Re: [vserver] Howto configure graphic card in a guest/Xorg-server configuration

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Fri 26 Mar 2010 - 16:22:05 GMT
Message-ID: <20100326162205.GB28383@MAIL.13thfloor.at>

On Fri, Mar 26, 2010 at 03:14:15PM +0200, Romberg Christo wrote:
> Thank you for your hospitality!

> I've installed X on the host-system for testing purposes, and I was
> able to successfully get 'X' and 'gdm' running on the host with great
> graphics. I also ran 'X -configure' to get a tailor-made xorg.conf
> for the hardware. And I copied the new xorg.conf over to the guest to
> replace the existing xorg.conf on there, but still it doesn't work -
> same problems as earlier.

> I have an Intel 82865G Integrated Graphics Controller that's located
> at PCI:0:2:0. So "Device" section in xorg.conf now looks like this
> (only relevant parts..):

> Driver "intel"
> BusID "PCI:0:2:0"

> However, this does not work in the guest. If I try, I soon get this
> error message on the screen (as earlier):

> "(EE) No devices detected.

> Fatal server error:
> no screens found"

> So I have to use the VGA driver for X to start, and I need to comment
> out the BusID option:

> Driver "vga"
> #BusID "PCI:0:2:0

> However, VGA is not an option for the graphics - I can't even start
> 'gdm', the login-screen just flashes a second and then bails out. So
> the intel driver is a must..

> So...

> I've traced 'startx' on host- and the guest-system with 'strace...'
> and I've come to the conclusion that the PCI devices aren't detected
> at all in the guest. If I run 'Xorg -scanpci' in the guest I get:

> "No PCI info available"

> ...though if I run it in the host system I get a long list of devices.

> If I search in the Xorg.0.log, I see:

> "(WW) OS did not count PCI devices, guessing wildly"

> Now, how come? Is it unable to find PCI devices or why does it not
> count them? On the same spot in the host-systems Xorg.0.log I see:

> "(II) PCI: PCI scan (all values are in hex)"

> In lack of better ideas, I've even copied all files from host /dev to
> guest (from my host: /etc/vservers/[vservername]/~vdir/dev), but no
> success. I've even tried copying /sys and /proc, but with errors. I've
> also copied and replaced the /lib and /usr (the latter with errors).

> I've done all things that are stated on these pages:
> http://oldwiki.linux-vserver.org/MoreUbuntu
> http://oldwiki.linux-vserver.org/Vservers+and+X
> (in the "Running an X server inside a vserver" section)

> Maybe I need to dive in to the strace in more detail, or do you have
> any thoughts on why the PCI devices aren't detected?

my guess would be that you haven't made /proc/bus/pci
visible inside the guest(s) yet and it is hidden by
default (see vprocunhide for details)

> I appreciate your help, thank you so much!

best,
Herbert

PS: a visit to the IRC channel might speed up things
significantly because of the much better interactivity :)

> PS: grsecurity looks interesting, and I will certainly give it a
> spin if I can't get Vserver to work with this configuration. I'm not
> familiar with "MAC systems" nor Gentoo with a hardened profile, but
> they both seems interesting.

> -----Original Message-----
> From: Ed W [mailto:lists@wildgooses.com]
> Sent: den 25 mars 2010 15:40
> To: vserver@list.linux-vserver.org
> Subject: Re: [vserver] Howto configure graphic card in a guest/Xorg-server configuration
>
> On 25/03/2010 07:59, Romberg Christo wrote:
> >
> >> you probably need to copy any devices the userspace
> >> driver part (from xorg) uses when setting up the
> >> graphics card into the guest
> >>
> > Where should these devices be located in the filesystem?
> >
>
>
> vservers are basically just a fancy chroot, so when you are in a guest
> then what you think is /dev is really /vserver/guest/dev - hence
> populate that directory with whatever your software tries to access.
> Remember that unix is about making everything look like a file, but
> really you are talking to some hardware in the case of these special
> files - so essentially you are copying the interface to the device into
> the chroot
>
> Good luck
>
> Ed W
>
> P.S. You might as well/instead consider looking at grsecurity or
> similar - I seem to remember you needed to give the guest more
> permissions than you want (ie could escape the chroot) in order to make
> X work. A complementary lock down technique is a MAC system (eg
> grsec/selinux, etc). Personally I never got my head around selinux, but
> grsec is straightforward and likely you will already be using the other
> pax patches on your kernel so it's kind of there for free? Also look at
> the Suse MAC stuff (whatever it's called? app armour?) and I saw another
> new idea in some new distro recently - some of these are even simpler to
> configure than grsec
>
> P.P.S. If you really want your tinfoil hat on then switch to gentoo and
> turn on the hardened profile. I use this on all my servers and whilst
> it will require a far greater understanding of linux to build and
> initially setup, *if* you have this level of understanding then you gain
> a great amount of flexibility and also you can lock the box down to a
> much greater degree. Lots of other benefits to gentoo over <generic
> distro>, but the basic tradeoff will remain that it requires more
> knowhow to build...
Received on Fri Mar 26 16:22:20 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 26 Mar 2010 - 16:22:22 GMT by hypermail 2.1.8