Difference between revisions of "Installation on Debian"

Revision as of 13:16, 12 May 2009

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25

Packages installation

The packages required by Linux-VServer are:

• linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
• util-vserver - These are the utilities used to administer the guests
• ssh - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via

aptitude install linux-image-vserver-686 util-vserver ssh

so run this as root and reboot. To check out wherever everything went fine you may run

uname -r

and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.

Now that the host system is ready, you can proceed with building guests.

Versions

Debian already contains vservers kernels, so no manual patching and compiling is needed.

Issues with the current 2.6.26 Kernel

Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. This creates a considerable security issues for anyone who:

• has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
• has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
• has unified guests (such as created by vhashify).

In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situations above.

fixing the problem

As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see these instructions. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel.

For more details and a more concise explanation see Bertls IRC explanation

References

• Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch