Installation on Debian
This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.
If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25
The packages required by Linux-VServer are:
- linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
- util-vserver - These are the utilities used to administer the guests
- ssh - This is probably already installed, but just in case it isn't
All the packages you need can be obtained via
aptitude install linux-image-vserver-686 util-vserver ssh
so run this as root and reboot. To check out wherever everything went fine you may run
and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.
Now that the host system is ready, you can proceed with building guests.
Debian already contains vservers kernels, so no manual patching and compiling is needed.
|Debian release||Kernel version||VServer version|
Issues with the current 2.6.26 Kernel
Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. There is also a discrepancy between the immutable-unlink flag used for file unification. This creates a considerable security issues for anyone who:
- has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
- has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
- has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
- has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.
In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situation above and/or immutable links will not function correctly (failinf to break when overwritten) in a unified guest setup.
fixing the problem
As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see these instructions. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel.
For more details and a more concise explanation see Bertls IRC explanation
- Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch