Difference between revisions of "Installation on Debian"

From Linux-VServer

Jump to: navigation, search
m
(→‎Packages installation)
Line 20: Line 20:
  
 
=== Install util-vserver by source ===
 
=== Install util-vserver by source ===
−
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].
+
Occasionally, Debian's util-vserver package can be  
 +
5a8
 +
too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].
  
 
First, install the required packages for util-vserver to compile.
 
First, install the required packages for util-vserver to compile.
Line 61: Line 63:
 
=== Problems due to Xattrs ===
 
=== Problems due to Xattrs ===
  
−
There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.
+
There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which a
 +
5a8
 +
re set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.
  
 
As of writing these issue has not been corrected within the Debian archive.  These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].
 
As of writing these issue has not been corrected within the Debian archive.  These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].
Line 72: Line 76:
 
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
 
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
  
−
In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:
+
In effect, the barrier normally in place for guest servers is not recognised by the ke
 +
5a8
 +
rnel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:
  
 
* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
 
* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
Line 78: Line 84:
  
 
To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.
 
To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.
 +
 +
==== Unification Problems ====
 +
 +
There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:
 +
 +
* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
 +
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.
 +
 +
Symptoms suffered may include:
 +
 +
* file that cannot be deleted
 +
* any process involving the writing of files in guests not working
 +
* files not being unlinked on write
 +
 +
To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.oree [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.
  
 
==== Unification Problems ====
 
==== Unification Problems ====

Revision as of 06:28, 12 August 2009

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/May/04


Contents

Packages installation

The packages required by Linux-VServer are:

  • linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
  • util-vserver - These are the utilities used to administer the guests
  • ssh - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via 

aptitude install linux-image-vserver-686 util-vserver ssh

so run this as root and reboot. To check out wherever everything went fine you may run 

uname -r

and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.

Now that the host system is ready, you can proceed with building guests.

Install util-vserver by source

Occasionally, Debian's util-vserver package can be 5a8 too old. So, we'll need to compile from source.

First, install the required packages for util-vserver to compile. 

apt-get install vlan dietlibc-dev pkg-config libnss3-dev

Then, we configure util-vserver 

./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home

Note: You should change --with-vrootdir accordingly

Finally, we run make to finalise the installation 

make && make install install-distribution

Running vserver-info will show you that the proper util-vserver is installed. :)

Versions

Debian already contains vservers kernels, so no manual patching and compiling is needed.

Debian release Kernel version VServer version
Etch 2.6.18+6 2.0.2.2-rc9
Lenny 2.6.26+17 2.3.0.35

Issues with the current 2.6.26 Kernel

Hard CPU scheduling

This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.

Problems due to Xattrs

There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which a 5a8 re set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.

As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see Bertls IRC explanation .

Chroot Security Problems

Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:

  • has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
  • has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the ke 5a8 rnel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:

  • the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
  • guest not starting

To fix the barrier flags for a current kernel, see these instructions. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

Unification Problems

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

  • has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
  • has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

  • file that cannot be deleted
  • any process involving the writing of files in guests not working
  • files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.oree these instructions. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

Unification Problems

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

  • has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
  • has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

  • file that cannot be deleted
  • any process involving the writing of files in guests not working
  • files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to bugs.debian.org.

References

Retrieved from "http://linux-vserver.org/index.php?title=Installation_on_Debian&oldid=3869"
Personal tools