virtualize system root

Q & A for the old 2X Explorer file manager. For other topics, please use the corresponding forum.

Moderators: fgagnon, nikos, Site Mods

Post Reply
SuicidalLabRat
New Member
Posts: 2
Joined: 2003 Aug 16, 02:44
Location: SF Bay Area California

virtualize system root

Post by SuicidalLabRat »

As a Unix system administrator I have little experience with the win32 API; though I started my career as a Unix engineer I have not touched win development since 3.1 faded into the ether. I have been asked, however, to help replicate a development environment I built under Solaris, but on a cluster of w2k nodes, for the development of a new project; but I don’t have a good sense of the breadth of the win32 shells power -alas, I have found little documentation to outline its scope for me. I am appealing to you out of an affinity I have with your 2xExplorer, as it runs on both my home windows systems as well as my laptop and I had hoped to use it in this application. I have mounted a loopback file system under v:\ , its object structure is a mirror of the C:\* file system root ( Documents and Settings, Program Files, WINNT etc…). To emulate the Unix environment I recently built I would need to launch a virtual desktop under your shell with command line ( or otherwise ) arguments to redefine the 2xExplorers root namespace ( a’ la explorer.exe /e,/root,"V:\”, optionally[possibly?] set appropriate system variables in the hive and broadcast them ) so that a browser ( say firebird ) run from your shell would not know of any structure outside of v:\ ? For example, I initiate the download of an MP3, the known file system space presented as available to download this file to would be restricted to the objects under V:\, further, if an application living under this V:\* file system was run from your shell, can I jail it to that V:\ structure ( not concerned with COM or IPC calls -it doesn’t need to be a true chroot() ), assuming replication of system files exists under this V: object in a common hierarchy ( including the registry files!? )? Did that make any sense?

I would be more than happy to pay for you advice in this…


marc-
User avatar
nikos
Site Admin
Site Admin
Posts: 15771
Joined: 2002 Feb 07, 15:57
Location: UK
Contact:

Post by nikos »

marc

the quick version is that i don't know how to achieve what you want

although it is quite easy to limit your own process under a single root (e.g. the way xplorer2 does it), affecting child processes launched by it is a different thing

My hunch is that the secret would lie to put all created processes in the same "job" (see CreateJobObject) and use security attributes to make all drives other than your "V:" off limits for members of this job. That would work for NT/2000/XP only -- if you can figure out the details! Reading about security descriptors is such a headache.

PS: if you need any more info please send me an email
SuicidalLabRat
New Member
Posts: 2
Joined: 2003 Aug 16, 02:44
Location: SF Bay Area California

Post by SuicidalLabRat »

I attempted this reply post on Saturday, however the boards db seemed to be throwing errors; now that it is up again...


--- cut ---

Wow!? THNX for the prompt response!

Hmmm... I was unable to spot an email addy for you within this site, though my search was cursory; I do, indeed, have a few more questions, one of which is whether it is possible to call 2xExplorer with arguments to define the shell namespace, similar to how I would call explorer with explorer.exe /e,/root,"V:\” were I trying to root it ( can you lock the shell explorer under a defined root?).
Additionally, I am still struggling with the scope of the win32 shell, likely due to my Unix heritage -the world I live in allows the shell to dictate processes called from it, the breadth of that power is something I am intimate with. I am struggling, however, with what the bounds of the win32 shells power over the processes it calls is compared to Unix shells. This is something I am going to need to do a bit more research on…
My hunch is that the secret would lie to put all created processes in the same "job" (see CreateJobObject) and use security attributes to make all drives other than your "V:" off limits for members of this job
Unfortunately the processes in need of control don’t belong to me so I have no control over their code, the environment I need to build will be populated by an infinite number of 3rd party applications that will want to write to the system files under the c:\ root due to their own hard coded vars. Under Unix you can simply build a few new system calls to help virtualize the execution space they live in to get the job done, a new_sys_context( int, ctx) could set a new security context for the current process. It will be inherited by all children -simple job control like CreateJobObject, unfortunately, I need to do something more like temporarily overlaying C:\ with V:\, not just control access to C: objects. I don’t have the prowess to write some crazy syscall filter to proxy this for me. :( Are there no shell/system variables to effect a processes view of the file system, as if you could temporarily Junction link over the system folders, effectively hiding all the folders content under my own copy? i.e. if you use an existing 'populated' directory as a mount point for a new structure, the contents become unavailable, as the contents of the newly mounted structure obscure them. Anyway, if you would prefer to communicate via email, feel free to ping me with your address ( it may be that my questions have strayed too far a’field, sry! ).

THNX! I truly appreciate your tutelage…
marc-

SuicidalLabRat@yahoo.com
Post Reply