rlimit sandbox on cygwin

[Darren Tucker]

On Tue, Jul 03, 2012 at 01:23:48AM +1000, Darren Tucker wrote:
> Hi all.
> 
> I have an old windows VM with an oldish cygwin that I use for the
> regression tests.  Investigating one of the test failures, I see that
> it's for UsePrivilegeSeparation=sandbox, and it seems to be because
> setrlimit(RLIMIT_FSIZE, ...) is not supported.
> 
> IMO, this isn't a big loss, since the most useful thing in the rlimit
> "sandbox" is the descriptor limits.  Can anyone see a reason not to just
> omit RLIMIT_FSIZE on cygwin?  It's a no-op unless you've explicitly set
> "UsePrivilegeSeparation sandbox" in sshd_config.

On second thought, it might be better to explicitly test RLIMIT_FSIZE in
configure, like so.

Index: configure.ac
===================================================================
RCS file: /home/dtucker/openssh/cvs/openssh/configure.ac,v
retrieving revision 1.493
diff -u -p -r1.493 configure.ac
--- configure.ac	3 Jul 2012 04:31:18 -0000	1.493
+++ configure.ac	3 Jul 2012 12:30:30 -0000
@@ -2615,6 +2615,25 @@ AC_RUN_IFELSE(
 	[AC_MSG_WARN([cross compiling: assuming yes])]
 )
 
+AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
+AC_RUN_IFELSE(
+	[AC_LANG_PROGRAM([[
+#include <sys/types.h>
+#include <sys/resource.h>
+#include <stdlib.h>
+	]],[[
+		struct rlimit rl_zero;
+
+		rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+		exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
+	]])],
+	[AC_MSG_RESULT([yes])],
+	[AC_MSG_RESULT([no])
+	 AC_DEFINE(SANDBOX_SKIP_RLIMIT_FSIZE, 1,
+	    [setrlimit RLIMIT_FSIZE works])],
+	[AC_MSG_WARN([cross compiling: assuming yes])]
+)
+
 if test "x$sandbox_arg" = "xsystrace" || \
    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
 	test "x$have_systr_policy_kill" != "x1" && \
Index: sandbox-rlimit.c
===================================================================
RCS file: /home/dtucker/openssh/cvs/openssh/sandbox-rlimit.c,v
retrieving revision 1.2
diff -u -p -r1.2 sandbox-rlimit.c
--- sandbox-rlimit.c	23 Jun 2011 09:45:51 -0000	1.2
+++ sandbox-rlimit.c	3 Jul 2012 12:18:54 -0000
@@ -64,9 +64,11 @@ ssh_sandbox_child(struct ssh_sandbox *bo
 
 	rl_zero.rlim_cur = rl_zero.rlim_max = 0;
 
+#ifndef SANDBOX_SKIP_RLIMIT_FSIZE
 	if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
 		fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
 			__func__, strerror(errno));
+#endif
 	if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
 		fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
 			__func__, strerror(errno));

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.