On Sun, Jul 22, 2018 at 11:40:40AM +0100, Colin Watson wrote: > Do you know of a good support/bug contact for OpenVZ? I'm not familiar > with it at all, and I think we need some idea of what the problem is > there before we even have a clue about what a reasonable workaround in > OpenSSH might be. (Disabling the sandbox doesn't count as reasonable > here, at least not long-term.) Have you asked the hosting provider if > they know what might be going on, or if they have an upstream they could > ask? Presumably somebody maintains this kernel.
I grabbed the kernel source in question from https://wiki.openvz.org/Download/kernel/rhel6/042stab127.2 (there are a few newer versions, but it's apparently fairly recent and none of the newer ones mention anything about resource limits). I can't see anything in the implementation of setrlimit that could plausibly make it return EINVAL here, unless, I don't know, there's some silent type mismatch or something. What architecture is the container? I think you do need to ask OpenVZ people about this first, though. I'm not closing this bug since obviously it's bad for sshd's sandbox to stop working, but we need somebody who knows the OpenVZ kernel to tell us what a decent workaround might be (and maybe it's just a straight-up OpenVZ kernel bug and doesn't require a change in OpenSSH at all). -- Colin Watson [cjwat...@debian.org]
