[00:01] click (click@gonnamakeyou.com) joined #vserver. [00:02] urgh [00:03] ExpiryJames (~james@h24-71-63-164.ok.shawcable.net) left irc: Ping timeout: 499 seconds [00:09] ExpiryJames (~james@h24-71-63-164.ok.shawcable.net) joined #vserver. [00:13] ensc (~ircensc@ultra.csn.tu-chemnitz.de) left irc: Read error: No route to host [00:14] ensc (~ircensc@ultra.csn.tu-chemnitz.de) joined #vserver. [00:24] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) joined #vserver. [00:25] hi jes! [00:25] Hi all, I'm getting the error "Can't set the ipv4 root (Function not implemented)" when I try and start my vserver...anyone got any ideas? [00:25] Heya Bertl [00:26] http://vserver.13thfloor.at/Stuff/testme.sh [00:26] run this on the host, and let me know what it says ... [00:26] ok, one sec [00:27] ./testme.sh [00:27] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [00:27] Can't set the new security context [00:27] : Function not implemented [00:27] chcontext failed! [00:27] Can't set the ipv4 root (Function not implemented) [00:27] chbind failed! [00:27] Linux 2.6.3 x86_64/0.28/0.28 [E] [00:29] hmm, you did patch the kernel with the vserver patch? [00:29] this is with a 2.6.3 kernel on AMD64, it seems to compile fine [00:29] there didn't seem to be one for the version I downloaded [00:29] oops yes I did [00:29] sorry misread what you typed there [00:29] yeah I patched my kernel [00:30] okay, good, let me check this, brb ... [00:30] k ty [00:35] this is an issue with the tools, enrico is currently investigating which tool versions should work ... [00:35] ahhhh ok [00:35] (x86_64 has a different syscall number) [00:35] ahhh right [00:36] so the kernel patch seems to have worked, just the userspace tools need "adjusted"? [00:36] can't tell yet ;) [00:36] lol [00:37] is there anything I can do to help? [00:37] you could try 0.29.2 in the meantime ... [00:37] 0.29.1+2 should have it [00:37] thats the 0.29 tools you mean? [00:37] should my kernel be ok? [00:38] after recompile, give the testme.sh a run, then we'll see [00:38] ok, one sec [00:38] wait a sec...am I recompiling kernel or just user tools? [00:38] util-vserver 0.29 != 0.29.2 (FYI) [00:39] lol...ok I'm lost...what am I downloading? [00:39] probably the wrong file ;) sec [00:39] lol [00:40] http://www-user.tu-chemnitz.de/~ensc/util-vserver/pre/util-vserver-0.29.2.tar.bz2 [00:42] ok downloading [00:42] ok, installed [00:43] now try the script ... [00:44] ./testme.sh [00:44] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [00:44] Can't set the new security context [00:44] : Function not implemented [00:44] chcontext failed! [00:44] Can't set the ipv4 root (Function not implemented) [00:44] chbind failed! [00:44] Linux 2.6.3 x86_64/0.29.2/0.29.2 [E] [00:44] hrm .. okay, that's a bug, ... [00:44] all I had to do was run the patch against the kernel source, compile and reboot right? [00:44] no other patches after that? [00:44] yep [00:44] ok [00:44] please check with 'strace chcontext true' [00:44] is there anyway for me to check that it's compiled into the kernel ok? [00:45] want the output pasted here? [00:45] could you make it available via web? [00:45] yep, one sec [00:48] what is the patch version you used for that kernel? [00:48] http://www.daedalus-solutions.co.uk/jes/output.txt [00:48] http://www.13thfloor.at/vserver/e_patches/vs-26x/patch-2.6.3-vs0.09.diff [00:48] seemed to apply fine [00:48] no errors [00:48] it's supposed to apply fine ;) [00:48] enrico? syscall_273(0xffffffffffffffff, 0, 0, 0x20d10, 0x5032f0, 0x20d11, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8, 0xbffff7c8) = -1 (errno 38) [01:38] loger joined #vserver. [01:38] is there a possibility to mount the /proc of the host system into a vserver or is this no good idea due to security issues ? [01:38] hi Cyrix! [01:38] the proc is normally mounted inside a vserver [01:39] jes: I'm stupid ... you have to edit the following file: [01:39] include/asm-x86_64/unistd.h [01:40] (search for the following line:) [01:40] __SYSCALL(__NR_vserver, sys_ni_syscall) [01:40] thats from the tools root dir? [01:40] not the kernel source? [01:40] and change the sys_ni_syscall to sys_vserver [01:40] in the kernel source [01:40] ok [01:40] ok found that line [01:40] Cyrix: but you have the proc security feature to make only certain proc entries visible inside a vserverf [01:41] ok, recompile kernel, switch and reboot? [01:42] are you sure Bertl? then I'm confused why phpSysInfo is unable to show me any infos [01:42] probably because you have the security feature enabled ;) [01:42] (for 1.3.x and vs0.09 it's enabled as default) [01:42] is this security enabled by default ? [01:42] 23:43 < Bertl> (for 1.3.x and vs0.09 it's enabled as default) [01:45] um....i only have 1.24 as you should remember [01:45] ok, rebooting again [01:45] if I would remember every person's vserver version, I would require a brain the size of an elephant ... (or an elephant ;) [01:45] lol@Bertl [01:45] okay 1.24 has this but it is disabled by default ... [01:45] I always go for the latest version, I like the papercuts you get from being on the bleeding edge ;) [01:45] Cyrix: what was the reason for 'only' 1.24 again? [01:46] it was simply the latest stable version the last time i had enough time to compile myself a new kernel :) [01:46] jes: you'll now get some funny syscall logging ... but that shouldn't hurt too much .. think of it as vserver internal information exposed ;) [01:46] lol [01:47] ok, I'm back in again [01:47] try the chcontext again? [01:47] yup [01:47] [root@cerberus root]# chcontext --ctx 100 true [01:47] New security context is 100 [01:47] woohoo! [01:47] Cyrix: what does chcontext --ctx 100 ls /proc show? [01:47] I take it thats a good sign Bertl? [01:47] jes: now test the testme.sh ... [01:47] [root@cerberus tmp]# ./testme.sh [01:47] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [01:47] chcontext is working. [01:47] chbind is working. [01:47] Linux 2.6.3 x86_64/0.29.2/0.29.2 [E] [01:47] --- [04:17] loger joined #vserver. [04:19] ensc (~ircensc@ultra.csn.tu-chemnitz.de) joined #vserver. [04:25] serving (~serving@213.186.190.121) joined #vserver. [04:42] ben (~ben@bengrimm-host225.dsl.visi.com) left irc: Ping timeout: 480 seconds [05:02] Nick change: cdub -> cgone [06:07] cool! solaris zones is in the new solaris express release. you guys might be interested in it as its very similar to vserver [06:07] http://www.sun.com/bigadmin/content/zones/ [06:07] Action: talon_afk runs off to install the new solaris 10 beta [06:21] that's very cool [06:21] not much demand for solaris though [06:25] matta: theres plenty of big shops that use solaris. and i know people will love this. i also plan to make my product support both vserver and zones. [06:26] since i plan to sell a solaris version. [06:26] you're just making a front end? [06:26] heh [06:26] more of a configuration libary with a default front en don it but yeah. [06:26] i guess i could make my CP easily converted to this also [06:27] the web interface just calls a bunch of backend scripts (ie. addvps) [06:27] so different addvps for each system [06:27] only problem is the options [06:27] different options for each system [06:27] ive been planning to make mine portable for a while now. im just glad i actually have zones to develop with in paralel now. [06:31] basicly what im working on is a linux distro based around vserver with a cobalt like configuration interface built around a portable and documented perl library. that web,menu and command line tools are built around. and i plan on selling the config interface for solaris and possibly freebsd in the future. hopefulyl if its good enough maybe sun will ship it with thier low end 1U rackmount solaris boxes. [06:37] i know a few cobalt guys at sun, and ive been working on this since i got news they were killing off the cobalt. [10:09] Nick change: Mcleod[Zzz] -> Mcleod [10:44] Nick change: Bertl_zZ -> Bertl [10:44] morning everyone, anything urgent? [10:45] Bertl: nothign urgent, but you asked a whiel ago how solaris zones compares to vserver. you can look at the specs at http://www.sun.com/bigadmin/content/zones/ [10:46] might give you some ideas. [10:46] hmm, okay, probably you already did, right? so what are the advantages over vserver? [10:47] morning? [10:47] i guess it's like 3am [10:47] oh, you r what, 5 hours ahead? [10:48] always ;) [10:48] im still looking at it but basicly, it has full virtualization of network devices. resource limits on everything that are dynamicaly reconfigurable and can be automatically reallocated to other zones as utilization changes. [10:49] you can moutn NFS shares inside zones and they are only visible to that zone. (ie you cant even see it in the gobal zone IE ctx0) [10:49] hmm, the nfs? part is also in vs0.09 ;) [10:50] the pdf describes it in more detail and im still going through it. if anythign the admin tools might be intresting. [10:50] getting ready to create a few zones on a test box i set up an hour ago. [10:51] going to try quotas on it :) [10:51] ic ... [10:51] okay, let me know what you find out ... [10:51] wonder what the scalability is like [10:51] you can have 8192 zones max on a machine. [10:51] seems it'd be comparable to vserver [10:52] sounds like it virtualizes the kernel [10:52] how many you can run effectivly depends on the resource footprint of each zone and the hardware resources. [10:52] matta: yeah, at least thats what the docs say. [10:52] stupid pdf can't be read under xpdf [10:53] Bertl: whast the upper limit on contexts? just curious. [10:54] processes in zones will be unable to control [10:54] global aspects of the system configuration such as run level, most [10:54] physical devices, and network routing tables. [10:54] i know the bs is 1 and all.. [10:54] talon_afk: basically 49151 for the static and 16383 for dynamic [10:54] [root@uml11 home]# time dd if=/dev/zero of=testfile bs=1 count=3G [10:54] 92348255+0 records in [10:54] 92348254+0 records out [10:54] real 4m40.611s [10:54] user 0m32.254s [10:54] sys 4m8.248s [10:55] doesn't that seem a bit slow [10:55] Nick change: talon_afk -> talon [10:55] hrm, i guess it makes sense the small block size would kill it [10:55] Bertl: oh yeah it also looks like teh capability system they put ontop of solaris is a bit more fine tuned to teh job than the linux capability system. [10:55] read write at one byte ... [10:56] speaking of which [10:56] talon: we are currently addressing this ;) [10:56] Bertl: i hope they both end up compraable. sinc ei plan to make equal use of both. [10:57] i will certanly help any way i can. [10:57] has any work actually been done on that? [10:57] did you see my wish list herbert? :) [10:58] hmm, actually no ... [10:58] 22:25 struct vcmd_ctx_caps_v0 { [10:58] 22:25 uint64_t scaps; [10:58] 22:25 uint64_t ccaps; [10:58] 22:25 uint64_t cmask; [10:58] 22:25 }; [10:58] matta: where is your wishlist? [10:58] http://www.tektonic.net/public/vserver_hosting_req.txt [10:58] didn't see anything on the ml? [10:58] lol good luck! [10:59] yes, i know first 4 are essentially done [10:59] Ability to change hostname [10:59] done [10:59] done? [10:59] sure, since a long time ... [10:59] that's a major one honestly [10:59] uhm [10:59] i mean from within vserver [10:59] during runtime [10:59] try with 1.3.x or vs0.09, just use hostname [11:00] really? [11:00] nice [11:00] you would not believe how many people [11:00] e-mailed me [11:00] actually from the testme.sh one test checks this ;) [11:00] balking that I gave them root access [11:00] and that when they try to run hostname it says they must be root [11:00] and they get all snotty [11:00] that's why I put that in there :) [11:00] probably you need a cap for that too ... [11:00] CAP_NET_ADMIN I bet... [11:00] which isn't very safe [11:01] this is why we are addressing those issues ... [11:01] i might just enable CAP_SYS_RESOURCE [11:01] Sub-capabilities - More specifically named needs to be able to run wit [11:01] for named [11:01] not only for named for many other -d [11:01] remember, the list is for hosting [11:01] Virtualized /proc/mounts [11:01] done [11:01] hrm [11:02] i know you have the patch for no /proc/mounts [11:02] and private namespace [11:02] yeah, private namespace includes that [11:02] but does private namespace virtualize /proc/mounts ? [11:02] yes [11:02] ok [11:02] that explains it then [11:02] only thing is sub-capabilites and iptables and then throw it all together [11:02] but sure a nice list, could you post it on the mailing list? [11:03] i guess iptables isn't really required [11:03] maybe with a request to comment on it ... [11:03] and bind can be gotten around with CAP_SYS_RESOURCE [11:03] I'd like to see the community priorities on that ... [11:03] ok [11:04] okay, have to go now, will be back in 1-2 hours ... [11:04] talon, matta cu [11:04] Nick change: Bertl -> Bertl_oO [11:04] Bertl: bye. [11:05] hope you find the pdf interesting. [11:08] ben- (ben@bengrimm-host229.dsl.visi.com) left irc: Read error: Connection reset by peer [11:11] ok [11:11] it's sent [11:12] Action: talon goes back to sleep after reading a bit more. [11:13] had some more work fall into my lap, hope to have some mroe howto stuff done around monday. [11:30] AHTOH (~Anton@212.1.230.115) joined #vserver. [11:30] hi ppl [11:56] rs (rs@ice.aspic.com) joined #vserver. [11:57] hello [12:50] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) joined #vserver. [12:50] morning all [12:58] Nick change: Bertl_oO -> Bertl [12:58] hi everyone! [12:59] kestrel (~athomas@syd-h43C.adsl.AlwaysONLINE.net.au) joined #vserver. [12:59] hello [13:00] hi alec! [13:00] hey herbert, how are you? [13:00] fine thanks, how are you? [13:01] ooh. [13:01] *yawn* [13:01] <-- dead tired [13:02] 24 hrs up agaaaain. [13:02] fucking idiots that doesn't show up on time [13:02] can't close the club when I don't have the key. [13:04] hmm ... [13:05] jh hi bertl [13:05] jes: I ahve some ideas what to try .. you wanna test? [13:05] hi Anton! [13:06] hi i have couple quesyion [13:06] let's hear ... [13:06] 1st -- how can i write 2 ips in old conf file [13:07] IP_ROOT="192.168.0.1 192.168.0.2" [13:07] Heya Bertl [13:07] sorry was AFK [13:08] sure..Bertl! [13:08] and is it ok if they are in different interfaces on host? [13:08] and different network of course [13:08] ensc came up with a change last night to change the int declaration to long for sys_vserver [13:09] extern asmlinkage long [13:09] sys_vserver(uint32_t cmd, uint32_t id, void *data) [13:09] but running the test script now gives some failures [13:11] brb...just grabbing a coffee [13:12] ok [13:12] Anton: yes just use "eth0:192.168.0.1/24 eth1:192.168.1.1/24" [13:13] ok i see [13:13] another question is about proc [13:13] i am fixing proc problem using your vproc /proc/* /proc/*/* [13:13] but does that makes /proc/mtab readable for virtuals? [13:14] ok back [13:14] Anton /proc/mounts if you are referring to that, isn't affected/controlled by the vproc security ... [13:14] dont we have any security holes via proc? [13:15] yes, we have, that is why the rpoc security was introduced ... [13:15] s/rpoc/proc/ [13:16] jes: while the general idea was okay (enricos) the cause is somewhere else ... [13:16] how was it introduced and how dhoul i use it [13:16] ahhh ok [13:16] i use 1.3.7 + 0.29 [13:17] well Bertl...if you have anything else to try, I have a spare few hours ;) [13:17] okay [13:17] Anton, what do you mean by introduced? [13:18] http://www.linux-vserver.org/index.php?page=ChangeLog [13:18] Bertl, should I revert the int/long change I made last night? the test script now gives - [13:18] (this is the history) [13:18] [root@cerberus tmp]# ./testme.sh [13:18] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [13:18] chcontext is working. [13:18] chbind is working. [13:18] Linux 2.6.3 x86_64/0.29.2/0.29.2 [E] [13:18] --- [13:18] [001]# succeeded. [13:18] [011]# succeeded. [13:18] [031]# failed. [13:18] [101]# succeeded. [13:18] [102]# succeeded. [13:18] [201]# succeeded. [13:18] [202]# failed. [13:18] yes, we have, that is why the rpoc security was introduced ... [13:19] you said about introduces [13:19] oaky [13:20] http://archives.linux-vserver.org/200401/0125.html [13:20] (have a look at that) [13:20] jes, could you explain me the changes you and enrico did? [13:20] ok thnx will look firstly [13:21] but what about wriring to proc? [13:21] writing [13:21] Bertl: in kernel/vserver/switch.c changed the following extern asmlinkage int [13:21] sys_vserver(uint32_t cmd, uint32_t id, void *data) [13:21] where there is no entry, it can't be written to ... [13:21] to extern asmlinkage long [13:21] sys_vserver(uint32_t cmd, uint32_t id, void *data) [13:21] okay, yes that is necessary and useful ... [13:21] i.e, changed the "extern asmlinkage" bit [13:24] and that was it Bertl [13:24] good, I'll fix up the rest, and make a patch available ... [13:24] ok...anything you'd like me to test out? [13:25] not atm, but in a few minutes ... [13:25] *nods* [13:34] [HvD] (~guess@62.99.252.14) joined #vserver. [13:34] <[HvD]> marc ? [13:35] hmm, would a bertl do in the meantime? [13:36] surriel (~riel@imladris.surriel.com) left irc: Ping timeout: 480 seconds [13:36] lol [13:49] loger joined #vserver. [13:52] surriel (~riel@imladris.surriel.com) joined #vserver. [13:59] I like this channel, you have a flurry of activity followed by long gaps to get a few cups of coffee in ;) [13:59] does a vserver copy works in 29.196? [14:03] stubbsd (~stubbsd@217.206.216.194) joined #vserver. [14:03] surriel (~riel@imladris.surriel.com) left irc: Ping timeout: 485 seconds [14:03] Anton: you have to ask enrico about that (ensc) [14:07] <[HvD]> nop sorry .. wrong window .. ;-) [14:07] <[HvD]> bertl wont release wolk ;-) [14:08] jes: http://vserver.13thfloor.at/Experimental/delta-2.6.3-vs0.09-vs0.09.3.diff [14:08] please give it a try, I'm out for lunch now ... will be back soon [14:08] Nick change: Bertl -> Bertl_oO [14:10] sorry Bertl, was AFK [14:11] Bertl, do I apply that to a clean kernel, or can I apply it to mine "as-is"? [14:11] ahhh ok, catch you after lunch [14:15] patching file kernel/vserver/switch.c [14:15] Hunk #1 FAILED at 30. [14:15] 1 out of 1 hunk FAILED -- saving rejects to file kernel/vserver/switch.c.rej [14:19] ok, patched that file manually [14:25] [root@cerberus tmp]# ./testme.sh [14:25] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [14:25] chcontext is working. [14:25] chbind is working. [14:25] Linux 2.6.3 x86_64/0.29.2/0.29.2 [E] [14:25] --- [14:25] [001]# succeeded. [14:25] [011]# succeeded. [14:25] [031]# failed. [14:25] [101]# succeeded. [14:26] [102]# succeeded. [14:26] [201]# succeeded. [14:26] [202]# failed. [14:26] ok...give me a shout when you need to bang your head against the wall again Bertl ;) [14:31] stubbsd (~stubbsd@217.206.216.194) got netsplit. [14:31] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) got netsplit. [14:31] serving (~serving@213.186.190.121) got netsplit. [14:31] talon (talon@host-63-149-223-100.irwinresearch.com) got netsplit. [14:31] mcp (~hightower@wolk-project.de) got netsplit. [14:32] stubbsd (~stubbsd@217.206.216.194) returned to #vserver. [14:32] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) returned to #vserver. [14:32] serving (~serving@213.186.190.121) returned to #vserver. [14:32] talon (talon@host-63-149-223-100.irwinresearch.com) returned to #vserver. [14:32] mcp (~hightower@wolk-project.de) returned to #vserver. [14:32] #vserver: mode change '+o mcp' by ChanServ!services@services.oftc.net [14:35] surriel (~riel@imladris.surriel.com) joined #vserver. [14:42] bengrimm (~ben@bengrimm-host225.dsl.visi.com) joined #vserver. [15:09] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) left irc: Remote host closed the connection [15:18] Nick change: Bertl_oO -> Bertl [15:19] jes (~jes@cpc1-leed5-3-0-cust196.ldst.cable.ntl.com) joined #vserver. [15:19] bah, damn ISP [15:19] jes? [15:19] ah oaky ... [15:19] yep Bertl, sorry got disconnected [15:20] that patch is against the vs0.09 [15:20] bengrimm (~ben@bengrimm-host225.dsl.visi.com) left irc: Read error: Connection reset by peer [15:20] so you ahve to get 2.6.3, then patch vs0.09 then the 0.09.3 patch [15:20] thats what I did [15:20] and you got a reject? [15:21] yes [15:21] that is very unlikely .. but let me verify that ... [15:21] ok, let me try again to make sure I didn't screw up [15:22] bengrimm (~ben@bengrimm-host225.dsl.visi.com) joined #vserver. [15:22] mcp (~hightower@wolk-project.de) left irc: Ping timeout: 485 seconds [15:22] [root@cerberus linux-2.6.3]# patch -p1 < delta-2.6.3-vs0.09-vs0.09.3.diff [15:22] patching file arch/arm/kernel/ecard.c [15:22] patching file arch/mips/kernel/linux32.c [15:22] patching file arch/parisc/kernel/sys_parisc32.c [15:22] patching file arch/ppc64/kernel/sys_ppc32.c [15:22] patching file arch/s390/kernel/compat_linux.c [15:22] patching file arch/sparc64/kernel/sys_sparc32.c [15:22] patching file include/asm-x86_64/unistd.h [15:22] patching file include/linux/vserver/context.h [15:22] mcp (~hightower@wolk-project.de) joined #vserver. [15:22] patching file include/linux/vserver/legacy.h [15:22] patching file include/linux/vserver/namespace.h [15:22] patching file include/linux/vserver/switch.h [15:22] patching file kernel/sys.c [15:22] patching file kernel/vserver/Makefile [15:22] patching file kernel/vserver/context.c [15:22] patching file kernel/vserver/namespace.c [15:22] patching file kernel/vserver/switch.c [15:23] Hunk #1 FAILED at 30. [15:23] 1 out of 1 hunk FAILED -- saving rejects to file kernel/vserver/switch.c.rej [15:23] ahhhh no....I know what it is [15:23] hmm? [15:23] last night I modified the patch script when Enrico suggested changing the int to a long [15:23] doh! [15:24] AHTOH (~Anton@212.1.230.115) left #vserver (Client exiting). [15:24] hmm, okay, shouldn't make a difference, though ... [15:24] *nods* [15:24] I would ask you to do the testme.sh again with -vv option (2x v) and make the output available somewhere on the web ... [15:24] ok...one sec [15:25] Nick change: bengrimm -> ben- [15:25] hi ben! [15:25]