Bug 3398

root@qemuppc:~# uname -a
Linux qemuppc 5.15.26-yocto-standard #1 PREEMPT Wed Mar 2 21:12:55 UTC 2022 ppc ppc ppc GNU/Linux

FWIW

I ran sshd under strace, this is where things seem to go awry:

set_robust_list(0xa7d98090, 12)         = 0
close(6)                                = 0
close(7)                                = 0
getpid()                                = 715
getpid()                                = 715
getrandom("\xe7\x45\x7a\x54\xec\xef\xdf\x78\x4b\x73\x30\xac\xe3\x51\xfc\xfe\x84\x7c\xe0\x10\x3d\x1d\xc0\x6a\x54\x26\xd9\x27\x69\x09\x39\x70", 32, 0) = 32
getpid()                                = 715
getpid()                                = 715
getrandom("\x73\x65\x0a\x2a\x8d\xe8\xd7\x06\x5a\x07\xfe\xed\x38\x8c\x45\xd6\x46\x8f\xab\x52\xcd\x3c\x96\xf4\xde\x8d\x49\xbe\x70\x4f\x36\x24", 32, 0) = 32
getpid()                                = 715
getpid()                                = 715
brk(0xc88000)                           = 0xc88000
chroot("/var/run/sshd")                 = 0
chdir("/")                              = 0
getpid()                                = 715
setgroups(1, [995])                     = 0
getuid()                                = 0
getgid()                                = 0
getpid()                                = 715
setresgid(995, 995, 995)                = 0
setresuid(996, 996, 996)                = 0
setgid(0)                               = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)
getgid()                                = 995
getegid()                               = 995
setuid(0)                               = -1 EPERM (Operation not permitted)
setresuid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)
getuid()                                = 996
geteuid()                               = 996
prlimit64(0, RLIMIT_FSIZE, {rlim_cur=0, rlim_max=0}, NULL) = 0
prlimit64(0, RLIMIT_NOFILE, {rlim_cur=0, rlim_max=0}, NULL) = 0
prlimit64(0, RLIMIT_NPROC, {rlim_cur=0, rlim_max=0}, NULL) = 0
getpid()                                = 715
getpid()                                = 715
getpid()                                = 715
getpid()                                = 715
getpid()                                = 715
write(4, "\0\0\4\24\t\24?\345\251\262\371\245\3712;6\336\227\"\372yQ\0\0\1\tcurve2"..., 1048) = 1048
ppoll([{fd=4, events=POLLIN}], 1, NULL, NULL, 8) = -1 EINVAL (Invalid argument)
getpid()                                = 715
write(8, "\0\0\0Y\0\0\0\3\0\0\0\0\0\0\0Mssh_dispatch_run"..., 93) = 93
getpid()                                = 715
exit_group(255)                         = ?
+++ exited with 255 +++


Particulary, is calling prlimit64() with zeroes expected?

I compared the configure logs, this difference seems notable:

x86:
             Privsep sandbox style: seccomp_filter

ppc:
             Privsep sandbox style: rlimit

--with-sandbox=no is the workaround, for now,

How did you configure and compile this?  That particular problem should have been caught by this change to configure prior to 8.9:

commit bc16667b4a1c3cad7029304853c143a32ae04bd4
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Feb 22 15:29:22 2022 +1100

    Extend select+rlimit sanbox test to include poll.
    
    POSIX specifies that poll() shall fail if "nfds argument is greater
    than {OPEN_MAX}".  The setrlimit sandbox sets this to effectively zero
    so this causes poll() to fail in the preauth privsep process.
    
    This is likely the underlying cause for the previously observed similar
    behaviour of select() on plaforms where it is implement in userspace on
    top of poll().

This is cross-compiled using Yocto for powerpc on an x86 build machine. I'll attach the autoconf logs and config.h in a second.

Created attachment 3575 [details]
autoconf log

Created attachment 3576 [details]
generated config.h

Created attachment 3577 [details]
autoconf config.log

(In reply to Alexander Kanavin from comment #6)
> This is cross-compiled using Yocto for powerpc on an x86 build
> machine. I'll attach the autoconf logs and config.h in a second.

That's the reason the test didn't catch it: it relies on being able to run the test via AC_RUN_IFELSE.  We might have to assume the problem always exists when cross compiling.

Why didn't the test error out though? Not being able to run something to make a decision should be treated as a failure (or there should be a fallback for that scenario).

(In reply to Alexander Kanavin from comment #11)
> Why didn't the test error out though? Not being able to run
> something to make a decision should be treated as a failure (or
> there should be a fallback for that scenario).

There is a fallback:

AC_MSG_CHECKING([if select and/or poll works with descriptor rlimit])
AC_RUN_IFELSE(
        ...
        [AC_MSG_WARN([cross compiling: assuming yes])
         select_works_with_rlimit=yes]

In the past this was usually fine because on most systems select(2) didn't have this problem, but for poll(2) having the problem seems to be the common case.

I've changed the default for cross-compiling:
https://anongit.mindrot.org/openssh.git/commit/?id=8cf5275452a950869cb90eeac7d220b01f77b12e

I think that should fix this problem.

As far as we know this is fixed, please reopen if that's not the case.

OpenSSH 9.3 has been released. Close resolved bugs