sshd runs a program, moves a file, and is refused without its key

[Japabu]

Stage 4 of the network track (issues/hardware/the-t14-answers-only-through-a-usb-stick.md).

Every result from the T14 rides a USB stick because nothing a program prints reaches the harness. sshd is the cable's answer path, and it could carry a shell and nothing else: an exec request ran /system/bin/shell -c, so the diagnostics and the exit status were the shell's; there was no subsystem, so no file moved either way; and the only key file was /home/root/.ssh/authorized_keys, which on a freshly flashed machine is a file nobody can put a key in — /home may be a tmpfs and the machine is unreachable until somebody has already reached it.

The daemon

exec runs the named program, not a shell. SSH carries one string because it has no argument vector; command::split reads it with single quotes, double quotes and backslash, and every other shell metacharacter is an ordinary byte of an argument. shell -c '…' survives the split whole, which is how a client that wants a pipe gets one. stdout is channel data, stderr is the channel's extended data (it was merged into stdout before, so a program's diagnostics were indistinguishable from its output), and the exit status is the channel's exit-status. A line that will not split, a first word that is empty, a name that is neither absolute nor bare, and a spawn the kernel refuses each answer 127 with the reason on stderr — never a channel left open.

The sftp subsystem moves files, draft-ietf-secsh-filexfer-02 version 3 in the profile the bench needs: open, read, write, close, stat and the directory listing. Everything outside it — SETSTAT, FSETSTAT, REMOVE, MKDIR, RMDIR, RENAME, READLINK, SYMLINK, EXTENDED — answers SSH_FX_OP_UNSUPPORTED naming itself, because a SETSTAT that answered OK without setting anything would make a client that checks its own work believe a mode it never got. Nothing acts on a partial packet, and a session that ends on a packet the protocol has no reply for closes with the draft's own SSH_FX_BAD_MESSAGE — 127 is left saying one thing, that this daemon would not run what was asked.

A key installed in the image is read beside the writable one. /system/etc/ssh_authorized_keys is put on ROOT at build time and either file authorizes; /system is the read-only root, so the new file is the less reachable of the two.

A key no file names is refused at the probe. A public-key exchange is an offer carrying the key and no signature, and then — only under USERAUTH_PK_OK — a signature; russh's default answers PK_OK to every offer, which tells a stranger its key would be taken and asks it to prove it holds it. auth_publickey_offered refuses first, so the daemon fails closed at the earliest point the protocol has, and auth_publickey checks again because a client is free to sign without asking.

Nothing this daemon starts outlives the connection that asked for it. That is one rule where the first draft of this branch had four numbers. The session holds a watch sender and every task it spawns holds a subscription: when the connection goes, the input thread ends, the forwarder ends, and the program is killed and waited for before the console says it ended. It replaces EXIT_WAIT — which killed a live program ten seconds after it closed its output — SFTP_IDLE, whose wait ends anyway when the session's sender drops, and a stated inactivity_timeout that restated russh's own default of 600 s and bounded nothing. The one wall clock left is INPUT_STALL, which cannot be an event: the handler offering a program its bytes is the connection's own task, so a program that reads nothing while a client keeps sending would wedge that connection with nothing left able to notice. Its decision is offer, and three host tests judge it.

The harness

tests/ssh-client-host is the client: russh's client half and russh-sftp's, neither of which anybody here wrote, so where the two agree it is because the draft says so. It is its own crate with its own lockfile because russh 0.60 resolves against the RustCrypto release candidates; tests/https-fetch-host is the same shape for the same class of reason, and build_https_hosts is now build_host_judges and builds all three from named rows.

BootOptions::ssh_port is what makes slirp two-way: a hostfwd clause on a free loopback port, and the boot asserts the argv actually carries it, because a harness field that can be silently inert is this suite's worst defect class.

Three names on one tests/sshdcase boot (SSHD_LOGIN), with the key staged into that image:

• sshd_exec — echo byte-exact and 0; a missing program 127 with its name on stderr and nothing on stdout; an unterminated quote 127, refused before anything spawns; test_rs_empty_dir_stat, a real guest test binary, run over the cable and judged by its exit status, which is what the metal profile will do without a flash; cat <staged> <missing>, whose file lands on stdout and whose diagnostic lands on stderr with neither carrying the other's bytes; cat reading the channel's own data back, after an env request the guest answers rather than leaving open; and spin, started and then abandoned, which the guest ends and says it ended.
• sshd_files — the staged authorized_keys file read off the guest and compared with the bytes the build wrote, which never travelled over SFTP; a 1,000-byte file of every byte value out and back; the guest's own listing agreeing about its size; 1 MiB each way.
• sshd_key_auth — a key no file names refused at its offer, seen two ways: the client offers it through a signer that cannot sign and records being asked, and a guest that refused at the probe never asks; and the console line for the offer is not the console line for a signature. The staged key accepted with its fingerprint beside it, and publickey the only method still on offer after the refusal.

sshd_fail_closed now demands both key files be named as unreadable: a check on only the writable one would pass a machine whose image file was silently never consulted.

Priced from run 34200599143's test-durations-merged: sshd_exec 5110, sshd_files 535, sshd_key_auth 1428, all under FAST_COMMIT_MS, so all three are Tier::Fast.

The two checks

Negative controls — six, each a single thing reverted onto this branch's tip, built and run the same way:

control	result
auth_publickey_offered deleted	FAIL sshd_key_auth: the machine asked a key no file names to sign, so it answered PK_OK to a stranger's offer instead of refusing it; the other three green
exec_request back to shell -c	FAIL sshd_exec: \echo` answered "", FAIL sshd_key_auth: the authorized key got Some(127); sshd_files` green
a child's stderr sent as channel data instead of extended data	FAIL sshd_exec: stdout carried "ssh-ed25519 …\n/tmp/no_such_file_for_the_stderr_arm: file not found\n"; the other three green
the child no longer bound to its connection	FAIL sshd_exec: a program outlived the connection that started it: STALLED; the other three green
is_authorized returns true	FAIL sshd_key_auth, at the offer rather than after the signature; the other three green
the sftp arm of subsystem_request removed	FAIL sshd_files: … error starting an sftp session: Timeout; the other three green

Independent oracle — OpenSSH 10.3p1. Not a committed dependency and on no test's path: a temporary arm ran the host's own /usr/bin/ssh and /usr/bin/sftp against the guest through the same forward, then was reverted.

[openssh] ssh exec -> status Some(0) stdout "hello openssh\n" stderr ""
[openssh] ssh missing -> status Some(127) stderr "sshd: cannot run /system/bin/no_such_program_at_all: entity not found\r\n"
[openssh] sftp -> status Some(0);  ls /tmp, get, put, ls /tmp all as expected
[openssh] sftp get of the 1,000-byte file: 1000 bytes, identical=true
[openssh] sftp put of /etc/hosts read back: 214 bytes, identical=true

A mature implementation nobody here wrote read the refusal off stderr and the 127 off the channel's exit status, which is the whole of what the metal profile will judge a test binary by. The draft itself is the other independent reading: the SFTP encode/decode is host-tested against packets built from its own field order, and russh-sftp implements it from the other side.

Issues

Closed: issues/isolation/sshd-accept-path-unexercised.md. It named auth_publickey, auth_publickey_offered and the MethodSet that stops password auth being offered as certified by reading; all three are now exercised — the accepted key, the key refused at its offer, and AuthResult::Failure's remaining_methods, which sshd_key_auth demands be publickey alone.

One commit on this branch, 814020f4, deleted auth_publickey_offered and said no registration could reach it because russh's client signs immediately. That is false: client/encrypted.rs:940-949 sends the key as a probe with no signature — the source's own comment is // This is a probe — and the signature at :1039 follows only under USERAUTH_PK_OK. d301d065 restores the check, says so, and is where the truth is recorded; history is not rewritten.

Filed: issues/isolation/sshd-holds-one-channel-and-does-not-say-so.md — SshSession keeps one channel and one input sender, neither keyed on a ChannelId, so two session channels on one connection alias each other's input. It predates this work and nothing in the tree or in OpenSSH's client reaches it.

No ABI change: nothing under toyos-abi/src, toyos/src or userland/libc/src is touched, and the sysroot claim was never taken.

Measured on the dev host: 29 sshd host tests, 261 toyos-build lib gates, the host workspace (138 suites, 1,337 tests), cargo run -- --clippy clean on all five invocations, and the four sshd names green together in 14.2 s.

🤖 Generated with Claude Code