Ports/openssh: Instructions for starting with SystemServer don't work

Author: dwwmmnCreated Jul 28, 2026Updated Jul 28, 2026

Per instructions in Ports/openssh/ReadMe.md, I added this to my sync-local.sh file:

bash

#!/bin/bash

cat <<EOF >> mnt/etc/SystemServer.ini

[SSHServer]
Executable=/usr/local/sbin/sshd
Arguments=-D
KeepAlive=true
SystemModes=text,graphical

[SSHServerGenKeys]
Executable=/usr/local/bin/ssh-keygen
Arguments=-A
KeepAlive=false
SystemModes=text,graphical
EOF

Starting Serenity I can see something is listening on port 22, and that a process called sshd is running. Attempting to SSH from the host results in the ssh command hanging indefinitely, and this line in the debug output:

11181.261 [#0 SystemMonitor(51:51)]: Rejecting path '/usr/local/sbin/sshd' because it hasn't been unveiled

Looking at Ports/openssh/patches/0007-Use-unveil-for-privsep.patch:

@@ -452,12 +452,9 @@ privsep_preauth_child(void)
 
 	/* Demote the child */
 	if (privsep_chroot) {
-		/* Change our root directory */
-		if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
-			fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
-			    strerror(errno));
-		if (chdir("/") == -1)
-			fatal("chdir(\"/\"): %s", strerror(errno));
+		/* Hide the whole filesystem */
+		if (unveil(NULL, NULL) < 0)
+			fatal("unveil(NULL, NULL): %s", strerror(errno));
 
 		/* Drop our privileges */
 		debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid,

I didn't spend a whole lot of time diving into the code, but I'm pretty sure this code is called, as it's part of the main function, and privsep_on is enabled by default in servconf.c, which in turn sets privsep_chroot. As someone new to Serenity and pledge/unveil, I'm not sure I understand it. I would think in order to be useful the ssh daemon would need to at least be able to read and execute /bin/sh. But I'm not 100% sure that is the problem.

Source: SerenityOS/serenity

View original on GitHub View discussion on GitHub