You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cloudlinuxos/cloudlinux_os_kernel/README.md
+11-52Lines changed: 11 additions & 52 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -92,7 +92,7 @@ This will:
92
92
## Hybrid Kernels
93
93
94
94
::: tip Hybrid kernel availability
95
-
Hybrid kernels are only available for CloudLinux OS 6 and 7.
95
+
Hybrid kernels are only available for CloudLinux OS 7.
96
96
:::
97
97
98
98
Hybrid kernels allow you to take advantage of the benefits and features available in newer kernels without having to completely upgrade to another version of the operating system.
@@ -125,13 +125,6 @@ hybrid-to-normal
125
125
```
126
126
:::
127
127
128
-
#### Known limitations and issues of hybrid kernels
129
-
130
-
**CloudLinux OS 6 Hybrid kernel**
131
-
132
-
1. We do not remove Hybrid kernel after migration from Hybrid to the normal channel, but we remove <spanclass="notranslate"> linux-firmware </span> package which is needed to boot Hybrid kernel. This is because <spanclass="notranslate"> CloudLinux OS </span> 6 does not allow to remove the package of currently running kernel. Thus please don't reboot the server back to Hybrid kernel after you remove it.
133
-
134
-
2. Kernel module signature isn't checking for now, as 3.10 kernel is using x509 certificates to generate keys and CloudLinux OS 6 cannot detect signatures created in such way.
135
128
136
129
## SecureLinks and Link Traversal Protection
137
130
@@ -401,29 +394,20 @@ This command is available within CageFS.
401
394
402
395
**Requirements**
403
396
404
-
<spanclass="notranslate"> CloudLinux OS </span> 6 (requires Hybrid kernel) or 7
397
+
<spanclass="notranslate"> CloudLinux OS 7</span>
405
398
Kernel Version: 3.10.0-427.36.1.lve1.4.47
406
399
407
400
**Installation and configuration**
408
401
409
402
To install <spanclass="notranslate"> cloudlinux-fchange </span> system run:
Configuration file can be found in <spanclass="notranslate">/etc/sysconfig/cloudlinux-fchange </span>
428
412
429
413
Database containing list of modified files is located at <spanclass="notranslate">/var/lve/cloudlinux-fchange.db </span> by default.
@@ -433,7 +417,6 @@ Database containing list of modified files is located at <span class="notranslat
433
417
After successful installation the event collecting daemon starts automatically, providing all <spanclass="notranslate"> kernel-exposed </span> data are in place.
434
418
435
419
To start daemon:
436
-
<spanclass="notranslate">_CloudLinux OS 7:_ </span>
To uninstall <spanclass="notranslate"> cloudlinux-fchange </span> run:
475
439
<divclass="notranslate">
@@ -831,10 +795,6 @@ mount -o remount /proc
831
795
to apply `/etc/fstab` changes.
832
796
Nevertheless, we recommend to manage procfs mount options via `/etc/sysctl.conf` as described above for backward compatibility.
833
797
834
-
::: tip Note
835
-
There is a known issue on CloudLinux OS 6 systems. User cannot see full /proc inside CageFS even when this user is in “super” group, that should see full /proc. This issue does not affect users with CageFS disabled. CloudLinux OS 7 is not affected.
836
-
:::
837
-
838
798
::: tip Note
839
799
Starting from lve-utils 3.0-21.2, lve_namespaces service can read parameters from the /etc/sysctl.d/90-cloudlinux.conf.
840
800
:::
@@ -867,7 +827,7 @@ On Cloudlinux OS 8, changing the `/etc/fstab` file for setting `/proc` remountin
867
827
Since CL7 kernel it’s recommended to use the native sysctl parameter `yama.ptrace_scope`. For details refer to the [official documentation](https://docs.kernel.org/admin-guide/LSM/Yama.html#ptrace-scope).
868
828
:::
869
829
870
-
Starting with kernel 3.10.0-427.18.s2.lve1.4.21 ( <spanclass="notranslate"> CloudLinux OS </span> 7) and 2.6.32-673.26.1.lve1.4.17 ( <spanclass="notranslate"> CloudLinux OS </span> 6) we re-implemented <spanclass="notranslate"> ptrace block </span> to protect against <spanclass="notranslate"> ptrace </span> family of vulnerabilities. It prevents end user from using any <spanclass="notranslate"> ptrace </span> related functionality, including such commands as <spanclass="notranslate"> strace, lsof </span> or <spanclass="notranslate"> gdb </span> .
830
+
Starting with kernel 3.10.0-427.18.s2.lve1.4.21 ( <spanclass="notranslate"> CloudLinux OS </span> 7) we re-implemented <spanclass="notranslate"> ptrace block </span> to protect against <spanclass="notranslate"> ptrace </span> family of vulnerabilities. It prevents end user from using any <spanclass="notranslate"> ptrace </span> related functionality, including such commands as <spanclass="notranslate"> strace, lsof </span> or <spanclass="notranslate"> gdb </span> .
871
831
872
832
By default, <spanclass="notranslate"> CloudLinux OS </span> doesn't prevent <spanclass="notranslate"> ptrace </span> functionality.
873
833
@@ -919,13 +879,13 @@ This is needed only for CloudLinux OS 6 and <span class="notranslate"> Hybrid </
919
879
## Umask behavior
920
880
921
881
:::tip Note
922
-
CloudLinux OS 6, CloudLinux OS 6 hybrid, CloudLinux OS 7, CloudLinux OS 7 hybrid kernels.
882
+
CloudLinux OS 7, CloudLinux OS 7 hybrid kernels
923
883
:::
924
884
925
885
Starting from the kernel module **lve-kmod-2.0-10**, the behavior of umask is changed.
926
886
927
887
Now, when entering LVE task's original umask value is preserved, instead of using LVE's umask value.
928
-
This behavior is typical for all kernels: CloudLinux OS 6, CloudLinux OS 6 hybrid, CloudLinux OS 7, CloudLinux OS 7 hybrid kernels.
888
+
This behavior is typical for all kernels: CloudLinux OS 7, CloudLinux OS 7 hybrid kernels.
929
889
930
890
## IO limits latency
931
891
@@ -936,7 +896,7 @@ By defining <span class="notranslate"> IO latency, you can make sure that no pro
936
896
937
897
This option is <spanclass="notranslate"> OFF by default. </span>
938
898
939
-
_For CloudLinux OS 6 , CloudLinux OS 7, CloudLinux OS 8 (kmodlve 2.1-2 and later):_
899
+
_For CloudLinux OS 7, CloudLinux OS 8 (kmodlve 2.1-2 and later):_
940
900
941
901
To enable <spanclass="notranslate"> IO </span> Limits latency and set it to 10 seconds:
CloudLinux OS kernel provides real time usage data in file.
981
941
982
-
All the statistics can be read from that file in real time. Depending on your kernel version you will get either Version 6 of the file, or version 4 of the file.
942
+
All the statistics can be read from that file in real time. Depending on your kernel version, you will get either version 6 or version 4 of the file.
983
943
You can detect the version by reading the first line of the file. It should look like:
984
944
985
945
6:LVE... for version 6
@@ -989,7 +949,7 @@ First line presents headers for the data.
989
949
Second line shows default limits for the server, with all other values being 0.
990
950
The rest of the lines present limits & usage data on per <spanclass="notranslate"> LVE </span> bases.
991
951
992
-
Version 6 (CL6 & hybrid kernels):
952
+
Version 6 file example:
993
953
<divclass="notranslate">
994
954
995
955
```
@@ -1047,7 +1007,7 @@ More info on <span class="notranslate"> flashcache </span> : [https://github.com
1047
1007
1048
1008
## OOM killer for LVE processes
1049
1009
1050
-
When <spanclass="notranslate">LVE</span> reaches its memory limit, the processes inside that <spanclass="notranslate"> LVE </span> are killed by <spanclass="notranslate"> OOM Killer </span> and appropriate message is written to <spanclass="notranslate"> /var/log/messages </span> . When any <spanclass="notranslate"> LVE </span> hits huge number of memory limits in short period of time, then <spanclass="notranslate"> OOM Killer </span> could cause system overload. Starting from kernel 2.6.32-673.26.1.lve1.4.15 ( <spanclass="notranslate"> CloudLinux OS </span> 6) and from kernel 3.10.0-427.18.2.lve1.4.14 ( <spanclass="notranslate"> CloudLinux OS </span> 7) heavy <spanclass="notranslate"> OOM Killer </span> could be disabled. If so - lightweight <spanclass="notranslate"> SIGKILL </span> will be used instead.
1010
+
When <spanclass="notranslate">LVE</span> reaches its memory limit, the processes inside that <spanclass="notranslate"> LVE </span> are killed by <spanclass="notranslate"> OOM Killer </span> and appropriate message is written to <spanclass="notranslate"> /var/log/messages </span> . When any <spanclass="notranslate"> LVE </span> hits huge number of memory limits in short period of time, then <spanclass="notranslate"> OOM Killer </span> could cause system overload. Starting from kernel 3.10.0-427.18.2.lve1.4.14 ( <spanclass="notranslate"> CloudLinux OS </span> 7) heavy <spanclass="notranslate"> OOM Killer </span> could be disabled. If so - lightweight <spanclass="notranslate"> SIGKILL </span> will be used instead.
1051
1011
1052
1012
:::tip Note
1053
1013
It is recommended to disable OOM killer for LVE processes and use SIGKILL instead
0 commit comments