3

Imagine that you have an object code file from an untrusted source. You want to run this code to know the result of its computation, and you want the code to perform fast, so setting up a whole virtual machine is a last resort. You also want nothing to happen to your system after the code is run.

Having that in mind, as far as I understand, that code would not be able to do any harm if you restrict the number of interrupts for it or disable interrupts whatsoever. One way to ensure there are no interrupts in code is to scan it instruction-wise and refuse to run if there is at least one int instruction in it. That will solve the problem, but this approach will as well disallow any system calls, and the code with no system calls is scarcely useful. If the running side decides to allow that code which only invokes some whitelisted interrupts, then the running side needs to be sure that the running code does not change itself in run time. If it does change, then each instruction to run needs to be re-scanned, what would impact performance.

It would be nice to have some kind of gateway between host and guest interrupts, which could translate guest interrupts to possibly different host interrupts or refuse to do so. Are there any solutions or researches available for this topic?

  • 1
    The answer to this is likely to depend on what platform the code is written for. A DOS executable can easily be isolated from the base machine's interrupts by running in a V86 environment. Linux provides integrated facilities for intercepting system calls. On Windows, it may be harder. – Jules Oct 3 '15 at 6:56
  • Thank you, @Jules. I want the described setting to depend on the platform as little as possible — think Google Native Client environment. – Craig Oct 3 '15 at 7:05
  • 2
    Why do you think virtual machines are slow? – kevin cline Oct 3 '15 at 7:19
  • ptrace possibly is a way to go, but I am unsure whether it is safe or generic enough. – Craig Oct 3 '15 at 7:24
  • 3
    Please see Halting problem and polymorphic viruses. Basically you need an antivirus software or its analog. – Basilevs Oct 3 '15 at 9:10
1

This is extremely dependent on the environment that you're using, and I don't think that you can avoid tying it to one operating system. Since this kind of work is heavily dependent on the kernel (you are trying to avoid interrupts, after all, a feature of the kernel itself), do not be afraid to use a Linux- or Windows-specific solution.

Your approach of scanning the object file for specific instructions isn't sufficient, because as you said, it will also disable system calls. This is also dependent on the architecture that you're running on, and since you don't want the solution to be OS-dependent, you probably don't want an architecture-dependent one, either.

Containers have less overhead than virtual machines, and can be started up and taken down extremely quickly, but since you're talking about separation from the kernel, a container would not be sufficient.

That being said, a virtual machine is your best solution, and is what is generally used in a situation such as this. Sure, there is a little overhead when starting/stopping a virtual machine, and a little bit of runtime overhead when running the application. But these can be solved by using a hardware virtual machine, which uses a hypervisor to give the virtual machine direct access to the hardware. It's a bit difficult to set up initially, but it gets rid of the vast majority of overhead that is present when running an application in a virtual machine.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.