Operating Systems 2021F: Tutorial 4 - Revision history

Soma: /* Getting set up (Running the right kernel) */

2021-10-08T03:02:03Z

Getting set up (Running the right kernel)

← Older revision		Revision as of 03:02, 8 October 2021
Line 46:		Line 46:

	(Note this is all easier if you can see the grub menu when the kernel boots. We will later show you how to navigate this menu; for now the above should get you running the correct kernel.)		(Note this is all easier if you can see the grub menu when the kernel boots. We will later show you how to navigate this menu; for now the above should get you running the correct kernel.)

			===Checking bpftrace===

	If you are running the right kernel, the following command should produce a long list:		If you are running the right kernel, the following command should produce a long list:

Soma: /* Installing a new kernel in the (old) class VM */

2021-10-08T03:01:31Z

Installing a new kernel in the (old) class VM

← Older revision		Revision as of 03:01, 8 October 2021
Line 43:		Line 43:
	linux-image-5.11.0-37-generic		linux-image-5.11.0-37-generic

	If it doesn't, you'll need to change the 4 to the base-0 index of the ~~kernel you want~~.		If it doesn't, you'll need to change the 4 in the 1\>4 to the right number. Every kernel generates two entries with the second of each being a recovery image; thus, the number we want is the base-0 index times two. In other words, to run each of the above kernels we would put in 0, 2, or 4, respectively.

	(Note this is all easier if you can see the grub menu when the kernel boots. We will later show you how to navigate this menu; for now the above should get you running the correct kernel.)		(Note this is all easier if you can see the grub menu when the kernel boots. We will later show you how to navigate this menu; for now the above should get you running the correct kernel.)

Soma: /* Installing a new kernel in the (old) class VM */

2021-10-08T02:56:51Z

Installing a new kernel in the (old) class VM

← Older revision		Revision as of 02:56, 8 October 2021
Line 31:		Line 31:
	apt install linux-virtual # install linux-virtual, which will		apt install linux-virtual # install linux-virtual, which will
	# install a generic linux kernel		# install a generic linux kernel
			apt clean; apt -y autoremove # clean up
	grub-reboot 1\>4 # on next reboot, select the 2nd		grub-reboot 1\>4 # on next reboot, select the 2nd
	# menu item and then the 5th one		# menu item and then the 5th one

Soma: /* Installing a new kernel in the (old) class VM */

2021-10-08T02:56:03Z

Installing a new kernel in the (old) class VM

← Older revision		Revision as of 02:56, 8 October 2021
Line 26:		Line 26:
	Run the following commands: (Note the # indicate comments:)		Run the following commands: (Note the # indicate comments:)

	sudo -i # become ~~rootroot~~		sudo -i # become root
	apt update # update the package database		apt update # update the package database
	apt -y dist-upgrade # upgrade all packages		apt -y dist-upgrade # upgrade all packages

Soma: /* Getting set up (Running the right kernel) */

2021-10-08T02:55:38Z

Getting set up (Running the right kernel)

← Older revision		Revision as of 02:55, 8 October 2021
Line 19:		Line 19:

	There are two solutions:		There are two solutions:
	# Make a new VM with an updated image COMP3000A-2021F-2. This VM has the right kernel installed.		# Make a new VM with an updated image COMP3000A-2021F-2. This VM has the right kernel installed. (If you do this, please delete your old VM.)
	# Follow the steps below to install the right kernel and make it the default.		# Follow the steps below to install the right kernel and make it the default.

Soma: /* Getting set up (Running the right kernel) */

2021-10-08T02:55:05Z

Getting set up (Running the right kernel)

← Older revision		Revision as of 02:55, 8 October 2021
Line 16:		Line 16:
	[https://bpftrace.org/ bpftrace] is already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install bpftrace yourself. You may be able to use a binary package; however, bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another. To minimize problems, then, you should use the COMP 3000 VM if at all possible.		[https://bpftrace.org/ bpftrace] is already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install bpftrace yourself. You may be able to use a binary package; however, bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another. To minimize problems, then, you should use the COMP 3000 VM if at all possible.

	Having said this, there is one problem with the class VMs: they are running the wrong kernel! The Ubuntu kvm kernel for some reason doesn't have all of the eBPF-related configuration options enabled even though the generic Ubuntu kernel does. So, you'll need to change the kernel that you're running in your VM. Run the following commands: (Note the # indicate comments:)		Having said this, there is one problem with the original class VMs: they are running the wrong kernel! The Ubuntu kvm kernel for some reason doesn't have all of the eBPF-related configuration options enabled even though the generic Ubuntu kernel does. So, you'll need to change the kernel that you're running in your VM.

			There are two solutions:
			# Make a new VM with an updated image COMP3000A-2021F-2. This VM has the right kernel installed.
			# Follow the steps below to install the right kernel and make it the default.

			===Installing a new kernel in the (old) class VM===

			Run the following commands: (Note the # indicate comments:)

	sudo -i # become rootroot		sudo -i # become rootroot

Soma: /* bpftrace scripts */

2021-10-07T15:36:22Z

bpftrace scripts

← Older revision		Revision as of 15:36, 7 October 2021
Line 58:		Line 58:
	So, to run <tt>bashreadline.bt</tt>, type		So, to run <tt>bashreadline.bt</tt>, type

	sudo bpftrace /usr/~~loca~~/share/bpftrace/tools/bashreadline.bt		sudo bpftrace /usr/local/share/bpftrace/tools/bashreadline.bt

	Copy/paste, up arrow, and Ctrl-K and Ctrl-Y are your friends! Also, you can cd to this directory and run them from there.		Copy/paste, up arrow, and Ctrl-K and Ctrl-Y are your friends! Also, you can cd to this directory and run them from there.

Soma: /* Tasks & Questions */

2021-10-05T17:36:58Z

Tasks & Questions

← Older revision		Revision as of 17:36, 5 October 2021
Line 92:		Line 92:
	<ol style="list-style-type:lower-alpha">		<ol style="list-style-type:lower-alpha">
	<li>What programs are generating lots of system calls?</li>		<li>What programs are generating lots of system calls?</li>
	<li>What calls are the most common? Use /usr/include/x86_64-linux-gnu/asm/unistd_64.h for the names associated with system call numbers on the class VM.</li>		<li>What calls are the most common? Use <tt>/usr/include/x86_64-linux-gnu/asm/unistd_64.h</tt> for the names associated with system call numbers on the class VM.</li>
	</ol>		</ol>
	<li>Run bashreadline.bt:		<li>Run bashreadline.bt:

Soma: /* Tasks & Questions */

2021-10-05T17:36:41Z

Tasks & Questions

← Older revision		Revision as of 17:36, 5 October 2021
Line 92:		Line 92:
	<ol style="list-style-type:lower-alpha">		<ol style="list-style-type:lower-alpha">
	<li>What programs are generating lots of system calls?</li>		<li>What programs are generating lots of system calls?</li>
	<li>What calls are the most common?</li>		<li>What calls are the most common? Use /usr/include/x86_64-linux-gnu/asm/unistd_64.h for the names associated with system call numbers on the class VM.</li>
	</ol>		</ol>
	<li>Run bashreadline.bt:		<li>Run bashreadline.bt:

Soma at 03:35, 5 October 2021

2021-10-05T03:35:07Z

← Older revision		Revision as of 03:35, 5 October 2021
Line 1:		Line 1:

	In this tutorial you will use a variety of bpftrace scripts in order to observe 3000shell and other running programs.		In this tutorial you will use a variety of bpftrace scripts in order to observe 3000shell and other running programs.


	==ptrace, eBPF, and bpftrace==		==ptrace, eBPF, and bpftrace==
Line 12:		Line 11:

	Because eBPF can monitor and even change almost anything in a running system, only root can use eBPF. In contrast, ptrace-based tools like strace can be used safely by anyone because they can only affect one process at a time.		Because eBPF can monitor and even change almost anything in a running system, only root can use eBPF. In contrast, ptrace-based tools like strace can be used safely by anyone because they can only affect one process at a time.


	==Getting set up (Running the right kernel)==		==Getting set up (Running the right kernel)==
Line 47:		Line 45:

	If this command stops with an error, you aren't running the right kernel.		If this command stops with an error, you aren't running the right kernel.


	==bpftrace scripts==		==bpftrace scripts==
Line 64:		Line 61:

	Copy/paste, up arrow, and Ctrl-K and Ctrl-Y are your friends! Also, you can cd to this directory and run them from there.		Copy/paste, up arrow, and Ctrl-K and Ctrl-Y are your friends! Also, you can cd to this directory and run them from there.


	==Tasks & Questions==		==Tasks & Questions==