Operating Systems 2020W: Assignment 4 - Revision history

Soma at 20:07, 3 April 2020

2020-04-03T20:07:07Z

← Older revision		Revision as of 20:07, 3 April 2020
Line 177:		Line 177:
	</li>		</li>
	</ol>		</ol>

			==Solutions==

			[https://homeostasis.scs.carleton.ca/~soma/os-2020w/solutions/assign4-sol.txt Assignment 4 (short answer) solutions)]

Soma at 18:07, 2 April 2020

2020-04-02T18:07:20Z

Soma at 20:36, 1 April 2020

2020-04-01T20:36:01Z

Show changes

Soma: Created page with "Below are questions for Assignment 4. Written answers will not be graded. Instead, related multiple choice questions will be posted on cuLearn by March 31st and will be due..."

2020-03-23T22:09:54Z

Created page with "Below are questions for Assignment 4. Written answers will not be graded. Instead, related multiple choice questions will be posted on cuLearn by March 31st and will be due..."

New page

Below are questions for Assignment 4. Written answers will not be graded. Instead, related multiple choice questions will be posted on cuLearn by March 31st and will be due by 2:30 PM on April 3, 2020.

==Tutorial 8 Questions==
# Can a process change where data and code is stored in virtual memory? What about in physical memory?
# If two processes mmap the same library, will that library (necessarily) have the same virtual addresses for both processes? What about the same physical addresses?
# What system calls does 3000memview2 use to get physical addresses? Are any of these new (ones we haven't previously seen in class)? Why?
# Who has access to /dev/physicalview? How do you know (from the code)?
# List all of the page table lookups that get_physical() does in 3000physicalview.c. Why are there so many lookups?
# Can you do an ioctl call on regular files? Why or why not?
# What are the values of PAGE_SHIFT and PAGE_SIZE? Where are they defined? What do they represent?

==Tutorial 9 Questions==
# Where is FILTER_PID defined? Where is it used?
# How could you make 3000shellwatch.py watch for events in any process, not just a specific one? What events would it then report?
# Make 3000shellwatch.py monitor all instances of 3000shell by checking a process's comm property. Be sure to remove the PID argument. (Hint: see bashreadline)
# What code of 3000shellwatch runs in userspace? What runs in kernel space?
# Why does 3000shellwatch require root privileges to run? Give an example of a small change you could make to 3000shellwatch that would give an unprivileged user the ability to see or do something that they normally can't.
# How are a uprobe and a uretprobe similar? How are they different?
# What is the signals dictionary used for?
# As presented in the tutorial, does 3000shellwatch have to use eBPF to achieve its goals? Could it instead have used ptrace? Argue for or against, based on the level of access you've seen gdb and strace have to processes using the ptrace system call.
# On line 69 of bpfprogram.c, does sys_exit refer to the exit system call? Explain.

← Older revision		Revision as of 18:07, 2 April 2020
Line 2:		Line 2:

	==Tutorial 8 Questions==		==Tutorial 8 Questions==
	# Can a process change where data and code is stored in virtual memory? What about in physical memory?		# [1] Can a process change where data and code is stored in virtual memory? What about in physical memory?
	# If two processes mmap the same library, will that library (necessarily) have the same virtual addresses for both processes? What about the same physical addresses?		# [1] If two processes mmap the same library, will that library (necessarily) have the same virtual addresses for both processes? What about the same physical addresses?
	# What system calls does 3000memview2 use to get physical addresses? Are any of these new (ones we haven't previously seen in class)? Why?		# [1] What system calls does 3000memview2 use to get physical addresses? Are any of these new (ones we haven't previously seen in class)? Why?
	# Who has access to /dev/~~physicalview~~? How do you know (from the code)?		# [1] Who has access to /dev/3000physicalview? How do you know (from the code)?
	# List all of the page table lookups that get_physical() does in 3000physicalview.c. Why are there so many lookups?		# [1] List all of the page table lookups that get_physical() does in 3000physicalview.c. Why are there so many lookups?
	# Can you do an ioctl call on regular files? Why or why not?		# [1] Can you do an ioctl call on regular files? Why or why not?
	# What are the values of PAGE_SHIFT and PAGE_SIZE? Where are they defined? What do they represent?		# [1] What are the values of PAGE_SHIFT and PAGE_SIZE? Where are they defined? What do they represent?

	==Tutorial 9 Questions==		==Tutorial 9 Questions==
	# Where is FILTER_PID defined? Where is it used?		# [1] Where is FILTER_PID defined? Where is it used?
	# How could you make 3000shellwatch.py watch for events in any process, not just a specific one? What events would it then report?		# [1] How could you make 3000shellwatch.py watch for events in any process, not just a specific one? What events would it then report?
	# Make 3000shellwatch.py monitor all instances of 3000shell by checking a process's comm property. Be sure to remove the PID argument. (Hint: see bashreadline)		# [1] Make 3000shellwatch.py monitor all instances of 3000shell by checking a process's comm property. Be sure to remove the PID argument. (Hint: see bashreadline)
	# What code of 3000shellwatch runs in userspace? What runs in kernel space?		# [1] What code of 3000shellwatch runs in userspace? What runs in kernel space?
	# Why does 3000shellwatch require root privileges to run? Give an example of a small change you could make to 3000shellwatch that would give an unprivileged user the ability to see or do something that they normally can't.		# [1] Why does 3000shellwatch require root privileges to run? Give an example of a small change you could make to 3000shellwatch that would give an unprivileged user the ability to see or do something that they normally can't.
	# How are a uprobe and a uretprobe similar? How are they different?		# [1] How are a uprobe and a uretprobe similar? How are they different?
	# What is the signals dictionary used for?		# [1] What is the signals dictionary used for?
	# As presented in the tutorial, does 3000shellwatch have to use eBPF to achieve its goals? Could it instead have used ptrace? Argue for or against, based on the level of access you've seen gdb and strace have to processes using the ptrace system call.		# [1] As presented in the tutorial, does 3000shellwatch have to use eBPF to achieve its goals? Could it instead have used ptrace? Argue for or against, based on the level of access you've seen gdb and strace have to processes using the ptrace system call.
	# On line 69 of bpfprogram.c, does sys_exit refer to the exit system call? Explain.		# [1] On line 69 of bpfprogram.c, does sys_exit refer to the exit system call? Explain.

	==Multiple Choice==		==Multiple Choice==
Line 109:		Line 109:
	<li>filter() in bpfprogram.c is called (select all that apply)		<li>filter() in bpfprogram.c is called (select all that apply)
	<ol style="list-style-type:lower-alpha">		<ol style="list-style-type:lower-alpha">
	<li>Every time the specified 3000shell process makes a system call</li>		<li>Every time the specified 3000shell process makes a system call, but not when other processes make system calls</li>
	<li>Every time any 3000shell process makes a system call</li>		<li>Every time any 3000shell process makes a system call, but not when other processes make system calls</li>
	<li>Every time any process makes a system call</li>		<li>Every time any process makes a system call</li>
	<li>Every time any process calls fgets()</li>		<li>Every time any process calls fgets()</li>
Line 127:		Line 127:
	</li>		</li>

	<li>What can I probe using a eBPF program?		<li>What can I probe using an eBPF program?
	<ol style="list-style-type:lower-alpha">		<ol style="list-style-type:lower-alpha">
	<li>system calls</li>		<li>system calls</li>