial code fragments or explanations will not be sufficient.

==Part A==

<ol>
<li>Compile run-program.c with the command ''gcc -g run-program.c -o run-program'' and use it to answer the following questions.</li>
<ol style="list-style-type: lower-alpha;">
<li> Is the line "Is this line printed?" printed when you execute '''./run-program /bin/ls -a /tmp'''? Why?
<li> Change the program to use execve instead of execvp. What is the difference between the two system calls? </li>
</ol>
<li> Linux signals is a simple form of IPC that is used for a variety of purposes.</li>
<ol style="list-style-type: lower-alpha;">
<li> What signal is generated when a program attempts to dereference an invalid pointer? Give a simple program that generates such a signal.</li>
<li> How would you send a signal to a process to have it pause execution? Resume?</li>
</ol>
<li>What command can lower the priority of an already running process?
<li>Create ''run-program-reverse.c'' that is the same as run-program.c except that it interprets its arguments in reverse order. Hence, ''./run-program-reverse /tmp -a /bin/ls'' will do the same as ''./run-program /bin/ls -a /tmp''.</li>
<li>Create ''sanitize-env.c'' that does the same as run-program.c except it exec's the program with all environment variables stripped except the PATH and TERM variables (assuming they are defined). Be sure to document how you tested your program.
</ol>

==Part B==

<ol>
<li value=6> Create a simple program ''receive-usr1.c'' that uses sigaction in order to print "Ouch!" when you send the program the USR1 signal. Note that your program should not consume much CPU time while waiting (i.e., do not poll for the signal).</li>
<li> Create a simple program ''nocrash.c'' that accesses an invalid pointer but then prints "Oops, my mistake" rather than crash.</li>
<li> Create a program ''run-program-dots.c'' that works the same as run-program.c, except that it prints one dot every second while a given program runs. Note that it should stop printing dots once the exec'd program terminates. Your solution should use the fork(), sleep(), execve(), and sigaction() calls.</li>
<li> What is the difference between the PR and NI columns in the top command? Explain in the context of running a CPU-intensive program. (Hint: you should try running a CPU intensive program or two and observe these columns...)</li>
</ol>

==Program Listings==

/* run-program.c */

#include <unistd.h>
#include <stdio.h>

int main( int argc, char *argv[], char *envp[] ) {

if( argc < 2 ) {
printf( "Insufficient arguments.\n" );
return -1;
}
execvp( argv[1], argv + 1 );
printf( "Is this line printed?\n" );
return 0;
}

=Answers=
==Part A==

<ol> <li>
<ol style="list-style-type: lower-alpha;">
<li>"is this line printed?" is not printed because execvp/execve replaces the program binary with a different one.</li>
<li> execve( argv[1], argv + 1 , envp); 
execve requires an environment argument which may be different from the existing one, where as execvp runs the program using the current environment. Another difference is that execvp searches the PATH environment variable for folders containing binary files, if it can't find the file in the current working directory. </li>
</ol> </li>
<li> <ol style="list-style-type: lower-alpha;">
<li>SIGSEGV or SIGBUS is raised for invalid memory references. SIGBUS is low level device specific signal. The following program generates a SIGSEGV in my computer : int *a; *a = 10; </li>
<li> SIGSTOP for pausing, and SIGCONT for continuing.
You can use "kill -SIGWHATEVER pid" from the terminal, or from code. For ex :
pause-and-cont.c </li>
</ol>
</li>
<li> renice </li>
<li> run-program-reverse.c </li>
<li> sanitize-env.c </li>
</ol>

(Part B)

<ol>
<li value=6> Compile and run receive-usr1.c and issue "kill -SIGUSR1 pid" </li>
<li> Use gdb to figure out what signal is thrown for invalid pointer accesses, then catch that. </li>
<li> run-program-dots.c </li>
<li>NI is the nice value of a process, which can be changed by the user. It ranges from -20 to 19 and is used as an input to the scheduler. Depending on all other processes and available resources, the scheduler decides the priority of a process and displays its calculated value in the PR column.
</li>
</ol>

==Answers : Program Listings==

/* pause-and-cont.c */

#include<stdio.h>
#include<signal.h>

int main(int argc, char * argv[], char *envp[])
{
int child = fork();
if(child == 0)
{
execvp("/usr/bin/yes",argv);
}
else
{
kill(child,SIGSTOP);
sleep(4);
kill(child,SIGCONT);
sleep(4);
kill(child,SIGKILL);
}
return 0;
}

/* run-program-reverse.c */

#include <errno.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main( int argc, char **argv, char *envp[] ) {
char **newenv;
int i = 0;
if( argc < 2 ) {
printf( "Insufficient arguments.\n" );
return -1;
}
newenv = (char**)malloc(argc*sizeof(char**));
for(i = 0; i < argc; i++)
{
newenv[i] = (char*)malloc(sizeof(argv[argc-i-1]));
strcpy(newenv[i],argv[argc-i-1]);
}
newenv[argc-1] = NULL;
if(execvp(newenv[0],newenv + 1) == -1)
printf("error! = %s",strerror(errno));

printf( "Is this line printed?\n" );
return 0;
}

/* sanitize-env.c */

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main( int argc, char *argv[], char *envp[] ) {
extern char **environ;
int i = 0;

char *path = getenv("PATH");
char *term = getenv("TERM");
if(clearenv())
exit(-1);
setenv("PATH",path,1);
setenv("TERM",term,1);

//Check now.
while(environ[i] != NULL) {
printf("environ[%d] = %s\n",i,environ[i++]);
}

if( argc < 2 ) {
printf( "Insufficient arguments.\n" );
return -1;
}
execvp(argv[1], argv + 1);
printf( "Is this line printed?\n" );
return 0;
}

/* receive-usr1.c */

#include <sys/wait.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>

int child;
void sig_handler(int signum)
{
if(signum == SIGUSR1)
printf("Ouch!.\n");
fflush(stdout);
}

int main()
{
struct sigaction act;
sigset_t set;

act.sa_handler = sig_handler;
act.sa_flags = 0;
sigemptyset(&act.sa_mask);

sigaction(SIGUSR1, &act, NULL);
sigfillset(&set);//Block on all signals
sigdelset(&set,SIGUSR1);//except this one
sigsuspend(&set);//now wait.
return 0;
}

/* nocrash.c */

#include <sys/wait.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>

int child;
void sig_handler(int signum)
{
if(signum == SIGSEGV)
printf("Oops, my mistake.\n");
fflush(stdout);
exit(1);
}

int main()
{
int *a;
struct sigaction act;

act.sa_handler = sig_handler;
act.sa_flags = 0;
sigemptyset(&act.sa_mask);

sigaction(SIGSEGV, &act, NULL);
sleep(1);
*a = 10; // Make a mistake.
return 0;
}

/* run-program-dots.c */

#include <sys/wait.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>

int child;
void sigchild_handler(int signum)
{
exit(0);
}

int main()
{
struct sigaction act;

act.sa_handler = sigchild_handler;
act.sa_flags = 0;
sigemptyset(&act.sa_mask);

child = fork();

if(child == 0) {
execve("program",NULL,NULL);
return 0;
}
else {
sigaction(SIGCHLD, &act, NULL);
while(1)
{
printf(".");
fflush(stdout);
sleep(1);
}
return 0;
}
}

where my program.c is
#include<stdlib.h>
int main()
{
sleep(8);
return 0;
}