- (djm) [configure.ac sandbox-capsicum.c sandbox-rlimit.c] Disable

    RLIMIT_NOFILE pseudo-sandbox on FreeBSD. In some configurations,
    libc will attempt to open additional file descriptors for crypto
    offload and crash if they cannot be opened.

1 files changed, 2 insertions, 0 deletions

diff --git a/sandbox-capsicum.c b/sandbox-capsicum.c
index f648c6ece..ee2a7e79e 100644
--- a/sandbox-capsicum.c
+++ b/sandbox-capsicum.c
@@ -75,9 +75,11 @@ ssh_sandbox_child(struct ssh_sandbox *box)
         if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
                 fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
                         __func__, strerror(errno));
+#ifndef SANDBOX_SKIP_RLIMIT_NOFILE
         if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
                 fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
                         __func__, strerror(errno));
+#endif
         if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
                 fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
                         __func__, strerror(errno));