Running Network Services under User-Mode Linux, Part I

Leverage the Linux kernel's virtualization features to isolate network dæmons.
Preparing the Host

First, you need to make sure you've got the right kind of kernel on your host system. You very likely may need to compile a new kernel.

On the one hand, some Linux distributions already have User-Mode Linux compiled into their default kernels. On the other hand, your distribution of choice may or may not also have the skas (separate kernel address space) patch compiled in as well. It is, in fact, somewhat unlikely that your default kernel has skas support. Although the Linux kernel source code has included UML support since version 2.6.9, the skas patch is still maintained separately (and Linus has resisted its inclusion).

The skas patch is important. It greatly improves UML performance and security by running the guest system's kernel in separate address space from its other processes (just like the host's kernel does). The User-Mode Linux Web site's skas page on SourceForge provides a more detailed explanation of why you need skas (see the on-line Resources).

To obtain kernel source code, your best bet may be simply to install your Linux distribution's kernel-source package. Take care, however, that your distribution provides a kernel version of 2.6.9 or higher, because UML support is included from 2.6.9 onward, and prior UML patches had security vulnerabilities.

Because Debian 3.1 still uses kernel version 2.6.8, I decided not to use the official Debian kernel packages and instead downloaded the 2.6.17 kernel from kernel.org. I did, however, install the kernel-package package, which provides tools for generating Debian packages from official kernel source.

Besides kernel source code, you need the skas patch, the latest version of which is available on Blaisorblade's site (see Resources). Be sure to download the patch version that corresponds to the kernel source code you're about to patch.

On my Debian host, I unpacked my official source code to /usr/src/linux-2.6.17.3, renamed the source code directory to /usr/src/linux-2.6.17.3-host and copied the skas patch tarball (skas-2.6.17-rc5-v9-pre9.patch.bz2) to /usr/src. I then changed ownership of the directory /usr/src/linux-2.6.17.3-host to a nonroot account. (Adhering to the principle of never being root unless you really need to, we're going to do most of this kernel build as an unprivileged user.)

Here are the commands I executed as root:

host:/usr/src/# tar -xjvf ./linux-2.6.17.3.tar.bz
host:/usr/src/# mv ./linux-2.6.17.3 ./linux-2.6.17.3-host
host:/usr/src/# chown mick ./linux-2.6.17.3
host:/usr/src/# su - mick

To apply the skas patch, I then navigated, as my nonroot user, to /usr/src/linux-2.6.17.3-host and ran the following command:

host:/usr/src/linux-2.6.17.3-host$ bunzip2 -c
 ↪../skas-2.6.17-rc5-v9 -pre9.patch.bz2 | patch -p1

Next, from the same directory, I issued the command make menuconfig. When setting up the kernel configuration for User-Mode Linux, the defaults generally are fine, though you should ensure that the configuration matches your host's hardware. In addition, it's probably prudent to double-check the following settings:

  • Under Processor type and features, make sure /proc/mm is enabled.

  • Under Networking options, make sure IP: tunneling and 802.1d Ethernet Bridging are enabled. If you intend to restrict guest system behavior with iptables, you also may want to check the Network packet filtering section to ensure that Core Netfilter Configuration, IP: Netfilter Configuration and Bridged IP/ARP packets filtering are set up.

  • Under Network device support, enable Universal TUN/TAP device driver support.

  • And, by all means, make sure to hard-compile (into the kernel, not as a module) the filesystem in which your system's root partition is formatted (for example, ext3 or ReiserFS).

From this point on, the process is the same with any other kernel build: issue the commands make bzImage and make modules;. Then, become root and issue the commands make modules, make modules_install and make install. (Or in the case of Debian, use the make-kpkg command to achieve the same thing, and run dpkg to install the resulting kernel package.)

Once your new host kernel is installed, reboot your system. Your host system is now capable of running User-Mode Linux guest systems.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Thanks

Finance's picture

Thanks for sharing.

Skas patch not needed

ldrolez's picture

There's no need for a skas patch (skas3). The latest UML kernel sources, include a mode called skas0, which has the benefits of skas3 without having to patch to host kernel.

Cheers,
Ludovic.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState