Editing
MoreUbuntu
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
= Linux-VServer makes it possible... = [[File:http://www.13thfloor.at/~zeng/images/moreubuntu.png|moreubuntu.png]] '''M'''ultiseat '''o'''ptimized '''r'''esource '''e'''fficient Ubuntu<br /> powered by Linux-VServer. by Soewono Effendi and Mike Schneider <span id="introduction"></span> == Introduction == MoreUbuntu is an open source project to provide multiple real isolated full-feature Xorg-Desktops based on Ubuntu. The added edge compared to other multiseat-solutions is that using Linux-VServer, the different seats are isolated from each other. First announcement and public show were made at LinuxTag2006. <span id="some-background-information"></span> == Some background information == [[File:http://www.13thfloor.at/~zeng/images/ubuntu_kubuntu.jpg|ubuntu_kubuntu.jpg]] <span id="what-is-multiseat"></span> === What is Multiseat? === Many people have worked on multiseat solutions based on X11. The earliest record is from Apr 11th, 2002, a patch known as backstreet-ruby, which can be found at [1]. The same also has links to other people's efforts [2]. A very nice HowTo[[HowTo?action=edit|?]]! called "XFree Local Multi-User HOWTO" by Svetoslav Slavtchev dated back to May 13th, 2003 can be found at [3]. It was last updated on Aug 2004. Today, Xorg [4] has some new features which make it easier to setup multiseat desktops. <span id="what-is-linux-vserver"></span> === What is Linux-VServer? === Quoted from Linux-VServer Project's WIKI [5] "Linux-VServer provides virtualization for GNU/Linux systems. This is accomplished by kernel level isolation. It allows to run multiple virtual units at once. Those units are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel." Note:<br /> The term guest is used in vserver for each virtual enviroment on the host, where vserver runs. Before you try to setup multiseat desktops, please try to be acquainted with vservers as described in [7]. Please refor to [8] just in case you have trouble setting Xorg to run inside a vserver's guest. <span id="multiseat-powered-by-linux-vserver"></span> === Multiseat powered by Linux-VServer! === Nowadays hardwares are getting powerful and cheaper. For normal daily usages, like in offices, internet cafes, call centers, etc. most of the time, computers spend most of their time idling but still consume electric power, which is, sad but true, not getting cheaper despite of technology improvement. The on-going trend of online-based application, rich-client application, etc. is a very good reason why multiseat desktop s nowadays the most cost effective solution. By utilizing virtualization we can provide a secured isolated enviroment for each seat. Linux-VServer makes it possible to run secured isolated multiseat desktops, due to the fact that Linux-VServer creates almost no overhead at all. Linux-VServer, which provides not only isolated file system but also isolated processes, makes it possible to install different Linux based distributions on one computer. <span id="why-moreubuntu"></span> === Why MoreUbuntu? === Due to the fact that Ubuntu is pushing hard to bring linux to desktops, and due to the fact that there are lots of derivates of Ubuntu, like Kubuntu, Edubuntu, Xubuntu, etc., it is very nice to see that all these *buntus can run concurrently on the same computer. During LinuxTag2006 we showed Ubuntu and Kubuntu running concurrently on one computer. Also due to the fact that there exists a nice Wiki-page [6] on how to use Linux-VServer on Ubuntu with uptodate Linux-VServer packages for Ubuntu, which has helped me a lot on providing the setup shown on LinuxTag2006. <span id="requirements"></span> == Requirements == For my setup I used: * P4 2,4 GHz with 1 GByte RAM. * Ubuntu Dapper as basic distribution installed on host. * Ubuntu Breezy, Ubuntu Dapper, Kubuntu Dapper as guests. * And Linux-VServer packages for Ubuntu which can be found at (6) For each seat we need: * Graphic card (AGP, PCI, or PCI-X) * USB mouse * USB keyboard * USB hub * and optionally any other USB devices, e.g. USB audio <span id="the-setup"></span> == The setup == Assuming now you have some guests running inside you vserver, it is time to setup Xorg for each of your guest. You need to assign resources for each guest, by copying device nodes into the guests needed for your Xorg. For example device nodes of USB keyboards, and USB mice or other USB devices that you assigned to a specific guest. Some people might want to utilize udev to make their setup easier [9]. Note:<br /> The device node /dev/mem is needed for Xorg, which is, regarding to Linux-VServer, considered a security problem if you need a real secure isolated multiseat desktop. Due to the fact that user in a guest might have access to system memory, which is also use by other guests. <span id="graphic-cards-pci-agp-pci-x"></span> === Graphic cards (PCI, AGP, PCI-X) === For accelerated Xorg, specific device nodes might need to be assigned for each seat, e.g. for NVidia driver /dev/nvidia*. Use the lspci command to find out PCI BusId[[BusId?action=edit|?]] to be assigned for each Xorg-Desktop (seat). Use '''lspci -X''' to get a suitable format for use in xorg.conf. Here is some sample output of my system (only relevant lines are shown): <pre class="code"># lspci -X sh-3.00$ lspci -X PCI:0:2:0 VGA compatible controller: Intel Corp. 82915G Express Chipset Family Graphics Controller PCI:1:0:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200] PCI:1:5:0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 MX 440] PCI:1:6:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200]</pre> <span id="input-devices"></span> === Input devices === Information regarding (USB) input devices can be obtained from '''/proc/bus/input/devices'''. This information is needed for Xorg's evdev driver. Same sample output of my system (only relevant lines are shown): <pre class="code"># cat /proc/bus/input/devices ... N: Name="AT Translated Set 2 keyboard" P: Phys=isa0060/serio0/input0 S: Sysfs=/class/input/input0 H: Handlers=kbd event0 ... N: Name="ACROX Combo Mouse" P: Phys=usb-0000:00:1d.1-1.2/input0 S: Sysfs=/class/input/input2 H: Handlers=mouse0 ts0 event2 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input0 S: Sysfs=/class/input/input6 H: Handlers=kbd event6 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input1 S: Sysfs=/class/input/input7 H: Handlers=kbd event7 ... N: Name="Magic ball Mouse Magic ball Mouse" P: Phys=usb-0000:00:1d.1-2.2/input0 S: Sysfs=/class/input/input8 H: Handlers=mouse1 ts1 event8</pre> <span id="audio-devices"></span> === Audio devices === Information regarding (USB) audio devices can be obtained from '''/proc/asound/devices'''. By copying the corresponding device nodes to each guest (seat), you can assign audio devices to guest. It is recommended to rename the device nodes, as if they were for audio device zero (first audio devices), so that no special setting is needed for alsa based application to work. Also remember to copy/create related OSS device nodes, if your application is still using OSS API. <span id="capabilities"></span> === Capabilities === For security reasons, it might be desired, to reduce linux capabilities for each guest (seat). Following capabilities should be set in /etc/vservers/*/bcapabilities for each seat. Don't worry about the security now, since it is anticipated by dropping these capabilities as soon as a user logs in to Xorg-Desktop. * CAP_IPC_LOCK * CAP_IPC_OWNER * CAP_SYS_RAWIO * CAP_SYS_ADMIN * CAP_NET_ADMIN * CAP_NET_RAW * CAP_MKNOD <span id="proc-filesystem"></span> === /proc filesystem === Add following /proc entries to util-vserver/defaults/vprocunhide-files. Note: These might also be considered as a security problem. * /proc/mtrr * /proc/bus/ <span id="xorg"></span> === Xorg === New switches needed for multiseat capable Xorg * -novtswitch, don't immediately switch to new VT * -sharevts, share VTs with another X server Console and tty0 might cause problem, since many older programs are still using these device nodes. /dev/tty0 and /dev/console should be linked to /dev/ttyN assigned to corresponding seat, where N is console number, e.g. tty7 for seat1, tty8 for seat2, etc. Some Xorg sample configuration for * /etc/X11/xorg.conf of xserver-xorg (7.0.0-0ubuntu33, Dapper beta) <pre class="code">Section "InputDevice" Identifier "USBKeyboard" Driver "evdev" Option "CoreKeyboard" Option "Device" "/dev/input/event3" Option "XkbRules" "xorg" Option "XkbLayout" "de" Option "XkbModel" "evdev" Option "XkbVariant" "nodeadkeys" EndSection Section "InputDevice" Identifier "USBMouse" Driver "mouse" Option "CorePointer" Option "Device" "/dev/input/mouse3" Option "Protocol" "auto" Option "ZAxisMapping" "4 5" ... EndSection Section "Device" Identifier "Card0" Driver "nvidia" BusID "PCI:1:0:0" ... EndSection Section "ServerLayout" Identifier "Default Layout" InputDevice "USBKeyboard" InputDevice "USBMouse" Option "SingleCard" ... EndSection</pre> Note:<br /> Only relevant settings are shown. * /etc/X11/xorg.conf of xserver-xorg (6.8.2-77, Breezy) <pre class="code">Section "InputDevice" Identifier "USBKeyboard" Option "CoreKeyboard" Driver "kbd" Option "Protocol" "evdev" Option "Dev Phys" "usb-0000:00:1d.1-2.1/input0" Option "XkbRules" "xorg" Option "XkbModel" "pc104" Option "XkbLayout" "de" ... EndSection Section "InputDevice" Identifier "USBMouse" Driver "mouse" Option "SendCoreEvents" Option "Device" "/dev/input/mouse1" Option "Protocol" "auto" Option "ZAxisMapping" "4 5" ... EndSection Section "Device" Identifier "Card0" Driver "nvidia" BusID "PCI:1:5:0" ... EndSection Section "ServerLayout" InputDevice "USBKeyboard" InputDevice "USBMouse" Option "SingleCard" ... EndSection</pre> Note:<br /> Only relevant settings are shown. <span id="gnome-desktop-manager"></span> === GNOME Desktop Manager === Change following settings in gdmrc * FirstVT=N * For standard X server command add -novtswitch -sharevts vtN, e.g. <pre class="code">FirstVT=6 # Definition of the standard X server. [server-Standard] name=Standard server command=/usr/X11R6/bin/X -br -audit 0 -novtswitch -sharevts vt6</pre> Note:<br /> N is console number assigned to corresponding seat. Add following line to gdm/PostLogin/Default to reduce guest's capabilities on login <pre class="code">/sbin/reducecap --secure --cap CAP_SYS_TTY_CONFIG /bin/true</pre> <span id="kde-desktop-manager"></span> === KDE Desktop Manager === Change following settings in kdmrc (only relevant parts are shown, leave others unchanged) * For standard X server command add -novtswitch -sharevts vtN, e.g. <pre class="code">[X-:*-Core] ServerCmd=/usr/X11R6/bin/X -br -novtswitch -sharevts vt7 TerminateServer=true</pre> Note N is console number assigned to corresponding seat. * kdm/Xsetup, add following lines to this file to reduce guest's capabilities on login <pre class="code">/sbin/reducecap --cap CAP_SYS_TTY_CONFIG /bin/true /sbin/reducecap --cap CAP_NET_ADMIN /bin/true /sbin/reducecap --cap CAP_NET_RAW /bin/true /sbin/reducecap --cap CAP_SYS_BOOT /bin/true /sbin/reducecap --cap CAP_MKNOD /bin/true /sbin/reducecap --cap CAP_QUOTACTL /bin/true</pre> Note:<br /> Due to how kdm works, Xorg must be terminated after each session and the CAP_SYS_RAWIO and CAP_SYS_ADMIN capabilities may not be reduced, This is a major security risk. I hope that kdm will address this issue in the near future. One possible workaround is to use gdm to start KDE session. <span id="future-works"></span> == Future works == Some GUI tools might be provided to help setting up multiseat desktop and to help on assigned resources to seats. It might be also useful to have some remote tools to monitor status and to control each seat. <span id="credits"></span> == Credits == * Thanks go to Herbert Pötzl and all of the Linux-VServer community for the great real (not subset) open source linux virtualization software! * Also thanks go to Gerald Hochegger for providing Linux-VServer packages for Ubuntu, which saved lots of time in preparing MoreUbuntu for LinuxTag2006. * Last but not least, thanks go to derjohn for organizing the Linux-VServer booth at at http://linux-vserver.org/LinuxTag2006 (LinuxTag2006) <span id="reference"></span> == Reference == # http://www.ltn.lv/~aivils/index.php # http://www.ltn.lv/~aivils/index.php?proj_id=multiseat&menu_id=4 # http://www.tldp.org/HOWTO/XFree-Local-multi-user-HOWTO/ # http://www.freedesktop.org # http://linux-vserver.org/Linux-VServer # https://wiki.ubuntu.com/VServer # http://www2.uni-klu.ac.at/support/VServer # http://linux-vserver.org/Vservers+and+X # http://www.reactivated.net/writing_udev_rules.html # https://wiki.ubuntu.com/MoreUbuntu # http://www.13thfloor.at/~zeng/ (temporary site until MoreUbuntu finds it way back home ;) ) # http://gallery.linux-vserver.org/ (Linux-VServer at LinuxTag2006, you must see it for yourself!) </div> <div id="footer"> <div class="copyleft"> <br /> Permission is granted to copy, distribute and/or modify this document under the terms of the<br /> [http://www.fsf.org/licenses/fdl.txt GNU Free Documentation License], Version 1.2 or any later version published by the Free Software Foundation. </div> ----- <div id="toolbar-bottom"> [[MoreUbuntu?action=edit|Edit this document]] | [[MoreUbuntu?action=history|View document history]]<br /> </div> Document last modified Sun, 18 Jun 2006 07:03:14<br /> <div class="form"> <br /> Search: </div> </div>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information