Editing
MoreUbuntu
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
== The setup == Assuming now you have some guests running inside you vserver, it is time to setup Xorg for each of your guest. You need to assign resources for each guest, by copying device nodes into the guests needed for your Xorg. For example device nodes of USB keyboards, and USB mice or other USB devices that you assigned to a specific guest. Some people might want to utilize udev to make their setup easier [9]. Note:<br /> The device node /dev/mem is needed for Xorg, which is, regarding to Linux-VServer, considered a security problem if you need a real secure isolated multiseat desktop. Due to the fact that user in a guest might have access to system memory, which is also use by other guests. <span id="graphic-cards-pci-agp-pci-x"></span> === Graphic cards (PCI, AGP, PCI-X) === For accelerated Xorg, specific device nodes might need to be assigned for each seat, e.g. for NVidia driver /dev/nvidia*. Use the lspci command to find out PCI BusId[[BusId?action=edit|?]] to be assigned for each Xorg-Desktop (seat). Use '''lspci -X''' to get a suitable format for use in xorg.conf. Here is some sample output of my system (only relevant lines are shown): <pre class="code"># lspci -X sh-3.00$ lspci -X PCI:0:2:0 VGA compatible controller: Intel Corp. 82915G Express Chipset Family Graphics Controller PCI:1:0:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200] PCI:1:5:0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 MX 440] PCI:1:6:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200]</pre> <span id="input-devices"></span> === Input devices === Information regarding (USB) input devices can be obtained from '''/proc/bus/input/devices'''. This information is needed for Xorg's evdev driver. Same sample output of my system (only relevant lines are shown): <pre class="code"># cat /proc/bus/input/devices ... N: Name="AT Translated Set 2 keyboard" P: Phys=isa0060/serio0/input0 S: Sysfs=/class/input/input0 H: Handlers=kbd event0 ... N: Name="ACROX Combo Mouse" P: Phys=usb-0000:00:1d.1-1.2/input0 S: Sysfs=/class/input/input2 H: Handlers=mouse0 ts0 event2 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input0 S: Sysfs=/class/input/input6 H: Handlers=kbd event6 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input1 S: Sysfs=/class/input/input7 H: Handlers=kbd event7 ... N: Name="Magic ball Mouse Magic ball Mouse" P: Phys=usb-0000:00:1d.1-2.2/input0 S: Sysfs=/class/input/input8 H: Handlers=mouse1 ts1 event8</pre> <span id="audio-devices"></span> === Audio devices === Information regarding (USB) audio devices can be obtained from '''/proc/asound/devices'''. By copying the corresponding device nodes to each guest (seat), you can assign audio devices to guest. It is recommended to rename the device nodes, as if they were for audio device zero (first audio devices), so that no special setting is needed for alsa based application to work. Also remember to copy/create related OSS device nodes, if your application is still using OSS API. <span id="capabilities"></span> === Capabilities === For security reasons, it might be desired, to reduce linux capabilities for each guest (seat). Following capabilities should be set in /etc/vservers/*/bcapabilities for each seat. Don't worry about the security now, since it is anticipated by dropping these capabilities as soon as a user logs in to Xorg-Desktop. * CAP_IPC_LOCK * CAP_IPC_OWNER * CAP_SYS_RAWIO * CAP_SYS_ADMIN * CAP_NET_ADMIN * CAP_NET_RAW * CAP_MKNOD <span id="proc-filesystem"></span> === /proc filesystem === Add following /proc entries to util-vserver/defaults/vprocunhide-files. Note: These might also be considered as a security problem. * /proc/mtrr * /proc/bus/ <span id="xorg"></span> === Xorg === New switches needed for multiseat capable Xorg * -novtswitch, don't immediately switch to new VT * -sharevts, share VTs with another X server Console and tty0 might cause problem, since many older programs are still using these device nodes. /dev/tty0 and /dev/console should be linked to /dev/ttyN assigned to corresponding seat, where N is console number, e.g. tty7 for seat1, tty8 for seat2, etc. Some Xorg sample configuration for * /etc/X11/xorg.conf of xserver-xorg (7.0.0-0ubuntu33, Dapper beta) <pre class="code">Section "InputDevice" Identifier "USBKeyboard" Driver "evdev" Option "CoreKeyboard" Option "Device" "/dev/input/event3" Option "XkbRules" "xorg" Option "XkbLayout" "de" Option "XkbModel" "evdev" Option "XkbVariant" "nodeadkeys" EndSection Section "InputDevice" Identifier "USBMouse" Driver "mouse" Option "CorePointer" Option "Device" "/dev/input/mouse3" Option "Protocol" "auto" Option "ZAxisMapping" "4 5" ... EndSection Section "Device" Identifier "Card0" Driver "nvidia" BusID "PCI:1:0:0" ... EndSection Section "ServerLayout" Identifier "Default Layout" InputDevice "USBKeyboard" InputDevice "USBMouse" Option "SingleCard" ... EndSection</pre> Note:<br /> Only relevant settings are shown. * /etc/X11/xorg.conf of xserver-xorg (6.8.2-77, Breezy) <pre class="code">Section "InputDevice" Identifier "USBKeyboard" Option "CoreKeyboard" Driver "kbd" Option "Protocol" "evdev" Option "Dev Phys" "usb-0000:00:1d.1-2.1/input0" Option "XkbRules" "xorg" Option "XkbModel" "pc104" Option "XkbLayout" "de" ... EndSection Section "InputDevice" Identifier "USBMouse" Driver "mouse" Option "SendCoreEvents" Option "Device" "/dev/input/mouse1" Option "Protocol" "auto" Option "ZAxisMapping" "4 5" ... EndSection Section "Device" Identifier "Card0" Driver "nvidia" BusID "PCI:1:5:0" ... EndSection Section "ServerLayout" InputDevice "USBKeyboard" InputDevice "USBMouse" Option "SingleCard" ... EndSection</pre> Note:<br /> Only relevant settings are shown. <span id="gnome-desktop-manager"></span> === GNOME Desktop Manager === Change following settings in gdmrc * FirstVT=N * For standard X server command add -novtswitch -sharevts vtN, e.g. <pre class="code">FirstVT=6 # Definition of the standard X server. [server-Standard] name=Standard server command=/usr/X11R6/bin/X -br -audit 0 -novtswitch -sharevts vt6</pre> Note:<br /> N is console number assigned to corresponding seat. Add following line to gdm/PostLogin/Default to reduce guest's capabilities on login <pre class="code">/sbin/reducecap --secure --cap CAP_SYS_TTY_CONFIG /bin/true</pre> <span id="kde-desktop-manager"></span> === KDE Desktop Manager === Change following settings in kdmrc (only relevant parts are shown, leave others unchanged) * For standard X server command add -novtswitch -sharevts vtN, e.g. <pre class="code">[X-:*-Core] ServerCmd=/usr/X11R6/bin/X -br -novtswitch -sharevts vt7 TerminateServer=true</pre> Note N is console number assigned to corresponding seat. * kdm/Xsetup, add following lines to this file to reduce guest's capabilities on login <pre class="code">/sbin/reducecap --cap CAP_SYS_TTY_CONFIG /bin/true /sbin/reducecap --cap CAP_NET_ADMIN /bin/true /sbin/reducecap --cap CAP_NET_RAW /bin/true /sbin/reducecap --cap CAP_SYS_BOOT /bin/true /sbin/reducecap --cap CAP_MKNOD /bin/true /sbin/reducecap --cap CAP_QUOTACTL /bin/true</pre> Note:<br /> Due to how kdm works, Xorg must be terminated after each session and the CAP_SYS_RAWIO and CAP_SYS_ADMIN capabilities may not be reduced, This is a major security risk. I hope that kdm will address this issue in the near future. One possible workaround is to use gdm to start KDE session. <span id="future-works"></span>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information