Subject: Re: [vserver] dietlibc and util-vserver
From:Sandino Araico Sánchez <sandino@sandino.net>
Date: Wed, 6 Dec 2017 12:23:51 -0600
Wed, 6 Dec 2017 12:23:51 -0600
On 04/12/17 02:29, Tor Rune Skoglund wrote:
> Hi list,
>
> I wonder if it is possible for util-vserver to work with glibc instead
> of relying on dietlibc? It seems that dietlibc is fairly unmaintained
> latest years, and the current ebuild for it fails on gcc-6.4.0 on
> Gentoo. (Have not investigated root causes yet.)
>
> On my system, the only package that depends on dietlibc is currently
> util-vserver. What are the pros/cons of this dependency?
>
> BR,
> Tor Rune Skoglund
>
it's explained in this thread:

http://archives.linux-vserver.org/201112/0045.html

http://archives.linux-vserver.org/201112/0046.html


On 19/12/11 08:02, Herbert Poetzl wrote:
> On Mon, Dec 19, 2011 at 04:33:55PM +1100, Steve Kieu wrote:
>> Hello,
>> the version is util-vserver-0.30.216.pre2986 build on centos6 system
> the question which comes to my mind here is: why the hell
> would you build an old version of util-vserver?
>
>> When I ran configure I got
>> configure:10369: WARNING: *** it is strongly recommended to link
>> util-vserver against ***
>> configure:10371: WARNING: *** dietlibc;  glibc's NSS functions are very
>> unreliable in ***
>> configure:10373: WARNING: *** chroot() environments,  so you have to
>>  expect problems ***
>> configure:10375: WARNING: *** there.
>> I am not quite clear what is the use of dietlibc in the
>> picture. If I use tools without linking to dietlibc what
>> damage/disadvantages I will have?
> dietlibc isn't just used to replace glibc, it is used to
> build static binaries which are actually 'static'
> note that glibc cannot build self contained binaries
> anymore, even if you build them 'statically' they will
> dynamically load resolver libraries, which in the case
> of guest management might be from the host or from the
> guest
>
>> I suppose after vserver <NAME> start - the vserver environment
>> is using normal libc under its root dir /lib/ rather than
>> dietglibc?
> correct, but anytime you start or enter the guest, you
> have a certain chance that the host will execute some
> code from the guest system (nss) which in turn gives
> guest root a good chance to do evil things on the host
> and even if security is not a concern in your case, you
> might end up with unexpected failures
>
>> Or just all commands I start using vnamespace for example will
>> be affected?
>> Should I download dietlibc somewhere and install it ?
> first, your distro should provide dietlibc as package
> (basically all known distros do) and if that isn't the
> case, yes, you better download dietlibc, build and 
> install it, unless you want to have issues with the
> tools ...
>
> best,
> Herbert
>
>> many thanks in advance
>> -- 
>> Steve Kieu

-- 
Sandino Araico Sánchez 
http://sandino.net



On 04/12/17 02:29, Tor Rune Skoglund wrote:
Hi list,

I wonder if it is possible for util-vserver to work with glibc instead
of relying on dietlibc? It seems that dietlibc is fairly unmaintained
latest years, and the current ebuild for it fails on gcc-6.4.0 on
Gentoo. (Have not investigated root causes yet.)

On my system, the only package that depends on dietlibc is currently
util-vserver. What are the pros/cons of this dependency?

BR,
Tor Rune Skoglund

it's explained in this thread:

http://archives.linux-vserver.org/201112/0045.html

http://archives.linux-vserver.org/201112/0046.html


On 19/12/11 08:02, Herbert Poetzl wrote:
On Mon, Dec 19, 2011 at 04:33:55PM +1100, Steve Kieu wrote:
Hello,
the version is util-vserver-0.30.216.pre2986 build on centos6 system
the question which comes to my mind here is: why the hell
would you build an old version of util-vserver?

When I ran configure I got
configure:10369: WARNING: *** it is strongly recommended to link
util-vserver against ***
configure:10371: WARNING: *** dietlibc;  glibc's NSS functions are very
unreliable in ***
configure:10373: WARNING: *** chroot() environments,  so you have to
 expect problems ***
configure:10375: WARNING: *** there.
I am not quite clear what is the use of dietlibc in the
picture. If I use tools without linking to dietlibc what
damage/disadvantages I will have?
dietlibc isn't just used to replace glibc, it is used to
build static binaries which are actually 'static'
note that glibc cannot build self contained binaries
anymore, even if you build them 'statically' they will
dynamically load resolver libraries, which in the case
of guest management might be from the host or from the
guest

I suppose after vserver <NAME> start - the vserver environment
is using normal libc under its root dir /lib/ rather than
dietglibc?
correct, but anytime you start or enter the guest, you
have a certain chance that the host will execute some
code from the guest system (nss) which in turn gives
guest root a good chance to do evil things on the host
and even if security is not a concern in your case, you
might end up with unexpected failures

Or just all commands I start using vnamespace for example will
be affected?
Should I download dietlibc somewhere and install it ?
first, your distro should provide dietlibc as package
(basically all known distros do) and if that isn't the
case, yes, you better download dietlibc, build and 
install it, unless you want to have issues with the
tools ...

best,
Herbert

many thanks in advance

      
-- 
Steve Kieu
-- 
Sandino Araico Sánchez 
http://sandino.net