OpenSSH drops sshd sandboxing on macOS as SDK 27 removes key API

jedisct1 · x · 2026-10-07

OpenSSH 10.6 release notes and commit d4b4c30 show that on macOS with SDK ≥27, sshd will no longer enable its sandbox: Apple removed the kSBXProfilePureComputation API the sandbox relied on and provided no obvious alternative. The build system now skips the Darwin sandbox when the symbol is missing. Bad news for anyone hardening sshd on macOS servers.

Original post →

More from Infra

Infra channel →