我正在尝试在嵌入式系统（QNAP NAS，内核为 2.6.33.2）的 chroot 中安装 Debian jessie。我成功运行debootstrap以安装基本系统，并且 chroot 正常工作，因为我能够使用 更新软件包apt-get。
添加新用户时出现问题：su总是打印su：严重错误 - 立即中止。以下是打印件：
CHROOT:/# whoami
root
CHROOT:/# id
uid=0(root) gid=0(root) groups=0(root),100(users)
CHROOT:/# su root
su: Critical error - immediate abort
CHROOT:/# adduser newuser
Adding user `newuser' ...
Adding new group `newuser' (1000) ...
Adding new user `newuser' (1000) with group `newuser' ...
Creating home directory `/home/newuser' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for newuser
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n] Y
CHROOT:/# su newuser
su: Critical error - immediate abort
每次我尝试时su都会出现此错误dmesg：
CHROOT:/# dmesg
CHROOT:/# su root
su: Critical error - immediate abort
CHROOT:/# dmesg
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
[ 0.000000] sys_set_ipsec_rules: copy_from_user failed!
这和旧内核版本有关吗？我能做些什么来解决这个问题吗？因为我显然无法升级内核。
顺便说一句，我有一个非常古老的 lenny chroot，它是以这种方式创建的，并且在同一系统中它可以正常运行。
strace su root给出：
### CUT ###
read(3, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
read(3, " issuing \n# the \"mesg y\" command"..., 4096) = 4096
read(3, "It supports passwords of unlimit"..., 4096) = 2286
close(3) = 0
munmap(0xb76e7000, 4096) = 0
access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
_llseek(3, 0, [0], SEEK_SET) = 0
alarm(0) = 0
rt_sigaction(SIGALRM, {0xb7666680, [], 0}, {SIG_DFL, [], 0}, 8) = 0
alarm(10) = 0
fcntl64(3, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0
read(3, "", 384) = 0
fcntl64(3, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0) = 10
rt_sigaction(SIGALRM, {SIG_DFL, [], 0}, NULL, 8) = 0
close(3) = 0
getuid32() = 0
time(NULL) = 1491675822
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
close(3) = 0
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
sendto(3, "p\0\0\0Q\4\5\0\4\0\0\0\0\0\0\0op=PAM:session_o"..., 112, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 112
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\2477\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\2477\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(3) = 0
time(NULL) = 1491675822
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
close(3) = 0
open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=2492, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76e7000
read(3, "# Locale name alias data base.\n#"..., 4096) = 2492
read(3, "", 4096) = 0
close(3) = 0
munmap(0xb76e7000, 4096) = 0
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "su: Critical error - immediate a"..., 37su: Critical error - immediate abort
) = 37
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
sendto(3, "l\0\0\0P\4\5\0\5\0\0\0\0\0\0\0op=PAM:setcred a"..., 108, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 108
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0004<\0\0\0\0\0\0l\0\0\0P\4\5\0\5\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0004<\0\0\0\0\0\0l\0\0\0P\4\5\0\5\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(3) = 0
munmap(0xb73e2000, 8284) = 0
munmap(0xb7324000, 16500) = 0
munmap(0xb7320000, 12384) = 0
munmap(0xb7319000, 24776) = 0
munmap(0xb72fb000, 119488) = 0
munmap(0xb73b7000, 163088) = 0
munmap(0xb7344000, 467256) = 0
munmap(0xb72ca000, 196956) = 0
munmap(0xb73df000, 8220) = 0
munmap(0xb72c7000, 8232) = 0
exit_group(1) = ?
+++ exited with 1 +++
答案1
在另一台 NAS 上安装相同的 Debian jessie 后，较新的内核并看到它工作，我通过比较文件找到了罪魁祸首/etc/pam.d/：它是pam_限制（在 Debian chroot 内部）我认为它与外部旧内核不兼容。
因此，如果我检查有问题的 chroot，我可以看到哪些服务使用了pam_限制和：
CHROOT:/# grep -l "^session.*pam_limits.so" $(find /etc/pam.d -type f)
/etc/pam.d/runuser
/etc/pam.d/login
/etc/pam.d/su
/etc/pam.d/cron
此命令搜索所有默认启用的服务pam_限制运行后你会看到它就su在那里（这就是它失败的原因）。所以我可以通过在前面加上一个#with来注释掉所有这些sed：
CHROOT:/# sed -i "/^session.*pam_limits.so/s/^/#/" $(find /etc/pam.d -type f)
CHROOT:/# grep -l "^session.*pam_limits.so" $(find /etc/pam.d -type f)
发出后sed，不再启用 pam_limits（因为grep现在不打印任何内容），实际上su没有任何dmesg输出：
CHROOT:/# whoami
root
CHROOT:/# dmesg
CHROOT:/# su root
CHROOT:/# dmesg
CHROOT:/# exit
exit
CHROOT:/# whoami
root