Public bug reported:
Release: Ubuntu 26.04.1 LTS
Package: openssh-server 1:10.2p1-2ubuntu3.8. Also seen on 1:10.2p1-2ubuntu3.6.
Kernel: 7.0.14 (Proxmox VE host). sshd runs in an unprivileged LXC container.
Upstream: https://bugzilla.mindrot.org/show_bug.cgi?id=4036 (reproduction and
patch)
What happens:
The preauth child (/usr/lib/openssh/sshd-auth) is occasionally killed by its
own seccomp filter. The trigger is the process being frozen and thawed while
it sleeps in ensure_minimum_time_since() (auth2.c), which calls nanosleep()
after failed userauth requests and also after postponed/successful publickey
requests. The interrupted clock_nanosleep is resumed by the kernel as
restart_syscall (x86_64 nr 219). That syscall is missing from the preauth
allowlist in sandbox-seccomp-filter.c, so SECCOMP_RET_KILL kills the child:
sshd-session[N]: error: mm_reap: child terminated by signal 31
sshd[P]: Session process N unpriv child crash for connection from A to B
sshd[P]: srclimit_penalise: ipv4: new A/32 active penalty of 90 seconds for
penalty: caused crash
audit: type=SECCOMP ... comm="sshd-auth" exe="/usr/lib/openssh/sshd-auth"
sig=31 arch=c000003e syscall=219 ... SYSCALL=restart_syscall
Freezes like this are routine for containers. Proxmox VE freezes a running
LXC with the cgroup v2 freezer for every storage-replication run, snapshot
and snapshot-mode backup ("freeze guest filesystem" in the task log).
SIGSTOP/SIGCONT and CRIU do the same. On a busy git server in a container
replicated every minute, we lose about one login per day. Because of the
default PerSourcePenalties (crash:90), each loss also blocks every client
behind that source address for 90+ seconds.
Reproduction (root, systemd, cgroup v2). Only a throwaway sshd is frozen:
systemd-run --unit=sshd-test /usr/sbin/sshd -D -e -p 2222 -o
ListenAddress=127.0.0.1 -o PidFile=none -o LogLevel=DEBUG3
Then freeze and thaw
/sys/fs/cgroup/system.slice/sshd-test.service/cgroup.freeze
(write 1, then 0) at random 2-20 ms intervals while making ~200 ssh logins
to 127.0.0.1:2222. The full script is in the upstream bug.
Result: 4/200 local logins killed, 103/148 over a network tunnel, 0/200
without the freezer. All audit records showed syscall=219.
Kernel mechanism alone: a `sleep 60` in its own systemd unit shows syscall
230 in /proc/PID/syscall; after one freeze/thaw of its cgroup it shows 219.
Expected: freezing and thawing sshd should not kill pre-auth sessions.
Suggested fix (attached upstream): add
#ifdef __NR_restart_syscall
SC_ALLOW(__NR_restart_syscall),
#endif
to preauth_insns. restart_syscall only continues a call that the filter
already allowed, so the sandbox is not widened. Please consider carrying it
in 26.04 once upstream takes it.
** Affects: openssh (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171094
Title:
sshd-auth killed with SIGSYS (seccomp, restart_syscall) when the
container/process is frozen, e.g. Proxmox LXC replication or snapshot
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2171094/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
