![[Home]](http://wiki.linux-vserver.org/skins/common/images/wiki.png)
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.
Multiseat optimized resource efficient Ubuntu
powered by Linux-VServer.
by Soewono Effendi and Mike Schneider
MoreUbuntu is an open source project to provide multiple real isolated full-feature Xorg-Desktops based on Ubuntu. The added edge compared to other multiseat-solutions is that using Linux-VServer, the different seats are isolated from each other.
First announcement and public show were made at LinuxTag2006.
Many people have worked on multiseat solutions based on X11. The earliest record is from Apr 11th, 2002, a patch known as backstreet-ruby, which can be found at [1]. The same also has links to other people's efforts [2]. A very nice HowTo?! called "XFree Local Multi-User HOWTO" by Svetoslav Slavtchev dated back to May 13th, 2003 can be found at [3]. It was last updated on Aug 2004.
Today, Xorg [4] has some new features which make it easier to setup multiseat desktops.
Quoted from Linux-VServer Project's WIKI [5]
"Linux-VServer provides virtualization for GNU/Linux systems. This is accomplished by kernel level isolation. It allows to run multiple virtual units at once. Those units are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel."
Note:
The term guest is used in vserver for each virtual enviroment on the host, where vserver runs. Before you try to setup multiseat desktops, please try to be acquainted with vservers as described in [7].
Please refor to [8] just in case you have trouble setting Xorg to run inside a vserver's guest.
Nowadays hardwares are getting powerful and cheaper. For normal daily usages, like in offices, internet cafes, call centers, etc. most of the time, computers spend most of their time idling but still consume electric power, which is, sad but true, not getting cheaper despite of technology improvement. The on-going trend of online-based application, rich-client application, etc. is a very good reason why multiseat desktop s nowadays the most cost effective solution.
By utilizing virtualization we can provide a secured isolated enviroment for each seat. Linux-VServer makes it possible to run secured isolated multiseat desktops, due to the fact that Linux-VServer creates almost no overhead at all. Linux-VServer, which provides not only isolated file system but also isolated processes, makes it possible to install different Linux based distributions on one computer.
Due to the fact that Ubuntu is pushing hard to bring linux to desktops, and due to the fact that there are lots of derivates of Ubuntu, like Kubuntu, Edubuntu, Xubuntu, etc., it is very nice to see that all these *buntus can run concurrently on the same computer. During LinuxTag2006 we showed Ubuntu and Kubuntu running concurrently on one computer.
Also due to the fact that there exists a nice Wiki-page [6] on how to use Linux-VServer on Ubuntu with uptodate Linux-VServer packages for Ubuntu, which has helped me a lot on providing the setup shown on LinuxTag2006.
For my setup I used:
For each seat we need:
Assuming now you have some guests running inside you vserver, it is time to setup Xorg for each of your guest. You need to assign resources for each guest, by copying device nodes into the guests needed for your Xorg. For example device nodes of USB keyboards, and USB mice or other USB devices that you assigned to a specific guest.
Some people might want to utilize udev to make their setup easier [9].
Note:
The device node /dev/mem is needed for Xorg, which is, regarding to Linux-VServer, considered a security problem if you need a real secure isolated multiseat desktop. Due to the fact that user in a guest might have access to system memory, which is also use by other guests.
For accelerated Xorg, specific device nodes might need to be assigned for each seat, e.g. for NVidia driver /dev/nvidia*. Use the lspci command to find out PCI BusId? to be assigned for each Xorg-Desktop (seat). Use lspci -X to get a suitable format for use in xorg.conf. Here is some sample output of my system (only relevant lines are shown):
# lspci -X sh-3.00$ lspci -X PCI:0:2:0 VGA compatible controller: Intel Corp. 82915G Express Chipset Family Graphics Controller PCI:1:0:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200] PCI:1:5:0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 MX 440] PCI:1:6:0 VGA compatible controller: nVidia Corporation NV34 [GeForce FX 5200]
Information regarding (USB) input devices can be obtained from /proc/bus/input/devices. This information is needed for Xorg's evdev driver. Same sample output of my system (only relevant lines are shown):
# cat /proc/bus/input/devices ... N: Name="AT Translated Set 2 keyboard" P: Phys=isa0060/serio0/input0 S: Sysfs=/class/input/input0 H: Handlers=kbd event0 ... N: Name="ACROX Combo Mouse" P: Phys=usb-0000:00:1d.1-1.2/input0 S: Sysfs=/class/input/input2 H: Handlers=mouse0 ts0 event2 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input0 S: Sysfs=/class/input/input6 H: Handlers=kbd event6 ... N: Name=" USB Keyboard" P: Phys=usb-0000:00:1d.1-2.1/input1 S: Sysfs=/class/input/input7 H: Handlers=kbd event7 ... N: Name="Magic ball Mouse Magic ball Mouse" P: Phys=usb-0000:00:1d.1-2.2/input0 S: Sysfs=/class/input/input8 H: Handlers=mouse1 ts1 event8
Information regarding (USB) audio devices can be obtained from /proc/asound/devices. By copying the corresponding device nodes to each guest (seat), you can assign audio devices to guest. It is recommended to rename the device nodes, as if they were for audio device zero (first audio devices), so that no special setting is needed for alsa based application to work. Also remember to copy/create related OSS device nodes, if your application is still using OSS API.
For security reasons, it might be desired, to reduce linux capabilities for each guest (seat). Following capabilities should be set in /etc/vservers/*/bcapabilities for each seat. Don't worry about the security now, since it is anticipated by dropping these capabilities as soon as a user logs in to Xorg-Desktop.
Add following /proc entries to util-vserver/defaults/vprocunhide-files. Note: These might also be considered as a security problem.
New switches needed for multiseat capable Xorg
Console and tty0 might cause problem, since many older programs are still using these device nodes. /dev/tty0 and /dev/console should be linked to /dev/ttyN assigned to corresponding seat, where N is console number, e.g. tty7 for seat1, tty8 for seat2, etc.
Some Xorg sample configuration for
Section "InputDevice"
Identifier "USBKeyboard"
Driver "evdev"
Option "CoreKeyboard"
Option "Device" "/dev/input/event3"
Option "XkbRules" "xorg"
Option "XkbLayout" "de"
Option "XkbModel" "evdev"
Option "XkbVariant" "nodeadkeys"
EndSection
Section "InputDevice"
Identifier "USBMouse"
Driver "mouse"
Option "CorePointer"
Option "Device" "/dev/input/mouse3"
Option "Protocol" "auto"
Option "ZAxisMapping" "4 5"
...
EndSection
Section "Device"
Identifier "Card0"
Driver "nvidia"
BusID "PCI:1:0:0"
...
EndSection
Section "ServerLayout"
Identifier "Default Layout"
InputDevice "USBKeyboard"
InputDevice "USBMouse"
Option "SingleCard"
...
EndSection
Note:
Only relevant settings are shown.
Section "InputDevice"
Identifier "USBKeyboard"
Option "CoreKeyboard"
Driver "kbd"
Option "Protocol" "evdev"
Option "Dev Phys" "usb-0000:00:1d.1-2.1/input0"
Option "XkbRules" "xorg"
Option "XkbModel" "pc104"
Option "XkbLayout" "de"
...
EndSection
Section "InputDevice"
Identifier "USBMouse"
Driver "mouse"
Option "SendCoreEvents"
Option "Device" "/dev/input/mouse1"
Option "Protocol" "auto"
Option "ZAxisMapping" "4 5"
...
EndSection
Section "Device"
Identifier "Card0"
Driver "nvidia"
BusID "PCI:1:5:0"
...
EndSection
Section "ServerLayout"
InputDevice "USBKeyboard"
InputDevice "USBMouse"
Option "SingleCard"
...
EndSection
Note:
Only relevant settings are shown.
Change following settings in gdmrc
FirstVT=6 # Definition of the standard X server. [server-Standard] name=Standard server command=/usr/X11R6/bin/X -br -audit 0 -novtswitch -sharevts vt6
Note:
N is console number assigned to corresponding seat.
Add following line to gdm/PostLogin/Default to reduce guest's capabilities on login
/sbin/reducecap --secure --cap CAP_SYS_TTY_CONFIG /bin/true
Change following settings in kdmrc (only relevant parts are shown, leave others unchanged)
[X-:*-Core] ServerCmd=/usr/X11R6/bin/X -br -novtswitch -sharevts vt7 TerminateServer=true
Note
N is console number assigned to corresponding seat.
/sbin/reducecap --cap CAP_SYS_TTY_CONFIG /bin/true /sbin/reducecap --cap CAP_NET_ADMIN /bin/true /sbin/reducecap --cap CAP_NET_RAW /bin/true /sbin/reducecap --cap CAP_SYS_BOOT /bin/true /sbin/reducecap --cap CAP_MKNOD /bin/true /sbin/reducecap --cap CAP_QUOTACTL /bin/true
Note:
Due to how kdm works, Xorg must be terminated after each session and the CAP_SYS_RAWIO and CAP_SYS_ADMIN capabilities may not be reduced, This is a major security risk. I hope that kdm will address this issue in the near future. One possible workaround is to use gdm to start KDE session.
Some GUI tools might be provided to help setting up multiseat desktop and to help on assigned resources to seats. It might be also useful to have some remote tools to monitor status and to control each seat.