Documentation
¶
Overview ¶
Command isobox-sshd launches an SSH server inside an isobox sandbox so you can ssh in and explore the confinement interactively, the way a remote user would.
It is a development/inspection helper, not a production SSH daemon. macOS OpenSSH cannot run inside isobox's Seatbelt sandbox: sshd's mandatory preauth privilege-separation child calls sandbox_init(), and the kernel forbids applying a second Seatbelt profile once isobox has applied one. So instead of shelling out to /usr/sbin/sshd, isobox-sshd embeds a small SSH server that runs as the sandboxed command itself and spawns the login shell as its child, so the whole session inherits the isobox.
By default it accepts any login with no credentials. Pass -key to require a specific public key instead.
The process runs in two modes. The default (supervisor) mode compiles an isobox spec that re-execs this same binary in -serve mode inside the sandbox. The -serve mode is the actual SSH server and is not meant to be invoked directly.
Source Files