How can an attacker identify that a system is using User-Mode Linux (UML)?

How can an attacker identify that a system is using User-Mode Linux (UML)?

• A. /etc/fstab file
• B. /proc/mounts
• C. /var/log
• D. /etc/hosts

Answer: (A)

User-Mode Linux often runs the guest from a disk image on the host. That image is typically specified or mounted as part of the host’s boot or startup configuration, which can be visible in the host’s filesystem table. Inspecting the host’s /etc/fstab can reveal an entry that points to a UML disk image or a loopback device used for the UML root filesystem. That static mounting line is a telltale sign that a UML guest is configured to boot from a file on the host, making it the most straightforward way to identify UML from the host’s perspective. Browsing /proc/mounts would show active mounts, but it may not persist or clearly indicate UML configuration in a way that’s easy to attribute to UML alone. /var/log and /etc/hosts don’t provide information about virtualization or guest environments, so they’re not helpful for identifying UML.

User-Mode Linux often runs the guest from a disk image on the host. That image is typically specified or mounted as part of the host’s boot or startup configuration, which can be visible in the host’s filesystem table. Inspecting the host’s /etc/fstab can reveal an entry that points to a UML disk image or a loopback device used for the UML root filesystem. That static mounting line is a telltale sign that a UML guest is configured to boot from a file on the host, making it the most straightforward way to identify UML from the host’s perspective.

Browsing /proc/mounts would show active mounts, but it may not persist or clearly indicate UML configuration in a way that’s easy to attribute to UML alone. /var/log and /etc/hosts don’t provide information about virtualization or guest environments, so they’re not helpful for identifying UML.