From owner-svn-src-all@FreeBSD.ORG Wed May 29 12:36:17 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id BF26E915; Wed, 29 May 2013 12:36:17 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 832D7899; Wed, 29 May 2013 12:36:17 +0000 (UTC) Received: from nine.des.no (smtp.des.no [194.63.250.102]) by smtp-int.des.no (Postfix) with ESMTP id 7D6007058; Wed, 29 May 2013 12:36:16 +0000 (UTC) Received: by nine.des.no (Postfix, from userid 1001) id BDE7F4A7C8; Wed, 29 May 2013 14:36:17 +0200 (CEST) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Pawel Jakub Dawidek Subject: Re: svn commit: r251088 - head/crypto/openssh References: <201305290019.r4T0JxLE011755@svn.freebsd.org> <20130529070952.GA1400@garage.freebsd.pl> Date: Wed, 29 May 2013 14:36:17 +0200 In-Reply-To: <20130529070952.GA1400@garage.freebsd.pl> (Pawel Jakub Dawidek's message of "Wed, 29 May 2013 09:09:53 +0200") Message-ID: <86zjve3qv2.fsf@nine.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, bdrewery@freebsd.org X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2013 12:36:17 -0000 Pawel Jakub Dawidek writes: > Which library is needed for AES-NI? I don't see any engine in /usr/lib/ > that implements AES-NI support. Could you be more specific? Ah, you're right. Bryan (cc:ed) did the analysis and I misunderstood his report. I just ran through the steps to reproduce the issue, and what happens is that a CRIOGET ioctl cal (which is supposed to allocate and return a file descriptor) fails due to setrlimit(RLIMIT_FSIZE, 0): 90344 sshd CALL setrlimit(RLIMIT_NOFILE,0x7fffffffca10) 90344 sshd RET setrlimit 0 [...] 90344 sshd CALL ioctl(0x3,CRIOGET,0x7fffffffcb4c) 90344 sshd RET ioctl -1 errno 24 Too many open files Note that you have to remove the setrlimit(RLIMIT_FSIZE, 0) call in sandbox-rlimit.c to debug this, otherwise ktrace stops at that point: May 29 12:10:37 zoo2 kernel: ktrace write failed, errno 27, tracing stopped= =20 To reproduce: # ktrace -tcnstuy -di env LD_UTRACE=3Dyes /usr/sbin/sshd -oUsePrivilegeSepa= ration=3Dsandbox -Dddd -oPort=3D2222 -oListenAddress=3Dlocalhost followed by % ssh -c aes128-cbc -p 2222 localhost on a machine with an AESNI-capable CPU and aesni.ko loaded. > Also what is the exact difference between "sandbox" and "yes" settings? "sandbox" enables sandboxing (no surprise) which in FreeBSD's case means a bunch of rlimit settings. > The reason I ask is because I plan to experiment with OpenSSH sandboxing > to use Capsicum and Casper. You still have the patches I sent you? DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no