Difference between revisions of "Installation on Debian"
From Linux-VServer
(→Versions) |
(→fixing the problem) |
||
Line 48: | Line 48: | ||
=== fixing the problem === | === fixing the problem === | ||
− | To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier these instructions]]. | + | To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. |
== References == | == References == | ||
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch | * Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch |
Revision as of 13:11, 12 May 2009
This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.
If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25
Contents |
Packages installation
The packages required by Linux-VServer are:
- linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
- util-vserver - These are the utilities used to administer the guests
- ssh - This is probably already installed, but just in case it isn't
All the packages you need can be obtained via
aptitude install linux-image-vserver-686 util-vserver ssh
so run this as root and reboot. To check out wherever everything went fine you may run
uname -r
and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.
Now that the host system is ready, you can proceed with building guests.
Versions
Debian already contains vservers kernels, so no manual patching and compiling is needed.
Debian release | Kernel version | VServer version |
---|---|---|
Etch | 2.6.18+6 | 2.0.2.2-rc9 |
Lenny | 2.6.26+17 | 2.3.0.35 |
Issues with the current 2.6.26 Kernel
Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. This creates a considerable security issues for anyone who:
- has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
- has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
- has unified guests (such as created by vhashify).
In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situations above.
fixing the problem
To fix the barrier flags for a current kernel, see these instructions.
References
- Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch