Yep Shift Tab and Roshi, yeah.
I'm going.
Yeah. Okay.
Good morning everyone.
I started a poll, just the beginning of class. And I will end that pole right now because I think everyone should be here.
So, what I see here in the poll of the.
I saw of 85% of you participated.
So the most of you said that. So it was about 70% of you say that's what you expected, but it was actually 80% of you said it was what you expected but half you thought you put real down half you said so it's pretty hard by 20% of you're saying it's not
always about way harder I'm worried about how you did.
So, what I will say to you for. If it was
okay that's fine I mean it's like,
show results. Here you go.
here showing the results, and this over here.
Let's do some logistics.
So, if you messed up the.
Yes.
Do you just ask the same questions at the midterm.
There might be some repeat of questions.
But typically they might be a bit tweaked. So, I wouldn't just memorize the solutions us.
So we'll be posting grades to that and also assignment to and stuff so that should all I've talked to the th we'll get it done by the end of the break.
And, and so that I can start doing interviews, so I want you to have your grades and have the solutions when we start, I start doing those.
Okay, um, so the way the no Sophia, how the interviews marketing.
So that's all the interview is basically it's just we're going through your exam paper normally I normally.
Half the time at least find a pointer to, to, to give you back because of grading because always when you think about like oh I see I can get up but
can you get bonus marks to do really well in the interview. No, sorry.
I don't do things.
So quick question. Are you a lot for the interview. Are you allowed to
refer to your sources, I'm not.
It's not about.
So when I talk about your answers. It's not about me making sure you really know things. It's just that I go like, I'll see an answer. I'll go like, Oh, that's a really good answer.
you go like well you know i really worked hard on tutorial three and stuff and I had to do a lot of looking up stuff and, like, okay, or it's like you messed up that question What were you thinking well I was thinking about this, I don't know, my brain
just got blank or something. But I understand now what's going on it's this thing or what I'll say, well, actually this is what's going on, I'll explain it to you and stuff so it's not about you.
I'm not interviewing you. I'm discussing. I mean, really, I'm discussing your answers on the midterm.
And so really, unless you really, you know, decided to cheat.
You know, this is really no big deal and actually it's like what I see this is primary is about making sure that people get fair grades on their midterms and I understand you know because like might find that, oh wow you know you know that's being too
No, you should get more points or something but, and also it gives me a chance to understand what you all are, how you all are understanding the material so it's a good diagnostic for me. But it also has the incentive of discouraging cheating, because
this interview will not go well, of course if it turns out that what you know and what's on the exam paper seem pretty different.
Okay, so if you have problems with a. So basically if you want to appeal your grade on the midterm do an interview.
That's gonna be the same process.
Okay so,
So can start so kitchen questions.
It says it's okay to say you got your answers from the lectures, but we're going to watch the discussion so.
Okay.
Can I get hired if I do on the internet.
If you want to be a grad see me but I have no funding for the craft since right now, when you increase the grade marks as you boost the midterm work. Yes, exactly.
I will give you more points, because it's like, oh, look, we were two hours from grading this.
I'm going to have a sign up sheet and then you can, you know, sign up for that or email me if you guys did want to volunteer but
okay get with your safety and I'm, I will be doing interviews, your TA is not doing interviews I'm doing interviews.
So, I can't interview all of you.
So, if you miss the pole in general.
Don't say you missed the pole because it's kind of useless for everyone else. I kind of feel like that should always get negative participation marks because you're distracting the class.
Instead, what you should say is, ask a useful question later or hope for later polls come along.
So, yes, you're gonna get your mark. Yes, March will be there before the interview time so you'll know exactly how you did.
So, yeah.
Ah, this is a question of if I find a problem with grading.
If there was a systematic problem, we certainly can review the midterms and give everyone backup back points if there was, you know, some systematic problem with grading, because, but basically individual teams we bring individual questions as as that,
you know, major ones and then I recalculate things so that's certainly possible but that isn't normal normally if there's the teaser only pretty consistent what you can have though, is just, yeah.
So, but yeah, certainly, we try to be fair.
Yeah, I forgot again it's not about you, just remember exactly I'm more interested in your process, not your,
your the process by which you get things out.
It's I guess I'm not interviewing you on interview I'm looking at your answers.
So, anyway, I'm moving on.
So I'm not going to talk about solutions to the midterm they're actually few people are taking it late, due to various other issues. So please don't discuss the midterm with anyone didn't take it but those, but really the people who are doing it later
kind of unnoticed to avoid getting compromised information.
So, so now we're let's, let's start talking about tutorial five.
So, the big thing is I wanted to do. This is basically the material I want to cover but I want to add in some EBPF stuff to it that's why it's not finalized yet.
But if you look at where this is, if you.
Sure. So if you look at this tutorial, it's the tutorial for from the previous previous time I taught this course which was winter 2020.
And
we'll, we'll talk about. I'm going to be giving you background on this niche on this thing right now.
But first let's um let's talk at a high level here.
What let's start with let's start with a demo here.
So, number one.
Good.
So here I am on my VM.
I'm going to do the same command over here so I have to Windows logged in.
One thing This tutorial is you're going to actually figure out how to log in without being caught off typing in passwords every time.
So I'm actually before I do that, let's say I want to show.
So I'm going to run open Snoop here.
Ok so now this is going.
So there's some stuff going on the background
was a key command there to log out, I hit control the.
The system doesn't remember the commands you paste in, I'm not.
Now one thing is that command history and modern, and then like batches of the best because it will.
Yeah, it causes.
There's some things but what I wanted to point out here is when you log in. All these files.
Wait, no, this is not what this is all background stuff.
But no.
Let's do that again.
Okay, so. So log out log back in
comments a lot of stuff. So you see all these files are being accessed. So this account demons opening what shells are open bashes accessing all these files, you know their stuff happening here there's bashes accessing these things, SSH is accessing all
these files, so.
So,
when you log in, lots happens. And we're not going to cover everything that happens. Um, but, What we will do is,
we'll talk about will give you basically a high level model of understanding things in order for you.
Should your counter all the files that are open.
Your don't count files manually, although counting files open is actually pretty simple.
Remember, Well let's do this.
There.
Okay, so now
let's just look at what bash was doing during this whole thing.
So we just look at what Baxter's doing, you'll notice that it's accessing a bunch of what a bunch of local files.
And notice the returned by saying like these don't exist. So you know it's it's trying all these file, they don't exist.
stuff but then it's loading password profile so that, so we'll,
We'll talk about all these things here but
if you wanted to count how many files were opened, you could just grab for it. And so you can say how many files did two to 8511 open.
Now we have all the ones that process, which is very interesting actually if you look at it, you notice that it. You have an SSH process that then all of a sudden starts accessing this so very clearly between here, there was an executive, he.
Ah, good.
Okay, I'm kind of surprised we're here I've been using graph a lot happened right been using. So graph is search.
A true.
What is grab Stanford tournament what man.
Global regular expression. I feel like there's this this acronym like it's commands like they've got a really old name it kicked out.
Yeah.
I think you're, I think he grew up.
He grew up, boys. Use the search one graph doesn't use a graph dash E for expression. Anyway, doesn't uses. Most the time I use grab, just as like us given number.
So what's cool here is if you have a bracelet is open, you can actually see the.
You can see what's happening for a particular process ID, you can see that oh we have SSH D here and then we have bash.
And then or we can spend rep for SSH D.
And we can see what SSH is doing with the files is accessing.
And you see here that.
So there was 20 511.
Tweet 510 was here.
Understand what SSH D is a whole.
Yeah.
Expression print Thank you. Yeah, I think that's actually a vit vi commands or ex commands.
Anyway, side note.
So, so.
so
that mean that SSH was forked and then created bash why they're all simple process right yeah so there's
what.
First thing you should think of is.
So the other just infinitely running in the background.
That's what demons do, is they sit in the background and and wait for things happen, they don't consume resources. Normally, while
while they're just sitting there, they just, they don't consume any resources because that means a demon is just a background process in Unix, that's just the term we use the ideas is this this kind of disability mythological thing behind it but it's
background process that's running to provide some service. So, there is a demon waiting for connections, and you notice these demons normally end with a D of some kind, that's the name so you know it's a demon.
When winner attempt to lawyer happens, it creates a child to handle the request, and the parents is there a way through new connections.
Depending on how it's set up and if it's on the TTY so but like if you do SSH. This is definitely how things go.
Yeah.
is it possible to kill if it's a child, a big one. Okay so,
so yeah so now how does it even decide how to access grant. So, first before we understand this we have to understand.
So, before we talk about like the mechanism let's talk about what is so.
So,
every file is a user group.
So, processes which are running programs have a user ID and potentially multiple IDs.
You can kind of switch between them.
You know your process has a UI dmg ID, a file has a user ID and God, so.
thanks James for the demon back.
Damon background so.
So does the kernel map every file with it so we're getting to that. So route you idea zero.
The colonel. the colonel is what is actually looking at these you IDs, ultimately, and it's making decisions that are just like, Are you allowed to access this file you're allowed to access the signal.
So yeah so basically it can it run the program generally yes now.
Thanks. I should just mention this that. Well, normally you say route can do everything you ID zero.
That isn't strictly to in modern Unix, there are definite situations where you ID zero can't work.
So,
yeah, so I kind of decided to a user has access not so.
hello to the colonel, there's no
girl has no concept of a username that just, you know, doesn't exist. So to give you some insight into what we're talking about here, there's the ID command.
So the ID command will tell you what user you're currently running from. So there is, you know you ID equals, you know says your ID 1000, that's the idea of student g ID is 1000 student groups so student is in all these groups this, the student group
the admin group, see the wrong group pseudo dip plug Deb LXD so student is a relatively privileged user, because they're in all these different groups.
And in fact, because they are in the pseudo group. That's why they can run pseudo and become root.
So, but, but no, this isn't really the numbers are what the colonel cares about.
But we have to have other mechanisms to implement the rest of this, so.
your key ID and Unix, and this is in general.
operating system design is you tend to want to have implement mechanism, not policy. And so you have something else have the policy and user space is.
And so you're having a regular part because the currently you normally don't want to mess with too much in terms of semantics because everyone depends on it.
But policy potentially has changed from installation installation so it's nice to have that configurable. So really, you want to in config files that are run by us space process that actually implement stuff so they could change that without messing with
with the colonel. That's part of the reason why Linux kernel can be used in lots of different contexts, is it doesn't you know isn't.
It's mechanisms can you use and lots of different ways.
So, so okay so now we're getting to, you know, so, so.
so we're the user IDs yo so where are the artists stored and files. Where is the association between you IDs and username God, your where's that, and
probably was another
good, so good. Okay, so we're getting the.
So, so these are all things so in a Unix way.
So it has a microphone.
Second here.
So, network systems and we complicate this using group info so like there's
know that.
directory. lf.
So, so network Unix systems by saving your network Unix systems so.
So like if you have something where like just, you know, when you want to log into a Windows machine or when you go to allow, and you can log into any of the machines, there has to be some mechanism to keep accounts in sync between all those machines.
That's what I'm talking about Microsoft solution for this is Active Directory Active Directory is actually partially built on its on Unix technology called curb rose curb rose can be used here it's a very secure, you know, authentication protocol and
there's also elder app which is can be used as an older system called Yellow Pages Yp but Yellow Pages was trademark. So they end up calling network information service.
So, they've been all these things that are in network context.
So we'll, we'll talk Etsy shadow seg shadow later. But
do you have to research all those networking. Do or do not look up these.
those. Those are outside the scope of this class and increasingly irrelevant so I definitely wouldn't worry about those.
Yellow Pages.
Okay, old school question Does anyone know what.
Does anyone know what the yellow pages were fone bone. Yes, exactly. says if I'm not mistaken specifically. Yep. Yellow Pages for business, white pages was for residential individuals.
So, yellow pages have advertisements that So, yes, should be people use this stuff.
So yeah, historical know cooking their Sun Microsystems tuck it into their system and then.
Yeah, things like that.
Blake show you, I can show you these files, so it because it turns out, by default, etsy group and Etsy password, our world readable.
This is the password file.
This is what stores, the association between users. And so in particular we can look to see here is user student.
So what user student here has it has no username. You ID.
Their main their default group ID.
Then there.
Oh right that's that's their information. So like this is like, you know, what's their name and then their home directory and their shell.
So you
see my finger.
Okay.
No.
So they use.
So there's this, you should really know about the finger command although it's such a. I don't know why it's called that.
No, it's not really useful anymore but it's kind of there.
So the way you used to.
So this.
I'll talk about that. Great question is that, but so when you finger someone. What it does is a you, it basically gives you their information.
So, this is almost like your social media status. So you would say you know login student here name student that's here so I can do,
I can be changed finger.
I pay my password, and so full name is Student Room number.
I'm gonna change my name my student.
What is up my home phone number. Okay, fine.
Oh. Gotcha. Okay, so.
Okay so
that makes sense. You can't change your name as a privileged operation because, well, yeah.
And oh, by the way this thing it says no plan.
I plan to learn all about operating system so you can create a little clan file, it would tell you when you're logged in, tells your home directory, you can put in your phone number room number.
So, this was how you can look up, look up someone.
So I haven't gotten to the password yet so I'm going to talk about in a second.
I didn't come so.
yeah, The finger command is very old, do you change your login name.
Yes you can, but you normally have to change your thing. So the doc plan file needs to drop into the doc. Doc plan file has to be in your home directory.
So, in general, if you look at the top, your top level directory. So, this is my home directory in your home directory, traditionally configuration things that configure how your user works is in these dot files.
And so these are long it's like for example if you want to see your command history.
This is, you know, that's there if I want to see like bash aliases. That's where I put the, the CS backup command here.
This is what it does when you log out bash RC is every time you start a shell that gets loaded.
Then there's a profile which is loaded when you first log in. I just create a plan file so it tells him to do me so dot files by default.
So
I guess the finger someone for the crime I guess so. Yeah, that fingers like that just does history effectively access the history effectively access that the batch history file.
Yes, exactly.
You can definitely edit these files directory, and in fact, you know that's the whole idea is you can control, so.
So remember, Unix is much older than desktops. So we think about all the things for customizing your desktop and that you know I was there, Unix was doing this kind of thing,
way before, but it was in the context of a command line environment so people at all kinds of ways to customize your command line environment to make it specific for them.
And in fact, when you go from one place to the other.
Go from issues issue that you would potentially, update your you'd want to take your doc files with you because they might have lots of weird customizations and you will only be covered with like for example you might make aliases for different commands
you run, you know, quickly
change how they be so if you want to change your following you just edit it.
So by default.
So there's no special thing in Unix if you want to change how things work.
You just edit these files like if I want to change my.
Here's this I can,
you know, I've got this I can edit, edit this and change I want, I want to change my man calf can do this, you know, it's a you notice a lot of the things that profile is messing with environment variables.
I can do this. You know, it's a you notice a lot of the things in dot profile is messing with environment variables. If you rename profile to say profile would it still work as normally as interest in hide it, new you.
If you rename that you've renamed it and it would expect to see dot profile, not profile and so when find it and you would have no profile. Now, would it probably work.
Yes, but why do you think that profile did it wouldn't do.
Yeah, it's just it just, uh, yeah.
Anyway, so.
So what's so I've given you this idea that there is this your user IDs here but I haven't told you have a login process happens in terms of authentication.
So
we actually do something called.
So.
so explain shadow passwords in a second here but if you look at this, this is with shadow config off. This is what the password file looks like. And you'll notice that when you see this, you'll see that the students here now.
It's now a much longer entry in a particular, we have this big old thing here. That's the password hash. So that is this password hash.
Because I changed my password, but this is a hash there now, the algorithm that's used to do the hashing is actually. He is actually told by the first dollar sign here, this dollar six because it turns out there's many algorithms for hashing things.
It's something that you should know about secure hashing it's kind of outside the scope of this class.
But yeah so that password hashes here now.
Okay, so the use of the password file needs to be world readable.
If I have access to this password hash, I can just, I can't go from this directly to your password. But what I can do is get a password, run the hash function and see if it has this hash.
If I keep doing that, I mean I might require millions of tries but computers can be pretty fast with this and password.
So.
when people talk about password cracking, that's what they're really doing is it so I'm guessing passwords.
Using password hashes.
Is it some simple hash code algorithm, I'm new does not
see.
Okay, so.
So this is curious what
doesn't tell me
either look up there's there's the there's documentation on which password actually but this is.
This could be shot to 56. But I, it might be something tougher than that I'm not sure.
So is it, what is
brute forcing, I mean yeah there's different ways to do it. Yeah.
You can't buy
Oh, you're not feel too bad, raise your hand, it's not feasible to backward house, but you're just what you're guessing pop.
Now it's not from user
testing.
That's really what it is you get a password, and you test it in the past international dark.
We're going to rainy day here in Nashville. So,
there are Reading Rainbow tables yes but there's also you can choose a different hash algorithm and the rainbow table doesn't work
as sharp 512, okay.
So, there's different, there's you know there's different algorithm. But anyway, so.
you normally see group passwords but there it is kind of a thing.
group here. There is a little pop field there for that but if I.
So I do that.
The Shadow password for this oh this is where the hashes are. And then,
if I look now look at student, it just puts a little x there. So there's no.
So the password hashes and. Now let's look at the permissions.
Note that these both are owned by route.
But password so now we have to talk about file permissions.
So.
So when you look at this, what you're seeing here is he is actually nine bits.
There's also another bit there. We'll talk about that later, but first approximation. Let's go.
This is read write execute rewrite execute and stuff so this is, so this is for saying this file is readable and rideable by the root user, it is readable by anyone in the group, and is readable by everyone else who's not the root user and not in the
group. This file is readable and rideable by the root user, and it's readable by users in the shadow group, and not readable by anyone else so now if I as a regular user go.
Permission denied.
So in the first bit to show itself. So, the first bit yes what yeah there's there's other bits.
There's more bits, I just watched the simple things.
So.
big ones
will go through all these.
So, so that first field there there's also a fourth that for each that will try to fail but so when you do LS dash l This tells you a lot about the file, and this is.
So if it what the colonel has to do is look compare the process so.
So, the Colonel's not going to like, look at the password file or do anything like that. It just has a huge ID number, and these things and it's just comparing it going like, Okay, this process is, you know, as this user ID has this God, and the file
this thing and so let's, let's compare it. Okay, if you put the password hash file so shout out with that run shock of thing off.
Isn't that redundant.
So, so if you turn shadow config off it deletes the shadow files.
So, now it's not their.
Permission denied space. So it's there.
Where do you look at the command line for the type of type of file symbol and meeting, um, I haven't talked about symbolic links, I will talk about later.
I'll probably for interviews all PMU.
Ah, actually I think you have to
actually Jamal Jamal it's probably the thing that tells you about the version that's.
Yeah.
Oh,
thanks, James.
I'm.
So, this is all saying, okay, when you have a user, it runs a certain user ID. And then,
and then it runs a certain user ID and does have certain privileges, but how do you get that first process. So in particular, look, if you look at SSH key.
You'll notice that SSH D is running as root.
What is the system called.
Oh yeah, sent you it.
So,
so this will be so we'll talk that is.
So ym becomes.
So there's certain system calls which lets a process, change its user ID, and it's group ID.
And by doing that you all of a sudden now have a process that is a different user ID, so that in effect lets it become the user and instead of being rude having access to everything you have access to only some things.
So now, what if I want to do a privilege operation as a regular user.
So, in particular, let's, let's look at this. So I find want to do.
my work, check run CHF and so change finger.
And I think my password room number.
My old office, giving up.
So, and I type in this stuff so notice I've typed in this.
You see, now it says office 5137 Hertzberg, and if we rep per student.
We can see now in the line, we've changed it.
But
this file is only modifiable by route.
So, if I just do.
If I just do that is gonna say permission tonight, I can't modify the password file I can't just write to it.
And that makes sense because in fact the password file is owned by root and only rideable by route, but somehow I run this command.
The CHFNNCHFN was able to edit that file.
They would know what the mechanism is that that allows us to do make this happen.
I was curious many of you have heard about this mechanism.
There must be a system call.
Not exactly.
There has to basically we need a mechanism that allows a user to start a process that runs with a special permissions.
So,
yes.
So, the command has root privileges. Exactly. The command as root privileges by does it now notice this LS by default in this color mode, puts us in nice red because this.
This program is inherently dangerous. And notice it's permissions. it's rW not x, but s.
So,
so, so this is, so this is the set up ID route mechanism. So what it means is when I run a command that has this bit set. It will run as the owner of it as opposed to me.
I am student. So normally, when I, when I do it exactly of anything. My processes, don't change their user ID. They keep the same your ID so every, every program I run runs as the user student.
But if I want to escape that I need to run a program that has a set your ID bit set, and is owned by route. And so this program will set you ID route.
So, the question is what commands, what do these look like so.
So, let's use the argument look so it's basically the it's the fourth bit Exactly. Well, it has different meanings, there's a set you ID bits that gap bit and then the other one, which is that so basically it's the extra bit that has different meanings
So the fourth bit for the owner field is the set you it. And so you see these are all things that are set your ID route. And you'll notice that the password command is, is there.
The change finger is there change your shell, same thing, but also pseudo and Su are both set your ID route. That's how they let you become route.
So, can someone not route change that can set you ready to route and use the change things, anyone can run these programs, and when they when anyone runs these programs.
The user now, is no longer in that process now we'll run with root privileges. So, in effect, the root user has delegated these programs to run as them.
Now there's nothing special about set your ID route, you couldn't make a file that set you ID student.
And then if another user on this system, maybe you got an account Anil on the system, and it were to run it could run programs as user student can access all those students files with a program could access any student files, but they wouldn't have general
access to have to be mediated by the code. So pseudo like if any of these programs are compromised, if there's a programming on any of these. These are a way to get root privileges.
Isn't this dangerous.
Can we delegate more commands like this and make the change current Yes you can, but you have to do it as me, I can create, like, I can create a new.
So let's do a.
Let's do a little experiment here.
Come here.
And so let's you know let's go to students.
Okay so,
so super last now is
last shadow.
Super last now can look at any file on the system, but no in order for it to look at any file in the system. What did I do is I had to create basic, I made a new by I first created new binary.
And then I added it, I made sure it was owned by the user I wanted it was owned by route because I copied it as route. And then I did, you know, shame on you plus s so that activated the super user bit you know, set your ID bet.
And so now when super lessons run. Anytime I do it will, it can access it can read any file in the system.
So, yeah, set your ideas very dangerous.
So.
pseudo inherently isn't.
pseudo actually allows you to specify all these patterns about what commands can be run or can't be run.
Its most people don't use that in practice, but you could do that there's a way to instead of doing instead of having specific set your ID binaries. You can just say okay if you do this command you can do this but otherwise you can't.
But it's just checking to see if you're in the right group and if it is then lets you do it.
I just, I just made it by copying less super lessons just less, but with that your IT group.
Um, so yeah so that's.
So that's the permission so what's happening when you log in.
So, I mean that's really the tricky part is when you log in as you better drop your privileges, you don't know, you don't if you don't drop the privileges.
Of course they become rude and they can do anything to the system and presumably a regular user shouldn't have the privilege that and in fact actually you really.
Why do we do things as a user students, even though student has to their privileges because that prevents you from accidentally messing things up.
If you want to mess things don't change the figuration you say pseudo and you know we supposed to do it but otherwise you want to run as an underprivileged user.
Just, just in case.
You know, just in case because like if someone comes in and run something as you, they can't just run pseudo because they have to know your password. In order to make pseudo do things as root.
So, so that that's an additional layer of protection on the system. That's why you always have to keep copying your password for pseudo, at least for at least for a period of time, they'll remember it for you for a while.
Oh, Yeah, there's one thing that we have not discussed.
What's up Oh, so you're gonna play with like what's actually happening in the login process and seeing what's happening in the tutorial and there's definitely more stuff here to talk about but at least this is kind of a high level picture of what's going
on and we will talk about the details of what's going on more after the break. So, the full tutorial will be released tomorrow. If you have time, work on that.
But, or, you know, catch the other classes.
And we'll see you after the break.
When is to tour