Hacker News Reader

Comment by remram | Hacker News Reader

> Unlike in other Linux virtualization solutions such as User Mode, special driver software on the host operating system is used to execute the coLinux kernel in a privileged mode

That's unfortunate, is there a version of this that runs unprivileged like user mode Linux?

View on HN

You're not going to take over NT's control of the MMU et. al. without elevated privileges. To run as a non-admin, you either need a VM that leverages NT's built-in virtualization capabilities (requires admin to enable), a separate personality (requires admin to install), or a Win32 application a la cygwin, which isn't very good.

You could do a very slow x86 interpreter.

https://www.qemu.org/download/#windows

The site is down, so I can't see what they're doing with the MMU: that said, most virtual memory management works just fine from normal boring userspace. If wine can do it for running win32 on Linux, this thing can do it for running Linux stuff on win32, which isn't less powerful when it comes to virtual memory management.

It's been years since I used Wine, but I think it just runs each Windows process in its own Linux process. There's no Wine "kernel" that needs to manage virtual memory or isolate multiple processes.

AIUI this is correct, yes.

Sort of. Wine still has a privileged (w.r.t. other wine processes) manager process that handles coordination between other wine processes. Whether that's a "kernel" is a matter of opinion.

The VMM is part of the kernel (or executive), not userspace. App requests memory, VMM assigns pages from RAM, page file, or backing store.

If you wanted to segment yourself and take over anything 'below' the kernel like the MMU, you'd need elevated rights. But that'd be some interesting programming.

https://en.wikipedia.org/wiki/Architecture_of_Windows_NT#/me...

Huh? What are you talking about? I can manipulate page tables just fine from userspace through the magic of MapViewOfFile.

You could try to use the Win32 debug API in the same way like Linux UML by using ptrace. But it would probably still be much slower because of missing things like PTRACE_SYSCALL.

More performant would be a noMMU variant of UML for Windows, supporting only PIE executables, similar to nabla-linux [1]. This is also quite similar to how mssql for Linux works NT kernel+Win32 in a single usermode process (single address space) [2]. Interestingly, mssql also uses memory protection keys to recover a bit of fault tolerance but last time I checked Win32 does not have an API for MPKs.

[1] https://github.com/nabla-containers/nabla-linux

[2] https://threedots.ovh/slides/Drawbridge.pdf

SeDebugPrivilege requires local admin, which would be required to debug a process the user doesn't own. This privilege level is just about the highest one you can obtain in NT.

Don't besmirch the good name of Cygwin, I daily drove that for Python development for 2 years and it worked shockingly well. In retrospect I think I liked Cygwin more than I liked WSL because I really could interoperate my Linux/Windows together nearly seamlessly. But I think that was because I was operating and using tools right in the sweet spot of the Cygwin abstraction; e.g. no GUI programs, sockets/file work only.

Agreed. For a long time, Cygwin was the best Unix userland. It also fit conveniently into a single folder, allowing multiple portable environments on the same machine. Mingw was pretty nice too.

Reply on news.ycombinator.com