Installation on Debian

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25

Packages installation

The packages required by Linux-VServer are:

• linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
• util-vserver - These are the utilities used to administer the guests
• ssh - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via

aptitude install linux-image-vserver-686 util-vserver ssh

so run this as root and reboot. To check out wherever everything went fine you may run

uname -r

and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.

Now that the host system is ready, you can proceed with building guests.

Versions

Debian already contains vservers kernels, so no manual patching and compiling is needed.

Issues with the current 2.6.26 Kernel

Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. This creates a considerable security issues for anyone who:

• has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
• has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
• has unified guests (such as created by vhashify).

In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situations above.

fixing the problem

To fix the barrier flags for a current kernel, see Secure_chroot_Barrier#Solution:_Secure_Barrier these instructions.

References

• Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch