> sshd(8): On OS X SDK >= 27, sandboxing is no longer supported as the API we depended upon has been removed and no obvious alternative provided.
https://github.com/openssh/openssh-portable/commit/d4b4c304a...
https://github.com/openssh/openssh-portable/commit/d4b4c304a...
It’s what Apple experimented with before they came up with the current entitlements system.
(Restricted entitlements require a provisioning profile which requires a bundle, but restricted entitlements are pretty rare)
"Updated sandbox for privilege-separated pre-authorization sshd process" is listed as a modification to the open-source project, but I suspect this is out-of-date.
They just got burned by the documented usage of sandbox_init() going away (which didn’t even get a mention in the release notes), I can understand why they’d be unexcited about moving to a different deprecated/undocumented API.
So I think it would be up to the team that ports it to Apple, so I think the "Apple Team" is the ones who would worry about sandboxing.
There are a couple of people who have done significant work on OpenBSD's ssh (eg Markus, Theo) and various OpenBSD folks who add a feature or fix a bug and move on.
There is one person who currently works exclusively on -Portable (Tim Rice, who is still around although not very active these days) and at least one other in the past (Andre Lucas, who wrote the multi-platform login recording code). You can see the current set here: https://github.com/openssh/openssh-portable/blob/master/.git...