0

I'm trying to install Debian jessie inside a chroot on a embedded system (QNAP NAS with kernel 2.6.33.2). I successfully run debootstrap to install the base system and the chroot works correctly because I'm able to update the packages using apt-get.

The problem occurs when adding a new user: su always prints su: Critical error - immediate abort. Here's a printout:

CHROOT:/# whoami
root
CHROOT:/# id
uid=0(root) gid=0(root) groups=0(root),100(users)
CHROOT:/# su root
su: Critical error - immediate abort
CHROOT:/# adduser newuser
Adding user `newuser' ...
Adding new group `newuser' (1000) ...
Adding new user `newuser' (1000) with group `newuser' ...
Creating home directory `/home/newuser' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:

Retype new UNIX password:

passwd: password updated successfully
Changing the user information for newuser
Enter the new value, or press ENTER for the default
        Full Name []:
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n] Y
CHROOT:/# su newuser
su: Critical error - immediate abort

and every time I try su this error appears on dmesg:

CHROOT:/# dmesg
CHROOT:/# su root
su: Critical error - immediate abort
CHROOT:/# dmesg
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!
[    0.000000] sys_set_ipsec_rules: copy_from_user failed!

Is it something related to the old kernel version? Can I do anything to circumvent this issue, as I cannot obviously upgrade the kernel?

By the way, I have a VERY old lenny chroot that was created in this way and in the same system it works correctly.

strace su root gives:

### CUT ###
read(3, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
read(3, " issuing \n# the \"mesg y\" command"..., 4096) = 4096
read(3, "It supports passwords of unlimit"..., 4096) = 2286
close(3)                                = 0
munmap(0xb76e7000, 4096)                = 0
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
_llseek(3, 0, [0], SEEK_SET)            = 0
alarm(0)                                = 0
rt_sigaction(SIGALRM, {0xb7666680, [], 0}, {SIG_DFL, [], 0}, 8) = 0
alarm(10)                               = 0
fcntl64(3, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
read(3, "", 384)                        = 0
fcntl64(3, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0)                                = 10
rt_sigaction(SIGALRM, {SIG_DFL, [], 0}, NULL, 8) = 0
close(3)                                = 0
getuid32()                              = 0
time(NULL)                              = 1491675822
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
sendto(3, "p\0\0\0Q\4\5\0\4\0\0\0\0\0\0\0op=PAM:session_o"..., 112, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 112
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\2477\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\2477\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(3)                                = 0
time(NULL)                              = 1491675822
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=2492, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76e7000
read(3, "# Locale name alias data base.\n#"..., 4096) = 2492
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb76e7000, 4096)                = 0
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "su: Critical error - immediate a"..., 37su: Critical error - immediate abort
) = 37
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
sendto(3, "l\0\0\0P\4\5\0\5\0\0\0\0\0\0\0op=PAM:setcred a"..., 108, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 108
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0004<\0\0\0\0\0\0l\0\0\0P\4\5\0\5\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0004<\0\0\0\0\0\0l\0\0\0P\4\5\0\5\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(3)                                = 0
munmap(0xb73e2000, 8284)                = 0
munmap(0xb7324000, 16500)               = 0
munmap(0xb7320000, 12384)               = 0
munmap(0xb7319000, 24776)               = 0
munmap(0xb72fb000, 119488)              = 0
munmap(0xb73b7000, 163088)              = 0
munmap(0xb7344000, 467256)              = 0
munmap(0xb72ca000, 196956)              = 0
munmap(0xb73df000, 8220)                = 0
munmap(0xb72c7000, 8232)                = 0
exit_group(1)                           = ?
+++ exited with 1 +++
0

After installing the same Debian jessie in another NAS with a newer kernel and seeing it worked, I managed to identify the culprit by comparing the files in /etc/pam.d/: it's pam_limits.so (inside the Debian chroot) which I think is not compatible with the outer older kernel.

So, if I inspect the problematic chroot, I can see which services use pam_limits.so with:

CHROOT:/# grep -l "^session.*pam_limits.so" $(find /etc/pam.d -type f)
/etc/pam.d/runuser
/etc/pam.d/login
/etc/pam.d/su
/etc/pam.d/cron

This command searches all the services which by default are enabling pam_limits.so to run and you see that su is there (that's the reason why it fails). So I can comment out all these by prepending a # with sed in this way:

CHROOT:/# sed -i "/^session.*pam_limits.so/s/^/#/" $(find /etc/pam.d -type f)
CHROOT:/# grep -l "^session.*pam_limits.so" $(find /etc/pam.d -type f)

After issuing sed, there are no more pam_limits enabled (as grep now prints nothing) and in fact the su is working without any dmesg output:

CHROOT:/# whoami
root
CHROOT:/# dmesg
CHROOT:/# su root
CHROOT:/# dmesg
CHROOT:/# exit
exit
CHROOT:/# whoami
root

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.