On Fri, Mar 26, 2010 at 03:14:15PM +0200, Romberg Christo wrote: > Thank you for your hospitality! > I've installed X on the host-system for testing purposes, and I was > able to successfully get 'X' and 'gdm' running on the host with great > graphics. I also ran 'X -configure' to get a tailor-made xorg.conf > for the hardware. And I copied the new xorg.conf over to the guest to > replace the existing xorg.conf on there, but still it doesn't work - > same problems as earlier. > I have an Intel 82865G Integrated Graphics Controller that's located > at PCI:0:2:0. So "Device" section in xorg.conf now looks like this > (only relevant parts..): > Driver "intel" > BusID "PCI:0:2:0" > However, this does not work in the guest. If I try, I soon get this > error message on the screen (as earlier): > "(EE) No devices detected. > Fatal server error: > no screens found" > So I have to use the VGA driver for X to start, and I need to comment > out the BusID option: > Driver "vga" > #BusID "PCI:0:2:0 > However, VGA is not an option for the graphics - I can't even start > 'gdm', the login-screen just flashes a second and then bails out. So > the intel driver is a must.. > So... > I've traced 'startx' on host- and the guest-system with 'strace...' > and I've come to the conclusion that the PCI devices aren't detected > at all in the guest. If I run 'Xorg -scanpci' in the guest I get: > "No PCI info available" > ...though if I run it in the host system I get a long list of devices. > If I search in the Xorg.0.log, I see: > "(WW) OS did not count PCI devices, guessing wildly" > Now, how come? Is it unable to find PCI devices or why does it not > count them? On the same spot in the host-systems Xorg.0.log I see: > "(II) PCI: PCI scan (all values are in hex)" > In lack of better ideas, I've even copied all files from host /dev to > guest (from my host: /etc/vservers/[vservername]/~vdir/dev), but no > success. I've even tried copying /sys and /proc, but with errors. I've > also copied and replaced the /lib and /usr (the latter with errors). > I've done all things that are stated on these pages: > http://oldwiki.linux-vserver.org/MoreUbuntu > http://oldwiki.linux-vserver.org/Vservers+and+X > (in the "Running an X server inside a vserver" section) > Maybe I need to dive in to the strace in more detail, or do you have > any thoughts on why the PCI devices aren't detected? my guess would be that you haven't made /proc/bus/pci visible inside the guest(s) yet and it is hidden by default (see vprocunhide for details) > I appreciate your help, thank you so much! best, Herbert PS: a visit to the IRC channel might speed up things significantly because of the much better interactivity :) > PS: grsecurity looks interesting, and I will certainly give it a > spin if I can't get Vserver to work with this configuration. I'm not > familiar with "MAC systems" nor Gentoo with a hardened profile, but > they both seems interesting. > -----Original Message----- > From: Ed W [mailto:lists@wildgooses.com] > Sent: den 25 mars 2010 15:40 > To: vserver@list.linux-vserver.org > Subject: Re: [vserver] Howto configure graphic card in a guest/Xorg-server configuration > > On 25/03/2010 07:59, Romberg Christo wrote: > > > >> you probably need to copy any devices the userspace > >> driver part (from xorg) uses when setting up the > >> graphics card into the guest > >> > > Where should these devices be located in the filesystem? > > > > > vservers are basically just a fancy chroot, so when you are in a guest > then what you think is /dev is really /vserver/guest/dev - hence > populate that directory with whatever your software tries to access. > Remember that unix is about making everything look like a file, but > really you are talking to some hardware in the case of these special > files - so essentially you are copying the interface to the device into > the chroot > > Good luck > > Ed W > > P.S. You might as well/instead consider looking at grsecurity or > similar - I seem to remember you needed to give the guest more > permissions than you want (ie could escape the chroot) in order to make > X work. A complementary lock down technique is a MAC system (eg > grsec/selinux, etc). Personally I never got my head around selinux, but > grsec is straightforward and likely you will already be using the other > pax patches on your kernel so it's kind of there for free? Also look at > the Suse MAC stuff (whatever it's called? app armour?) and I saw another > new idea in some new distro recently - some of these are even simpler to > configure than grsec > > P.P.S. If you really want your tinfoil hat on then switch to gentoo and > turn on the hardened profile. I use this on all my servers and whilst > it will require a far greater understanding of linux to build and > initially setup, *if* you have this level of understanding then you gain > a great amount of flexibility and also you can lock the box down to a > much greater degree. Lots of other benefits to gentoo over <generic > distro>, but the basic tradeoff will remain that it requires more > knowhow to build...