systemd: sshd: Disable ssh-keygen

The default _sshd.service_ unit runs `ssh-keygen -A` in `ExecStartPre`,
to ensure host keys exist before starting the SSH daemon.
Unfortunately, this tool does _not_ respect the `HostKey` settings in
`sshd_config`, and unconditionally tries to create the key files in
`/etc/ssh`.  Since this directory is not writable, the command fails,
preventing the SSH daemon from starting.

build-rootfs.sh

@@ -76,11 +76,24 @@ if [ -f /mnt/gentoo/etc/udev/hwdb.bin ]; then
     mv /mnt/gentoo/etc/udev/hwdb.bin /mnt/gentoo/usr/lib/udev/
 fi
 
+gccver=$(qlist -I -F '%{PV}' cross-${target}/gcc | sed 's/[^0-9].*//')
+for lib in \
+    libstdc++ \
+    libgcc_s \
+; do
+    cp /usr/lib/gcc/${target}/${gccver}/${lib}.so.* /mnt/gentoo/usr/lib64/
+done
+
 qemu-${target%%-*} \
 /mnt/gentoo/usr/sbin/ldconfig \
     -r /mnt/gentoo \
     -f /mnt/gentoo/etc/ld.so.conf
 
+if [ -d /mnt/gentoo/lib64/security ]; then
+    find /mnt/gentoo/lib64/security -name 'pam_*.so' \
+        -exec mv -t /mnt/gentoo/lib/security {} +
+fi
+
 rm -f /mnt/gentoo/lib/tmpfiles.d/provision.conf
 systemd-tmpfiles --root=/mnt/gentoo -E --exclude-prefix=/var --create
 

overlay/usr/lib/systemd/sshd.service.d/no-keygen.conf

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=

prepare.sh

@@ -42,7 +42,7 @@ if [ ! -f portage/make.conf/10-crossdev.conf ]; then
         > "${O}"/portage/etc/portage/make.conf/10-crossdev.conf
 fi
 
-FEATURES="${FEATURES}" \
+FEATURES="${FEATURES} -preserve-libs -protect-owned" \
 PKGDIR="${PKGDIR}" \
 ${target}-emerge -bk1nvj sys-libs/glibc