application security using a copy-on-write virtual machine

An architecture is possible that uses a lightweight VM for use as an application sandbox. Instead of the duplication of an OS plus a run-time environment, this virtual machine uses the host environment as a read-only resource. This allows the VM to serve as a Sandbox that allows reads and writes to the file system, but only the VM address space is modified. Since the host OS environment is supplying a-prior values, the total VM footprint is minimal. This architecture is able to serve as a base for secure application solutions.

In practice an application is installed into a host OS and via installation and use it creates a cache mirror of changed OS data and resources that it would normally have modified in the traditional installation. This application and the ‘cache’ is then versioned and mirrored. If the application is compromised it is deleted or the cache is rolled back to the period before the compromise.

There are many types of virtual machines. Two examples are the system VM types such as VMWare or Oracle VirtualBox, another is the focused process VM such as the Java Virtual Machine, Dalvik VM, or the Common Language Runtime. The former are complex and since they must “dupe” an OS are large and complex. The latter application level VMs are smaller and optimized for a single runtime environment. Each of these have corresponding security issues.

A virtual machine is usually a sandbox in implementation and provides a level of security. However, the cost is that it must duplicate OS resources. In contrast the sandboxed process VM type being discussed here depends on a real OS host and does as little duplication of the environment as possible. It is not generic, but integral to a specific application program or system.

Though this may possibly help in making an application survive destruction by protecting the storage address space, there is still the issue of active infiltration and use of system resources such as networks accessible to the application. Perhaps this type of VM will make conventional security practices and tools more useful?

Just an idea off the top of my head. Haven’t looked to see if is unique or even remotely makes sense.

June 12, 2013: “Security Anti-Pattern – Mobile Hypervisors (for user facing VM’s)
August 31, 2013: Was just reading about Docker which uses the LXC (LinuX Containers). Maybe that is what I had in mind.

Further reading

  1. Android Application Sandbox
  2. Virtual Machine
  3. Sandbox
  4. Pushing The Limits of Web Browsers … or Why Speed Matters
  5. Sandboxing Java Code
  6. Security Anti-Pattern – Mobile Hypervisors (for user facing VM’s)

Access virtual storage with UNC and mklink on Windows

many ways to do this and of course corresponding security concerns. My quick approach was to just use file directory symbolic links.

I set up a Tomcat app server on a ‘virtual’ hard drive. The virtual drive is assigned a local hard drive letter. But when a Groovlet attempts to access a local file, the file path used is on the default local drive, C:. How to allow access to the non-local file?

Symbolic links
There are probably many ways to do this and of course corresponding security concerns. One of these is to use Universal Naming Convention (UNC) paths. My quick approach is to just use file directory symbolic links. These are supported in most windows versions. On Windows 7 the MKLINK command is available.

You want to access the folder w:\a\b\c on the virtual drive. On the “real” drive you create a link:

mkdir a\b
mklink /D c w:\a\b\c

Now when the app server accesses the “c” folder via a UNC, \\mymachine\a\b\c, it will find it.

Virtual Machine Applicance for development environment

Configuration of a development environment can be very time consuming, error prone, or difficult.

Configuration of a development environment can be very time consuming, error prone, or difficult. This is especially true when investigating or getting up to speed on a new technology or framework. In a corporate environment this is a also a drain on resources and existing developer staff who must take the time to prep a new developer.

One approach to mitigate this is to use a Virtual Appliance.

Virtual appliances are a subset of the broader class of software appliances. Installation of a software appliance on a virtual machine creates a virtual appliance. Like software appliances, virtual appliances are intended to eliminate the installation, configuration and maintenance costs associated with running complex stacks of software.

A virtual appliance is not a complete virtual machine platform, but rather a software image containing a software stack designed to run on a virtual machine platform which may be a Type 1 or Type 2 hypervisor. Like a physical computer, a hypervisor is merely a platform for running an operating system environment and does not provide application software itself. — Virtual Appliance

Creating a Virtual Machine Applicance
The available VM software such as Oracle VirtualBox and the VMware VM have facilities to generate appliances. Thus, when a functioning development environment is created by a lead tech or group, an appliance can be generated for the rest of the team. This appliance can even be provided using a Virtual Desktop Infrastructure (VDI).

Open Virtualization Format
While a VM system can be used to create individual VM instances that can be reused, a more recent technology (supported by some vendors) is the use of OVF:

… is an open standard for packaging and distributing virtual appliances or more generally software to be run in virtual machines.

The standard describes an “open, secure, portable, efficient and extensible format for the packaging and distribution of software to be run in virtual machines”. The OVF standard is not tied to any particular hypervisor or processor architecture. The unit of packaging and distribution is a so called OVF Package which may contain one or more virtual systems each of which can be deployed to a virtual machine.

An OVF package consists of several files, placed in one directory. A one-file alternative is the OVA package, which is a TAR file with the OVF directory inside. —

Using ready made appliances
Each VM vendor can/does make available an appliance marketplace. Thus, one can find ready-made LAMP based environments with a development software stack, for example.

Alternative 1, an installable virtual disk
Where resources are constrained, such as places where developers are still on 3GB of ram and ancient PCs, a Virtual Machine is just not going to cut it.

One easy alternative is to create a dev environment on an installable soft hard drive. TrueCrypt can be used for this purpose. One simply create a true crypt volume, which is just a single file. Then creates the desired dev env in that volume, and that file can now be copied to load into other dev’s workstations as a new hard drive.

TrueCrypt is really for security and privacy concerns, it encrypts data, so may not be ideal for this application. Since TrueCrypt is so useful as a virtual disk, it would be great if it had the option of not encrypting content. But, that would perhaps be outside of its feature space. For that the next alternative is available.

Alternative 2, use VHD files
An alternative is using something directly targeted at virtual disks such as the VHD file format. However, this does not seem to have easily useful public gui or command support (for the end user: developer).

On Windows following the instructions here and using these Send To scripts will allow one to seamlessly use vhd files as mountable hard disk volumes.

Note that Windows 8 will support native mounting of ISO and VHD files.

Further Reading


Screen capture in Ubuntu running in VirtualBox

Screen capture was not working in a new install of Ubuntu in VirtualBox. The attempts would result in an image of the desktop background. Weird.

Since the default app didn’t work, I installed various other ones. None worked. Finally I installed Gimp. Even that didn’t work.

I think that ruled out an application issue. Left was Ubuntu, Unity desktop, hardware, VirtualBox, or me. Certainly not I.

It was the 3D setting on the virtual machine! Doh! I thought the check box was a request; if the system has no 3D support it would just not use that setting.

VirtualBox: 4.1.6
Ubuntu: 11.10
Host: Windows 7 64bit

Off topic, but what a great rant! “Why I’ve finally had it with my Linux server and I’m moving back to Windows.” I know the feeling. I had Linux running on an old laptop. Then I tried to upgrade the distro. The laptop stopped working. Now nothing installs, Windoze, other Linux distros, nada. Boot sector issues or firmwear issues. I don’t know. One day I’ll buy an enclosure and try to reuse the laptop harddrive as an external USB backup.



Bassnectar – Pleasure the Bassnympho

Amy Winehouse – All my lovin’ (The Beatle’s cover)

Network access to VirtualBox VM?

How I setup a new VirtualBox VM running Ubuntu that could only be reached from the local network. An external network access (using port forwarding at the router) fails.

How I set up a new VirtualBox VM running Ubuntu that could be reached from the local network.

I first used the Bridged Network setup, which did not work. This is on VirtualBox 4.1.4. I have other VB vms where the Bridged Networking does work. hmm.

On this VM I changed networking to:
– NAT. Network Address Translation.
– Defined a Port Forward rule (via Virtual Box GUI). Ports on hosting PC get mapped to the VM guest. For example, 22.
– Made sure the Windows 7 Firewall allowed the external port.
– Defined a port forwarding at my network provider.
– Defined a port forward at my local router.

At least, that is what I think I did. In the turmoil of getting things to work, research what others tried, and then success, it is hard to get the actual process just right.

Saved, then waited; takes a while for everything to percolate through the network. Opened the URL and voila, I have access!

That was not easy! Where is that button?

Further reading

  1. VirtualBox Bridged Network Port Forwarding Issue

Bill Evans Trio – Waltz for Debby [Take 2]

Guest Additions info incorrect in VirtualBox?

When I go to the menu Machine > Session Information, the runtime tab says my Guest Additions is 4.0.4_OSEr70112. Shouldn’t that be 4.0.8_711778, since that is what I loaded?

Took a bit of effort but I got with my Windows 7 64bit host the VB 4.0.8 update to work with Ubuntu 11.04 w Unity.

When I go to the menu Machine > Session Information, the runtime tab says my Guest Additions is 4.0.4_OSEr70112. Shouldn’t that be 4.0.8_711778, since that is what I loaded?

Here is the info using the VBoxManage CLI:

C:\Program Files\Oracle\VirtualBox>VBoxManage.exe guestproperty enumerate "Ubuntu" | grep -i GuestAdd
Name: /VirtualBox/GuestAdd/Version, value: 4.0.4_OSE, timestamp: 1306626029078892600, flags:
Name: /VirtualBox/GuestAdd/Revision, value: 70112, timestamp: 1306626029079392600, flags:
Name: /VirtualBox/GuestAdd/Vbgl/Video/SavedMode, value: 1920x1105x32, timestamp: 1306626031970259700, flags:
Name: /VirtualBox/GuestAdd/HostVerLastChecked, value: 4.0.8, timestamp: 1306626070499652300, flags:

Hmm, this does show 4.0.8 for one property. Maybe I’m missing some step?

Issues with upgrade?
What were my issues with the upgrade? Ubuntu VM would not complete the boot up. First it was the freeze at checking battery state, then after getting by that, it was the freeze at installing new binary file formats.

I tried some of the suggestions found on the web. The final one I tried is listed below. But, even that didn’t work. Yet after a few reboots of the vm and setting the 3D mode for graphics it finally rebooted fully.

Some links I used to solve issues
Natty Narwhal and Virtual Box

Host: Windows 7 Professional 64bit.
Guest: Ubuntu 11.04 “Natty Narwhal”, Unity desktop.
PC: AMD quad with 8GB ram.
Brain: Belonging to carbon-based life form, Earth, Homo sapiens sapiens.

VB file sharing with Ubuntu guest and Windows 7 host

VirtualBox 4.0 can now mount shared folders automatically! I tried it and can now see my full C drive on Windows 7 from the Ubuntu guest.

VirtualBox 4.0 can now mount shared folders automatically!

Yes, you could always do it with a few edits of some system config files, but this puts it at a non-geek average user level, a file sharing for idiots perhaps. The instructions on creating shares is in the VB manual section 4.3.2 Automatic Mounting.

I tried it and can now see my full C drive on Windows 7 from the Ubuntu guest running in VirtualBox (VB). But, at first, it did not work, and a previous manually mounted share also stopped working, both with access permission problem. The big detail I missed:

Access to auto-mounted shared folders is only granted to the user group vboxsf, which is created by the VirtualBox Guest Additions installer. Hence guest users have to be member of that group to have read/write access or to have read-only access in case the folder is not mapped writable.

So after you create the share you have to add users to the vboxsf group. Using the Ubuntu UI you navigate to System, Administration, Users and Groups, then Manage Groups. Now find vboxsf and show its properties, from there you can add users. Reboot.

From the Oracle VM VirtualBox manual:

4.3.2. Automatic mounting
Starting with version 4.0, VirtualBox can mount shared folders automatically, at your option. If automatic mounting is enabled for a specific shared folder, the Guest Additions will automatically mount that folder as soon as a user logs into the guest OS. The details depend on the guest OS type:

With Windows guests, any auto-mounted shared folder will receive its own drive letter (e.g. E:) depending on the free drive letters remaining in the guest.

If there no free drive letters left, auto-mounting will fail; as a result, the number of auto-mounted shared folders is typically limited to 22 or less with Windows guests.

With Linux guests, auto-mounted shared folders are mounted into the /media directory, along with the prefix sf_. For example, the shared folder myfiles would be mounted to /media/sf_myfiles on Linux and /mnt/sf_myfiles on Solaris.

The guest property /VirtualBox/GuestAdd/SharedFolders/MountPrefix determines the prefix that is used. Change that guest property to a value other than “sf” to change that prefix; see Section 4.6, “Guest properties” for details.

Access to auto-mounted shared folders is only granted to the user group vboxsf, which is created by the VirtualBox Guest Additions installer. Hence guest users have to be member of that group to have read/write access or to have read-only access in case the folder is not mapped writable.

To change the mount directory to something other than /media, you can set the guest property /VirtualBox/GuestAdd/SharedFolders/MountDir.

Solaris guests behave like Linux guests except that /mnt is used as the default mount directory instead of /media.

To have any changes to auto-mounted shared folders applied while a VM is running, the guest OS needs to be rebooted. (This applies only to auto-mounted shared folders, not the ones which are mounted manually.)

VirtualBox: 4.0.0 r69151
Ubuntu: 10.10 (maverick)
Kernal Linux: 2.6.35-24-generic
Window 7:
PC: p6230

Further reading

VirtualBox Shared Folders in Ubuntu 10.10 Guest with Windows 7 Host


Ratkje- Vox

Synergistic Social Agent Network Cloud

Multi-agent systems embedded in the social cloud offer more value then ‘Apps’


Multi-agent systems embedded in the social cloud offer more value then ‘Apps’.

Key words: agents, multi-agent, dynamic networks, social networks, Recommender system, cloud, cloud agent

SynergisticMobileAgentSocialNet MindMap
SynergisticMobileAgentSocialCloud Mind Map (click for larger view)


2014-10-28: I see Google is doing a new “Physical Web” effort”. Intro is here.


Mobile apps have not been very gratifying. Testing an app last year gave some clarity to what I felt to be a problem with the current App ecosystem. And, this is not just a mobile issue, but also for traditional computing platforms. I have been thinking of this subject for years. This is just, finally, a very simple and pragmatic example.


Last year I downloaded an app that locates the cheapest gas based on my current location. Whether cheap gas should be used in one’s car is not the point here. The app could have been one for finding the best licensed massage therapist or bookstore. The point, is this using mobile computing to its full potential?

What if the cheap gas station is located in an area where crime is very high? Should I risk a carjacking just to save 3 cents? What if I’m about to run out of gas now, is the cheapest gas too far away? We can get even more complicated of course. What if I have to be at an appointment, shouldn’t the cheap criteria be augmented with route info; the cheapest gas is the one easiest to get to on my way to or from my appointment.

In short, the current app is one-dimensional. Real life is multidimensional and the human brain easily makes decisions within this mostly analog fuzzy chaos. If an app cannot make decisions or recommendations in that same world, it collapses the dimensions, it is a dumbing down.


How can the app be made more dimensional? AGENTS. The app should really be an Agent that cooperates with other agents to fulfill a need, in this case finding cheaper gas. Thus, it should talk to other autonomous agents, such as:

  • calendar
  • law enforcement to grade destination
  • vehicle network for fuel requirements
  • traffic
  • mapper
  • GPS
  • weather
  • retail for
    • quality
    • complaints
    • hours of operation
    • costs
  • Social Net
  • Politics
  • Financial
  • map routing, and so forth.

It should also be informed by human agents in a trusted relationship with the user. What we then have is An Ad Hoc Dynamic Network of Social Agent Recommenders (AhDyNoSAR).

The Mind Map Diagram shown previously gives a contextual view of this idea.

Let’s look at another example. Someone is walking in neighborhood that has a few restaurants. The embedded Agent notes that the last time the person ate was a few hours ago (based on shopping venue, Calendar, etc.). The shop’s agents are contacted and a decision processing workspace is created. Is the person currently viable, do they have cash or credit available? Each store will check inventory and accounting ratios, does it need to offer a discount or promotion to this person? More agents mobilize to assert their criteria. What are the person’s tastes, dietary restrictions and allergies, past intake (who wants pizza twice in one day?), and other multidimensional agents in a problem space hierarchy are evoked.

After all agents complete their reckonings and the spontaneous net reaches a stable resonance, the person’s intimate personal soft computing agents make a decision. It turns out that the person is currently following their spiritual observance and is fasting today. This result is sent into the local agent milieu and starts a new search for resonance, so no food, how about some clothing or reading material? Again a new recommendation graph is created, religious and political leanings are queried, clothing and accessory rules are fired, ah, that is a very old turban, here are some suggestions.

Unfortunately, the person has now walked into a new map space, a neighborhood park. Now new agents awake: social engagement, entertainment, sexual, defensive.


It would be so gross if the information that this new cloud offers is shown as ads. A better approach is that this information space is entered as a virtual world, using technologies like that of Massively multiplayer online role-playing game (MMORPG). The consumer becomes an Avatar moving through Recommendation Space, a superimposed view on current locality based environments. Instead of or in addition to other consumers, the other characters are the various agents most visible recommendation goal.


Unlike Apps an Agent should always be considered adversarial. That is, even when an agent provides a benefit, it also can allow intentionally or via weaknesses a loss of security and privacy since it must negotiate information with other agents. Thus, though current or future standards may be used, they must be in virtual application spaces that use encrypted anonymous data. This will be just as virus and other malware, an ongoing battle.


It would not be optimal to require a download of an agent to each user’s location or device. Instead, agents will exist in the cloud as a multi-agent system. A user will have a private cloud virtual machine and address space for agent storage and recommendation space. To handle disconnected use, an agent will have a mobile agent shadow. It will provide simple assistance and will punt decisions and actions it cannot handle until connection to the cloud is established.


With Apps, the app provider may require purchase or try to enforce lock-in or an advertising monopoly. This can also be accomplished by centralizing the App marketplace. This may not work directly with Agents. Agents may not even provide an obvious visible function. For example, an agent may just contribute parking meter locations and status to other agents that use a map agent.

In the real world eventually someone has to pay the piper. So too will the development and use of agents must be rewarded. Some options are:

  • Advertising:
    An agent can contribute to an advertising stream that ultimately reaches the consumer facing user interface device.
  • Agent micropayments:
    Agents will negotiate among their collaborators to maintain a balance of payments, an agent of agents, and this payment is satisfied by the user or the user’s fee structure that the network provider maintains.
  • Purchase:
    The consumer will purchase agents. If the fidelity and number of agents is adequate the quality of service is greater.
  • Other.



Of course, the internet is currently wide open and thus this opens up predation to another level if Agent “sandboxes” are porous, if personal data is not secure.


The present cavalier attitudes regarding personal privacy exhibited by the large Internet service providers is a big warning sign that giving agents access to even more information would be just another data mining delicacy ripe for exploitation.


And now for an even more far out scenario. In a classic Science Fiction novel, before a character dies, a copy of their knowledge is captured. This intelligence is then available for implantation into someone as an “Aspect”, an agent that can add its unique expertise and judgment to the human host. That is a more radical direct means for accomplishing something that the social networking may evolve into, a means to collect knowledge and translate that into a ubiquitous intelligence.


Presented was a critique of conventional app centric mobile computing and a suggestion that Agent technology can provide a more realistic computing environment. The term Agent was not defined here. Perhaps the difference with an App is just intent or where the output is ingested. The experts are still debating Agent technology and its applications.



Further Reading

All rights reserved. No part of this document may be reproduced or transmitted in any form by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from Josef Betancourt.

This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License, See:

go Top

An update to Open Solaris 11 Express in VirtualBox failed.

An attempted update to the new Open Solaris 11 Express in VirtualBox failed

I attempted to update open Solaris running in VirtualBox VM to the new Open Solaris 11 Express.

Failed. On the VM screen I get a blinking command shell with a whole bunch of undefined symbols and missing modules for example:
opensolaris genunix: /kernel/drv/amd64/oss_sadasupport: undefined symbol

opensolaris genunix: unable to resolve dependency, module ‘misc/amsrc2’ not found

I followed the instructions at:

Well, don’t have time to muck with it. The great thing about virtual machines is that you can just delete them. So, I did. Will stick with Ubuntu.

Ubuntu 10.10 update in VirtualBox, no gui.

Solution for no-gui in Ubuntu 10.10 running in VirtualBox on Win7 host.

I’ve been running Ubuntu Linux 10.03 on a VirtualBox VM with the Windows 7 host PC. Works fine. Updated to Ubuntu 10.10 – the Maverick Meekat, restarted the system, and now it comes up in console mode and asks for a user/pass. I give it what I have, and it doesn’t accept it. Hosed. Gee ain’t Linux grand.

Hmmm. Let me try again. Ah, it accepted another username/password, which is not the one in my Keepass database, now that needs maintenance.


But, now how do I get the Ubuntu gui back. Tried to reinstall the Guest Additions. Nope, even though I do the Devices->Install Guest Additions, I don’t see the CD in /media/cdrom folder.

At the end of this blog post the author has:

The Unixmen’s site has a workaround to the X Window issue. Run the following commands:

sudo apt-get update

sudo apt-get install build-essential linux-headers-$(uname -r)

sudo apt-get install virtualbox-ose-guest-x11

I was prompted whether or not I wanted to keep my current configuration file or replace it, I chose to keep it.

Once the last command finishes reboot the virtual machine. The display can then be resized.

It works! Ubuntu is back to normal.

Incidentally, I also had to remove etckeeper. Its been giving some trouble for a while now.

11Oct10: Oracle just released VirtualBox 3.2.10, that probably fixes this issue.