Installation on Debian
This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.
If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25
The packages required by Linux-VServer are:
- linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
- util-vserver - These are the utilities used to administer the guests
- ssh - This is probably already installed, but just in case it isn't
All the packages you need can be obtained via
aptitude install linux-image-vserver-686 util-vserver ssh
so run this as root and reboot. To check out wherever everything went fine you may run
and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.
Now that the host system is ready, you can proceed with building guests.
Debian already contains vservers kernels, so no manual patching and compiling is needed.
|Debian release||Kernel version||VServer version|
Issues with the current 2.6.26 Kernel
Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. This creates a considerable security issues for anyone who:
- has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
- has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
- has unified guests (such as created by vhashify).
In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situations above.
fixing the problem
As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see these instructions. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel.
For more details and a more concise explanation see Bertls IRC explanation
- Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch