We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Linux-VServer makes it possible...

moreubuntu.png

Multiseat optimized resource efficient Ubuntu
powered by Linux-VServer.

by Soewono Effendi and Mike Schneider

Introduction

MoreUbuntu is an open source project to provide multiple real isolated full-feature Xorg-Desktops based on Ubuntu. The added edge compared to other multiseat-solutions is that using Linux-VServer, the different seats are isolated from each other.

First announcement and public show were made at LinuxTag2006.

Some background information

ubuntu_kubuntu.jpg

What is Multiseat?

Many people have worked on multiseat solutions based on X11. The earliest record is from Apr 11th, 2002, a patch known as backstreet-ruby, which can be found at [1]. The same also has links to other people's efforts [2]. A very nice HowTo?! called "XFree Local Multi-User HOWTO" by Svetoslav Slavtchev dated back to May 13th, 2003 can be found at [3]. It was last updated on Aug 2004.

Today, Xorg [4] has some new features which make it easier to setup multiseat desktops.

What is Linux-VServer?

Quoted from Linux-VServer Project's WIKI [5]

"Linux-VServer provides virtualization for GNU/Linux systems. This is accomplished by kernel level isolation. It allows to run multiple virtual units at once. Those units are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel."

Note:
The term guest is used in vserver for each virtual enviroment on the host, where vserver runs. Before you try to setup multiseat desktops, please try to be acquainted with vservers as described in [7].

Please refor to [8] just in case you have trouble setting Xorg to run inside a vserver's guest.

Multiseat powered by Linux-VServer!

Nowadays hardwares are getting powerful and cheaper. For normal daily usages, like in offices, internet cafes, call centers, etc. most of the time, computers spend most of their time idling but still consume electric power, which is, sad but true, not getting cheaper despite of technology improvement. The on-going trend of online-based application, rich-client application, etc. is a very good reason why multiseat desktop s nowadays the most cost effective solution.

By utilizing virtualization we can provide a secured isolated enviroment for each seat. Linux-VServer makes it possible to run secured isolated multiseat desktops, due to the fact that Linux-VServer creates almost no overhead at all. Linux-VServer, which provides not only isolated file system but also isolated processes, makes it possible to install different Linux based distributions on one computer.

Why MoreUbuntu?

Due to the fact that Ubuntu is pushing hard to bring linux to desktops, and due to the fact that there are lots of derivates of Ubuntu, like Kubuntu, Edubuntu, Xubuntu, etc., it is very nice to see that all these *buntus can run concurrently on the same computer. During LinuxTag2006 we showed Ubuntu and Kubuntu running concurrently on one computer.

Also due to the fact that there exists a nice Wiki-page [6] on how to use Linux-VServer on Ubuntu with uptodate Linux-VServer packages for Ubuntu, which has helped me a lot on providing the setup shown on LinuxTag2006.

Requirements

For my setup I used:

For each seat we need:

The setup

Assuming now you have some guests running inside you vserver, it is time to setup Xorg for each of your guest. You need to assign resources for each guest, by copying device nodes into the guests needed for your Xorg. For example device nodes of USB keyboards, and USB mice or other USB devices that you assigned to a specific guest.

Some people might want to utilize udev to make their setup easier [9].

Note:
The device node /dev/mem is needed for Xorg, which is, regarding to Linux-VServer, considered a security problem if you need a real secure isolated multiseat desktop. Due to the fact that user in a guest might have access to system memory, which is also use by other guests.

Graphic cards (PCI, AGP, PCI-X)

For accelerated Xorg, specific device nodes might need to be assigned for each seat, e.g. for NVidia driver /dev/nvidia*. Use the lspci command to find out PCI BusId? to be assigned for each Xorg-Desktop (seat). Use lspci -X to get a suitable format for use in xorg.conf. Here is some sample output of my system (only relevant lines are shown):

# lspci -X
sh-3.00$ lspci -X
PCI:0:2:0 VGA compatible controller: Intel Corp. 82915G Express Chipset Family Graphics Controller
PCI:1:0:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200]
PCI:1:5:0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 MX 440]
PCI:1:6:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200]

Input devices

Information regarding (USB) input devices can be obtained from /proc/bus/input/devices. This information is needed for Xorg's evdev driver. Same sample output of my system (only relevant lines are shown):

# cat /proc/bus/input/devices
...
N: Name="AT Translated Set 2 keyboard"
P: Phys=isa0060/serio0/input0
S: Sysfs=/class/input/input0
H: Handlers=kbd event0
...
N: Name="ACROX Combo Mouse"
P: Phys=usb-0000:00:1d.1-1.2/input0
S: Sysfs=/class/input/input2
H: Handlers=mouse0 ts0 event2
...
N: Name="  USB Keyboard"
P: Phys=usb-0000:00:1d.1-2.1/input0
S: Sysfs=/class/input/input6
H: Handlers=kbd event6
...
N: Name="  USB Keyboard"
P: Phys=usb-0000:00:1d.1-2.1/input1
S: Sysfs=/class/input/input7
H: Handlers=kbd event7
...
N: Name="Magic ball Mouse Magic ball Mouse"
P: Phys=usb-0000:00:1d.1-2.2/input0
S: Sysfs=/class/input/input8
H: Handlers=mouse1 ts1 event8

Audio devices

Information regarding (USB) audio devices can be obtained from /proc/asound/devices. By copying the corresponding device nodes to each guest (seat), you can assign audio devices to guest. It is recommended to rename the device nodes, as if they were for audio device zero (first audio devices), so that no special setting is needed for alsa based application to work. Also remember to copy/create related OSS device nodes, if your application is still using OSS API.

Capabilities

For security reasons, it might be desired, to reduce linux capabilities for each guest (seat). Following capabilities should be set in /etc/vservers/*/bcapabilities for each seat. Don't worry about the security now, since it is anticipated by dropping these capabilities as soon as a user logs in to Xorg-Desktop.

/proc filesystem

Add following /proc entries to util-vserver/defaults/vprocunhide-files. Note: These might also be considered as a security problem.

Xorg

New switches needed for multiseat capable Xorg

Console and tty0 might cause problem, since many older programs are still using these device nodes. /dev/tty0 and /dev/console should be linked to /dev/ttyN assigned to corresponding seat, where N is console number, e.g. tty7 for seat1, tty8 for seat2, etc.

Some Xorg sample configuration for

Section "InputDevice"
        Identifier      "USBKeyboard"
        Driver          "evdev"
        Option          "CoreKeyboard"
        Option          "Device"        "/dev/input/event3"
        Option          "XkbRules"      "xorg"
        Option          "XkbLayout"     "de"
        Option          "XkbModel"      "evdev"
        Option          "XkbVariant"    "nodeadkeys"
EndSection

Section "InputDevice"
        Identifier      "USBMouse"
        Driver          "mouse"
        Option          "CorePointer"
        Option          "Device"        "/dev/input/mouse3"
        Option          "Protocol"      "auto"
        Option          "ZAxisMapping"  "4 5"
        ...
EndSection

Section "Device"
        Identifier      "Card0"
        Driver          "nvidia"
        BusID           "PCI:1:0:0"
        ...
EndSection

Section "ServerLayout"
        Identifier      "Default Layout"
        InputDevice     "USBKeyboard"
        InputDevice     "USBMouse"
        Option          "SingleCard"
        ...
EndSection

Note:
Only relevant settings are shown.

Section "InputDevice"
        Identifier      "USBKeyboard"
        Option          "CoreKeyboard"
        Driver          "kbd"
        Option          "Protocol"      "evdev"
        Option          "Dev Phys"      "usb-0000:00:1d.1-2.1/input0"
        Option          "XkbRules"      "xorg"
        Option          "XkbModel"      "pc104"
        Option          "XkbLayout"     "de"
        ...
EndSection

Section "InputDevice"
        Identifier      "USBMouse"
        Driver          "mouse"
        Option          "SendCoreEvents"
        Option          "Device"                "/dev/input/mouse1"
        Option          "Protocol"              "auto"
        Option          "ZAxisMapping"          "4 5"
        ...
EndSection

Section "Device"
        Identifier      "Card0"
        Driver          "nvidia"
        BusID           "PCI:1:5:0"
        ...
EndSection

Section "ServerLayout"
        InputDevice     "USBKeyboard"
        InputDevice     "USBMouse"
        Option          "SingleCard"
        ...
EndSection

Note:
Only relevant settings are shown.

GNOME Desktop Manager

Change following settings in gdmrc

FirstVT=6
# Definition of the standard X server.
[server-Standard]
name=Standard server
command=/usr/X11R6/bin/X -br -audit 0 -novtswitch -sharevts vt6

Note:
N is console number assigned to corresponding seat.

Add following line to gdm/PostLogin/Default to reduce guest's capabilities on login

/sbin/reducecap --secure --cap CAP_SYS_TTY_CONFIG /bin/true

KDE Desktop Manager

Change following settings in kdmrc (only relevant parts are shown, leave others unchanged)

[X-:*-Core]
ServerCmd=/usr/X11R6/bin/X -br -novtswitch -sharevts  vt7
TerminateServer=true

Note

N is console number assigned to corresponding seat.

  • kdm/Xsetup, add following lines to this file to reduce guest's capabilities on login
/sbin/reducecap --cap CAP_SYS_TTY_CONFIG /bin/true
/sbin/reducecap --cap CAP_NET_ADMIN /bin/true
/sbin/reducecap --cap CAP_NET_RAW /bin/true
/sbin/reducecap --cap CAP_SYS_BOOT /bin/true
/sbin/reducecap --cap CAP_MKNOD /bin/true
/sbin/reducecap --cap CAP_QUOTACTL /bin/true

Note:
Due to how kdm works, Xorg must be terminated after each session and the CAP_SYS_RAWIO and CAP_SYS_ADMIN capabilities may not be reduced, This is a major security risk. I hope that kdm will address this issue in the near future. One possible workaround is to use gdm to start KDE session.

Future works

Some GUI tools might be provided to help setting up multiseat desktop and to help on assigned resources to seats. It might be also useful to have some remote tools to monitor status and to control each seat.

Credits

Reference

  1. http://www.ltn.lv/~aivils/index.php
  2. http://www.ltn.lv/~aivils/index.php?proj_id=multiseat&menu_id=4
  3. http://www.tldp.org/HOWTO/XFree-Local-multi-user-HOWTO/
  4. http://www.freedesktop.org
  5. http://linux-vserver.org/Linux-VServer
  6. https://wiki.ubuntu.com/VServer
  7. http://www2.uni-klu.ac.at/support/VServer
  8. http://linux-vserver.org/Vservers+and+X
  9. http://www.reactivated.net/writing_udev_rules.html
  10. https://wiki.ubuntu.com/MoreUbuntu
  11. http://www.13thfloor.at/~zeng/ (temporary site until MoreUbuntu finds it way back home ;) )
  12. http://gallery.linux-vserver.org/ (Linux-VServer at LinuxTag2006, you must see it for yourself!)