Following up to this, I was running testing under this same openvz kernel, and I noticed that su displayed a similar message about setrlimit, and failed.
So perhaps the problem is really in PAM? Or multiple things just don't work with that openvz kernel. -- see shy jo
signature.asc
Description: PGP signature
