Searching the swapfile of a kvm/qemu image

Searching the swapfile of a kvm/qemu image

[Sean McLinden]

Greetings:

I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?

Thanks, in advance.

Sean McLinden



-- 
NOTICE of CONFIDENTIALITY and DISCLAIMER

This transmission, including attachments, is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail to the sender, only, and delete it from your system; you may not copy this message or disclose its contents to anyone.

Unless expressly noted, above, this communication does not reflect an intention by the sender to conduct a transaction or make any agreement by electronic means. Nothing contained in this transmission shall constitute a contract or electronic signature under the ESIGN, any version of the UETA, or any other statute governing electronic transactions. 

If this transmission contains advice, the advice is based on instructions in relation to, and is provided to the addressee in connection with, the matter mentioned above. Responsibility is not accepted for reliance upon it by any other person or for any other purpose.

Re: Searching the swapfile of a kvm/qemu image

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 627 bytes --]

On Mon, Apr 04, 2016 at 11:53:45PM -0400, Sean McLinden wrote:
> I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?

Keep in mind that the contents of the swap partition can change at any
time.  I don't know the details of the swap on-disk layout, but if you
need to read from multiple non-contiguous sectors you have a race
condition where you might read part old and part new contents.

What are you trying to achieve?

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: Searching the swapfile of a kvm/qemu image

[Sean McLinden]

I am searching for (possibly) meaningful strings.

This is a shot-in-the-dark kinda of effort.

Thanks!

Sean



----- Original Message -----
From: "Stefan Hajnoczi" <stefanha@gmail.com>
To: "Sean McLinden" <mclinden@informed.net>
Cc: kvm@vger.kernel.org
Sent: Tuesday, April 5, 2016 6:08:13 AM GMT -05:00 US/Canada Eastern
Subject: Re: Searching the swapfile of a kvm/qemu image

On Mon, Apr 04, 2016 at 11:53:45PM -0400, Sean McLinden wrote:
> I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?

Keep in mind that the contents of the swap partition can change at any
time.  I don't know the details of the swap on-disk layout, but if you
need to read from multiple non-contiguous sectors you have a race
condition where you might read part old and part new contents.

What are you trying to achieve?

Stefan


-- 
NOTICE of CONFIDENTIALITY and DISCLAIMER

This transmission, including attachments, is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail to the sender, only, and delete it from your system; you may not copy this message or disclose its contents to anyone.

Unless expressly noted, above, this communication does not reflect an intention by the sender to conduct a transaction or make any agreement by electronic means. Nothing contained in this transmission shall constitute a contract or electronic signature under the ESIGN, any version of the UETA, or any other statute governing electronic transactions. 

If this transmission contains advice, the advice is based on instructions in relation to, and is provided to the addressee in connection with, the matter mentioned above. Responsibility is not accepted for reliance upon it by any other person or for any other purpose.