- (djm) [configure.ac sandbox-capsicum.c sandbox-rlimit.c] Disable

    RLIMIT_NOFILE pseudo-sandbox on FreeBSD. In some configurations,
    libc will attempt to open additional file descriptors for crypto
    offload and crash if they cannot be opened.

1 files changed, 2 insertions, 0 deletions

diff --git a/sandbox-rlimit.c b/sandbox-rlimit.c
index da91eb1b9..bba80778b 100644
--- a/sandbox-rlimit.c
+++ b/sandbox-rlimit.c
@@ -69,9 +69,11 @@ ssh_sandbox_child(struct ssh_sandbox *box)
                 fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
                         __func__, strerror(errno));
 #endif
+#ifndef SANDBOX_SKIP_RLIMIT_NOFILE
         if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
                 fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
                         __func__, strerror(errno));
+#endif
 #ifdef HAVE_RLIMIT_NPROC
         if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
                 fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",