Date: Wed, 29 May 2013 14:36:17 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Pawel Jakub Dawidek <pjd@FreeBSD.org> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, bdrewery@freebsd.org Subject: Re: svn commit: r251088 - head/crypto/openssh Message-ID: <86zjve3qv2.fsf@nine.des.no> In-Reply-To: <20130529070952.GA1400@garage.freebsd.pl> (Pawel Jakub Dawidek's message of "Wed, 29 May 2013 09:09:53 %2B0200") References: <201305290019.r4T0JxLE011755@svn.freebsd.org> <20130529070952.GA1400@garage.freebsd.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
Pawel Jakub Dawidek <pjd@FreeBSD.org> writes: > Which library is needed for AES-NI? I don't see any engine in /usr/lib/ > that implements AES-NI support. Could you be more specific? Ah, you're right. Bryan (cc:ed) did the analysis and I misunderstood his report. I just ran through the steps to reproduce the issue, and what happens is that a CRIOGET ioctl cal (which is supposed to allocate and return a file descriptor) fails due to setrlimit(RLIMIT_FSIZE, 0): 90344 sshd CALL setrlimit(RLIMIT_NOFILE,0x7fffffffca10) 90344 sshd RET setrlimit 0 [...] 90344 sshd CALL ioctl(0x3,CRIOGET,0x7fffffffcb4c) 90344 sshd RET ioctl -1 errno 24 Too many open files Note that you have to remove the setrlimit(RLIMIT_FSIZE, 0) call in sandbox-rlimit.c to debug this, otherwise ktrace stops at that point: May 29 12:10:37 zoo2 kernel: ktrace write failed, errno 27, tracing stopped= =20 To reproduce: # ktrace -tcnstuy -di env LD_UTRACE=3Dyes /usr/sbin/sshd -oUsePrivilegeSepa= ration=3Dsandbox -Dddd -oPort=3D2222 -oListenAddress=3Dlocalhost followed by % ssh -c aes128-cbc -p 2222 localhost on a machine with an AESNI-capable CPU and aesni.ko loaded. > Also what is the exact difference between "sandbox" and "yes" settings? "sandbox" enables sandboxing (no surprise) which in FreeBSD's case means a bunch of rlimit settings. > The reason I ask is because I plan to experiment with OpenSSH sandboxing > to use Capsicum and Casper. You still have the patches I sent you? DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86zjve3qv2.fsf>