On 04/12/17 02:29, Tor Rune Skoglund wrote: > Hi list, > > I wonder if it is possible for util-vserver to work with glibc instead > of relying on dietlibc? It seems that dietlibc is fairly unmaintained > latest years, and the current ebuild for it fails on gcc-6.4.0 on > Gentoo. (Have not investigated root causes yet.) > > On my system, the only package that depends on dietlibc is currently > util-vserver. What are the pros/cons of this dependency? > > BR, > Tor Rune Skoglund > it's explained in this thread: http://archives.linux-vserver.org/201112/0045.html http://archives.linux-vserver.org/201112/0046.html On 19/12/11 08:02, Herbert Poetzl wrote: > On Mon, Dec 19, 2011 at 04:33:55PM +1100, Steve Kieu wrote: >> Hello, >> the version is util-vserver-0.30.216.pre2986 build on centos6 system > the question which comes to my mind here is: why the hell > would you build an old version of util-vserver? > >> When I ran configure I got >> configure:10369: WARNING: *** it is strongly recommended to link >> util-vserver against *** >> configure:10371: WARNING: *** dietlibc; glibc's NSS functions are very >> unreliable in *** >> configure:10373: WARNING: *** chroot() environments, so you have to >> expect problems *** >> configure:10375: WARNING: *** there. >> I am not quite clear what is the use of dietlibc in the >> picture. If I use tools without linking to dietlibc what >> damage/disadvantages I will have? > dietlibc isn't just used to replace glibc, it is used to > build static binaries which are actually 'static' > note that glibc cannot build self contained binaries > anymore, even if you build them 'statically' they will > dynamically load resolver libraries, which in the case > of guest management might be from the host or from the > guest > >> I suppose after vserver <NAME> start - the vserver environment >> is using normal libc under its root dir /lib/ rather than >> dietglibc? > correct, but anytime you start or enter the guest, you > have a certain chance that the host will execute some > code from the guest system (nss) which in turn gives > guest root a good chance to do evil things on the host > and even if security is not a concern in your case, you > might end up with unexpected failures > >> Or just all commands I start using vnamespace for example will >> be affected? >> Should I download dietlibc somewhere and install it ? > first, your distro should provide dietlibc as package > (basically all known distros do) and if that isn't the > case, yes, you better download dietlibc, build and > install it, unless you want to have issues with the > tools ... > > best, > Herbert > >> many thanks in advance >> -- >> Steve Kieu -- Sandino Araico Sánchez http://sandino.net
Hi list, I wonder if it is possible for util-vserver to work with glibc instead of relying on dietlibc? It seems that dietlibc is fairly unmaintained latest years, and the current ebuild for it fails on gcc-6.4.0 on Gentoo. (Have not investigated root causes yet.) On my system, the only package that depends on dietlibc is currently util-vserver. What are the pros/cons of this dependency? BR, Tor Rune Skoglund
it's explained in this thread:
http://archives.linux-vserver.org/201112/0045.html
http://archives.linux-vserver.org/201112/0046.html
On Mon, Dec 19, 2011 at 04:33:55PM +1100, Steve Kieu wrote:Hello,the version is util-vserver-0.30.216.pre2986 build on centos6 systemthe question which comes to my mind here is: why the hell would you build an old version of util-vserver?When I ran configure I gotconfigure:10369: WARNING: *** it is strongly recommended to link util-vserver against *** configure:10371: WARNING: *** dietlibc; glibc's NSS functions are very unreliable in *** configure:10373: WARNING: *** chroot() environments, so you have to expect problems *** configure:10375: WARNING: *** there.I am not quite clear what is the use of dietlibc in the picture. If I use tools without linking to dietlibc what damage/disadvantages I will have?dietlibc isn't just used to replace glibc, it is used to build static binaries which are actually 'static' note that glibc cannot build self contained binaries anymore, even if you build them 'statically' they will dynamically load resolver libraries, which in the case of guest management might be from the host or from the guestI suppose after vserver <NAME> start - the vserver environment is using normal libc under its root dir /lib/ rather than dietglibc?correct, but anytime you start or enter the guest, you have a certain chance that the host will execute some code from the guest system (nss) which in turn gives guest root a good chance to do evil things on the host and even if security is not a concern in your case, you might end up with unexpected failuresOr just all commands I start using vnamespace for example will be affected?Should I download dietlibc somewhere and install it ?first, your distro should provide dietlibc as package (basically all known distros do) and if that isn't the case, yes, you better download dietlibc, build and install it, unless you want to have issues with the tools ... best, Herbertmany thanks in advance-- Steve Kieu
-- Sandino Araico Sánchez http://sandino.net