Subject: Re: [vserver] Any chance of an update to the hardened patch?
From: Ed W <lists@wildgooses.com>
Date: Tue, 07 Jul 2009 13:21:14 +0100
Tue, 07 Jul 2009 13:21:14 +0100
Daniel Hokka Zakrisson wrote:
> Ed W wrote:
>   
>> I'm trying the latest hardened patch listed on the front page (2.6.29.2)
>>
>> Problems I'm seeing are that:
>>
>> - hostname is no longer virtualised - whichever vserver is booted last
>> sets the hostname for the host and all vservers
>>     
>
> Too old utils, upgrade to util-vserver-0.30.216+.
>
>   

Is there a guide as to how new I can go for a given kernel/patch version?

Any suggestion as to why I am getting a completely broken setup by going 
to the latest version of util-vserver (0.30.216_pre2841)?  Could it be 
related to either glibc 2.9 or a 64 bit build or my hardened toolchain?

Also any tips on debugging, eg how to use gdb with the vserver shell script?

eg:

linux-2.6.29.5-vs2.3.0.36.14 # vserver www2 enter
vcontext: pivot_root(): Invalid argument


What does this indicate?  I added some debug statements and it gives 
this as the command line:

/usr/bin/ionice -c2 -n0 /usr/bin/nice -n 0 /usr/sbin/chbind --silent 
--secure --nid 5206 --ip 192.168.105.206/24 
/usr/lib64/util-vserver/exec-ulimit /etc/vservers/www2/ulimits 
/usr/sbin/vspace --enter 5206 --default -- /usr/sbin/vtag --migrate 
--tag 5206 --silent -- /usr/sbin/vcontext --silent --migrate 
--pivot-root --xid 5206 --uid 0 --vlogin -- /bin/bash -login


I'm struggling to get a good coredump (or perhaps just not using the one 
I have got correctly?  I will email it privately?)

I try:

# vserver www1 start

and at the end of the bootup it gives:
/usr/sbin/chbind: line 135: 23320 Segmentation fault      (core dumped) 
"${create_cmd[@]}" "${chain_cmd[@]}" -- "$@"

I naively try the following:
# gdb /usr/sbin/chbind /vservers/images/www1/core

and get:
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu"...
"/usr/sbin/chbind": not in executable format: File format not recognized
(no debugging symbols found)
Core was generated by `/usr/sbin/vspace --new --default -- 
/usr/sbin/vcontext --create --silent --xid'.
Program terminated with signal 11, Segmentation fault.
[New process 23320]
#0  0x000000000040089c in ?? ()
(gdb) thread apply all bt full

Thread 1 (process 23320):
#0  0x000000000040089c in ?? ()
No symbol table info available.
#1  0x0f0000000fc0c748 in ?? ()
No symbol table info available.
#2  0x0000000000000000 in ?? ()
No symbol table info available.



Anyone got any advice? 

Thanks

Ed W


Daniel Hokka Zakrisson wrote:
Ed W wrote:
  
I'm trying the latest hardened patch listed on the front page (2.6.29.2)

Problems I'm seeing are that:

- hostname is no longer virtualised - whichever vserver is booted last
sets the hostname for the host and all vservers
    

Too old utils, upgrade to util-vserver-0.30.216+.

  

Is there a guide as to how new I can go for a given kernel/patch version?

Any suggestion as to why I am getting a completely broken setup by going to the latest version of util-vserver (0.30.216_pre2841)?  Could it be related to either glibc 2.9 or a 64 bit build or my hardened toolchain?

Also any tips on debugging, eg how to use gdb with the vserver shell script?

eg:

linux-2.6.29.5-vs2.3.0.36.14 # vserver www2 enter
vcontext: pivot_root(): Invalid argument


What does this indicate?  I added some debug statements and it gives this as the command line:

/usr/bin/ionice -c2 -n0 /usr/bin/nice -n 0 /usr/sbin/chbind --silent --secure --nid 5206 --ip 192.168.105.206/24 /usr/lib64/util-vserver/exec-ulimit /etc/vservers/www2/ulimits /usr/sbin/vspace --enter 5206 --default -- /usr/sbin/vtag --migrate --tag 5206 --silent -- /usr/sbin/vcontext --silent --migrate --pivot-root --xid 5206 --uid 0 --vlogin -- /bin/bash -login


I'm struggling to get a good coredump (or perhaps just not using the one I have got correctly?  I will email it privately?)

I try:

# vserver www1 start

and at the end of the bootup it gives:
/usr/sbin/chbind: line 135: 23320 Segmentation fault      (core dumped) "${create_cmd[@]}" "${chain_cmd[@]}" -- "$@"

I naively try the following:
# gdb /usr/sbin/chbind /vservers/images/www1/core

and get:
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu"...
"/usr/sbin/chbind": not in executable format: File format not recognized
(no debugging symbols found)
Core was generated by `/usr/sbin/vspace --new --default -- /usr/sbin/vcontext --create --silent --xid'.
Program terminated with signal 11, Segmentation fault.
[New process 23320]
#0  0x000000000040089c in ?? ()
(gdb) thread apply all bt full

Thread 1 (process 23320):
#0  0x000000000040089c in ?? ()
No symbol table info available.
#1  0x0f0000000fc0c748 in ?? ()
No symbol table info available.
#2  0x0000000000000000 in ?? ()
No symbol table info available.



Anyone got any advice? 

Thanks

Ed W