Context Agent Injection Using Virtual Machine Introspection

• US 20090241109A1
• Filed: 03/24/2008
• Published: 09/24/2009
• Est. Priority Date: 03/24/2008
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Dodd, Timothy David, Skapinetz, Kevin Michael, Vandegrift, Marshall Thomas
• Granted Patent: US 9,015,704 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 1/24 Resetting means
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A computer implemented method, apparatus, and computer usable program code for executing a process within a virtual machine. A module is injected into an operating system for the virtual machine to form an injected module. The injected module is executed to load an agent process within an application space within the virtual machine. Execution of the agent process is initiated by the injected module.

Claims

1. A computer implemented method for executing a process within a virtual machine, the computer implemented method comprising:

injecting a module into an operating system for the virtual machine;

executing the injected module to load an agent process within an application space within the virtual machine; and

initiating execution of the agent process by the injected module.

2. The computer implemented method of claim 1, wherein the injecting step comprises:

allocating memory assigned to the virtual machine to form allocated memory;

copying the module into the allocated memory;

loading the module into the allocated memory to form a loaded module; and

starting execution of the loaded module.

3. The computer implemented method of claim 2, wherein the loading step comprises:

halting execution of the operating system;

locating a loading function;

creating arguments for the loading function;

modifying an instruction pointer to point to the loading function; and

restarting the operating system to cause loading of the module by the loading function using the arguments.

4. The computer implemented method of claim 1, wherein the step of executing the module comprises:

mounting a file system containing a set of components for the agent process; and

executing the agent process using the set of components.

5. The computer implemented method of claim 1, wherein the injecting step is performed by a process executing a privileged virtual machine.

6. The computer implemented method of claim 3, wherein the file system is located in a disk image loaded in a memory space assigned to the virtual machine.

7. The computer implemented method of claim 6, wherein the disk image is selected from one of a first disk image that is part of the module, a second disk image that is loaded by calls made to a code injection process, and a third disk image residing in a set of shared pages.

8. The computer implemented method of claim 1, wherein the agent process is a virus scanning process.

9. A data processing system comprising:

a bus;

a communications unit connected to the bus;

a storage device connected to the bus, wherein the storage device includes computer usable program code; and

a processor unit connected to the bus;

wherein the processor unit executes the computer usable program to inject a module into an operating system for a virtual machine to form an injected module;

execute the injected module to load an agent process within an application space within the virtual machine; and

initiate execution of the agent process by the injected module.

10. The data processing system of claim 9, wherein in executing the program code to inject the module into the operating system for the virtual machine to form the injected module, the processor unit executes the program code to comprise allocated memory assigned to the virtual machine to form allocated memory;

copy the module into the allocated memory;

load the module into the allocated memory to form a loaded module; and

start execution of the loaded module.

11. The data processing system of claim 10, wherein in executing the program code to load the module into the allocated memory to form the loaded module, the processor unit executes the program code to halt execution of the operating system;

locate a loading function;

create arguments for the loading function;

modify an instruction pointer to point to the loading function; and

restart the operating system to cause loading of the module by the loading function using the arguments.

12. The data processing system of claim 9, wherein in executing the program code to execute the injected module to load the agent process within the application space within the virtual machine, the processor unit executes the program code to mount a file system containing a set of components for the agent process;

and execute the agent process using the set of components.

13. The data processing system of claim 11, wherein the file system is located in a disk image loaded in a memory space assigned to the virtual machine.

14. The data processing system of claim 13, wherein the disk image is selected from one of a first disk image that is part of the module, a second disk image that is loaded by calls made to a code injection process, and a third disk image residing in a set of shared pages.

15. A computer program product for executing a process within a virtual machine, the computer program product comprising:

a computer readable storage medium;

program code, stored on the computer readable storage medium, for injecting a module into an operating system for the virtual machine to form an injected module;

program code, stored on the computer readable storage medium, for executing the injected module to load an agent process within an application space within the virtual machine; and

program code, stored on the computer readable storage medium, for initiating execution of the agent process by the injected module.

16. The computer program product of claim 15, wherein the program code, stored on the computer readable storage medium, for injecting the module into the operating system for the virtual machine to form the injected module comprises:

program code, stored on the computer readable storage medium, for allocating memory assigned to the virtual machine to form allocated memory;

program code, stored on the computer readable storage medium, for copying the module into the allocated memory;

program code, stored on the computer readable storage medium, for loading the module into the allocated memory to form a loaded module; and

program code, stored on the computer readable storage medium, for starting execution of the loaded module.

17. The computer program product of claim 16, wherein the program code, stored on the computer readable storage medium, for loading the module into the allocated memory to form the loaded module comprises:

program code, stored on the computer readable storage medium, for halting execution of the operating system;

program code, stored on the computer readable storage medium, for locating a loading function;

program code, stored on the computer readable storage medium, for creating arguments for the loading function;

program code, stored on the computer readable storage medium, for modifying an instruction pointer to point to the loading function; and

program code, stored on the computer readable storage medium, for restarting the operating system to cause loading of the module by the loading function using the arguments.

18. The computer program product of claim 15, wherein the program code, stored on the computer readable storage medium, for executing the injected module to load the agent process within the application space within the virtual machine comprises:

program code, stored on the computer readable storage medium, for mounting a file system containing a set of components for the agent process; and

program code, stored on the computer readable storage medium, for executing the agent process using the set of components.

19. An apparatus comprising:

a set of guest virtual machines executing on a data processing system;

a set of operating systems executing in the set of guest virtual machines;

a set of modules;

a set of agents; and

an injection process, wherein the injection process allocates memory in the data processing system, places a module from the set of modules into the memory and initiates execution of the module in an operating system in the set of operating systems and wherein the module executes to execute an agent in the set of agents within the operating system.