% Options for packages loaded elsewhere
\PassOptionsToPackage{unicode}{hyperref}
\PassOptionsToPackage{hyphens}{url}
\documentclass[
  12pt,
  a4paper,
]{scrbook}
\usepackage{xcolor}
\usepackage[margin=0.25in]{geometry}
\usepackage{amsmath,amssymb}
\setcounter{secnumdepth}{-\maxdimen} % remove section numbering
\usepackage{iftex}
\ifPDFTeX
  \usepackage[T1]{fontenc}
  \usepackage[utf8]{inputenc}
  \usepackage{textcomp} % provide euro and other symbols
\else % if luatex or xetex
  \usepackage{unicode-math} % this also loads fontspec
  \defaultfontfeatures{Scale=MatchLowercase}
  \defaultfontfeatures[\rmfamily]{Ligatures=TeX,Scale=1}
\fi
\usepackage{lmodern}
\ifPDFTeX\else
  % xetex/luatex font selection
    \setmainfont[Ligatures=TeX,Extension=.otf,BoldFont=*-bold,UprightFont=*-regular,ItalicFont=*-italic,BoldItalicFont=*-bolditalic,SmallCapsFeatures={Letters=SmallCaps}]{texgyretermes}
    \setsansfont[Ligatures=TeX,Extension=.otf,BoldFont=*-bold,UprightFont=*-regular,ItalicFont=*-italic,BoldItalicFont=*-bolditalic,SmallCapsFeatures={Letters=SmallCaps}]{texgyreheros}
  \setmathfont[Ligatures=TeX]{texgyretermes-math.otf}
\fi
% Use upquote if available, for straight quotes in verbatim environments
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
\IfFileExists{microtype.sty}{% use microtype if available
  \usepackage[]{microtype}
  \UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
}{}
\makeatletter
\@ifundefined{KOMAClassName}{% if non-KOMA class
  \IfFileExists{parskip.sty}{%
    \usepackage{parskip}
  }{% else
    \setlength{\parindent}{0pt}
    \setlength{\parskip}{6pt plus 2pt minus 1pt}}
}{% if KOMA class
  \KOMAoptions{parskip=half}}
\makeatother
\usepackage{longtable,booktabs,array}
\usepackage{calc} % for calculating minipage widths
% Correct order of tables after \paragraph or \subparagraph
\usepackage{etoolbox}
\makeatletter
\patchcmd\longtable{\par}{\if@noskipsec\mbox{}\fi\par}{}{}
\makeatother
% Allow footnotes in longtable head/foot
\IfFileExists{footnotehyper.sty}{\usepackage{footnotehyper}}{\usepackage{footnote}}
\makesavenoteenv{longtable}
\setlength{\emergencystretch}{3em} % prevent overfull lines
\providecommand{\tightlist}{%
  \setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
\input{./doc/manual/header.tex}
\usepackage{bookmark}
\IfFileExists{xurl.sty}{\usepackage{xurl}}{} % add URL line breaks if available
\urlstyle{same}
\hypersetup{
  hidelinks,
  pdfcreator={LaTeX via pandoc}}

\author{}
\date{}

\begin{document}
\frontmatter

\begin{titlepage}
  \centering
  \vspace*{3cm}

  {\Huge\bfseries \thetitle\par}
  \vspace*{3cm}

  \includegraphics[height=0.5\textheight,width=0.5\textwidth,keepaspectratio]{./doc/manual/img/syd}%

  \vspace*{5cm}

  {\large\bfseries \GITAuthorName\par}
  \vspace{0.5cm}
  {\normalsize \VCDateISO\par}
\end{titlepage}

\newpage
\thispagestyle{empty}
\mbox{}

\newpage
\thispagestyle{empty}

\begin{figure}[!ht]
   \centering
   \includegraphics[width=\textwidth,height=\textheight,keepaspectratio]{./doc/manual/img/tao}%
\end{figure}

\newpage
\thispagestyle{empty}

\vspace*{6cm}

{\LARGE\bfseries COPYLEFT}

\vspace*{1cm}

{\large
Written by Ali Polatel. Distributed under the terms of the GNU General
Public License v3. Up-to-date sources can be found at
https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be
submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss
in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.
}

\vspace*{2cm}

{\LARGE\bfseries METADATA\par}

\vspace*{1cm}

\begin{description}
    \large
    \item[\textbf{Author:}] \GITAuthorName
    \item[\textbf{Email:}] \GITAuthorEmail
    \item[\textbf{Date:}] \GITAuthorDate
    \item[\textbf{Commit:}] \GITHash
\end{description}

{
\setcounter{tocdepth}{5}
\tableofcontents
}
\mainmatter
\chapter{sydtutorial(7)}\label{sydtutorial7}

\section{NAME}\label{name}

\textbf{sydtutorial} - Tutorial introduction to Syd

\section{SYNOPSIS}\label{synopsis}

\textbf{syd} *

\section{DESCRIPTION}\label{description}

This tutorial explains how to sandbox applications using Syd, write sandbox profiles, and configure Syd at runtime from within the sandbox. If you are instead primarily interested in using Syd as a package build sandbox, like we do at Exherbo Linux, you may prefer to start with \emph{syd}(2) and the "paludis" profile whose rules you may list using "syd-cat -p paludis".

\section{INTRODUCTION}\label{introduction}

Syd is secure by default and highly configurable for your application\textquotesingle s usecase. As we go towards the steps you are going to learn how to restrict an application in various ways and at the same time keep the sandbox flexible for cases where restriction is not possible and/or needed. To make the most out of this tutorial, you are recommended to pick an application whose systemic functionality is known to you and try and sandbox this application similar to the instructions in the respective chapter. This functionality, above all, includes the system calls the process calls to interact with the Linux kernel and which parts of the filesystem/network the application needs to access to fulfill its functionality correctly. \emph{bpftrace}(1) and \emph{strace}(1) are your friends. In a further chapter we\textquotesingle ll also get to know \emph{pandora}(1) which is a tool to generate Syd profiles automatically for a given application, stay tuned!

In its simplest sense, you can think Syd as a proxy between the Linux kernel and the sandbox process: Syd checks system call arguments for access and if access is granted Syd will execute the system call \emph{on behalf of the sandbox process} and return the result to the sandbox process. Going forward this is important to keep in mind: from the point of view of the Linux kernel, it\textquotesingle s one of Syd\textquotesingle s syscall handler threads that\textquotesingle s running the syscall \emph{not} the sandbox process. This is necessary to achieve a Time-of-check-to-Time-of-use free sandbox. Syd does their best to reduce the side-effects, e.g.~with ls /proc/self, the sandbox process will still see their own process ID, not Syd\textquotesingle s.

\begin{enumerate}
\def\labelenumi{\arabic{enumi}.}
\item
  \textbf{Learn by doing}: Trace your applications, learn the ins-and-outs!
\item
  \textbf{Experiment}: Tweak Syd in various different ways and observe the effects!
\item
  \textbf{Make it a game}: Try and break the own sandbox profile you configured, then make it stricter and retry!
\end{enumerate}

\section{SYD QUICK INSTALL}\label{syd-quick-install}

You have the following alternatives:

\begin{enumerate}
\def\labelenumi{\arabic{enumi}.}
\item
  Use the latest release binary located @ https://distfiles.exherbo.org/\#sydbox/
\item
  cave resolve sys-apps/sydbox:3 \# if Exherbo (unmask with testing keyword)
\item
  emerge sys-apps/syd \# if Gentoo
\item
  cargo install syd \# You will not get the manual pages, check: https://man.exherbo.org
\item
  \textbf{Take the time to package Syd for your Linux distribution and spread the love!}
\end{enumerate}

Note, releases are signed with this PGP key https://keybase.io/alip/pgp\_keys.asc, so take the time to verify the tarball you downloaded. If using cargo to install, you need to install the "libseccomp" library manually. This is a relatively common library and it\textquotesingle s packaged by almost all Linux distributions these days. Two things to keep in mind:

\begin{enumerate}
\def\labelenumi{\arabic{enumi}.}
\item
  Install libseccomp development headers (usually included or comes with e.g.~the package libseccomp-devel).
\item
  Install libseccomp static libraries if you want to link Syd statically (usually included or comes with e.g.~the package libseccomp-static).
\end{enumerate}

One final note, at the time of writing with libseccomp version 2.5.5, a patched libseccomp is required to make interrupts work correctly under Syd (libseccomp.git has support for the new Linux kernel flag already, we also add a patch to set it by default). The binary release is built with a patched libseccomp and Exherbo source build patches the libseccomp package during preparation phase. Note, in our experience, this bug is mostly noticeable when you sandbox applications written in the Go language. Otherwise, you\textquotesingle ll rarely notice it with the latest libseccomp release version. For reference, the patchset resides here: https://gitlab.exherbo.org/exherbo/arbor/-/tree/master/packages/sys-libs/libseccomp/files

\section{SYD 101}\label{syd-101}

First, if you run Syd without arguments, you\textquotesingle ll silently drop into a new shell. This is because Syd is designed to act as a login shell and in this case it uses the "user" sandbox profile. We\textquotesingle ll get to profiles at a later chapter but if you\textquotesingle re curious do "syd-cat -p user \textbar{} less" and read through the rules.

Second, Syd is secure by default and allows you to construct a sandbox to your applications\textquotesingle{} needs. Here is how the state of the sandbox looks before we pass any options to Syd:

{\scriptsize \begin{verbatim}
$ syd -mstat
syd:
Process ID: 0
Lock: None
Capabilities: Read, Stat, Write, Execute, Connect, Bind
Options:
Memory Max: 134217728
Virtual Memory Max: 4294967296
Pid Max: 128
SegvGuard Max Crashes: 5
SegvGuard Expiry: 120 seconds
SegvGuard Suspension: 600 seconds
Allowed UID Transitions: (total: 0, source -> target)
Allowed GID Transitions: (total: 0, source -> target)
Cidr Rules: (total 0, highest precedence first)
Glob Rules: (total 0, highest precedence first)
Mask Rules: (total 1)
1. Pattern: /proc/cmdline
Force Rules: (total 0, default action: Kill)
$
\end{verbatim}}

For now let\textquotesingle s just take into attention the "Capabilities" line. These are the sandboxing types that are enabled at startup by default.

Initially, we\textquotesingle ll do the bare minimum and try to execute a statically linked binary under Syd. \emph{busybox}(1) is a handy tool for our experiment:

{\scriptsize \begin{verbatim}
$ file $(which busybox)
/usr/host/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
$ syd busybox true
syd: exec error: No such file or directory
$ echo $?
2
$ syd-sys -e 2
2       ENOENT  No such file or directory
$
\end{verbatim}}

We get an error that the path does not exist. This is because "Stat Sandboxing" is on by default and the path to the \emph{busybox}(1) binary is hidden. We can see that Syd makes clear by its exit value which error caused the execution to fail. We use the utility \emph{syd-sys}(1), one of the many utilities that come with \emph{syd}(1), to look up the error definition by the exit code.

Let\textquotesingle s try to allow and retry:

{\scriptsize \begin{verbatim}
$ syd -m'allow/stat+/usr/host/bin/busybox' busybox true
syd: exec error: No such file or directory
$
\end{verbatim}}

No luck, we get the same error. This is because the path we specified to "allow/stat" is not a canonicalised path. A canonicalised path is a path which begins with "/" and has neither "." nor ".." nor repeating slashes nor any symbolic links in any of its path components. Let\textquotesingle s find out the canonicalised path to our \emph{busybox}(1) binary and retry with it.

{\scriptsize \begin{verbatim}
$ readlink -f /usr/host/bin/busybox
/usr/x86_64-pc-linux-musl/bin/busybox
$ syd -m'allow/stat+/usr/x86_64-pc-linux-musl/bin/busybox' busybox true
{"act":"Deny","cap":"x","ctx":"access","id":"nostalgic_black","l":2,"path":"/usr/x86_64-pc-linux-musl/bin/busybox","pid":2602591,"sys":"execve","uid":1000,...}
syd: exec error: Permission denied
$ echo $?
13
$ syd-sys -e 13
13      EACCES  Permission denied
$
\end{verbatim}}

We get an error again, but this time we have context. Since Stat Sandboxing is about hiding paths, reporting access violations about it on standard error would beat its purpose so Syd was quiet. However, this time we see "Exec Sandboxing" at play and Syd gives us details about the access violation. The format is JSON lines. It may be hard to read at first but the fact that it\textquotesingle s easily parseable allows you to easily search for Syd access violation logs in your system log and filter using tools such as \emph{jq}(1).

Back to the task, for now let\textquotesingle s briefly observe that this was an access violation ("ctx":"access") about the \emph{execve}(2) system call ("sys":"execve"). The access violation is of category Exec ("cap":"x") and the target path is "/usr/x86\_64-pc-linux-musl/bin/busybox". The decision was to deny the system call ("act":"Deny"). We also have useful metadata such as the process ID ("pid") and the user ID ("uid") executing the offending system call. The "id" field is a human-readable name generated from the "pid" field to make logs easier to follow. There are more information in the omitted fields, it\textquotesingle s recommended that you take a look at a complete access violation log entry on your own and make note of the fields that are of value to you. Let\textquotesingle s this time allow our \emph{busybox}(1) binary for exec and retry:

{\scriptsize \begin{verbatim}
$ syd -m'allow/exec,stat+/usr/x86_64-pc-linux-musl/bin/busybox' busybox true
$ echo $?
$ 0
\end{verbatim}}

Task accomplished! Note, how we used the short notation "allow/exec,stat+/path" which is a convenient way to pass -m "allow/exec+/path" -m "allow/stat+/path" as a single rule.

Now let\textquotesingle s try again with a dynamically linked executable and figure out what we have to add to make it work. This time we will use the \emph{gtrue}(1) utility from the GNU coreutils project which is dynamically linked on this system:

{\scriptsize \begin{verbatim}
$ file $(which gtrue)
/usr/host/bin/gtrue: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /usr/x86_64-pc-linux-musl/lib/ld-musl-x86_64.so.1, stripped
$ lddtree $(which gtrue)
/usr/x86_64-pc-linux-musl/lib/ld-musl-x86_64.so.1 => /usr/x86_64-pc-linux-musl/lib/libc.so
libc.so => /usr/x86_64-pc-linux-musl/lib/libc.so
$ readlink -f $(which gtrue)
/usr/x86_64-pc-linux-musl/bin/gtrue
$ syd -m'allow/exec,stat+/usr/x86_64-pc-linux-musl/bin/gtrue' gtrue
{"act":"Kill","cap":"x","ctx":"access","id":"compassionate_spence","l":2,"path":"/usr/x86_64-pc-linux-musl/lib/libc.so","pid":2601331,"sys":"exec","uid":1000,...}
$ echo $?
137
$
\end{verbatim}}

Observing the offending path of the new access violation, we understand libc.so is denied execution access. We can also observe, this time Syd has terminated the process ("act":"Kill") rather than denying access to the system call ("act":"Deny"). This is also evident from the exit code which is 137 = 128 + 9 where 9 is the value of the signal "SIGKILL". The deny/kill distinction stems from Syd internals and is not significant for us at this point. Suffice it to say in both cases the execution has been stopped before any code of the target binary had a chance to run.

During access check for Exec Sandboxing, Syd treats dynamically linked executables and their tree of dynamic library dependencies as a single unit. In that sense "allow/read+/path/to/libc.so" and "allow/exec+/path/to/libc.so" serves two different purposes: the former allows you to literally read the contents of the file whilst the latter allows you to load the file into memory as part of an executable.

Having clarified that, let\textquotesingle s allow libc.so and retry:

{\scriptsize \begin{verbatim}
$ syd -m'allow/exec,stat+/usr/x86_64-pc-linux-musl/bin/gtrue' -m 'allow/exec+/usr/x86_64-pc-linux-musl/lib/libc.so' gtrue
$ echo $?
0
$
\end{verbatim}}

Task accomplished! Curious reader will recognise we did not have to add an "allow/stat" clause for "libc.so". This is because the concepts of Stat Sandboxing and Path Hiding pertain specifically to direct access to file paths. Loading libraries into memory is part of the execution process and is therefore only subject to Exec Sandboxing (and Force Sandboxing, aka Binary Verification, which we\textquotesingle ll talk more about later).

Now at the third step, let\textquotesingle s generalise our small sandbox such that it will allow whichever version of the \emph{true}(1) binary we execute, moreover it will also allow the execution of any other coreutils utility prefixed with "g*". We also do not want to worry if "libc.so" has a version suffix and want to allow all libraries under the common library paths without having to list them one by one. To achieve all this we\textquotesingle re going to use \emph{glob}(3) patterns:

{\scriptsize \begin{verbatim}
$ eclectic coreutils list
Available providers for coreutils:
[1]   gnu
[2]   busybox *
$ readlink -f /bin/true
/usr/x86_64-pc-linux-musl/bin/busybox
$ syd -m'allow/stat,exec+/usr/**/bin/{busybox,g*}' -m 'allow/exec+/usr/**/lib*/*.so*' true
$ echo $?
0
$ doas eclectic coreutils set -1
$ readlink -f /bin/true
/usr/x86_64-pc-linux-musl/bin/gtrue
$ syd -m'allow/stat,exec+/usr/**/bin/{busybox,g*}' -m 'allow/exec+/usr/**/lib*/*.so*' true
$ echo $?
0
$
\end{verbatim}}

We have seen how \emph{glob}(3) patterns make life easy for us in configuring our sandbox. We have seen using "**" is possible to match recursively and alternates of the form "\{foo,bar\}" are supported. Syd also supports \textbf{empty} alternates of the form "foo/\{bar/,\}baz" and the \textbf{triple star extension}, ie "foo/***" is equivalent to the combination of the two patterns "foo" and "foo/**". Finally we can see we managed to allow a lot more using the same number of rules. Syd has many more powerful features that makes rule editing simple and efficient such as:

\begin{itemize}
\item
  You may specify denylisted paths with "deny/" in addition to "allow/".
\item
  You may specify filtered paths with "filter/", similar to "deny/" and "allow/" to quiet access violations but still deny access.
\item
  If more than one rule matches the target path, \textbf{the last matching rule wins.}
\item
  Many rules may be assembled into a configuration file and passed to Syd with \emph{-P\textless path\textgreater{}}.
\item
  Files having common rulesets can be included from other configuration files using the "include \textless path\textgreater" clause.
\item
  Relative paths in "include" clauses are canonicalised based on the parent directory of the current configuration file (\emph{not} the current working directory!).
\item
  Environment variables are expanded in configuration files. Unset environment variables will cause an error.
\item
  Configuration can be locked at any point with the "lock:on" clause preventing further edits to the sandbox.
\end{itemize}

At this point you\textquotesingle re highly recommended to experiment with configuring Syd. Do not be afraid to add as many rules as you like. Internally, Syd keeps \emph{glob}(3) patterns as \textbf{globsets} and compiles them into a single \textbf{regular expression} for efficient matching. This offers acceptable performance up to roughly 10k rules on my system, your mileage may vary.

We have taken a sneak peek at how to configure Syd path allowlists. This is similar for other sandboxing types. Let\textquotesingle s leave those for later and explore another way of configuring Syd. This time we\textquotesingle ll do it at runtime, from within the sandbox. It may come as a shock from a security perspective to allow access to the sandbox policy from within the sandbox but Syd has a fair set of restrictions to provide this usecase securely and as we\textquotesingle ll see later this gives the chance to restrict the sandbox process even further. Another alternative is to make Syd load a dynamic library at startup rather than running a command which is another advanced topic for later. The idea of runtime configuration depends on the \textbf{Sandbox Lock} and the lock can have three states: "on", "off", and "exec". The first two are self-explanatory while "exec", allows access to the sandbox policy only for the initial sandbox process. Once the sandbox lock is set to "on", there is no turning back so subsequent edits to the sandbox will no longer be possible. Now let\textquotesingle s execute a shell under Syd. This time we will not submit any configuration at startup and run Syd without arguments. This is going to put Syd into login mode when Syd will use the builtin, dynamic "user" profile and spawn a shell. We will not delve into details of the user profile for now, check out "syd-cat -p user" if you\textquotesingle re curious. Suffice it to say it provides a relatively safe set of access rules to system paths and read+write access to your HOME directory and user "/run"time paths. In addition, Syd comes with a shell library, called "esyd", that makes Syd interaction easier:

{\scriptsize \begin{verbatim}
TODO
\end{verbatim}}

\section{AUTHORS}\label{authors}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd(7)}\label{syd7}

\section{NAME}\label{name-1}

Overview of sandboxing with Syd

\section{SANDBOXING}\label{sandboxing}

The list of available sandboxing categories is given below:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{stat} & Confine file metadata accesses. This sandboxing category may be used to effectively \emph{hide files and directories} from the sandbox process. List of filtered system calls are \emph{access}(2), \emph{faccessat}(2), \emph{faccessat2}(2), \emph{getdents64}(2), \emph{readlink}(2), \emph{readlinkat}(2) \emph{stat}(2), \emph{fstat}(2), \emph{lstat}(2), \emph{statx}(2), \emph{newfstatat}(2), \emph{getxattr}(2), \emph{getxattrat}(2), \emph{lgetxattr}(2), \emph{fgetxattr}(2), \emph{listxattr}(2), \emph{listxattrat}(2), \emph{flistxattr}(2), \emph{llistxattr}(2), \emph{statfs}(2), \emph{statfs64}(2), \emph{fstatfs}(2), \emph{fstatfs64}(2), \emph{fanotify\_mark}(2), and \emph{inotify\_add\_watch}(2). In addition, paths may be masked using the \emph{mask} command. In this case, all filtered system calls on the path will be executed on the character device /dev/null instead. See the description of the \emph{mask} command in \emph{syd}(2) manual page for more information. \\
\textbf{walk} & Confine path traversals. This sandboxing category is used during path canonicalization to confine path traversals. As such, its arguments are not necessarily fully canonicalized paths but they\textquotesingle re guaranteed to be absolute paths without any \textbf{.} (dot) or \textbf{..} (dotdot) components. It has been split from the \emph{stat} category as of version 3.39.0. Together with the \emph{stat} category, path hiding provides a full implementation resilient against attempts to unhide otherwise hidden paths by passing through them during path canonicalization. Notably, OpenBSD\textquotesingle s \emph{unveil}(2) pioneered similar capabilities and remains a widely respected, mature reference implementation. \\
\textbf{read} & Confine file reads. List of filtered system calls are \emph{open}(2), \emph{openat}(2) and \emph{openat2}(2) with the \textbf{O\_RDONLY} or \textbf{O\_RDWR} flags. \\
\textbf{write} & Confine file writes. List of filtered system calls are \emph{open}(2), \emph{openat}(2) and \emph{openat2}(2) with the \textbf{O\_WRONLY} or \textbf{O\_RDWR} flags. \\
\textbf{exec} & Confine binary execution and dynamic library loading. The list of filtered system calls are \emph{execve}(2), \emph{execveat}(2), \emph{mmap}(2), \emph{mmap2}(2), and \emph{memfd\_create}(2). Note, for scripts access check is done for both the script and the interpreter binary. As of version 3.16.3, Syd checks the paths of the dynamic libraries an executable is linked against for exec access as well. This only works for ELF binaries. As of version 3.21.2, Syd seals memory file descriptors as non-executable by default, therefore memory file descriptors are not checked for exec access unless the option \emph{trace/allow\_unsafe\_memfd:1} is set to lift this restriction. As of version 3.21.3, Syd hooks into \emph{mmap}(2) and \emph{mmap2}(2) system calls and checks the file descriptor for exec access when the memory protection mode includes \textbf{PROT\_EXEC} and flags does not include \textbf{MAP\_ANONYMOUS} which typically indicates a \emph{dlopen}(3). Therefore, libraries dynamically loaded at runtime are checked for exec access as well. In addition, \textbf{SegvGuard} is used to deny execution if binary is crashing repeatedly which is similar to the implementation of Grsecurity \& HardenedBSD. See the \textbf{SegvGuard} section for more information. \\
\textbf{ioctl} & Confine \emph{ioctl}(2) requests. Use \textbf{lock/ioctl} to confine \emph{ioctl}(2) system call for filesystem access. This feature may be used to effectively access GPU, PTY, DRM, and KVM etc. safely. \emph{ioctl}(2) requests may be allowed or denied by adding them to the respective list using the options \emph{allow/ioctl+} and \emph{deny/ioctl+}. As of version 3.38.0, architecture-agnostic \emph{ioctl}(2) decoding was introduced, allowing ioctls to be specified by name in addition to numeric values. See the \emph{syd}(2) manual page for more information. \\
\textbf{create} & Confine creation of regular files and memory file descriptors. List of filtered system calls are \emph{creat}(2), \emph{mknod}(2), \emph{mknodat}(2), and \emph{memfd\_create}(2). In addition, open system calls \emph{open}(2), \emph{openat}(2), and \emph{openat2}(2) are filtered if the flag \textbf{O\_CREAT} is set and the flag \textbf{O\_TMPFILE} is not set in arguments. \emph{memfd\_create}(2) name argument is prepended with \emph{!memfd:} before access check. Use e.g.~\emph{deny/create+!memfd:**} to deny access to memory file descriptors regardless of name. As of version 3.37.0, \emph{memfd\_create}(2) name argument is prepended with \emph{!memfd-hugetlb:} before access check in case flags include \textbf{MFD\_HUGETLB}. \\
\textbf{delete} & Confine file deletions. List of filtered system calls are \emph{unlink}(2) and \emph{unlinkat}(2). As of version 3.33.0, \emph{unlinkat}(2) is confined by this category if and only if \textbf{AT\_REMOVEDIR} is not set in flags, otherwise it\textquotesingle s confined by the \emph{rmdir} category. \\
\textbf{rename} & Confine file renames and hard links. List of filtered system calls are \emph{rename}(2), \emph{renameat}(2), \emph{renameat2}(2), \emph{link}(2), and \emph{linkat}(2). \\
\textbf{symlink} & Confine creation of symbolic links. List of filtered system calls are \emph{symlink}(2) and \emph{symlinkat}(2). \\
\textbf{truncate} & Confine file truncations. List of filtered system calls are \emph{truncate}(2), \emph{truncate64}(2), \emph{ftruncate}(2), \emph{ftruncate64}(2), and \emph{fallocate}(2). In addition, open system calls \emph{open}(2), \emph{openat}(2), and \emph{openat2}(2) are filtered if the flag \textbf{O\_TRUNC} is set in arguments and the flags \textbf{O\_TMPFILE} or \textbf{O\_CREAT} are not set in arguments. \\
\textbf{chdir} & Confine directory changes. List of filtered system calls are \emph{chdir}(2) and \emph{fchdir}(2). Additional hardening may be achieved using the \emph{trace/deny\_dotdot:1} option to deny parent directory traversals. It is possible to set this option at runtime before sandbox is locked. This allows for incremental confinement. See the \textbf{Path Resolution Restriction For Chdir and Open Calls} section for more information. \\
\textbf{readdir} & Confine directory listings. List of filtered system calls are \emph{open}(2), \emph{openat}(2), and \emph{openat2}(2) when they\textquotesingle re called on an existing directory regardless of the \textbf{O\_DIRECTORY} flag. \\
\textbf{mkdir} & Confine creation of directories. List of filtered system calls are \emph{mkdir}(2), \emph{mkdirat}(2), \emph{mknod}(2) and \emph{mknodat}(2). \\
\textbf{rmdir} & Confine deletion of directories. List of filtered system calls are \emph{rmdir}(2) and \emph{unlinkat}(2). Note \emph{unlinkat}(2) is confined by this category if and only if \textbf{AT\_REMOVEDIR} is set in flags, otherwise it\textquotesingle s confined by the \emph{delete} category. This category was split from the \emph{delete} category as of version 3.33.0. \\
\textbf{chown,~chgrp} & Confine owner and group changes on files. List of filtered system calls are \emph{chown}(2), \emph{chown32}(2), \emph{fchown}(2), \emph{fchown32}(2), \emph{lchown}(2), \emph{lchown32}(2), and \emph{fchownat}(2). \\
\textbf{chmod} & Confine mode changes on files. List of filtered system calls are \emph{chmod}(2), \emph{fchmod}(2), \emph{fchmodat}(2), and \emph{fchmodat2}(2). In addition, a \emph{umask}(2) value may be set using the \emph{trace/force\_umask} option which is enforced at \emph{chmod}(2) boundary as well as during regular file creation, e.g.~setting \emph{trace/force\_umask:7177} effectively disallows setting s\{u,g\}id bits, all group+other bits and execute bit for the current user. This feature is useful in setting up W\^{}X (Write XOR Execute) configuration for the sandbox. \\
\textbf{chattr} & Confine extended attribute changes on files. List of filtered system calls are \emph{setxattr}(2), \emph{setxattrat}(2), \emph{fsetxattr}(2), \emph{lsetxattr}(2), \emph{removexattr}(2), \emph{removexattrat}(2), \emph{fremovexattr}(2), and \emph{lremovexattr}(2). In addition, Syd ensures extended attributes whose name start with the one of the prefixes \emph{security.}, \emph{trusted.} and \emph{user.syd.} can not be listed or tampered by the sandbox process unless the sandbox lock is \emph{off} for the respective process. This access can be permitted to the initial sandbox process with \emph{lock:exec} or to all sandbox processes with \emph{lock:off}. As of version 3.37.0, this restriction may be lifted with \emph{trace/allow\_unsafe\_xattr:1}. \\
\textbf{chroot} & Confine change of the root directory using the \emph{chroot}(2) system call. This sandboxing category can be disabled with \emph{trace/allow\_unsafe\_chroot:1} at startup, when the \emph{chroot}(2) system call becomes a no-op. Similarly the \emph{pivot\_root}(2) system call is denied with the \emph{errno}(3) \textbf{EPERM} by default unless \emph{trace/allow\_unsafe\_pivot\_root:1} is set at startup in which case it becomes a no-op like \emph{chroot}(2). Note, though, no actual change of root directory takes place either way. \textbf{Syd must share the root directory with the sandbox process to work correctly.} Instead, Syd will prevent all filesystem access after the first allowed \emph{chroot}(2) attempt regardless of the root directory argument. The only exception to the prevention of filesystem access is the \emph{chdir}(2) system call with the specific argument \textbf{/}, aka the root directory, is allowed. This ensures a TOCTOU-free way to support the common use-case of cutting all filesystem access by means of a \emph{chroot}(2) call to /var/empty which is common case among unix daemons. This sandboxing category does not depend on the Linux capability \textbf{CAP\_SYS\_CHROOT}, therefore can be used in unprivileged context. Syd drops the \textbf{CAP\_SYS\_CHROOT} Linux capability by default unless \emph{trace/allow\_unsafe\_caps:1} is passed at startup. \\
\textbf{utime} & Confine last access and modification time changes on files. List of filtered system calls are \emph{utime}(2), \emph{utimes}(2), \emph{futimesat}(2), \emph{utimensat}(2), and \emph{utimensat\_time64}(2). \\
\textbf{mkbdev} & Confine block device creation. List of filtered system calls are \emph{mknod}(2) and \emph{mknodat}(2). Block device creation is disabled by default to adhere to the principle of secure defaults with a kernel level seccomp-bpf filter which terminates the process on violation. This filter includes the Syd process, so a compromised Syd process will not be able to create block devices either. Therefore, the user must opt-in at startup using the \emph{trace/allow\_unsafe\_mkbdev:1} option to use this category for path-based access checks on block devices. \\
\textbf{mkcdev} & Confine character device creation. List of filtered system calls are \emph{mknod}(2) and \emph{mknodat}(2). Character device creation is disabled by default to adhere to the principle of secure defaults with a kernel level seccomp-bpf filter which terminates the process on violation. This filter includes the Syd process, so a compromised Syd process will not be able to create character devices either. Therefore, the user must opt-in at startup using the \emph{trace/allow\_unsafe\_mkcdev:1} option to use this category for path-based access checks on character devices. \\
\textbf{mkfifo} & Confine named pipe (FIFO) creation. List of filtered system calls are \emph{mknod}(2) and \emph{mknodat}(2). \\
\textbf{mktemp} & Confine temporary file creation. List of filtered system calls are \emph{open}(2), \emph{openat}(2), and \emph{openat2}(2) with the \textbf{O\_TMPFILE} flag. A rule such as \emph{allow/mktemp+/tmp} permits the sandbox process to create \emph{anonymous} temporary files under the directory /tmp. Note, the creation of regular files of temporary nature are confined by the \textbf{create} category instead. \\
\textbf{net} & Confine network access. Socket types UNIX, IPv4, IPv6, NetLink and KCAPI are supported, use the option \emph{trace/allow\_unsupp\_socket:1} to pass-through sockets of unsupported types. Note, UNIX domain sockets are always matched on absolute path, therefore always start with the character \textbf{/}. UNIX abstract sockets are prefixed with the *** character before access check. Similarly unnamed UNIX sockets use the dummy path \emph{!unnamed} for access check. Finally, network sandboxing concentrates on confining the initial connection action and leaves out the system calls \emph{recvfrom}(2), \emph{recvmsg}(2) and \emph{recvmmsg}(2) as out of scope for sandbox confinement for performance reasons and due to a lack of security implications noting the fact that recv* system calls cannot specify target addresses. \\
\textbf{net/bind} & Confine binding network access. This category confines the \emph{bind}(2) system call, UNIX domain socket file creation using the \emph{mknod}(2) and \emph{mknodat}(2) system calls, and UNIX socket-pair creation using the \emph{socketpair}(2) system call. \emph{socketpair}(2) system call uses the dummy path \emph{!unnamed} for access check. Unnamed UNIX sockets use the same dummy path. \\
\textbf{net/connect} & Confine connecting network access. List of filtered system calls are \emph{connect}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2). For IPv4 and IPv6 sockets, the target address of these system calls are also checked against the IP blocklist, see the description of the \emph{block} command in \emph{syd}(2) manual page for more information. \\
\textbf{net/sendfd} & Confine sending of file descriptors. The list of filtered system calls are \emph{sendmsg}(2) and \emph{sendmmsg}(2). As of version 3.31.0, file descriptors referring to block devices, directories and symbolic links may not be passed. The restriction on block devices can be lifted with \emph{trace/allow\_unsafe\_mkbdev:1}. UNIX domain sockets are always matched on absolute path, therefore always start with the character \textbf{/}. UNIX abstract sockets are prefixed with the \emph{ (at sign) character before access check. Similarly unnamed UNIX sockets use the dummy path }!unnamed* for access check. \\
\textbf{net/link} & Confine \emph{netlink}(7) sockets used in communication between kernel and user space. This sandboxing category may be used to specify a list of \emph{netlink}(7) families to allow for the sandbox process. Use e.g.~\emph{allow/net/link+route} to allow the \textbf{NETLINK\_ROUTE} family. See the \emph{syd}(2) manual page for more information. \\
\textbf{lock/read} & Use \emph{landlock}(7) to confine file read access. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_READ\_FILE} and only applies to the content of the directory not the directory itself. As of version 3.33.0, \emph{lock/exec} and \emph{lock/readdir} access rights are confined in their respective categories. Previously, this category included the access rights \textbf{LANDLOCK\_ACCESS\_FS\_EXECUTE} and \textbf{LANDLOCK\_ACCESS\_FS\_READ\_DIR} as well. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/write} & Use \emph{landlock}(7) to confine file write access. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_WRITE\_FILE} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/exec} & Use \emph{landlock}(7) to confine file execution. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_EXECUTE} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/ioctl} & Use \emph{landlock}(7) to confine \emph{ioctl}(2) operations. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_IOCTL\_DEV} and only applies to the content of the directory not the directory itself. This access right is supported as of Landlock ABI version 4 which was introduced with Linux-6.7. This command has no effect when running on older Linux kernels. Use \emph{syd-lock}(1) to check the latest Landlock ABI supported by the running Linux kernel. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/create} & Use \emph{landlock}(7) to confine file creation, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_REG} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/delete} & Use \emph{landlock}(7) to confine file unlinking, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_REMOVE\_FILE} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/rename} & Use \emph{landlock}(7) to confine link or rename a file from or to a different directory (i.e.~reparent a file hierarchy). This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_REFER} and only applies to the content of the directory not the directory itself. This access right is supported as of Landlock ABI version 2 which was introduced with Linux-5.19. This command has no effect when running on older Linux kernels. Use \emph{syd\_lock}(1) to check the latest Landlock ABI supported by the running Linux kernel. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/symlink} & Use \textbf{Landlock LSM} to confine symbolic link creation, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_SYM} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/truncate} & Use \textbf{Landlock LSM} to confine file truncation with \emph{truncate}(2), \emph{ftruncate}(2), \emph{creat}(2), or \emph{open(2)} with \textbf{O\_TRUNC}. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_TRUNCATE} and only applies to the content of the directory not the directory itself. This access right is supported as of Landlock ABI version 3 which was introduced with Linux-6.2. This command has no effect when running on older Linux kernels. Use \emph{syd-lock}(1) to check the latest Landlock ABI supported by the running Linux kernel. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/readdir} & Use \textbf{Landlock LSM} to confine directory listings. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_READ\_DIR} and applies to the given directory and the directories beneath it. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/mkdir} & Use \textbf{Landlock LSM} to confine directory creation and renames. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_DIR} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/rmdir} & Use \textbf{Landlock LSM} to confine directory deletion and renames. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_REMOVE\_DIR} and only applies to the content of the directory not the directory itself. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/mkbdev} & Use \textbf{Landlock LSM} to confine block device creation, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_BLOCK}. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/mkcdev} & Use \textbf{Landlock LSM} to confine character device creation, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_CHAR}. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/mkfifo} & Use \textbf{Landlock LSM} to confine named pipe (FIFO) creation, renames and links. This category corresponds to the \emph{landlock}(7) access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_FIFO}. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/bind} & Use \textbf{Landlock LSM} to confine network ports for \emph{bind}(2) and UNIX domain socket creation, renames and links. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_NET\_BIND\_TCP} for network ports, and \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_SOCK} for UNIX domain sockets. The latter access right only applies to the content of the directory not the directory itself. The access right \textbf{LANDLOCK\_ACCESS\_NET\_BIND\_TCP} is supported as of Landlock ABI version 4 which was introduced with Linux-6.7. This command has no effect when running on older Linux kernels. Use \emph{syd\_lock}(1) to check the latest Landlock ABI supported by the running Linux kernel. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{lock/connect} & Use \textbf{Landlock LSM} to confine network ports for \emph{connect}(2). This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_NET\_CONNECT\_TCP}. This access right is supported as of Landlock \textbf{ABI} version 4 which was introduced with Linux-6.7. This command has no effect when running on older Linux kernels. Use \emph{syd\_lock}(1) to check the latest Landlock ABI supported by the running Linux kernel. This category is enforced completely in kernel-space so it can be used to construct a multi-layered sandbox. See the \textbf{Lock Sandboxing} section for more information. \\
\textbf{block} & Application firewall with capability to include \emph{ipset} and \emph{netset} files. List of filtered system calls are \emph{accept}(2), \emph{accept4}(2), \emph{connect}(2), \emph{sendto}(2), \emph{sendmsg}(2), \emph{sendmmsg}(2). IPv4 and IPv6 family sockets are supported. Source and target addresses are checked against the IP blocklist. Refer to the description of the \textbf{block} command in \emph{syd}(2) manual page for more information. \\
\textbf{fs} & Confine file opens based on filesystem type. By default, no filesystem types are allowed. To make this sandboxing practical, the \emph{fs} profile included by the \emph{linux} profile allows all filesystem types except aafs, bpf\_fs, securityfs, selinux, smack, debugfs, pstorefs, tracefs, cgroup, cgroup2, nsfs, pid\_fd, rdtgroup, devmem, efivarfs, hostfs, mtd\_inode\_fs, openprom, daxfs, secretmem, bdevfs, binderfs, usbdevice, xenfs, and zonefs. Use \emph{allow/fs+\textless fstype\textgreater{}} to allow a filesystem type. \\
\textbf{force} & Verified Execution: Verify binary/library integrity at \emph{exec}(3)/\emph{mmap}(2) time which is similar to \textbf{Veriexec} (NetBSD) \& \textbf{IntegriForce} (HardenedBSD). See the \textbf{Force Sandboxing} section for more information. \\
\textbf{tpe} & Trusted Path Execution: Execution only allowed from \textbf{Trusted directories} for \textbf{Trusted files} which are not writable by group or others and are optionally owned by root or current user. This feature is similar to the implementation of Grsecurity \& HardenedBSD. See the \textbf{TPE Sandboxing} section for more information. \\
\textbf{crypt} & Transparent File Encryption with AES-CTR and HMAC-SHA256, see the \textbf{Crypt Sandboxing} section for more information. \\
\textbf{proxy} & SOCKS5 proxy forwarding with network namespace isolation. Defaults to TOR. See the \textbf{Proxy Sandboxing} section for more information. \\
\textbf{pty} & Run sandbox process inside a new pseudoterminal. See the \textbf{PTY Sandboxing} section for more information. \\
\textbf{mem,~pid} & Memory and PID sandboxing: Simple, unprivileged alternatives to Control Groups. See the \textbf{Memory Sandboxing} and \textbf{PID Sandboxing} sections for more information. \\
\textbf{SafeSetID} & Safe user/group switching with predefined UID/GID transitions like \textbf{SafeSetID} of the \textbf{Linux} kernel. See the \textbf{SafeSetID} section for more information. \\
\textbf{Ghost~mode} & Detach Syd from the sandbox process, similar to \emph{seccomp}(2) Level 1, aka "Strict Mode". See the \textbf{Ghost mode} section for more information. \\
\end{xltabular}

Sandboxing for a category may be \emph{on} or \emph{off}: If sandboxing is off, none of the relevant system calls are checked and all access is granted. If, however, sandboxing is on, the action defaults to \emph{deny} and allowlists and denylists can be used to refine access rights, e.g. \emph{allow/read+/etc/passwd}. The default action for a sandboxing category may be changed with the respective option, e.g.~default/force:kill. See the \emph{syd}(2) manual page for more information on how to configure Syd sandbox policies. If the sandbox process invokes a system call that violates access, this attempt is reported in system log and the system call is denied from execution. There are two ways to customise this behaviour. Syd may be configured to \emph{allow} some \emph{glob}(3p) patterns. If the path argument of the system call which is subject to be modified matches a pattern in the list of allowed \emph{glob}(3p) patterns, this attempt is not denied. If, however it matches a pattern in the list of \emph{deny} \emph{glob}(3p) patterns the attempt is denied. \textbf{If many rules match} the same path or address, the last matching pattern wins. It is also possible to use the actions \emph{exit}, \emph{kill}, \emph{abort}, \emph{stop}, \emph{panic}, and \emph{warn} instead of the \emph{allow} and \emph{deny} actions. The list of available sandboxing actions is given below:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{allow} & Allow system call. \\
\textbf{warn} & Allow system call and warn. \\
\textbf{filter} & Deny system call silently. \\
\textbf{deny} & Deny system call and warn. This is the default. \\
\textbf{panic} & Deny system call, warn and panic the current Syd thread. \\
\textbf{stop} & Deny system call, warn and stop offending process. \\
\textbf{abort} & Deny system call, warn and abort offending process. \\
\textbf{kill} & Deny system call, warn and kill offending process. \\
\textbf{exit} & Warn, and exit Syd immediately with deny \emph{errno}(3) as exit value. \\
\end{xltabular}

\emph{deny} is default unless another default action is set using one of the \emph{default/\textless category\textgreater:\textless action\textgreater{}} options. See \emph{syd}(2) manual page for more information. \emph{exit} causes Syd to exit immediately with all the sandbox processes running under it. \emph{kill} makes Syd send the offending process a \textbf{SIGKILL} signal and deny the system call. \emph{stop} makes Syd send the offending process a \textbf{SIGSTOP} signal and deny the system call. \emph{abort} makes Syd send the offending process a \textbf{SIGABRT} signal and deny the system call. Unlike \emph{kill} and \emph{stop} actions sandbox processes are able to catch the \textbf{SIGABRT} signal, therefore \emph{abort} action should only be used for debugging in trusted environments where a \emph{core}(5) dump file may provide invaluable information. \emph{panic} causes the respective Syd emulator thread to panic in which case the system call is denied by an RAII guard. This behaviour of \emph{panic} action is currently functionally equivalent to the \emph{deny} action, however it may be further extended in the future where Syd emulator processes are fork+exec\textquotesingle ed and address space is rerandomized by ASLR on each access violation. \emph{warn} makes Syd allow the system call and print a warning about it which is used by \emph{pandora}(1) for learning mode. Additionally, Syd may be configured to \emph{filter} some \emph{glob}(3p) patterns. In this case a match will prevent Syd from reporting a warning about the access violation, the system call is still denied though. For \emph{lock/*} categories the only available action is \emph{allow}, and these categories accept path names rather than \emph{glob}(3p) patterns as arguments. Relative paths are permitted for all \emph{lock/*} categories except \emph{lock/bind} which requires either an absolute UNIX domain socket path or a port-range as argument.

\subsection{SANDBOX CATEGORY SETS}\label{sandbox-category-sets}

As of v3.38.0, multiple categories may be specified split by commas and the following sets are defined to streamline sandbox profile composition. Names are intentionally chosen to be consistent with OpenBSD\textquotesingle s \emph{pledge}(2) and FreeBSD\textquotesingle s capsicum \emph{rights}(4freebsd):

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{all} & All categories \\
\textbf{all-x} & All categories except \textbf{exec} \\
\textbf{lock/all} & All \emph{landlock}(7) access rights \\
\textbf{lpath} & walk, stat, chdir \\
\textbf{rpath} & read, readdir \\
\textbf{lock/rpath} & lock/read, lock/readdir \\
\textbf{wpath} & write, truncate \\
\textbf{lock/wpath} & lock/write, lock/truncate \\
\textbf{cpath} & create, delete, rename \\
\textbf{lock/cpath} & lock/create, lock/delete, lock/rename \\
\textbf{dpath} & mkbdev, mkcdev \\
\textbf{lock/dpath} & lock/mkbdev, lock/mkcdev \\
\textbf{spath} & mkfifo, symlink \\
\textbf{lock/spath} & lock/mkfifo, lock/symlink \\
\textbf{tpath} & mkdir, rmdir \\
\textbf{lock/tpath} & lock/mkdir, lock/rmdir \\
\textbf{fown} & chown, chgrp \\
\textbf{fattr} & chmod, chattr, utime \\
\textbf{net} & net/bind, net/connect, net/sendfd \\
\textbf{lock/net} & lock/bind, lock/connect \\
\textbf{inet} & net/bind, net/connect \\
\textbf{lock/inet} & lock/bind, lock/connect \\
\textbf{bnet} & net/bind \\
\textbf{lock/bnet} & lock/bind \\
\textbf{cnet} & net/connect \\
\textbf{lock/cnet} & lock/connect \\
\textbf{snet} & net/sendfd \\
\end{xltabular}

Some examples are given below:

{\scriptsize \begin{verbatim}
default/all:kill
sandbox/inet:off
deny/cpath,rpath,wpath+${HOME}/.ssh/***
kill/spath+/tmp/***
allow/inet+loopback!1024-65535
kill/unix+/dev/log
\end{verbatim}}

\subsection{SANDBOX RULE SHORTCUTS}\label{sandbox-rule-shortcuts}

Sandbox capabilities may be passed to sandbox actions either as a single unit or as a comma-delimited list, e.g:

{\scriptsize \begin{verbatim}
allow/read,write,stat,exec+/***
allow/read,write,stat-/***
deny/read,write,stat+/***
deny/read,write-/***
filter/read,write,stat+/dev/mem
filter/read,write-/dev/mem
\end{verbatim}}

As of version 3.18.14, sandboxing modes may be specified as a single unit or as a comma-delimited list, e.g:

{\scriptsize \begin{verbatim}
sandbox/read,write,stat,exec:on
sandbox/net,lock:off
\end{verbatim}}

As of version 3.19.0, namespace types may be specified as a single unit or as a comma-delimited list, e.g.:

{\scriptsize \begin{verbatim}
unshare/user,pid,mount:on
unshare/net,cgroup:off
\end{verbatim}}

As of version 3.35.0, default modes may be specified as a single unit or as a comma-delimited list, e.g:

{\scriptsize \begin{verbatim}
default/write,truncate:kill
default/read,stat:allow
\end{verbatim}}

\subsection{SegvGuard}\label{segvguard}

As of version 3.16.3, Syd has a simple implementation of SegvGuard. The implementation is inspired by that of HardenedBSD with identical defaults: If a sandbox process receives a signal that may produce a \emph{core}(5) dump file for \emph{segvguard/maxcrashes} times (defaults to 5), in a period of \emph{segvguard/expiry} seconds (defaults to 2 minutes), subsequent attempts to execute the same executable is denied for \emph{segvguard/suspension} seconds (defaults to 10 minutes). SegvGuard can be disabled by setting \emph{segvguard/expiry:0}. SegvGuard support depends on \emph{ptrace}(2), therefore it may also be disabled by setting \emph{trace/allow\_unsafe\_ptrace:1} at startup. The trigger signals for SegvGuard are \textbf{SIGABRT}, \textbf{SIGBUS}, \textbf{SIGFPE}, \textbf{SIGILL}, \textbf{SIGIOT}, \textbf{SIGKILL}, \textbf{SIGQUIT}, \textbf{SIGSEGV}, \textbf{SIGSYS}, \textbf{SIGTRAP}, \textbf{SIGXCPU}, and \textbf{SIGXFSZ}. The signal \textbf{SIGKILL} is intentionally included into the list even though it is not a \emph{core}(5) dump file generating signal to make \emph{kill} rules trigger SegvGuard, a design later mirrored in HardenedBSD\textquotesingle s work on PaX SEGVGUARD and Capsicum integration.

Check out the following links for further information on SegvGuard:

\begin{itemize}
\item
  http://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#Deter\_exploit\_bruteforcing
\item
  http://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#Active\_kernel\_exploit\_response
\item
  http://phrack.org/archives/issues/59/9.txt
\item
  http://phrack.org/archives/issues/58/4.txt
\item
  https://github.com/HardenedBSD/hardenedBSD/wiki/segvguard2-ideas-\/-\/-brainstorm
\item
  https://hardenedbsd.org/article/shawn-webb/2025-03-01/hardenedbsd-february-2025-status-report
\end{itemize}

\subsection{Force Sandboxing}\label{force-sandboxing}

Force Sandboxing enhances system security by scrutinizing the path provided to \emph{execve}(2) and \emph{execveat}(2) system calls, comparing them against a predefined Integrity Force map -\/- a registry of path-to-checksum correlations. Upon invocation of these calls, the sandbox computes the checksum of the target binary and cross-references it with the map. Discrepancies trigger rule-defined actions: execution might proceed with a logged warning, or culminate in the termination of the process in violation. This mechanism allows for rigorous enforcement of binary integrity, echoing the preventative ethos of HardenedBSD\textquotesingle s Integriforce and NetBSD\textquotesingle s Veriexec by proactively mitigating unauthorised code execution, albeit with a unique emphasis on flexible, user-defined consequence management ranging from permissive alerts to stringent execution blocks.

Distinguishing itself through user-centric customization, Force Sandboxing offers a versatile approach to execution integrity. Administrators can tailor the sandbox\textquotesingle s response to checksum mismatches -\/- kill, deny, or warn -\/- thereby balancing security needs with operational flexibility. This adaptability, combined with tools like \emph{syd-sha}(1) for checksum calculation and \emph{syd-path}(1) for rule creation, positions Force Sandboxing as a powerful ally in the preservation of system integrity. See \emph{force} command in \emph{syd}(2) manual page on how to add/remove entries to/from the Integrity Force map.

As of version 3.16.3, Syd checks the paths of the dynamic libraries an executable is linked against for force access as well. This only works for ELF files.

As of version 3.21.3, Syd hooks into \emph{mmap}(2), and \emph{mmap2}(2) system calls and checks the file descriptor for Force access when the memory protection mode includes \textbf{PROT\_EXEC} and flags does not include \textbf{MAP\_ANONYMOUS} which typically indicates a \emph{dlopen}(3). Therefore libraries dynamically loaded at runtime are checked for Force access as well.

\subsection{TPE sandboxing}\label{tpe-sandboxing}

As of version 3.21.0, Syd introduces Trusted Path Execution (TPE) sandboxing, which restricts the execution of binaries to ensure they come from \emph{trusted directories}. As of version 3.37.2, the binary file must be \emph{trusted} as well as its parent directory. The intention is to make privilege escalation harder when an account restricted by TPE is compromised as the attacker won\textquotesingle t be able to execute custom binaries which are not in the trusted path. A binary is \emph{trusted} if the file and its parent directory meet the following criteria:

\begin{itemize}
\item
  Not writable by group or others.
\item
  Optionally owned by root, controlled by the \emph{tpe/root\_owned} option.
\item
  Optionally owned by the current user or root, controlled by the \emph{tpe/user\_owned} option.
\item
  Optionally part of the root filesystem, controlled by the \emph{tpe/root\_mount} option.
\end{itemize}

If these criteria are not met, the execution is denied with an \textbf{EACCES} \emph{errno}(3), and optionally, the offending process can be terminated with the \textbf{SIGKILL} signal using the \emph{default/tpe:kill} option. This mechanism ensures that only binaries from secure, trusted paths can be executed, enhancing security by preventing unauthorized code execution. TPE sandboxing operates by checking the the executables at three stages:

\begin{itemize}
\item
  During the system call entry of \emph{execve}(2) and \emph{execveat}(2) to check scripts.
\item
  On \emph{ptrace}(2) exec event to check the ELF executable and dynamic loader.
\item
  On \emph{mmap}(2) when dynamic libraries are mapped to memory, typically with \emph{dlopen}(3).
\end{itemize}

TPE can be configured to apply to a specific user group. By default, TPE applies to all users. However, administrators can specify an untrusted GID with the \emph{tpe/gid} setting, restricting TPE only to users in that group. Additionally, TPE can negate GID logic with the \emph{tpe/negate} setting, making the specified group trusted and exempt from TPE.

Syd\textquotesingle s TPE implementation is based on HardenedBSD\textquotesingle s which is inspired by GrSecurity\textquotesingle s TPE. Check out the following links for more information:

\begin{itemize}
\item
  http://phrack.org/issues/52/6.html\#article
\item
  http://phrack.org/issues/53/8.html\#article
\item
  https://wiki.gentoo.org/wiki/Hardened/Grsecurity\_Trusted\_Path\_Execution
\end{itemize}

\subsection{Lock Sandboxing}\label{lock-sandboxing}

Lock sandboxing utilises the \textbf{Landlock Linux Security Module} for simple unprivileged access control. It is enforced completely in kernel-space and the policy is also applied to the Syd process, such that a compromised Syd process is still stuck inside the \emph{landlock}(7) sandbox, therefore Lock sandboxing can be used to construct a multi-layered sandbox for added security. Lock sandboxing may be turned on with the \emph{sandbox/lock:on} sandbox command at startup. Paths to files and file hierarchies should be populated using the \emph{lock/*} categories either specifying them one at a time, e.g.~\emph{allow/lock/read+/usr}, \emph{allow/lock/write+/dev/null} or by specifying them as a comma delimited list, e.g.~allow/lock/read,write,ioctl+/dev/null. The shorthand \emph{lock/all} is provided to ease configuration and it stands for the union of categories \emph{lock/read}, \emph{lock/write}, \emph{lock/exec}, \emph{lock/ioctl}, \emph{lock/create}, \emph{lock/delete}, \emph{lock/rename}, \emph{lock/symlink}, \emph{lock/truncate}, \emph{lock/readdir}, \emph{lock/mkdir}, \emph{lock/rmdir}, \emph{lock/mkdev}, \emph{lock/mkfifo}, and \emph{lock/bind}. As of version 3.29.0, network confinement is supported and allowlisted \emph{bind}(2) and \emph{connect}(2) ports can be specified using the commands \emph{allow/lock/bind+port} and \emph{allow/lock/connect+port}. A closed range in format \emph{port1-port2} may also be specified instead of a single port number. Use the \emph{lock/bind} category with an absolute path to confine UNIX domain socket creation, renames and links, e.g \emph{allow/lock/bind+/run/user/\$\{SYD\_UID\}}. As of version 3.35.0, the default compatibility level has been changed to \emph{Hard Requirement}. Compared to the old default \emph{Best Effort}, this level ensures the sandbox is fully enforced. Moreover, \textbf{ENOENT} ("No such file or directory"), errors are made fatal in this level. The compatibility level may be changed at startup using the command \emph{default/lock}. See the \emph{syd}(2) manual page for more information.

\subsection{Crypt Sandboxing}\label{crypt-sandboxing}

This sandboxing category provides transparent file encryption using AES-CTR, with HMAC-SHA256 ensuring secure data handling without manual encryption steps. When \emph{sandbox/crypt:on} is set, files matching the \emph{glob}(3) patterns specified by \emph{crypt+} are encrypted on write and decrypted on read. Configuration includes specifying a 32-bit decimal encryption key serial ID for the \emph{keyrings}(7) interface using \emph{crypt/key/main}, and specifying a 32-bit decimal authentication key serial ID for the \emph{keyrings}(7) interface using \emph{crypt/key/auth}. Specifying the same key serial ID for both options is permitted and the option \emph{crypt/key} may be used as a shorthand to set both key serial IDs. The specified key serial IDs are used with the \textbf{ALG\_SET\_KEY\_BY\_KEY\_SERIAL} \emph{setsockopt}(2) operation which is new in Linux-6.2, therefore \emph{Crypt sandboxing requires Linux-6.2 or newer}. The keys must have \emph{search} permission -\/- i.e.~have the \textbf{KEY\_(POS\textbar USR\textbar GRP\textbar OTH)\_SEARCH} permission bit(s) set so the kernel can locate and copy the key data into the crypto API; otherwise the operation will be denied (\textbf{EPERM}: "Operation not permitted"). Refer to the following link for more information https://lkml.org/lkml/2022/10/4/1014.

The utility \emph{syd-key}(1) may be used to generate encryption keys and save them to \emph{keyrings}(7) for use with Crypt sanboxing. To avoid including the key serial IDs into the configuration file, the user may set the key serial IDs using an environment variable and then specify this environment variable, e.g: crypt/key:\$\{SYD\_KEY\_ID\}. The user \emph{must} use an environment variable name that starts with the prefix \textbf{SYD\_} but does not start with the prefix \textbf{SYD\_TEST\_} as such environment variables don\textquotesingle t leak into the sandbox process. Similarly the user \emph{must} refrain from using any environment variable specified under the ENVIRONMENT section of the \emph{syd}(1) manual page.

Encryption operates via Linux kernel cryptography API sockets, using zero-copy techniques with \emph{splice}(2) and \emph{tee}(2) to avoid unencrypted data in memory. To assert we use zero-copy exclusively and respect user\textquotesingle s privacy by avoiding to read plain-text into memory at all costs, \emph{syd\_aes} threads who are responsible for encryption are confined with a \emph{seccomp}(2) filter to deny the \emph{read}(2), \emph{open}(2), and \emph{socket}(2) system calls (and many more) and allow the \emph{write}(2) system call only up to 32 bytes which is required to write the HMAC tag and the random IV to the file. The setup sockets are created on startup, the key is selected using the \emph{keyrings}(7) interface without copying the key material into userspace. IV uniqueness is ensured by generating a random IV using \emph{getrandom}(2) per file. In case of an error retrieving entropy via \emph{getrandom}(2) the random bytes in AT\_RANDOM are used instead. Per-file IV is prepended to encrypted files. This ensures security by preventing IV reuse. Syd ensures that per-file IVs are securely zeroized on drop.

A 32-byte HMAC (SHA256) message authentication tag is included between the file magic header and the IV, and is authenticated on decrypt, following the Encrypt-then-MAC approach. This provides integrity checking and resistance against bit-flip attacks. By default, decryption occurs in a memory file descriptor to prevent tampering, which limits practicality for large files due to memory constraints. User may specify a secure temporary backing directory with \emph{crypt/tmp} to workaround this. Ideally this directory should be on encrypted storage as Syd is going to write plaintext here. File locks are set before attempting to encrypt files to ensure security and safe concurrent access. Linux OFD locks are used for locking. Encrypted data is flushed to disk only after all file descriptors that point to the encrypted open file description are closed enabling safe and performant concurrent access. File appends are handled efficiently with last block reencryption. Only regular files will be encrypted. The file format header \textbf{\textbackslash x7fSYD3} identifies encrypted files and the version in the header must match the current Syd API which at the moment is \textbf{3}. Compared to GSWTK\textquotesingle s dbfencrypt, Crypt sandboxing avoids TOCTOU vulnerabilities and encryption weaknesses by utilizing AES-CTR with HMAC-SHA256 and robust setup steps, providing a more secure and streamlined encryption process.

Crypt sandboxing employs the AES-CTR algorithm, a secure and efficient symmetric key encryption method suitable for various applications. It operates as a stream cipher (skcipher) with a block size of 1 byte, allowing data to be encrypted in a byte-by-byte manner. The algorithm uses a fixed key size of 32 bytes (256 bits) by default, providing robust security, and a fixed initialization vector (IV) size of 16 bytes to ensure randomness and uniqueness in each encryption operation. Processing data in byte-sized chunks, the algorithm maintains a consistent walk size of 16 bytes for traversal and operations, ensuring seamless encryption and decryption processes. This configuration, with its secure default key size, significantly enhances security, preventing common encryption weaknesses and supporting efficient, transparent file encryption within the sandbox environment. The inclusion of HMAC-SHA256 for integrity checking further enhances security by detecting any unauthorized modifications or corruption of data. CTR is infinitely parallelizable because each block in the stream can be encrypted independently. This allows for encryption and decryption processes to be split across multiple processors, significantly increasing throughput. With hardware support such as AES-NI CPU instructions, speeds can easily exceed a gigabyte per second.

As of version 3.21.2, Syd opens memory file descriptors with the flag \textbf{MFD\_NOEXEC\_SEAL} during transparent decryption to ensure the memfds are non-executable and can\textquotesingle t ever be marked executable. This ensures security as otherwise transparent decryption can be used to bypass Exec, Force and TPE sandboxing. Notably, this flag requires Linux-6.3 or newer. On older kernels, a backing directory must be specified with \emph{crypt/tmp} for transparent decryption to work. Attempt to use transparent decryption without a backing directory on older kernels will fail with the \emph{errno}(3) \textbf{EOPNOTSUPP} ("Operation not supported on transport endpoint"). As of version 3.28.0, Syd allows this restriction to be lifted with the option \emph{trace/allow\_unsafe\_memfd:1}.

As of version 3.39.0, \emph{keyrings}(7) interface is used for key management and specifying keys as raw payload is no longer permitted. Moving key material into the kernel \emph{keyrings}(7) interface substantially reduces the exposure of raw keys to userland, narrowing the attack surface for memory-disclosure, core-dump, and accidental-persistence vulnerabilities while enabling cryptographic operations to be performed without copying key bytes into process memory. Because \emph{keyrings}(7) enforce kernel-side permissions and lifecycle semantics (search/view/revoke, expiries, etc.), they provide a principled provenance and access-control model that simplifies secure rotation, auditing, and least-privilege enforcement. Together, these properties both harden the runtime security posture and facilitate integration with hardware-backed or sealed key types, improving operational compliance and reducing the likelihood of application-level key-management errors.

\textbf{File Format}: Each file encrypted within the Crypt sandboxing framework follows a structured format to ensure consistency, secure handling, and clear identification. Each encrypted file starts with a five-byte magic header, \textbf{\textbackslash x7fSYD3}, where \textbf{\textbackslash x7fSYD} indicates that the file is encrypted by Syd, and \textbf{3} denotes the current API version. This header is followed by a 32-byte HMAC (SHA256) message authentication tag, providing integrity checking by authenticating the encrypted content. Next is followed by a 16-byte initialization vector (IV), which is unique per file, ensuring strong cryptographic security. The AES-CTR-encrypted ciphertext follows the IV, providing the file\textquotesingle s protected content. Syd will only process files that match this format and have a compatible version; if a file does not have the correct file format header or API version, or if it exists unencrypted, Syd will leave it untouched. This approach prevents unintended operations on incompatible or unencrypted files.

{\scriptsize \begin{verbatim}
+----------------+-------------------------+-----------------------+--------------------+
| Magic Header   | HMAC Tag                | Initialization Vector | Encrypted Content  |
| "\x7fSYD3"     | 32 bytes (SHA256 HMAC)  | 16 bytes              | AES-CTR Ciphertext |
+----------------+----------------------- -+-----------------------+--------------------+
\end{verbatim}}

\textbf{Limitations:}

\begin{itemize}
\item
  \textbf{Large files} are not handled efficiently during decryption by default due to usage of in-memory files, specify a secure temporary backing directory with \emph{crypt/tmp:/path} to workaround this. Ideally this directory should be on encrypted storage as Syd is going to write plaintext here.
\item
  \textbf{Concurrent Access}: Encrypted file access utilises Linux OFD locks, which are now standardized in POSIX 2024. Ensure that the underlying filesystem fully supports OFD locks to enable effective advisory file locking. Modern filesystems and NFS implementations compliant with POSIX 2024 typically provide this support, mitigating issues present in older versions. The multithreaded architecture of Syd relies on OFD locks to ensure safe and efficient concurrent access, eliminating the need for alternative locking mechanisms such as POSIX advisory locks. For further details, refer to the \emph{fcntl\_locking}(2) manual page.
\item
  \textbf{Crash Safety}: Currently, encrypted data is flushed to disk only after all file descriptors are closed. In the event of a system or sandbox crash, this may result in incomplete writes or potential data loss, as in-flight data might not be persisted. Future enhancements will focus on implementing transactional flush mechanisms and crash recovery procedures to ensure atomicity and integrity of encrypted data, thereby improving resilience against unexpected terminations.
\end{itemize}

\textbf{Utilities}:

\begin{itemize}
\item
  \emph{syd-aes}(1): Encrypt/decrypt files akin to \emph{openssl-enc}(1ssl).
\item
  \emph{syd-key}(1) - Generate random AES-CTR keys using \emph{getrandom}(2), and save to \emph{keyrings}(7). - Read passphrases from TTY or STDIN, hash with SHA3-256, and save to \emph{keyrings}(7).
\end{itemize}

\subsection{Proxy Sandboxing}\label{proxy-sandboxing}

As of version 3.22.0, Proxy sandboxing in Syd confines network communication exclusively through a designated SOCKS proxy, enforced by the helper utility \emph{syd-tor}(1). Configured at startup with \emph{sandbox/proxy:on}, this type implies the use of \emph{unshare/net:1}, isolating network namespaces to prevent direct network access. Traffic is forwarded from a specified local port (proxy/port:9050) to an external address and port (proxy/ext/host:127.0.0.1, proxy/ext/port:9050). As of version 3.34.1, you may also specify an external UNIX domain socket using e.g.~proxy/ext/unix:/path/socks5.sock. This setup ensures all network interactions route through the proxy, leveraging zero-copy data transfers and edge-triggered \emph{epoll}(7) for efficient event handling. The implementation enhances security by employing seccomp and Landlock for additional confinement, preventing unauthorized network access and ensuring strict adherence to the defined network path. This approach minimizes the risk of proxy bypasses and maintains the integrity of the network isolation.

\subsection{PTY Sandboxing}\label{pty-sandboxing}

As of version 3.36.0, PTY Sandboxing runs the target process inside a dedicated pseudoterminal managed by the \emph{syd-pty}(1) helper, isolating all terminal I/O from the host TTY and preventing direct \emph{ioctl}(2) or control-sequence escapes. The PTY main is proxied via an edge-triggered \emph{epoll}(7) loop with non-blocking zero-copy \emph{splice}(2), ensuring no unencrypted data ever traverses user space. A minimal \emph{seccomp}(2) filter confines only the essential PTY syscalls (e.g.~\textbf{TIOCGWINSZ}, \textbf{TIOCSWINSZ}) and denies all others -\/- including injection via \textbf{TIOCSTI} -\/- while Landlock locks down access to the PTY device, filesystem, and network. Combined with no-exec memory seals and namespace isolation, this approach hardens against terminal-based attacks and preserves the confidentiality and integrity of the sandboxed session.

\subsection{Memory Sandboxing}\label{memory-sandboxing}

This sandboxing category handles the system calls \emph{brk}(2), \emph{mmap}(2), \emph{mmap2}(2), and \emph{mremap}(2) and checks the per-process memory usage on each memory allocation request. If the memory usage reaches the maximum value defined by \emph{mem/max}, the system call is denied with \textbf{ENOMEM}. Moreover the virtual memory size can be limited using \emph{mem/vm\_max}. If the limit is reached on the entry of any of the respective system calls, the system call is denied with \textbf{ENOMEM} and the signal \textbf{SIGKILL} is delivered to the offending process. Subsequent to the delivery of the signal, the \emph{process\_mrelease}(2) system call is called on the process to immediately release memory. The default action may be changed using the \emph{default/mem} option. The per-process memory usage is a fair estimate calculated using the file \emph{proc\_pid\_smaps}(5) summing the following fields together:

\begin{itemize}
\item
  \emph{Pss (Proportional Set Size)} is similar to \emph{Rss}, but accounts for shared memory more accurately by dividing it among the processes that share it. \emph{Rss (Resident Set Size)} is the portion of memory occupied by a process that is held in RAM.
\item
  \emph{Private\_Dirty} represents the private memory that has been modified (dirty).
\item
  \emph{Shared\_Dirty} represents the shared memory that has been modified.
\end{itemize}

As of version 3.43.1, the memory sandboxing system has been updated to improve memory usage tracking. Syd now enforces a strict memory limit based on allocation granularity, meaning that programs cannot exceed the defined memory limits, even by the amount they allocate at once. This change aligns the limit with the allocation size rather than allowing any overflow beyond the limit. Additionally, memory tracking has been optimized by switching from iterating over \emph{proc\_pid\_smaps}(5) to using the more efficient \emph{/proc/pid/smaps\_rollup}, which consolidates memory usage information for better performance and more accurate enforcement of memory constraints.

\emph{Memory sandboxing is not an alternative to cgroups(7)!} You should use \emph{cgroups}(7) when you can instead. This sandboxing category is meant for more constrained environments where \emph{cgroups}(7) is not supported or not available due to missing permissions or other similar restrictions.

\subsection{PID sandboxing}\label{pid-sandboxing}

This sandboxing category handles the system calls \emph{fork}(2), \emph{vfork}(2), \emph{clone}(2), and \emph{clone3}(2) and checks the total number of tasks running on the system on each process creation request. If the count reaches the maximum value defined by \emph{pid/max}, the system call is denied with \textbf{EAGAIN}. If \emph{pid/kill} is set to true, the signal \textbf{SIGKILL} is delivered to the offending process. This sandboxing category is best coupled with a pid namespace using \emph{unshare/pid}. In this mode, Syd will check the number of running tasks in the current namespace only.

As of version 3.40.0, with \emph{unshare/pid:1} the limit and accounting apply per PID namespace; on Linux 6.14 and newer the namespaced \emph{kernel.pid\_max} \emph{sysctl}(8) is set to \emph{max(pid/max, 301)} so the kernel\textquotesingle s 300 reserved PIDs do not reduce the configured headroom, and on older kernels \emph{kernel.pid\_max} \emph{sysctl}(8) is not modified.

\emph{PID sandboxing is not an alternative to cgroups(7)!} You should use \emph{cgroups}(7) when you can instead. This is meant for more constrained environments where \emph{cgroups}(7) is not supported or not available due to missing permissions or other similar restrictions.

\subsection{SafeSetID}\label{safesetid}

\textbf{SafeSetID}, introduced in version 3.16.8, enhancing the management of UID/GID transitions. This feature enables finer-grained control by allowing administrators to explicitly specify permissible transitions for UID and GID changes, thus tightening security constraints around process privilege management. It works by allowing predefined UID and GID transitions that are explicitly configured using the \emph{setuid+\textless source\_uid\textgreater:\textless target\_uid\textgreater{}} and \emph{setgid+\textless source\_gid\textgreater:\textless target\_gid\textgreater{}} commands in the Syd configuration. This ensures that transitions can only occur between specified user and group IDs, and unauthorised privilege escalations are blocked. For instance, a transition might be allowed from a higher-privileged user to a less-privileged user but not vice versa, thereby preventing any escalation of privileges through these system calls.

As of version 3.24.5, Syd applies a kernel-level \emph{seccomp}(2) filter by default to deny all set*uid system calls with UID less than or equal to 11 which is typically the operator user, and all set*gid system calls with GID less than or equal to 14 which is typically the uucp group. This means even a compromised Syd process cannot elevate privileges using these system calls. Refer to the output of the command \emph{syd-ls} setid to see the full list of system calls in this group.

When a UID or GID transition is defined Syd will keep the \textbf{CAP\_SETUID} and \textbf{CAP\_SETGID} capabilities respectively and sandbox process will inherit these capabilities from Syd. Since version 3.24.6, Syd drops the \textbf{CAP\_SETUID} capability after the first successful UID transition and similarly the \textbf{CAP\_SETGID} capability after the first successful GID transition. This means Syd can only ever change its UID and GID once in its lifetime. However, this does not completely lock the setid system calls in the sandbox process: Transitions to Syd\textquotesingle s current UID and GID are continued in the sandbox process which means the first successful UID and GID transition will continue to function as long as the sandbox process keeps the respective \textbf{CAP\_SETUID}, and \textbf{CAP\_SETGID} capabilities. This allows containing daemons, such as \emph{nginx}(1), which spawn multiple unprivileged worker processes out of a single main privileged process.

\subsection{Ghost mode}\label{ghost-mode}

Ghost Mode, introduced in Syd version 3.20.0, is a one-way sandboxing mode, closely resembling \emph{seccomp}(2) Level 1, also known as \textbf{Strict} Mode. This mode enhances security by allowing a process to transition to a highly restrictive state after completing its initial setup. When a sandboxed process is ready for this higher level of confinement, it invokes Ghost Mode by executing the \emph{stat}(2) system call with the virtual path \emph{/dev/syd/ghost}. Upon receiving this command, Syd closes the \emph{seccomp\_unotify}(2) file descriptor. This action elevates all previously hooked system calls to a kernel-level deny with the \textbf{ENOSYS} ("Function not implemented") \emph{errno}(3), effectively making them unavailable. The transition to Ghost Mode is irreversible; once the file descriptor is closed, the process is locked into this restricted state. This mechanism ensures that the sandboxed process can only perform a very limited set of operations, akin to those allowed in Seccomp Level 1, thus significantly reducing its potential attack surface. Ghost Mode provides a robust security measure by denying all but the most essential system calls, which is crucial for applications that require maximum isolation and security after their initial configuration phase.

The mode is aptly named ghost because, upon closing the \emph{seccomp\_unotify}(2) file descriptor, the sandboxed process effectively detaches from Syd and becomes independent, much like a ghost. Entering ghost mode subsequently causes the \emph{syd\_mon} monitor thread and all \emph{syd\_emu} emulator threads to exit, and the remaining \emph{syd\_main} thread merely waits for the sandbox process to exit without any further intervention. This detachment underscores the finality and isolation of the Ghost Mode, ensuring that the process operates in a secure, tightly confined environment without further interaction from Syd. This mechanism is particularly useful for processes that require maximum security and minimal system call exposure after their initial configuration phase, providing a robust layer of protection against various exploits and vulnerabilities.

A process cannot enter Ghost mode once the sandbox lock is set. Alternatively, though, a process can set its process dumpable attribute to zero using the \textbf{PR\_SET\_DUMPABLE} \emph{prctl}(2). Under Syd, this achieves almost the same effect as Syd will not be able to emulate system calls with the per-process directory inaccessible. This provides an unprivileged way to enter Ghost mode.

\section{SECURITY}\label{security}

Syd stands out for its ability to operate without requiring elevated privileges, eliminating the need for root access. This feature significantly simplifies setup and usage. Users benefit from the capability to dynamically configure the sandbox from within, with options to secure it further as needed. Tip: To take a quick peek at the seccomp filters applied by Syd under various different configurations, use \emph{syd \textless flags...\textgreater{} -Epfc} where PFC stands for Pseudo Filter Code which yields a human-readable textual dump of Syd\textquotesingle s \emph{seccomp}(2) filters. Syd further enrichens the output of this textual dump with \textbf{\#} comments.

\subsection{Threat Model}\label{threat-model}

\emph{Syd strictly adheres to the current threat model of seccomp(2)}. The goal is to restrict how untrusted userspace applications interact with the shared OS kernel through system calls to protect the kernel from userspace exploits (e.g., shellcode or ROP payload). The kernel is trusted. Syd\textquotesingle s threat model delineates the sandbox as the trusted interceptor of system calls, while all user applications running within the sandbox are considered untrusted. These untrusted applications can manipulate their execution environment through syscalls, and attackers are assumed to have the capability to execute arbitrary code within these applications. Syd uses several mechanisms, including \emph{seccomp}(2) and \emph{ptrace}(2) for syscall filtering, \emph{landlock}(7) for filesystem access restrictions, and \emph{namespaces}(7) for process and device isolation, to limit the impact of these potential attacks. The threat model assumes that attackers have control over the untrusted user space and may attempt reads, writes, or arbitrary code execution that could influence the behavior of the trusted sandbox or exploit syscall handling. The security of Syd relies on the correctness of its implementation and the underlying Linux kernel features it utilises. It is assumed that there are no vulnerabilities in Syd\textquotesingle s interception and handling of syscalls, nor in the enforcement mechanisms provided by \emph{landlock}(7) and \emph{namespaces}(7). External attacks via network vectors or physical access to hardware are considered out of scope for this threat model.

"The sandbox lock" is an integral component of Syd\textquotesingle s security architecture, which governs the configurability and integrity of the sandbox environment. By default, the sandbox lock is set to \emph{on}, effectively preventing any further sandbox commands after the initial setup, thereby ensuring that once the sandbox is configured and the primary process is executed, the security policies remain unaltered by any untrusted processes within the sandbox. When the lock is set to \emph{exec}, only the initial sandbox process retains the authority to access and modify the sandbox configuration, enabling a trusted process to securely establish the sandbox parameters while maintaining a \emph{pidfd} (process ID file descriptor) to the initial process to safeguard against PID recycling attacks. Conversely, if the lock is set to \emph{off}, all sandbox processes are permitted to access and modify the sandbox configuration, allowing for broader configurability during the setup phase. However, this state persists only until the sandbox is explicitly locked, after which the lock becomes immutable and the sandbox policies are fixed, preventing any subsequent processes from altering the configuration. This layered locking mechanism, reinforced by the use of \emph{pidfd} in \emph{exec} mode, effectively safeguards against untrusted processes attempting to modify sandbox settings to escalate privileges or circumvent restrictions, thereby maintaining a robust and secure execution environment within Syd\textquotesingle s framework. In \emph{ipc} mode, the sandbox configuration is accessible through a UNIX socket which may or may not be accessible from within the sandbox depending on sandbox ACL rules. In \emph{read} mode, the sandbox configuration is accessible only to reads, but NOT edits. Transition from lock modes \emph{off}, \emph{exec}, and \emph{ipc} into one of \emph{read} and \emph{on} is one-way and idempotent: It results in the sandbox policy getting sealed in memory using the \emph{mseal}(2) system call either immediately or simultaneously with sandbox process startup. Transitions between lock modes \emph{read} and \emph{on} are not permitted.

"Crypt Sandboxing" in Syd ensures the confidentiality and integrity of specified files by transparently encrypting them using AES-CTR with HMAC-SHA256, even when adversaries fully control processes within the sandbox (i.e., attackers can execute arbitrary code and perform any allowed system calls). In this extended threat model, it is acknowledged that while attackers may access plaintext data within the sandbox\textquotesingle s memory during process execution, they cannot extract encryption keys or plaintext data from outside the controlled environment, nor can they interfere with the encryption process to leak keys or plaintext to persistent storage or external channels. Cryptographic operations are performed via kernel-level cryptography API sockets using zero-copy techniques to prevent plaintext from residing in user-space memory buffers accessible to attackers. The \emph{syd\_aes} threads responsible for encryption are confined with strict \emph{seccomp}(2) filters, denying them critical system calls like \emph{read}(2), \emph{open}(2), and \emph{socket}(2), and allowing only minimal \emph{write}(2) operations required for encryption metadata (e.g., writing the HMAC tag and random IV to the file). This confinement prevents exploitation that could leak sensitive data. Encryption keys are handled using kernel \emph{keyrings}(7) interface and the \textbf{ALG\_SET\_KEY\_BY\_KEY\_SERIAL} \emph{setsockopt}(2) option. The threat model trusts the kernel and Syd\textquotesingle s implementation, assuming attackers cannot exploit kernel vulnerabilities to access keys or plaintext within kernel memory or cryptographic operations. Additionally, file locks are employed before attempting to encrypt files to ensure safe concurrent access. In contrast to the general threat model, Crypt Sandboxing acknowledges that untrusted processes within the sandbox have access to plaintext data in memory during normal operation, as they need to read or write the plaintext files. However, the goal is to prevent attackers from accessing the plaintext outside the controlled environment or tampering with the encryption process to compromise confidentiality and integrity. This is achieved by ensuring that the encryption keys remain secure and that the encryption and decryption processes are tightly controlled and isolated from untrusted code.

\subsection{Accessing remote process memory}\label{accessing-remote-process-memory}

Syd denies various system calls which can access remote process memory such as \emph{ptrace}(2) and \emph{process\_vm\_writev}(2) and common sandboxing profiles such as \emph{paludis} and \emph{user} disallow write access to the \emph{/proc/pid/mem} file. This makes TOCTOU attack vectors harder to realise. Refer to the the output of the command \emph{syd-ls deny} to see the full list of denied system calls.

\subsection{Enhanced Handling of PTRACE\_TRACEME}\label{enhanced-handling-of-ptrace_traceme}

As of version 3.16.3, Syd introduced a new feature for managing the \textbf{PTRACE\_TRACEME} operation, aimed at improving stealth against detection. Traditionally, \textbf{PTRACE\_TRACEME} is the only \emph{ptrace}(2) operation allowed by a tracee, which makes it a common target for detection of ptracers. By converting \textbf{PTRACE\_TRACEME} into a no-operation (no-op) that always succeeds, Syd aims to subtly prevent simple detection methods that rely on this operation. Additionally, other \emph{ptrace}(2) operations are modified to return an \textbf{EPERM} ("Operation not permitted") \emph{errno}(3) instead of \textbf{ENOSYS} ("Function not implemented"), which helps reduce the likelihood of the sandbox being detected through these errors. This approach enhances the discreetness of Syd\textquotesingle s operation by mitigating straightforward detection tactics used by monitored processes.

As of version 3.19.0, Syd extends this mitigation and turns the system call \emph{ptrace}(2) into a no-op. Again, this provides a best-effort mitigation against using requests such as \textbf{PTRACE\_ATTACH} or \textbf{PTRACE\_SEIZE} to detect a ptracer.

As of version 3.47.0, Syd improves this mitigation and turns the \emph{prctl}(2) calls with \textbf{PR\_SET\_PTRACER} argument into a no-op.

As of version 3.47.0, Syd improves this mitigation to defend against intelligent \emph{ptrace}(2) detectors which utilize multiple \emph{ptrace}(2) requests to detect ptracer. Refer to the following links for more information on intelligent \emph{ptrace}(2) detection:

\begin{itemize}
\item
  https://arxiv.org/pdf/2109.06127
\item
  https://seblau.github.io/posts/linux-anti-debugging
\item
  https://docs.rs/debugoff
\end{itemize}

\subsection{Hardened procfs and devfs}\label{hardened-procfs-and-devfs}

To enhance system security and mitigate potential attack vectors, Syd enforces restrictions on \emph{procfs}(5) and devfs file systems by implementing several key measures: denying both the listing and opening of block devices and files of unknown types by omitting entries corresponding to these file types (identified by \textbf{DT\_BLK} and \textbf{DT\_UNKNOWN}) from directory listings and rejecting \emph{open}(2) operations on them. This prevents unauthorized enumeration and access to system storage devices, thereby mitigating information disclosure and potential tampering.

Syd also restricts visibility within the \emph{/proc} directory so that processes can only see their own process IDs, effectively preventing discovery and potential interaction with other running processes, which reduces risks of information leakage, privilege escalation, and process manipulation. Access to the \emph{/proc} entries of the Syd process itself is explicitly denied, safeguarding the sandbox manager from inspection or interference and preventing access to sensitive information about the sandboxing mechanism that could be exploited to bypass security controls or escape the sandbox.

Additionally, Syd addresses risks associated with magic symbolic links in \emph{/proc} -\/- such as \emph{/proc/{[}pid{]}/exe} and \emph{/proc/{[}pid{]}/fd/*} -\/- by denying access to these links when they refer to processes other than the calling process, thus preventing exposure of sensitive file descriptors or executable paths of other processes and mitigating unauthorized access or container escape scenarios; this mitigation can be disabled with the \emph{trace/allow\_unsafe\_magiclinks:1} option if necessary, though doing so is not recommended.

Collectively, these hardened controls over procfs and devfs significantly reduce the attack surface by preventing information disclosure, unauthorized access, and potential privilege escalations, ensuring that sandboxed applications operate within a tightly controlled and secure environment that adheres to the principle of least privilege and maintains system integrity. Refer to the following links for more information:

\begin{itemize}
\item
  https://forums.whonix.org/t/proc-pid-sched-spy-on-keystrokes-proof-of-concept-spy-gksu/8225
\item
  https://homes.luddy.indiana.edu/xw7/papers/zhou2013identity.pdf
\item
  https://petsymposium.org/2016/files/papers/Don\%E2\%80\%99t\_Interrupt\_Me\_While\_I\_Type\_\_Inferring\_Text\_Entered\_Through\_Gesture\_Typing\_on\_Android\_Keyboards.pdf
\item
  https://staff.ie.cuhk.edu.hk/\textasciitilde khzhang/my-papers/2016-oakland-interrupt.pdf
\item
  https://www.cs.ucr.edu/\textasciitilde zhiyunq/pub/sec14\_android\_activity\_inference.pdf
\item
  https://www.gruss.cc/files/procharvester.pdf
\item
  https://www.kicksecure.com/wiki/Dev/Strong\_Linux\_User\_Account\_Isolation\#/proc/pid/sched\_spy\_on\_keystrokes
\item
  https://www.openwall.com/lists/oss-security/2011/11/05/3
\item
  https://www.usenix.org/legacy/event/sec09/tech/full\_papers/zhang.pdf
\item
  https://www.openwall.com/lists/oss-security/2025/11/05/3
\end{itemize}

\subsection{Hardened proc\_pid\_status(5)}\label{hardened-proc_pid_status5}

As of version 3.38.0, Syd filters \emph{proc\_pid\_status}(5) at \emph{open}(2) boundary to defeat common sandbox-fingerprinting heuristics while preserving compatibility with ordinary tooling. When a process (or its threads) reads /proc/\textless pid\textgreater/status or /proc/\textless pid\textgreater/task/\textless tid\textgreater/status, Syd normalizes only the security-critical fields -\/- zeroing \emph{TracerPid}, \emph{NoNewPrivs}, \emph{Seccomp}, and \emph{Seccomp\_filters}, and rewriting the sandbox-revealing phrases in \emph{Speculation\_Store\_Bypass} and \emph{SpeculationIndirectBranch}. This targeted normalization breaks trivial anti-analysis checks (ptracer presence, seccomp/no\_new\_privs probes, speculative mitigation fingerprints) without altering process state.

The security impact is twofold: untrusted code loses a low-cost oracle for environment discovery, reducing the likelihood of logic bombs or capability gating based on sandbox detection, and defenders retain observability because the kernel\textquotesingle s real enforcement still applies -\/- only the user-space view of these select fields is masked. For forensic and debugging workflows that explicitly need the unfiltered view, this mitigation can be temporarily relaxed per trace with \emph{trace/allow\_unsafe\_proc\_pid\_status:1}, after which toggling back to \emph{:0} restores the hardened, stealth-preserving default.

\subsection{Hardened uname(2)}\label{hardened-uname2}

As of version 3.15.1, Syd mediates \emph{uname}(2) and returns a policy governed \emph{utsname} that suppresses host identification and constrains kernel disclosure. The release string is synthesized to expose only the Linux major and minor as observed on the host or, as of 3.36.1, as supplied via \textbf{SYD\_ASSUME\_KERNEL} for controlled feature detection, while the micro component is randomized per Syd run to limit patch level fingerprinting; reads of \emph{/proc/version} and \emph{/proc/sys/kernel/osrelease} are hardened to present the same masked view. As of 3.40.0, the nodename, domainname, and version fields are sourced from the options \emph{uts/host}, \emph{uts/domain}, and \emph{uts/version} with defaults \emph{localhost}, \emph{(none)}, and a startup random value. As of 3.44.2, this restriction may be relaxed at startup with the option \emph{trace/allow\_unsafe\_uname:1}. Practical effects include disrupting exploit and loader selection that depend on exact release matching, reducing cross host correlation via stable node and domain labels, neutralizing sandbox and VM fingerprinting heuristics that key off \emph{uname}(2) and the corresponding \emph{proc}(5) paths, and keeping build and compatibility probes functional by retaining \emph{major.minor} semantics while allowing explicit control through \textbf{SYD\_ASSUME\_KERNEL}. Workloads that tie licensing, clustering, telemetry, or feature gates to the precise host release or to the original nodename should use the \emph{uts} options to supply the required identity or opt out with the relaxation flag.

\subsection{Denying TIOCLINUX ioctl}\label{denying-tioclinux-ioctl}

The limitation on the use of the \textbf{TIOCLINUX} \emph{ioctl}(2) within secure environments, similar to the Syd sandbox, is an essential security measure addressing vulnerabilities specific to Linux terminal operations. The \textbf{TIOCLINUX} \emph{ioctl}(2) command offers various functionalities, including but not limited to manipulating console settings, changing keyboard modes, and controlling screen output. While these capabilities can be leveraged for legitimate system management tasks, they also introduce potential security risks, particularly in multi-user environments or in the context of sandboxed applications.

The security concerns surrounding \textbf{TIOCLINUX} stem from its ability to alter terminal behaviors and settings in ways that could be exploited for unauthorised information disclosure, terminal hijacking, or privilege escalation. For instance, manipulating the console display could mislead users about the true nature of the operations being executed, or altering keyboard settings could capture or inject keystrokes.

In summary, the restriction on \textbf{TIOCLINUX} within secure environments is a vital security strategy, addressing the complex risks associated with direct terminal manipulation capabilities. This precaution is in keeping with the broader security community\textquotesingle s efforts to mitigate known vulnerabilities and enhance the security posture of systems handling sensitive processes and data.

\subsection{Denying TIOCSTI ioctl}\label{denying-tiocsti-ioctl}

The restriction on the use of the \textbf{TIOCSTI} \emph{ioctl}(2) within the Syd sandbox addresses a significant security vulnerability associated with terminal input injection. The \textbf{TIOCSTI} \emph{ioctl}(2) allows a byte to be inserted into the terminal input queue, effectively simulating keyboard input. This capability, while potentially useful for legitimate purposes, poses \emph{a substantial security risk}, especially in scenarios where a process might retain access to a terminal beyond its intended lifespan. Malicious use of this \emph{ioctl}(2) can lead to the injection of commands that execute with the privileges of the terminal\textquotesingle s owning process, thereby breaching the security boundaries intended by user permissions and process isolation mechanisms. The concern over \textbf{TIOCSTI} is well-documented in the security community. For example, OpenBSD has taken measures to mitigate the risk by disabling the \textbf{TIOCSTI} \emph{ioctl}(2), reflecting its stance on the \emph{ioctl}(2) as \emph{one of the most} dangerous due to its potential for abuse in command injection attacks. The decision to disable or restrict \textbf{TIOCSTI} in various Unix-like operating systems underscores the \emph{ioctl}(2)\textquotesingle s inherent security implications, particularly in the context of privilege escalation and the execution of unauthorised commands within a secured environment.

In summary, the restriction on \textbf{TIOCSTI} within Syd is a critical security measure that prevents a class of vulnerabilities centered around terminal input injection, safeguarding against unauthorised command execution and privilege escalation. This precaution aligns with broader security best practices and mitigations adopted by the security community to address known risks associated with terminal handling and process isolation.

\subsection{Denying FS\_IOC\_SETFLAGS ioctl}\label{denying-fs_ioc_setflags-ioctl}

As of version 3.24.2, Syd denies the \textbf{FS\_IOC\_SETFLAGS} \emph{ioctl}(2) request by default, a critical security measure to ensure that once file flags are set, they remain unchanged throughout the runtime of the sandbox. This policy is particularly focused on the \emph{immutable} and \emph{append-only} flags, which need to be configured by an administrator at the start of the Syd process. Once these attributes are set on crucial system and log files -\/- marking them either as immutable to prevent any modification, or append-only to ensure that existing data cannot be erased -\/- they are frozen. This means that no subsequent modifications can be made to these attributes, effectively locking down the security settings of the files against any changes. This approach prevents scenarios where, even after a potential security breach, malicious entities are unable to alter or delete important files, thus maintaining the integrity and reliability of the system against tampering and ensuring that audit trails are preserved.

\subsection{Denying PR\_SET\_MM prctl}\label{denying-pr_set_mm-prctl}

The \textbf{PR\_SET\_MM} \emph{prctl}(2) call allows processes with the \textbf{CAP\_SYS\_RESOURCE} capability to adjust their memory map descriptors, facilitating operations like self-modifying code by enabling dynamic changes to the process\textquotesingle s memory layout. For enhanced security, especially in constrained environments like Syd, this capability is restricted to prevent unauthorised memory manipulations that could lead to vulnerabilities such as code injection or unauthorised code execution. Notably, Syd proactively drops \textbf{CAP\_SYS\_RESOURCE} among other capabilities at startup to minimise security risks. This action is part of Syd\textquotesingle s broader security strategy to limit potential attack vectors by restricting process capabilities.

\subsection{Restricting prctl option space and trace/allow\_unsafe\_prctl}\label{restricting-prctl-option-space-and-traceallow_unsafe_prctl}

Syd meticulously confines the scope of permissible \emph{prctl}(2) operations to enhance security within its sandbox environment. By limiting available \emph{prctl}(2) options to a specific set, including but not limited to \textbf{PR\_SET\_PDEATHSIG}, \textbf{PR\_GET\_DUMPABLE}, \textbf{PR\_SET\_NO\_NEW\_PRIVS}, and \textbf{PR\_SET\_SECCOMP}, Syd ensures that only necessary process control functionalities are accessible, thereby reducing the risk of exploitation through less scrutinised \emph{prctl}(2) calls. This constraint is pivotal in preventing potential security vulnerabilities associated with broader \emph{prctl}(2) access, such as unauthorised privilege escalations or manipulations of process execution states. However, recognizing the need for flexibility in certain scenarios, Syd offers the option to lift these restrictions through the \emph{trace/allow\_unsafe\_prctl:1} setting. This capability allows for a tailored security posture, where users can opt for a more permissive \emph{prctl}(2) environment if required by their specific use case, while still maintaining awareness of the increased security risks involved.

\subsection{Restricting io\_uring interface and trace/allow\_unsafe\_uring}\label{restricting-io_uring-interface-and-traceallow_unsafe_uring}

The \emph{io\_uring}(7) interface can be used to \emph{bypass path sandboxing}. By default, Syd restricts \emph{io\_uring}(7) operations due to their ability to perform system calls that could undermine the sandbox\textquotesingle s security controls, particularly those designed to limit file access and modify file permissions. The setting, \emph{trace/allow\_unsafe\_uring}, when enabled, relaxes these restrictions, allowing \emph{io\_uring}(7) operations to proceed unimpeded. While this can significantly enhance I/O performance for applications that rely on \emph{io\_uring}(7) for efficient asynchronous operations, it requires careful consideration of the security implications, ensuring that its use does not inadvertently compromise the sandboxed application\textquotesingle s security posture. Refer to the output of the command \emph{syd-ls uring} to see the full list of system calls that belong to the \emph{io\_uring}(7) interface.

\subsection{Restricting creation of device special files}\label{restricting-creation-of-device-special-files}

Since version 3.1.12, Syd has enhanced its security model by disallowing the creation of device special files through the \emph{mknod}(2) and \emph{mknodat}(2) system calls. This decision is rooted in mitigating potential security vulnerabilities, as device special files could be exploited to circumvent established path-based access controls within the sandbox environment. These files, which include character and block devices, can provide direct access to hardware components or facilitate interactions with kernel modules that could lead to unauthorised actions or data exposure. By restricting their creation, Syd significantly reduces the risk of such exploit paths, reinforcing the integrity and security of the sandboxed applications. This measure ensures that only predefined types of files -\/- such as FIFOs, regular files, and sockets -\/- are permissible, aligning with the principle of least privilege by limiting file system operations to those deemed safe within the sandbox\textquotesingle s context.

\subsection{Sharing Pid namespace with signal protections}\label{sharing-pid-namespace-with-signal-protections}

Since version 3.6.7, Syd has introduced a crucial security feature that prevents sandboxed processes from sending signals to the Syd process or any of its threads. This protection is implemented by hooking and monitoring system calls related to signal operations, including \emph{kill}(2), \emph{tkill}(2), \emph{tgkill}(2), and \emph{pidfd\_open}(2). When a sandboxed process attempts to send a signal to Syd or its threads, these system calls are intercepted, and the operation is denied at the seccomp level with an \textbf{EACCES} ("Permission denied") \emph{errno}(3). This measure ensures that Syd maintains control over the execution and management of sandboxed processes, safeguarding against interruptions or unauthorised interactions that could compromise the security or stability of the sandbox environment. This security mechanism is part of Syd\textquotesingle s broader strategy to share the same root, private proc, and mount namespaces with the sandboxed process, facilitating secure and simple system call emulation. By making Syd and its threads immune to signals from sandboxed processes, the integrity and isolation of the sandboxed environment are significantly enhanced, preventing potential exploitation scenarios where sandboxed processes could disrupt the operation of the sandbox manager or interfere with other sandboxed processes.

As of version 3.35.2, Syd puts itself in a new process group using \emph{setpgid}(2) and releases the controlling terminal using the \textbf{TIOCNOTTY} \emph{ioctl}(2) request. Moreover a scope-only Landlock sandbox is installed unconditionally to further isolate the sandbox process from the Syd process. This ensures that terminal-generated signals and I/O remain confined to the sandbox\textquotesingle s process group and cannot affect Syd or any other processes, further strengthening the sandbox\textquotesingle s isolation guarantees alongside the existing seccomp-based PID namespace protections.

\subsection{Process Priority and Resource Management}\label{process-priority-and-resource-management}

Since version 3.8.1, Syd has been implementing strategies to ensure the smooth operation of the host system while managing security through its sandboxing mechanism. It sets the \emph{nice}(2) value of its system call handler threads to \emph{19}, ensuring these threads operate at \emph{the lowest} priority to minimise CPU starvation for other critical processes. This approach prioritises system stability and fair CPU resource distribution, enabling Syd to handle numerous system calls without compromising the host\textquotesingle s performance and responsiveness.

Enhancing this strategy, Syd introduced further adjustments in versions 3.8.6 and 3.9.7 to address I/O and CPU resource management more comprehensively. From version 3.8.6, it sets the I/O priority of the system call handler threads to \emph{idle}, ensuring that I/O operations do not monopolise resources and lead to I/O starvation for other processes. Similarly, from version 3.9.7, it adjusts the CPU scheduling priority of these threads to \emph{idle}, further safeguarding against CPU starvation. These measures collectively ensure that Syd maintains optimal performance and system responsiveness while securely sandboxing applications, striking a balance between security enforcement and efficient system resource utilization.

As of version 3.30.0, changes in process and I/O priorities are inherited by sandbox processes as well and sandbox processes are prevented from making any further changes. Moreover, the option \emph{trace/allow\_unsafe\_nice} may be set at startup to prevent Syd from making any changes and allow sandbox processes access to the system calls that are used to make process and I/O priority changes.

\subsection{Streamlining File Synchronization Calls}\label{streamlining-file-synchronization-calls}

As of version 3.8.8, Syd has rendered the \emph{sync}(2) and \emph{syncfs}(2) system calls as no-operations (no-ops), ensuring they report success without executing any underlying functionality. This adjustment is designed to streamline operations within the sandboxed environment, bypassing the need for these file synchronization actions that could otherwise impact performance or complicate the sandbox\textquotesingle s control over file system interactions. By adopting this approach, Syd enhances its compatibility with applications that issue these calls, without altering the sandboxed process\textquotesingle s behavior or the integrity of file system management. As of version 3.28.0, this restriction can be disabled at startup with the option \emph{trace/allow\_unsafe\_sync:1}. This is useful in scenarios where sync is actually expected to work such as when sandboxing databases.

\subsection{Restricting Resource Limits, Core Dumps, and trace/allow\_unsafe\_prlimit}\label{restricting-resource-limits-core-dumps-and-traceallow_unsafe_prlimit}

Since version 3.9.6, Syd has implemented restrictions on setting process resource limits and generating core dumps for the sandboxed process, enhancing the sandbox\textquotesingle s security posture. This measure prevents the sandboxed process from altering its own resource consumption boundaries or producing core dumps, which could potentially leak sensitive information or be exploited for bypassing sandbox restrictions. However, recognizing the need for flexibility in certain use cases, Syd provides the option to disable these restrictions at startup through the \emph{trace/allow\_unsafe\_prlimit:1} setting. This allows administrators to tailor the sandbox\textquotesingle s behavior to specific requirements, balancing security considerations with functional needs.

\subsection{Enhancing Sandbox Security with Landlock}\label{enhancing-sandbox-security-with-landlock}

Since version 3.0.1, Syd leverages \emph{landlock}(7) to enforce advanced filesystem sandboxing, significantly bolstering the security framework within which sandboxed processes operate. By integrating Landlock, Syd empowers even unprivileged processes to create secure sandboxes, enabling fine-grained access control over filesystem operations without requiring elevated permissions. This approach is instrumental in mitigating the risk of security breaches stemming from bugs or malicious behaviors in applications, offering a robust layer of protection by restricting ambient rights, such as global filesystem or network access. Landlock operates by allowing processes to self-impose restrictions on their access to system resources, effectively creating a secure environment that limits their operation to a specified set of files and directories. This mechanism is particularly useful for running legacy daemons or applications that require specific environmental setups, as it allows for the precise tailoring of access rights, ensuring processes can only interact with designated parts of the filesystem. For instance, by setting Landlock rules, Syd can confine a process\textquotesingle s filesystem interactions to read-only or read-write operations on explicitly allowed paths, thus preventing unauthorised access to sensitive areas of the system.

Furthermore, the inclusion of the Syd process itself within the Landlock-enforced sandbox adds an additional layer of security. This design choice ensures that even if the Syd process were compromised, the attacker\textquotesingle s ability to manipulate the sandboxed environment or access unauthorised resources would be significantly constrained. This self-sandboxing feature underscores Syd\textquotesingle s commitment to maintaining a high security standard, offering peace of mind to users by ensuring comprehensive containment of sandboxed processes.

\subsection{Namespace Isolation in Syd}\label{namespace-isolation-in-syd}

Syd enhances sandbox isolation through meticulous namespace use, starting from version 3.0.2. Version 3.9.10 marks a pivotal enhancement by restricting user subnamespace creation, addressing a key path sandboxing bypass vulnerability. This strategic limitation thwarts sandboxed processes from altering their namespace environment to access restricted filesystem areas. Furthermore, since version 3.11.2, Syd maintains process capabilities within user namespaces, mirroring the \emph{unshare}(1) command\textquotesingle s -\/-keep-caps behavior. This ensures sandboxed processes retain necessary operational capabilities, enhancing security without compromising functionality. Additionally, Syd utilises the powerful \emph{bind} command within the mount namespace to create secure, isolated environments by allowing specific filesystem locations to be remounted with custom attributes, such as \emph{ro}, \emph{noexec}, \emph{nosuid}, \emph{nodev}, or \emph{nosymfollow}, providing a flexible tool for further restricting sandboxed processes\textquotesingle{} access to the filesystem.

Syd also introduces enhanced isolation within the mount namespace by offering options to bind mount temporary directories over /dev/shm and /tmp, ensuring that sandboxed processes have private instances of these directories. This prevents inter-process communication through shared memory and mitigates the risk of temporary file-based attacks, further solidifying the sandbox\textquotesingle s defence mechanisms. As of version 3.35.2, an empty mount namespace may be built from scratch starting with the \emph{root:tmpfs} command. As of version 3.11.2, Syd mounts the \emph{procfs}(5) filesystem privately with the \emph{hidepid=2} option, enhancing privacy by concealing process information from unauthorised users. As of version 3.37.2, this option is changed to \emph{hidepid=4} which is new in Linux\textgreater=5.8 for added hardening. As of version 3.39.0 the option \emph{subset=pid} is also supplied to private \emph{procfs}(5) mount for added hardening. This option is also new in Linux\textgreater=5.8.

Syd\textquotesingle s \emph{container} and \emph{immutable} profiles exemplify its adaptability, offering from isolated to highly restrictive environments. The container profile provides a general-purpose sandbox, while the immutable profile enforces stricter controls, such as making essential system directories read-only, to prevent tampering. This comprehensive approach underlines Syd\textquotesingle s adept use of kernel features for robust sandbox security, ensuring a secure and controlled execution environment for sandboxed applications. See \emph{syd-cat -pcontainer}, and \emph{syd-cat -pimmutable} to list the rules in these sandboxing profiles.

As of version 3.23.0, Syd has further strengthened its security with the introduction of a time namespace, represented by the \emph{unshare/time:1} option, allows Syd to reset the boot-time clock, ensuring that the \emph{uptime}(1) command reports container uptime instead of host uptime. Moreover, the creation of namespaces, including mount, UTS, IPC, user, PID, net, cgroup, and time is denied by default to prevent unauthorized namespace manipulation that could undermine path sandboxing security. To allow specific namespace types, administrators must explicitly enable them via the \emph{trace/allow\_unsafe\_namespace} setting. Another restriction to note is that the system calls \emph{mount}(2), \emph{mount\_setattr}(2), \emph{umount}(2), and \emph{umount2}(2) are denied by default unless \emph{mount} namespace is allowed. This change ensures tighter control over process capabilities and isolation, reinforcing the defense mechanisms against potential security breaches.

\subsection{Restricting environment and trace/allow\_unsafe\_env}\label{restricting-environment-and-traceallow_unsafe_env}

As of version 3.11.1, Syd has implemented measures to clear unsafe environment variables, such as \textbf{LD\_PRELOAD}, enhancing security by preventing the manipulation of dynamic linker behavior by sandboxed processes. This action mitigates risks associated with dynamic linker hijacking, where adversaries may load malicious shared libraries to execute unauthorised code, potentially leading to privilege escalation, persistence, or defence evasion. Variables like \textbf{LD\_PRELOAD} allow specifying additional shared objects to be loaded before any others, which could be exploited to override legitimate functions with malicious ones, thus hijacking the execution flow of a program. To accommodate scenarios where developers might need to use these variables for legitimate purposes, Syd allows this security feature to be disabled at startup with \emph{trace/allow\_unsafe\_env:1}, offering flexibility while maintaining a strong security posture. This careful balance ensures that sandboxed applications operate within a tightly controlled environment, significantly reducing the attack surface and enhancing the overall security framework within which these applications run. Refer to the output of the command \emph{syd-ls} env to see the full list of environment variables that Syd clears from the environment of the sandbox process. As of version 3.39.0, Syd additionally clears \textbf{LANG} and the full set of \textbf{LC\_*} locale variables (e.g.~\textbf{LC\_CTYPE}, \textbf{LC\_TIME}, \textbf{LC\_ALL}, etc.) to avoid leaking locale settings into the sandboxed process -\/- preventing subtle behavior differences or information disclosure that could be abused. Similarly, the \textbf{TZ} variable is cleared to prevent leaking timezone settings to the sandbox process. The builtin \emph{linux} profile masks the file \emph{/etc/localtime} and the \emph{glob}(3p) pattern \emph{/usr/share/zoneinfo/**} with the file \emph{/usr/share/zoneinfo/UTC} preventing another vector of timezone settings leaking into the environment of the sandbox process. For controlled exceptions, the CLI -e flag provides fine-grained control: \emph{-e var=val} injects var=val into the child environment, \emph{-e var} removes var from the child environment, and \emph{-e var=} explicitly passes through an otherwise unsafe variable; any of these forms may be repeated as needed.

\subsection{Managing Linux Capabilities for Enhanced Security}\label{managing-linux-capabilities-for-enhanced-security}

Since its 3.0.17 release, Syd strategically curtails specific Linux \emph{capabilities}(7) for sandboxed processes to bolster security. By revoking privileges such as \textbf{CAP\_SYS\_ADMIN} among others, Syd significantly reduces the risk of privilege escalation and system compromise. This proactive measure ensures that even if a sandboxed process is compromised, its ability to perform sensitive operations is severely limited. The comprehensive list of dropped capabilities, including but not limited to \textbf{CAP\_NET\_ADMIN}, \textbf{CAP\_SYS\_MODULE}, and \textbf{CAP\_SYS\_RAWIO}, reflects a meticulous approach to minimizing the attack surface. Refer to the output of the command \emph{syd-ls drop} to see the full list of \emph{capabilities}(7) that Syd drops at startup.

Exceptions to this stringent policy, introduced in version 3.11.1, such as retaining \textbf{CAP\_NET\_BIND\_SERVICE} with \emph{trace/allow\_unsafe\_bind:1}, \textbf{CAP\_NET\_RAW} with \emph{trace/allow\_unsafe\_socket:1}, \textbf{CAP\_SYSLOG} with \emph{trace/allow\_unsafe\_syslog:1} and \textbf{CAP\_SYS\_TIME} with \emph{trace/allow\_unsafe\_time:1}, offer a nuanced security model. These exceptions allow for necessary network, syslog and time adjustments within the sandbox, providing flexibility without significantly compromising security.

Since version 3.12.5, Syd allows the user to prevent dropping capabilities at startup using the command \emph{trace/allow\_unsafe\_caps:1}. This command may be used to construct privileged containers with Syd.

This balanced strategy of restricting \emph{capabilities}(7), coupled with selective permissions, exemplifies Syd\textquotesingle s commitment to crafting a secure yet functional sandbox environment. By leveraging the granularity of Linux \emph{capabilities}(7), Syd offers a robust framework for safeguarding applications against a variety of threats, underscoring its role as a pivotal tool in the security arsenal of Linux environments.

\subsection{Path Resolution Restriction For Chdir and Open Calls}\label{path-resolution-restriction-for-chdir-and-open-calls}

In Syd version 3.15.1, a configurable security feature is available to address the risk of directory traversal attacks by restricting the use of \emph{..} components in path arguments for \emph{chdir}(2), \emph{open}(2), \emph{openat}(2), \emph{openat2}(2), and \emph{creat}(2) system calls. This feature is off by default, ensuring broad compatibility and operational flexibility for a range of applications. When enabled with the \emph{trace/deny\_dotdot:1} command, Syd strengthens its defence mechanisms against unauthorised directory access, echoing the flexibility seen in FreeBSD\textquotesingle s \emph{vfs.lookup\_cap\_dotdot} sysctl. This allows for a nuanced approach to filesystem security, where administrators can tailor the sandbox\textquotesingle s behavior to match specific security requirements or operational contexts. By drawing on the security insights of FreeBSD and HardenedBSD, Syd provides a versatile toolset for managing path traversal security, adaptable to the unique demands of various application environments. See the following links for more information:

\begin{itemize}
\item
  https://man.freebsd.org/cgi/man.cgi?open(2)
\item
  https://cgit.freebsd.org/src/tree/sys/kern/vfs\_lookup.c\#n351
\end{itemize}

\subsection{Enhanced Symbolic Link Validation}\label{enhanced-symbolic-link-validation}

As of version 3.13.0, Syd enhances security by enforcing stricter validation on symbolic links within \emph{/proc/pid/fd}, \emph{/proc/pid/cwd}, \emph{/proc/pid/exe}, and \emph{/proc/pid/root}, addressing potential misuse in container escape scenarios. Specifically, Syd returns an \textbf{EACCES} ("Permission denied") \emph{errno}(3) for attempts to resolve these symbolic links if they do not pertain to the \emph{current process}, akin to implementing \textbf{RESOLVE\_NO\_MAGICLINKS} behavior of the \emph{openat2}(2) system call. This measure effectively hardens the sandbox against attacks exploiting these links to access resources outside the intended confinement, bolstering the isolation provided by Syd and mitigating common vectors for privilege escalation and sandbox escape. As of version 3.14.5, Syd keeps intercepting path system calls even if sandboxing is off making this protection unconditional.

\subsection{Trusted Symbolic Links}\label{trusted-symbolic-links}

As of version 3.37.2, Syd implements a robust symbolic-link hardening mechanism that intercepts every \emph{symlink}(7) resolution within untrusted directories -\/- those marked world-writable, group-writable, or carrying the sticky bit -\/- and denies any follow operation, returning \textbf{EACCES} ("Permission denied"); this behavior mirrors GrSecurity\textquotesingle s \textbf{CONFIG\_GRKERNSEC\_LINK} and guarantees that symlink chains in shared or temporary locations cannot be weaponized for TOCTOU or link-trick exploits. Under the default policy, neither direct nor nested symlinks in untrusted paths will be traversed, and the check is applied at the \emph{seccomp}(2) interception layer prior to any mutable state changes -\/- ensuring an early, fail-close enforcement. Administrators may relax this restriction at startup or runtime by enabling the \emph{trace/allow\_unsafe\_symlinks:1} option, which restores legacy symlink behavior for compatibility at the cost of re-exposing potential link-based race vulnerabilities. Refer to the following links for more information:

\begin{itemize}
\item
  https://wiki.gentoo.org/wiki/Hardened/Grsecurity2\_Quickstart
\item
  https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#Linking\_restrictions
\item
  https://xorl.wordpress.com/2010/11/11/grkernsec\_link-linking-restrictions/
\item
  https://man7.org/linux/man-pages/man5/proc\_sys\_fs.5.html
\end{itemize}

\subsection{Trusted Hardlinks}\label{trusted-hardlinks}

As of version 3.37.4, Syd introduces a comprehensive \emph{Trusted Hardlinks} policy to mitigate a class of vulnerabilities stemming from unsafe hardlink creation, particularly those enabling time-of-check-to-time-of-use (TOCTOU) exploitation and privilege escalation in shared filesystem environments. This mitigation enforces strict constraints on which files may be linked, based on their visibility, mutability, and privilege-related attributes. A file is permitted as a hardlink target only if it is accessible for both reading and writing by the caller, ensuring that immutable or opaque targets cannot be leveraged in multi-stage attack chains. Furthermore, the file must be a regular file and must not possess privilege-escalation enablers such as the set-user-ID bit or a combination of set-group-ID and group-executable permissions. These checks are performed preemptively and unconditionally during syscall handling to eliminate reliance on ambient filesystem state and to maintain integrity under adversarial conditions. Administrators may relax this policy for compatibility purposes using the \emph{trace/allow\_unsafe\_hardlinks:1} option, though doing so reintroduces well-documented attack surfaces and undermines the guarantees provided by Syd\textquotesingle s secure execution model. Refer to the following links for more information:

\begin{itemize}
\item
  https://wiki.gentoo.org/wiki/Hardened/Grsecurity2\_Quickstart
\item
  https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#Linking\_restrictions
\item
  https://xorl.wordpress.com/2010/11/11/grkernsec\_link-linking-restrictions/
\item
  https://man7.org/linux/man-pages/man5/proc\_sys\_fs.5.html
\end{itemize}

\subsection{Trusted File Creation}\label{trusted-file-creation}

As of version 3.37.4, Syd enforces a strict \emph{Trusted File Creation} policy designed to mitigate longstanding race-condition vulnerabilities associated with unprivileged use of \textbf{O\_CREAT} in shared or adversarial environments. Building upon the Linux kernel\textquotesingle s \emph{protected\_fifos} and \emph{protected\_regular} sysctls -\/- as well as the stricter semantics of grsecurity\textquotesingle s \textbf{CONFIG\_GRKERNSEC\_FIFO} -\/- this mitigation blocks all \textbf{O\_CREAT} operations targeting pre-existing FIFOs or regular files unless the calling process is the file\textquotesingle s owner and the file is neither group-writable nor world-writable, irrespective of the parent directory\textquotesingle s ownership or permissions. Unlike upstream Linux, which allows certain accesses if the file resides in a directory owned by the caller, Syd eliminates this dependency to close subtle privilege boundary gaps and ensure consistent, capability-centric enforcement even in nested namespace or idmapped mount scenarios. This policy guarantees that users cannot preempt or hijack file-based IPC or partial writes via shared directories, while maintaining usability through precise capability trimming. For compatibility with legacy workloads or permissive setups, this restriction may be selectively disabled by setting the \emph{trace/allow\_unsafe\_create:1} option, though doing so reintroduces exposure to well-documented filesystem race attacks.

As of version 3.45.0, Syd extends this policy to deny file creation through dangling symbolic links as part of its filesystem race hardening. At the \emph{open}(2) boundary, the presence of \textbf{O\_CREAT} implicitly adds \textbf{O\_NOFOLLOW} unless \textbf{O\_EXCL} is also specified, so attempts to create or truncate a path whose final component is a symlink will fail rather than resolving the link target. This behaviour directly addresses classes of vulnerabilities where privileged components are tricked into creating or modifying files behind attacker-controlled symlinks, such as CVE-2021-28153 in GLib (file creation via dangling symlink replacement) and repeated symlink- or mount-race attacks in container runtimes: CVE-2018-15664 (docker cp path traversal via symlink and mount races), CVE-2019-16884 (runc bind-mount escape through user-controlled symlinked host paths), CVE-2021-30465 (runc container escape via crafted /proc and mount races), CVE-2025-31133 (runc maskedPath abuse to obtain writable procfs bindings), CVE-2025-52565 (runc /dev/console bind-mount symlink races leading to writable procfs targets), and CVE-2025-52881 (runc redirected writes bypassing LSM enforcement to arbitrary procfs files). By enforcing fail-closed semantics for all \textbf{O\_CREAT} operations that encounter symlinks, Syd reduces the attack surface for these patterns even when higher-level code assumes symbolic links cannot influence file creation. Refer to the following links for more information:

\begin{itemize}
\item
  https://wiki.gentoo.org/wiki/Hardened/Grsecurity2\_Quickstart
\item
  https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#FIFO\_restrictions
\item
  https://xorl.wordpress.com/2010/11/24/grkernsec\_fifo-named-pipe-restrictions/
\item
  https://man7.org/linux/man-pages/man5/proc\_sys\_fs.5.html
\item
  https://nvd.nist.gov/vuln/detail/CVE-2021-28153
\item
  https://github.com/advisories/GHSA-9hh6-p5c5-mmmf
\item
  https://nvd.nist.gov/vuln/detail/CVE-2018-15664
\item
  https://nvd.nist.gov/vuln/detail/CVE-2019-16884
\item
  https://nvd.nist.gov/vuln/detail/CVE-2021-30465
\item
  https://nvd.nist.gov/vuln/detail/CVE-2025-31133
\item
  https://nvd.nist.gov/vuln/detail/CVE-2025-52565
\item
  https://nvd.nist.gov/vuln/detail/CVE-2025-52881
\item
  https://www.openwall.com/lists/oss-security/2025/11/05/3
\item
  https://github.com/opencontainers/runc/security
\item
  https://www.starlab.io/blog/linux-symbolic-links-convenient-useful-and-a-whole-lot-of-trouble
\end{itemize}

\subsection{Memory-Deny-Write-Execute Protections}\label{memory-deny-write-execute-protections}

Syd version 3.14.1 enhances its security framework by implementing Memory-Deny-Write-Execute (MDWE) protections, aligning with the \textbf{PR\_SET\_MDWE} and \textbf{PR\_MDWE\_REFUSE\_EXEC\_GAIN} functionality introduced in Linux kernel 6.3. This feature establishes a stringent policy against creating memory mappings that are \emph{simultaneously writable and executable}, closely adhering to the executable space protection mechanisms inspired by PaX project. In addition, Syd fortifies these MDWE protections by employing kernel-level seccomp filters on critical system calls, including \emph{mmap}(2), \emph{mmap2}(2), \emph{mprotect}(2), \emph{pkey\_mprotect}(2), and \emph{shmat}(2). These filters are designed to intercept and restrict operations that could potentially contravene MDWE policies, such as attempts to make non-executable memory mappings executable or to map shared memory segments with executable permissions. By integrating \textbf{PR\_SET\_MDWE} for preemptive kernel enforcement and utilizing seccomp filters for granular, kernel-level control over system call execution, Syd provides a robust defence mechanism against exploitation techniques that exploit memory vulnerabilities, thereby ensuring a securely hardened execution environment. This restriction may be relaxed using the \emph{trace/allow\_unsafe\_exec\_memory:1} sandbox command at startup. Even with this restriction relaxed, Syd is going to call \textbf{PR\_SET\_MDWE}, but it will use the \textbf{PR\_MDWE\_NO\_INHERIT} flag to prevent propagation of the MDWE protection to child processes on \emph{fork}(2).

As of version 3.25.0, Syd kills the process on memory errors rather than denying these system calls with \textbf{EACCES} ("Permission denied"). This ensures the system administrator gets a notification via \emph{dmesg}(1), and has a higher chance to react soon to investigate potentially malicious activity. In addition, repeated failures are going to trigger SegvGuard.

As of version 3.37.0, Syd addresses a fundamental architectural vulnerability in the Linux kernel\textquotesingle s Memory-Deny-Write-Execute (MDWE) implementation through proactive file descriptor writability assessment during memory mapping operations. This enhancement directly mitigates Linux kernel bug 219227, which exposes a critical W\^{}X enforcement bypass wherein adversaries can circumvent memory protection mechanisms by exploiting the semantic disconnect between file-backed memory mappings and their underlying file descriptors. The vulnerability manifests when executable memory regions are mapped with \textbf{PROT\_READ\textbar PROT\_EXEC} permissions from file descriptors that retain \emph{write} access, enabling post-mapping modification of executable memory content through standard file I/O operations -\/- effectively transforming read-only executable mappings into mutable code regions that violate fundamental W\^{}X invariants. By implementing mandatory writability validation prior to permitting any file-backed executable memory mapping, Syd enforces strict temporal isolation between memory mapping permissions and underlying file descriptor capabilities, thereby preventing the exploitation of this kernel-level abstraction leakage that would otherwise enable arbitrary code injection through seemingly benign file operations. This defense mechanism operates at the syscall interception layer, providing comprehensive protection against sophisticated memory corruption attacks that leverage the incongruity between virtual memory management and file system semantics to achieve unauthorized code execution within ostensibly hardened environments. This restriction may be relaxed using the \emph{trace/allow\_unsafe\_exec\_memory:1} sandbox command at startup.

\subsection{Advanced Memory Protection Mechanisms}\label{advanced-memory-protection-mechanisms}

Syd version 3.15.1 enhances its security framework by integrating sophisticated a seccomp BPF hook to meticulously block \emph{executable+shared} memory mappings, targeting a critical vulnerability exploitation pathway. As of version 3.21.3, Syd also blocks \emph{executable+anonymous} memory. These updates refine the sandbox\textquotesingle s defence against unauthorised memory access and arbitrary code execution by inspecting and filtering system calls, notably \emph{mmap}(2), and \emph{mmap2}(2), to enforce stringent policies against dangerous memory mapping combinations. While this bolstered security measure significantly reduces the attack surface for exploits like buffer overflows and code injections, it acknowledges potential legitimate use cases, such as Just-In-Time (JIT) compilation and plugin architectures, that may require exceptions. To accommodate necessary exceptions without compromising overall security, Syd allows these restrictions to be relaxed with explicit configuration through the \emph{trace/allow\_unsafe\_exec\_memory:1} command, ensuring that users can fine-tune the balance between security and functionality according to specific requirements, with a keen eye on preventing the propagation of relaxed security settings to child processes.

\subsection{Null Address Mapping Prevention}\label{null-address-mapping-prevention}

In our ongoing effort to enhance the security features of Syd, as of version 3.15.1 we introduced a crucial update inspired by the practices of HardenedBSD, specifically aimed at bolstering our sandbox\textquotesingle s defences against null pointer dereference vulnerabilities. Following the model set by HardenedBSD, Syd now includes a new security measure that completely prohibits the mapping of memory at the NULL address using the \emph{mmap}(2) and \emph{mmap2}(2) system calls with the \textbf{MAP\_FIXED} and \textbf{MAP\_FIXED\_NOREPLACE} flags. This addition is implemented through meticulous seccomp filter rules that block these specific mapping requests when the first argument (addr) is zero, effectively rendering attempts to exploit null pointer dereferences as non-viable by ensuring such memory allocations result in respective system call getting denied with \textbf{EACCES} ("Permission denied"). By disallowing the execution of arbitrary code at the NULL address, Syd significantly reduces the attack surface associated with such vulnerabilities, reinforcing the sandbox\textquotesingle s commitment to providing a robust security framework for Linux systems. This technical enhancement reflects our dedication to leveraging advanced security insights from the broader community, embodying our proactive stance on safeguarding against evolving threats.

Linux has \emph{vm/mmap\_min\_addr} which guards against this already. Hence, this acts as a second layer of defense. Note, though, unlike Syd, Linux allows processes with the \textbf{CAP\_SYS\_RAWIO} capability to edit/override this value. As of version 3.37.0, Syd caps this value at page size like OpenBSD does for added hardening against such edits.

As of version 3.25.0, all addresses lower than the value of \emph{vm/mmap\_min\_addr} at Syd startup are included into the seccomp filter the action of the filter is set to kill process rather than deny with EACCES. This ensures the system administrator gets a notification via \emph{dmesg}(1), and has a higher chance to react soon to investigate potentially malicious activity. In addition, repeated failures are going to trigger SegvGuard.

\subsection{Default Memory Allocator Security Enhancement}\label{default-memory-allocator-security-enhancement}

As of version 3.46.0, Syd has transitioned to using the GrapheneOS allocator as its default memory allocator. This new allocator leverages modern hardware capabilities to provide substantial defenses against common vulnerabilities like heap memory corruption, while reducing the lifetime of sensitive data in memory. While the previously used mimalloc with the secure option offered notable security improvements, the GrapheneOS allocator goes further with features like out-of-line metadata protection, fine-grained randomization, and aggressive consistency checks. It incorporates advanced techniques such as hardware memory tagging for probabilistic detection of use-after-free errors, zero-on-free with write-after-free detection, and randomized quarantines to mitigate use-after-free vulnerabilities. The allocator is designed to prevent traditional exploitation methods by introducing high entropy, random base allocations across multiple memory regions, and offers a portable solution being adopted by other security-focused operating systems like Secureblue. It also heavily influenced the next-generation musl malloc implementation, improving security with minimal memory usage. Refer to the following links for more information:

\begin{itemize}
\item
  https://grapheneos.org/features\#exploit-mitigations
\item
  https://github.com/GrapheneOS/hardened\_malloc
\end{itemize}

\subsection{Enhanced Security for Memory File Descriptors}\label{enhanced-security-for-memory-file-descriptors}

In version 3.21.1, Syd significantly enhanced its security posture by introducing restrictions on memory file descriptors (memfds). The \emph{memfd\_create}(2) system call is now sandboxed under Create sandboxing, with the name argument prepended with \emph{!memfd:} before access checks. This allows administrators to globally deny access to memfds using rules like \emph{deny/create+!memfd:*}. Additionally, the \emph{memfd\_secret}(2) system call, which requires the \emph{secretmem.enable=1} boot option and is seldom used, was denied to prevent potential exploits. Despite file I/O being restricted on secret memfds, they could be abused by attackers to write payloads and map them as executable, thus bypassing denylisted code execution controls.

Building on these changes, version 3.21.2 further fortifies security by making memfds non-executable by default. This is achieved by removing the \textbf{MFD\_EXEC} flag and adding the \textbf{MFD\_NOEXEC\_SEAL} flag to \emph{memfd\_create}(2), ensuring memfds cannot be made executable. Notably, the \textbf{MFD\_NOEXEC\_SEAL} flag requires Linux-6.3 or newer to function. These measures collectively mitigate the risk of memfd abuse, which can involve executing malicious code within a sandbox, circumventing security mechanisms like Exec, Force, and TPE sandboxing. For scenarios where executable or secret memfds are genuinely required, the \emph{trace/allow\_unsafe\_memfd:1} option allows for relaxing these restrictions, though it introduces increased security risks. By default, these enhancements enforce a robust security posture, preventing attackers from leveraging memfds as a vector for unauthorized code execution.

\subsection{Path Masking}\label{path-masking}

Introduced in version 3.16.7, the \emph{Path Masking} feature in Syd enhances security by enabling the obfuscation of file contents without denying access to the file itself. This functionality is critical in scenarios where compatibility requires file presence, but not file readability. Path Masking works by redirecting any attempt to \emph{open}(2) a specified file to the character device \emph{/dev/null}, effectively presenting an empty file to the sandboxed process. The original file metadata remains unchanged, which is essential for applications that perform operations based on this data. Moreover, masked files can still be executed, providing a seamless integration where executability is required but content confidentiality must be preserved.

This feature leverages \emph{glob}(3p) patterns to specify which files to mask, allowing for flexible configuration tailored to diverse security needs. By default, Syd masks sensitive paths such as \emph{/proc/cmdline} to prevent the leakage of potentially sensitive boot parameters, aligning with Syd\textquotesingle s security-first design philosophy. Path Masking is a robust security enhancement that minimises the risk of sensitive data exposure while maintaining necessary system functionality and compliance with expected application behaviors.

\subsection{Refined Socket System Call Enforcement}\label{refined-socket-system-call-enforcement}

In Syd version 3.16.12, we have strengthened the enforcement of socket system call restrictions within the sandbox using kernel-level BPF filters. This enhancement builds upon existing features by embedding these controls directly into the Syd process, ensuring that even if Syd is compromised, it cannot utilise or manipulate denied socket domains. This proactive measure restricts socket creation strictly to permitted domains such as UNIX (\textbf{AF\_UNIX}), IPv4 (\textbf{AF\_INET}), and IPv6 (\textbf{AF\_INET6}), significantly reducing the network attack surface. The \emph{trace/allow\_unsupp\_socket:1} option allows for the extension of permissible socket domains, catering to specific needs but potentially increasing exposure risks. Additionally, \emph{trace/allow\_safe\_kcapi:1} enables access to the Kernel Crypto API, facilitating necessary cryptographic operations directly at the kernel level. These enhancements provide a more secure and configurable environment, allowing administrators precise control over network interactions and improving the overall security posture of the sandbox.

\subsection{Enhanced Execution Control (EEC)}\label{enhanced-execution-control-eec}

The Enhanced Execution Control (EEC) feature, introduced in Syd version 3.17.0, represents a significant advancement in the sandbox\textquotesingle s defence mechanisms. This feature strategically disables the \emph{execve}(2) and \emph{execveat}(2) system calls for the Syd process after they are no longer required for executing the sandbox process, thus safeguarding against their potential abuse by a compromised Syd process. The prohibition of these critical system calls adds a robust layer to the existing Memory-Deny-Write-Execute (MDWE) protections, intensifying the system\textquotesingle s defences against exploit techniques such as code injection or return-oriented programming (ROP). Concurrently, EEC ensures that the \emph{ptrace}(2) syscall is limited following the initial use of the \textbf{PTRACE\_SEIZE} call for execution-related mitigations. This action effectively prevents subsequent system trace operations, barring unauthorised process attachments and further securing the system against manipulation. Together, these measures enhance Syd\textquotesingle s security architecture, reflecting an ongoing commitment to implement rigorous, state-of-the-art safeguards within the execution environment.

As of version 3.17.1, the Enhanced Execution Control (EEC) has been further strengthened by integrating \emph{mprotect}(2) hardening mechanisms specifically targeting the prevention of the \emph{ret2mprotect} exploitation technique. This enhancement blocks attempts to alter memory protections to executable (using the \textbf{PROT\_EXEC} flag) via the \emph{mprotect}(2) and \emph{pkey\_mprotect}(2) system calls. By adding these checks, EEC mitigates the risk associated with compromised Syd processes by enforcing stringent memory operation policies that prevent unauthorised memory from becoming executable, thereby countering sophisticated memory corruption attacks such as return-oriented programming (ROP) and other code injection strategies. This proactive security measure is crucial for maintaining the integrity of the sandbox environment, ensuring that Syd continues to offer robust protection against evolving exploit techniques.

As of version 3.23.9, the Enhanced Execution Control (EEC) feature has been expanded to mitigate Sigreturn Oriented Programming (SROP) attacks by denying access to the system calls \emph{sigreturn}(2) and \emph{rt\_sigreturn}(2) for \emph{syd}(1), \emph{syd-oci}(1), and \emph{syd-tor}(1). Given the lack of signal handlers, these system calls have no legitimate use. By preventing these calls, the system is better protected against SROP attacks, which involve manipulating signal handler frames to control program state, thus significantly enhancing the security of the execution environment. For further reading, refer to section 2.4.4 Sigreturn-oriented programming in the Low-Level Software Security book (URL: https://llsoftsec.github.io/llsoftsecbook/\#sigreturn-oriented-programming ). SROP (Bosman and Bos 2014) is a special case of ROP where the attacker creates a fake signal handler frame and calls \emph{sigreturn}(2), a system call on many UNIX-type systems normally called upon return from a signal handler, which restores the state of the process based on the state saved on the signal handler\textquotesingle s stack by the kernel previously. The ability to fake a signal handler frame and call sigreturn gives an attacker a simple way to control the state of the program.

\subsection{Enhanced execve and execveat Syscall Validation}\label{enhanced-execve-and-execveat-syscall-validation}

As of version 3.24.2, security enhancements to \emph{execve}(2) and \emph{execveat}(2) syscalls have been introduced to thwart simple Return-Oriented Programming (ROP) attacks. Per the Linux \emph{execve}(2) manpage: "On Linux, argv and envp can be specified as NULL. In both cases, this has the same effect as specifying the argument as a pointer to a list containing a single null pointer. \emph{Do not take advantage of} this nonstandard and nonportable misfeature! On many other UNIX systems, specifying argv as NULL will result in an error (\textbf{EFAULT}: "Bad address"). Some other UNIX systems treat the envp==NULL case the same as Linux." Based on this guidance, Syd now rejects \emph{execve}(2) and \emph{execveat}(2) with \textbf{EFAULT} when one of the pathname, argv and envp arguments is NULL. This mitigation targets basic ROP chains where NULL pointers are used as placeholders to bypass argument validation checks, a common tactic in exploiting buffer overflow vulnerabilities. For example, a typical ROP chain trying to execute \emph{execve}(2) with argv and envp set to NULL would be intercepted and denied under these rules:

{\scriptsize \begin{verbatim}
0x0000:         0x40ee2b pop rdx; ret
0x0008:              0x0 [arg2] rdx = 0
0x0010:         0x402885 pop rsi; ret
0x0018:              0x0 [arg1] rsi = 0
0x0020:         0x4013cc pop rdi; ret
0x0028:         0x460000 [arg0] rdi = 4587520
0x0030:         0x438780 execve
\end{verbatim}}

An attacker might circumvent this mitigation by ensuring that none of the critical syscall arguments are NULL. This requires a more sophisticated setup in the ROP chain, potentially increasing the complexity of the exploit and reducing the number of vulnerable targets. This focused security measure enhances system resilience against simple ROP exploits while maintaining compliance with POSIX standards, promoting robustness and cross-platform security.

As of version 3.25.0, Syd terminates the process upon entering these system calls with NULL arguments rather than denying them with \textbf{EFAULT}. This ensures the system administrator gets a notification via kernel audit log, ie. \emph{dmesg}(1), about potentially malicious activity. In addition, repeated failures are going to trigger SegvGuard.

We have verified the same issue is also present on HardenedBSD and notified upstream:

\begin{itemize}
\item
  Issue: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/106
\item
  Fix: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/commit/cd93be7afbcfd134b45b52961fc9c6907984c85f
\end{itemize}

\subsection{Securebits and Kernel-Assisted Executability}\label{securebits-and-kernel-assisted-executability}

As of version 3.41.0, Syd initializes the per-thread securebits in a kernel-cooperative manner: on Linux 6.14 and newer, which provide the executability-check interface (\emph{execveat}(2) with \textbf{AT\_EXECVE\_CHECK}) and the corresponding interpreter self-restriction securebits, Syd first attempts to install a comprehensive securebits configuration (with locks) that hardens capability semantics and execution constraints; if the kernel refuses changes due to privilege (e.g., \textbf{CAP\_SETPCAP} not present) and returns \textbf{EPERM} ("Operation not permitted"), Syd deterministically degrades to the unprivileged, interpreter-facing policy only, thereby enabling and locking a file-descriptor-based executability check and prohibiting interactive snippet execution unless the same kernel probe passes, while on older kernels the secure-exec policy setup is treated as a no-op and startup proceeds without altering executability behavior; this initialization is inherited across forks and execs (with the kernel rule that the \emph{keep capabilities} base flag is cleared on exec), is orthogonal to the \emph{no\_new\_privs} attribute, and is designed to be monotonic and predictable under mixed-privilege and mixed-kernel deployments: unsupported features are ignored, permission failures do not abort startup, and the resulting state is the strongest policy the kernel will accept; Users may opt out of these defaults per deployment by setting \emph{trace/allow\_unsafe\_exec\_script:1} to skip the script/file vetting policy, \emph{trace/allow\_unsafe\_exec\_interactive:1} to allow interactive interpreter inputs again, \emph{trace/allow\_unsafe\_exec\_null:1} to permit legacy exec with NULL argv/envp as described in the previous subsection, or \emph{trace/allow\_unsafe\_cap\_fixup:1} to preserve traditional UID/capability-fixup semantics. Refer to the following links for more information:

\begin{itemize}
\item
  https://docs.kernel.org/userspace-api/check\_exec.html
\item
  https://man7.org/linux/man-pages/man2/execveat.2.html
\item
  https://man7.org/linux/man-pages/man7/capabilities.7.html
\item
  https://man7.org/linux/man-pages/man2/prctl.2.html
\item
  https://man7.org/linux/man-pages/man2/pr\_set\_securebits.2const.html
\item
  https://www.man7.org/linux/man-pages/man2/PR\_SET\_KEEPCAPS.2const.html
\end{itemize}

\subsection{Enhanced Path Integrity Measures}\label{enhanced-path-integrity-measures}

As of version 3.17.4, Syd incorporates crucial enhancements to maintain the integrity of file system paths by systematically denying and masking paths that contain control characters. These modifications are essential for preventing the exploitation of terminal-based vulnerabilities and for maintaining robustness in logging activities. Paths identified with control characters are not only denied during sandbox access check but are also sanitized when logged to ensure that potentially harmful data does not compromise log integrity or facilitate inadvertent security breaches. Such measures underscore Syd\textquotesingle s ongoing commitment to fortifying security by adhering to rigorous, up-to-date standards for handling untrusted input efficiently.

As of version 3.18.6, this restriction can be relaxed by using the setting \emph{trace/allow\_unsafe\_filename:1}. This setting may be toggled from within the sandbox during runtime prior to locking the sandbox.

As of version 3.28.0, Syd has enhanced its path integrity measures by incorporating an implementation based on David A. Wheeler\textquotesingle s Safename Linux Security Module (LSM) patches. This update not only prevents the creation of filenames containing potentially harmful characters but also hides existing files with such names. Invalid filenames are now denied with an \textbf{EINVAL} ("Invalid argument") \emph{errno}(3) when necessary. In alignment with Wheeler\textquotesingle s recommendations on restricting dangerous filenames, the validation now enforces stricter rules:

\begin{itemize}
\item
  \textbf{Control Characters}: Filenames containing control characters (bytes 0x00--0x1F and 0x7F) are denied.
\item
  \textbf{UTF-8 Encoding}: Filenames must be valid UTF-8 sequences.
\item
  \textbf{Forbidden Characters}: The following characters are disallowed in filenames as they may interfere with shell operations or be misinterpreted by programs: *, ?, {[}, {]}, ", \textless, \textgreater, \textbar, (, ), \&, \textquotesingle, !, \textbackslash, ;, \$, and `.
\item
  \textbf{Leading Characters}: Filenames cannot start with a space ( ), dash (-), or tilde (\textasciitilde).
\item
  \textbf{Trailing Characters}: Filenames cannot end with a space ( ).
\end{itemize}

As of version 3.37.9, space checks have been extended to cover UTF-8 whitespace, thanks to an idea by Jacob Bachmeyer, see https://seclists.org/oss-sec/2025/q3/123 for more information.

As of version 3.38.0, the characters :, \{, and \} have been removed from the forbidden set to improve usability and reduce false positives. : is used commonly across /dev and /proc. \{\} are used by \emph{firefox}(1) for filenames under the profile directory.

These measures mitigate security risks associated with malicious filenames by ensuring that both new and existing filenames adhere to stringent validation rules. This enhancement strengthens overall system robustness by preventing potential exploitation through untrusted input in file operations. For more information, refer to the following links:

\begin{itemize}
\item
  https://dwheeler.com/essays/fixing-unix-linux-filenames.html
\item
  https://lwn.net/Articles/686021/
\item
  https://lwn.net/Articles/686789/
\item
  https://lwn.net/Articles/686792/
\end{itemize}

\subsection{Device Sidechannel Mitigations}\label{device-sidechannel-mitigations}

As of Syd version 3.21.0, Syd\textquotesingle s device sidechannel mitigations align closely with \textbf{GRKERNSEC\_DEVICE\_SIDECHANNEL} in Grsecurity, aiming to prevent timing analyses on block or character devices via \emph{stat}(2) or \emph{inotify}(7)/\emph{fanotify}(7). For stat-family system calls, Syd, like Grsecurity, matches the last access and modification times to the creation time for devices, thwarting unprivileged user timing attacks. Instead of dropping events, Syd strips access and modify \emph{fanotify}(7)/\emph{inotify}(7) flags at syscall entry, preventing unsafe \emph{fanotify}(7)/\emph{inotify}(7) event generation. This approach ensures unauthorized users cannot determine sensitive information, such as the length of the administrator password. Syd\textquotesingle s solution offers robust security by dynamically stripping flags, enhancing protection against these sidechannel attacks without compromising functionality. As of version 3.40.0, these mitigations can be disabled using the options \emph{trace/allow\_unsafe\_stat\_bdev}, \emph{trace/allow\_unsafe\_stat\_cdev}, \emph{trace/allow\_unsafe\_notify\_bdev}, \emph{trace/allow\_unsafe\_notify\_cdev} respectively. Refer to the following links for more information:

\begin{itemize}
\item
  https://web.archive.org/web/20130111093624/http://vladz.devzero.fr/013\_ptmx-timing.php
\item
  https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity\_and\_PaX\_Configuration\_Options\#Eliminate\_stat/notify-based\_device\_sidechannels
\end{itemize}

\subsection{Restricting CPU Emulation System Calls}\label{restricting-cpu-emulation-system-calls}

As of version 3.22.1, Syd denies the \emph{modify\_ldt}(2), \emph{subpage\_prot}(2), \emph{switch\_endian}(2), \emph{vm86}(2), and \emph{vm86old}(2) system calls by default, which are associated with CPU emulation functionalities. These calls can only be allowed if the \emph{trace/allow\_unsafe\_cpu} option is explicitly set. This restriction helps mitigate potential vulnerabilities and unauthorized access that can arise from modifying CPU state or memory protections, thus strengthening the overall security posture of the sandbox environment.

\subsection{Kernel Keyring Access Restriction}\label{kernel-keyring-access-restriction}

To enhance system security, access to the kernel\textquotesingle s key management facility via the \emph{add\_key}(2), \emph{keyctl}(2), and \emph{request\_key}(2) system calls is restricted by default as of version 3.22.1. These calls are crucial for managing keys within the kernel, enabling operations such as adding keys, manipulating keyrings, and requesting keys. The restriction aims to prevent unauthorized or potentially harmful modifications to keyrings, ensuring that only safe, controlled access is permitted. However, administrators can relax this restriction by enabling the "trace/allow\_unsafe\_keyring" option, allowing these system calls to be executed when necessary for legitimate purposes.

Note, because of this restriction, Syd is not affected by CVE-2024-42318 although we use Landlock. See here for more information: https://www.openwall.com/lists/oss-security/2024/08/17/2

\subsection{Restricting Memory Protection Keys System Calls}\label{restricting-memory-protection-keys-system-calls}

As of version 3.22.1, Syd denies the system calls \emph{pkey\_alloc}(2), \emph{pkey\_free}(2), and \emph{pkey\_mprotect}(2) by default. These system calls are associated with managing memory protection keys, a feature that can be leveraged to control memory access permissions dynamically. To allow these system calls, administrators can enable the \emph{trace/allow\_unsafe\_pkey} option. This restriction enhances security by preventing unauthorized or potentially harmful manipulations of memory access permissions within the sandbox environment, ensuring stricter control over memory protection mechanisms.

\subsection{Restricting vmsplice System Call}\label{restricting-vmsplice-system-call}

As of version 3.23.5, Syd disables the \emph{vmsplice}(2) system call by default to enhance security. This syscall, identified as a potential vector for memory corruption and privilege escalation, poses significant risks in sandboxed environments. By default, disabling \emph{vmsplice}(2) reduces the attack surface, aligning with security practices in other systems like Podman. Refer to the following links for more information:

\begin{itemize}
\item
  https://lore.kernel.org/linux-mm/X+PoXCizo392PBX7@redhat.com/
\item
  https://lwn.net/Articles/268783/
\end{itemize}

As of version 3.41.3, \emph{vmsplice}(2) call may be permitted at startup using the \emph{trace/allow\_unsafe\_vmsplice:1} option.

\subsection{Enforcing Position-Independent Executables (PIE)}\label{enforcing-position-independent-executables-pie}

As of version 3.23.9, Syd mandates that all executables must be Position-Independent Executables (PIE) to leverage Address Space Layout Randomization (ASLR). PIE allows executables to be loaded at random memory addresses, significantly enhancing security by making it more difficult for attackers to predict the location of executable code. This randomization thwarts various types of exploits, such as buffer overflow attacks, which rely on predictable memory addresses to execute malicious code. To accommodate scenarios where PIE is not feasible, users can relax this restriction using the \emph{trace/allow\_unsafe\_exec\_nopie:1} option. This ensures compatibility while maintaining a robust security posture by default, aligning with Syd\textquotesingle s overarching strategy of employing advanced security measures to mitigate potential attack vectors.

\subsection{Enforcing Non-Executable Stack}\label{enforcing-non-executable-stack}

As of version 3.23.16, Syd mandates that all executables must have a non-executable stack to enhance security. A non-executable stack helps to prevent various types of exploits, such as stack-based buffer overflow attacks, by making it more difficult for attackers to execute malicious code from the stack. This security measure is similar to the enforcement of Position-Independent Executables (PIE) and is a crucial part of Syd\textquotesingle s comprehensive security strategy. To accommodate scenarios where a non-executable stack is not feasible, administrators can relax this restriction using the \emph{trace/allow\_unsafe\_exec\_stack:1} option. This ensures compatibility while maintaining a robust security posture by default, aligning with Syd\textquotesingle s overarching strategy of employing advanced security measures to mitigate potential attack vectors.

As of version 3.23.19, Syd enforces this restriction at \emph{mmap}(2) boundary as well so it is no longer possible to \emph{dlopen}(3) a library with executable stack to change the stack permissions of the process to executable. This is useful in mitigating attacks such as CVE-2023-38408. Refer to the URL https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt for more information. As of version 3.25.0, Syd kills the process in this case rather than denying the system call to be consistent with other memory related seccomp filters. This ensures the system administrator gets a notification via the audit log, and has a higher chance to react soon to investigate potentially malicious activity. In addition, repeated failures are going to trigger SegvGuard.

\subsection{Mitigation Against Heap Spraying}\label{mitigation-against-heap-spraying}

As of version 3.23.18, Syd introduces a critical security enhancement to mitigate kernel heap-spraying attacks by restricting the \emph{msgsnd}(2) system call. This call, integral to System V message queues, is essential for inter-process communication (IPC) in Unix-like operating systems. System V message queues allow processes to send and receive messages asynchronously, facilitating robust communication between processes. However, it is also frequently exploited for heap spraying, a technique that increases the predictability of memory allocations to facilitate arbitrary code execution. Notably, exploits such as CVE-2016-6187, CVE-2021-22555, and CVE-2021-26708 have leveraged this system call for kernel heap-spraying to achieve privilege escalation and kernel code execution. Heap spraying aims to introduce a high degree of predictability to heap allocations, facilitating arbitrary code execution by placing specific byte sequences at predictable memory locations. This method is particularly dangerous because it increases the reliability of exploiting vulnerabilities by aligning memory in a way that malicious code execution becomes feasible. To counter this, Syd now disables the \emph{msgsnd}(2) system call by default, which is commonly used for heap spraying due to its ability to allocate large, contiguous blocks of memory in the kernel heap. This preemptive measure significantly reduces the attack surface, preventing attackers from leveraging this system call to bypass security mitigations and achieve kernel code execution. Administrators can re-enable this call using the \emph{trace/allow\_unsafe\_msgsnd:1} option if required for legitimate inter-process communication needs, ensuring that the default configuration prioritizes security against such advanced exploitation techniques.

For more information refer to the following links:

\begin{itemize}
\item
  https://en.wikipedia.org/wiki/Heap\_spraying
\item
  https://grsecurity.net/how\_autoslab\_changes\_the\_memory\_unsafety\_game
\item
  https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit
\item
  https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
\item
  https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html
\end{itemize}

\subsection{Mitigation against Page Cache Attacks}\label{mitigation-against-page-cache-attacks}

As of version 3.25.0, Syd denies the \emph{mincore}(2) system call by default, which is typically not needed during normal run and has been successfully (ab)used for page cache attacks: https://arxiv.org/pdf/1901.01161

To quote the \textbf{Countermeasures} section of the article:

Our side-channel attack targets the operating system page cache via operating system interfaces and behavior. Hence, it clearly can be mitigated by modifying the operating system implementation. \textbf{Privileged} Access. The \emph{QueryWorkingSetEx} and \emph{mincore} system calls are the core of our side-channel attack. Requiring a higher privilege level for these system calls stops our attack. The downside of restricting access to these system calls is that existing programs which currently make use of these system calls might break. Hence, we analyzed how frequently \emph{mincore} is called by any of the software running on a typical Linux installation. We used the Linux \emph{perf} tools to measure over a 5 hour period whenever the \emph{sys\_enter\_mincore} system call is called by any application. During these 5 hours a user performed regular operations on the system, i.e., running various work-related tools like Libre Ofﬁce, gcc, Clion, Thunderbird, Firefox, Nautilus, and Evince, but also non-work-related tools like Spotify. The system was also running regular background tasks during this time frame. Surprisingly, the \emph{sys\_enter\_mincore} system call was not called a single time. This indicates that making the \emph{mincore} system call privileged is feasible and would mitigate our attack at a very low implementation cost.

As of version 3.35.2, the new system call \emph{cachestat}(2) is also denied for the same reason as it is a scalable version of the \emph{mincore}(2) system call. Again, as of version 3.35.2, the option \emph{trace/allow\_unsafe\_page\_cache} has been added to relax this restriction at startup. This may be needed to make direct rendering work with Firefox family browsers.

\subsection{Enforcing AT\_SECURE and UID/GID Verification}\label{enforcing-at_secure-and-uidgid-verification}

As of version 3.27.0, Syd enhances security by enforcing the \textbf{AT\_SECURE} flag in the auxiliary vector of executables at \emph{ptrace}(2) boundary upon receiving the \textbf{PTRACE\_EVENT\_EXEC} event to enforce secure-execution mode. This event happens after the executable binary is loaded into memory but before it starts executing. This enforcement ensures that the C library operates in a secure mode, disabling unsafe behaviors like loading untrusted dynamic libraries or accessing insecure environment variables. Additionally, Syd performs strict UID and GID verification to confirm that the process\textquotesingle s user and group IDs match the expected values, preventing unauthorized privilege escalation. If the verification fails or the \textbf{AT\_SECURE} flag cannot be set, Syd terminates the process to prevent potential security breaches. This mitigation can be relaxed at startup with the option \emph{trace/allow\_unsafe\_exec\_libc:1}, though doing so is not recommended as it reduces the effectiveness of the sandbox. Notably, secure-execution mode is enforced by \emph{apparmor}(7) too and it may also be enforced by other LSMs and eBPF. You may find some implications of the secure-execution mode below. Refer to the \emph{ld.so}(8) and \emph{getauxval}(3) manual pages for implications of secure-execution mode on your system.

glibc dynamic linker strips/ignores dangerous LD\_* variables in secure-execution mode, including \textbf{LD\_LIBRARY\_PATH}, \textbf{LD\_PRELOAD} (only standard dirs; paths with slashes ignored), \textbf{LD\_AUDIT}, \textbf{LD\_DEBUG}, \textbf{LD\_DEBUG\_OUTPUT}, \textbf{LD\_DYNAMIC\_WEAK}, \textbf{LD\_HWCAP\_MASK}, \textbf{LD\_ORIGIN\_PATH}, \textbf{LD\_PROFILE}, \textbf{LD\_SHOW\_AUXV}, \textbf{LD\_USE\_LOAD\_BIAS}, etc. glibc also treats some non-LD\_* variables as unsafe in secure-execution mode: \textbf{GCONV\_PATH}, \textbf{GETCONF\_DIR}, \textbf{HOSTALIASES}, \textbf{LOCALDOMAIN}, \textbf{LOCPATH}, \textbf{MALLOC\_TRACE}, \textbf{NIS\_PATH}, \textbf{NLSPATH}, \textbf{RESOLV\_HOST\_CONF}, \textbf{RES\_OPTIONS}, \textbf{TMPDIR}, \textbf{TZDIR} (stripped/ignored). Refer to the \emph{ld.so}(8) manual page for more information. Note, as of version 3.11.1, Syd also strips unsafe environment variables before executing the sandbox process by default and this can be disabled altogether with \emph{trace/allow\_unsafe\_env:1} or unsafe environment variables can be selectively allowed using the \emph{-e} var= format, e.g.~\emph{-eLD\_PRELOAD=} See the \textbf{Restricting environment and} trace/allow\_unsafe\_env section of this manual page for more information.

glibc\textquotesingle s \textbf{LD\_PREFER\_MAP\_32BIT\_EXEC} is always disabled in secure-execution mode (mitigates ASLR-weakening). Historical bugs (e.g., CVE-2019-19126) fixed cases where this wasn\textquotesingle t ignored after a security transition. Refer to the \emph{ld.so}(8) manual page and the following links for more information:

\begin{itemize}
\item
  https://lists.gnu.org/archive/html/info-gnu/2020-02/msg00001.html
\item
  https://alas.aws.amazon.com/ALAS-2021-1511.html
\end{itemize}

glibc \textbf{GLIBC\_TUNABLES} environment variable handling under \textbf{AT\_SECURE}: tunables carry security levels (\textbf{SXID\_ERASE}, \textbf{SXID\_IGNORE}) so they\textquotesingle re ignored/erased for secure-execution mode; post-CVE-2023-4911 hardening ensures secure-execution mode invocations with hostile GLIBC\_TUNABLES are blocked/terminated. Refer to the following links for more information:

\begin{itemize}
\item
  https://lwn.net/Articles/947736/
\item
  https://access.redhat.com/security/cve/cve-2023-4911
\item
  https://nvd.nist.gov/vuln/detail/CVE-2023-4911
\end{itemize}

glibc \emph{secure\_getenv}(3) returns NULL when \textbf{AT\_SECURE} is set; any glibc subsystem that uses \emph{secure\_getenv}(3) (e.g., timezone, locale, iconv, resolver paths) will ignore environment overrides in secure-execution mode. Similarly calling \emph{getauxval}(3) with the flag \textbf{AT\_SECURE} returns true in secure-execution mode.

musl libc honors \textbf{AT\_SECURE} and likewise ignores preload/library/locale environment knobs in secure-execution mode; examples include \textbf{LD\_PRELOAD}, \textbf{LD\_LIBRARY\_PATH}, and \textbf{MUSL\_LOCPATH}. Refer to the following links for more information:

\begin{itemize}
\item
  https://musl.libc.org/manual.html
\item
  https://wiki.musl-libc.org/environment-variables
\end{itemize}

Because the Linux host kernel is not aware of Syd setting the \textbf{AT\_SECURE} bit, the \emph{proc\_pid\_auxv}(5) file will report the bit as unset. On the contrary, when verbose logging is turned on using the \emph{log/verbose:1} option, Syd will correctly log this bit as set after parsing the \emph{proc\_pid\_auxv}(5) file of the sandbox process.

\subsection{Process Name Modification Restriction}\label{process-name-modification-restriction}

As of version 3.28.0, Syd introduces a critical security enhancement that logs and denies attempts to set a process\textquotesingle s name using the \textbf{PR\_SET\_NAME} \emph{prctl}(2) request. This mitigation is essential as it prevents malicious software from disguising itself under legitimate process names such as \emph{apache} or other system daemons, thereby thwarting attempts to evade detection and maintain stealth within the system. By default, any invocation of \textbf{PR\_SET\_NAME} within the sandboxed environment is intercepted; the action is logged for audit purposes if verbose logging is on, and the system call is denied with success return, essentially turning it into a no-op. If there is a legitimate need to permit process name changes within the sandbox, this restriction can be overridden by enabling the \emph{trace/allow\_unsafe\_prctl:1} option, which allows \textbf{PR\_SET\_NAME} requests to succeed without logging.

\subsection{Mitigation against Sigreturn Oriented Programming (SROP)}\label{mitigation-against-sigreturn-oriented-programming-srop}

As of version 3.30.0, Syd employs a robust, multi-layered mitigation strategy against Sigreturn Oriented Programming (SROP), a sophisticated exploit technique that manipulates the state restoration behavior of the \emph{sigreturn}(2) system call to hijack process execution. This approach addresses SROP\textquotesingle s ability to bypass critical memory protections such as ASLR, NX, and partial RELRO by setting up a fake stack frame to redirect control flow upon signal return. Inspired by Erik Bosman\textquotesingle s proposal in May 2014 (LKML PATCH 3/4), Syd incorporates a signal counting mechanism to track the number of signals delivered to a thread group, ensuring that each \emph{sigreturn}(2) invocation corresponds to an actual, in-progress signal handler. A stray \emph{sigreturn}(2) call violating this rule causes the process to be terminated with the signal \textbf{SIGKILL}. This method provides more precise protection than \emph{sigreturn}(2) frame canaries, which are susceptible to circumvention under certain conditions and significantly enhances the integrity of sandboxed environments, effectively blocking a critical class of attacks. Administrators can disable these mitigations via the \emph{trace/allow\_unsafe\_sigreturn:1} option, though doing so exposes systems to exploitation and undermines security. For more information, refer to the following links:

\begin{itemize}
\item
  http://www.cs.vu.nl/\textasciitilde herbertb/papers/srop\_sp14.pdf
\item
  https://web.archive.org/web/20221002135950/https://lkml.org/lkml/2014/5/15/660
\item
  https://web.archive.org/web/20221002123657/https://lkml.org/lkml/2014/5/15/661
\item
  https://web.archive.org/web/20221002130349/https://lkml.org/lkml/2014/5/15/657
\item
  https://web.archive.org/web/20221002135459/https://lkml.org/lkml/2014/5/15/858
\item
  https://lwn.net/Articles/674861
\item
  https://lore.kernel.org/all/1454801964-50385-1-git-send-email-sbauer@eng.utah.edu/
\item
  https://lore.kernel.org/all/1454801964-50385-2-git-send-email-sbauer@eng.utah.edu/
\item
  https://lore.kernel.org/all/1454801964-50385-3-git-send-email-sbauer@eng.utah.edu/
\item
  https://marc.info/?l=openbsd-tech\&m=146281531025185
\item
  https://isopenbsdsecu.re/mitigations/srop/
\end{itemize}

\subsection{Speculative Execution Mitigation}\label{speculative-execution-mitigation}

As of version 3.30.0, Syd integrates a robust mitigation mechanism leveraging the \emph{prctl}(2) system call to enforce speculative execution controls to fortify the sandbox against advanced speculative execution vulnerabilities, such as \textbf{Spectre} and related side-channel attacks. Upon initialization, Syd attempts to apply the \textbf{PR\_SPEC\_FORCE\_DISABLE} setting for critical speculative execution features -\/- namely \textbf{PR\_SPEC\_STORE\_BYPASS}, \textbf{PR\_SPEC\_INDIRECT\_BRANCH}, and \textbf{PR\_SPEC\_L1D\_FLUSH} -\/- thereby irrevocably disabling these CPU-level misfeatures when permissible. This proactive stance ensures that, where supported by the underlying kernel and hardware, speculative execution is constrained to eliminate potential avenues for data leakage and privilege escalation across privilege domains. The mitigation is conditionally enforced based on the availability of per-task control via \emph{prctl}(2), and any inability to apply these settings due to architectural constraints or insufficient permissions results in logged informational messages without disrupting sandbox operations. Furthermore, administrators retain the capability to override this stringent security posture through the \emph{trace/allow\_unsafe\_exec\_speculative:1} configuration option, permitting flexibility in environments where speculative execution controls may need to be relaxed for compatibility or performance reasons. This dual approach balances rigorous security enforcement with operational adaptability, ensuring that Syd maintains a hardened execution environment while providing mechanisms for controlled exceptions. By systematically disabling speculative execution vulnerabilities at the kernel interface level, Syd significantly mitigates the risk of sophisticated side-channel exploits, thereby enhancing the overall integrity and confidentiality of sandboxed applications. Refer to the links below for more information:

\begin{itemize}
\item
  https://docs.kernel.org/admin-guide/hw-vuln/spectre.html
\item
  https://docs.kernel.org/userspace-api/spec\_ctrl.html
\end{itemize}

As of version 3.35.2, Syd disables Speculative Store Bypass mitigations for \emph{seccomp}(2) filters when \emph{trace/allow\_unsafe\_exec\_speculative:1} is set at startup.

\subsection{Cryptographically Randomized Sysinfo}\label{cryptographically-randomized-sysinfo}

Since Syd 3.28.0, the \emph{sysinfo}(2) system call has been cryptographically obfuscated by applying high-entropy offsets to memory fields (e.g., total RAM, free RAM) and constraining them to plausible power-of-two boundaries, frustrating trivial attempts at system fingerprinting. Specifically, uptime and idle counters each incorporate a distinct offset up to 0xFF\_FFFF (\textasciitilde194 days) unless \emph{unshare/time:1} when time starts from zero, while load averages are randomized in fixed-point format and clamped to realistic upper limits. Administrators seeking genuine system metrics may disable these transformations via \emph{trace/allow\_unsafe\_sysinfo:1}, albeit at the cost of enabling straightforward correlation and potential data leakage.

\subsection{Memory Sealing of Sandbox Policy Regions on Lock}\label{memory-sealing-of-sandbox-policy-regions-on-lock}

Beginning with version 3.33.1, Syd applies Linux\textquotesingle s \emph{mseal}(2) syscall to enforce immutability of policy-critical memory regions at the moment the sandbox is locked with \emph{lock:on}. At this point, all mutable structures influencing access control -\/- such as ACLs, action filters, and syscall mediation rules -\/- are sealed at the virtual memory level. Unlike traditional permission schemes (e.g., W\^{}X or \emph{mprotect}(2)), \emph{mseal}(2) protects against structural manipulation of memory mappings themselves, preventing \emph{mmap}(2), \emph{mremap}(2), \emph{mprotect}(2), \emph{munmap}(2), and destructive \emph{madvise}(2) operations from altering sealed VMAs. This eliminates attacker primitives that rely on reclaiming, remapping, or changing permissions on enforcement data, thereby closing off advanced data-oriented exploitation paths such as policy subversion through remapped ACLs or revocation of constraints via memory permission resets. Syd permits legitimate late-stage policy configuration during startup and defers sealing until \emph{lock:on} is called, after which mutation of enforcement state is structurally frozen. The process is one-way and idempotent; sealed memory cannot be unsealed, ensuring strong guarantees once lockdown is complete. For diagnostic or non-hardened environments, this mechanism may be disabled explicitly via the startup toggle \emph{trace/allow\_unsafe\_nomseal:1}, which should only be used with full awareness of the resulting relaxation in protection. When enabled, sealing substantially raises the integrity threshold of the sandbox, ensuring that post-lock policy enforcement is immune to both direct and indirect memory-level tampering.

\subsection{Force Close-on-Exec File Descriptors}\label{force-close-on-exec-file-descriptors}

The \emph{trace/force\_cloexec} option, introduced in Syd version 3.35.2, ensures that all \emph{creat}(2), \emph{open}(2), \emph{openat}(2), \emph{openat2}(2), \emph{memfd\_create}(2), \emph{socket}(2), \emph{accept}(2), and \emph{accept4}(2) system calls made by the sandbox process include the \textbf{O\_CLOEXEC} flag. This feature can be toggled at runtime via Syd\textquotesingle s virtual stat API, enabling dynamic adjustment of confinement levels as needed. The \textbf{O\_CLOEXEC} flag, when set on file descriptors, ensures they are automatically closed when executing a new program via \emph{execve}(2) or similar system calls. This automatic closure of file descriptors is critical for enhancing security and safety, as it prevents file descriptors from being unintentionally inherited by newly executed programs, which could otherwise lead to unauthorized access to sensitive files or resources. By enforcing the \textbf{O\_CLOEXEC} flag across all \emph{open}(2) calls, Syd mitigates the risk of file descriptor leakage, effectively isolating the sandboxed environment and ensuring a clean execution context for newly spawned processes.

\subsection{Force Randomized File Descriptors}\label{force-randomized-file-descriptors}

The \emph{trace/force\_rand\_fd} option, introduced in Syd version 3.35.2, ensures that all \emph{creat}(2), \emph{open}(2), \emph{openat}(2), \emph{openat2}(2), \emph{memfd\_create}(2), \emph{socket}(2), \emph{accept}(2), and \emph{accept4}(2) system calls made by the sandbox process allocate file descriptors at random available slots rather than the lowest-numbered one. When this feature is enabled, Syd specifies a random available slot (rather than the lowest-numbered one) to the \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD} operation which is used to install a file descriptor to the sandbox process. Randomizing file descriptor numbers makes it significantly harder for an attacker to predict or deliberately reuse critical descriptors, thereby raising the bar against file-descriptor reuse and collision attacks. Note that enabling this may break programs which rely on the POSIX guarantee that \emph{open}(2) returns the lowest available descriptor. This behavior can be toggled at runtime via Syd\textquotesingle s virtual stat API, allowing operators to enable or disable descriptor randomization without restarting or recompiling the sandboxed process. We\textquotesingle re also cooperating with the HardenedBSD project to implement a similar feature in the BSD kernel. Refer to the following link for more information: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/117

\subsection{Syscall Argument Cookies}\label{syscall-argument-cookies}

To further harden the \emph{seccomp}(2) boundary, as of version 3.35.2 Syd embeds cryptographically-strong, per-instance "cookies" into unused architecture-defined syscall argument slots (e.g., the 5th and 6th arguments of \emph{openat2}(2)). These cookies are generated at startup via the OS random number generator using \emph{getrandom}(2), and are checked in the BPF filter so that only calls bearing the correct 32- or 64-bit values will be allowed. By requiring this unpredictable token, Syd raises the bar against arbitrary or forged syscalls: Attackers must first discover or leak the randomized cookies despite Address Space Layout Randomization (ASLR) before mounting a successful path or network operation. This approach effectively transforms unused syscall parameters into an application-level authorization mechanism, preventing trivial reuse of legitimate code paths and mitigating time-of-check-to-time-of-use (TOCTTOU) and ROP payloads that rely on guessing or omitting optional arguments. In combination with absolute path enforcement and the denial of relative descriptors (e.g.~AT\_FDCWD), syscall argument cookies form a lightweight, zero-cost integrity check that elevates syscall hardening without kernel modifications or performance penalties. As an example, here is how the filters look in pseudo filter code for the system calls \emph{openat2}(2) and \emph{socket}(2) on x86-64. \emph{openat2}(2) uses two unused arguments as cookies and \emph{socket}(2) uses three. In addition, \emph{openat2}(2) denies negative file descriptor arguments such as \textbf{AT\_FDCWD}:

{\scriptsize \begin{verbatim}
# filter for syscall "openat2" (437) [priority: 65528]
if ($syscall == 437)
    if ($a0.hi32 > 0)
    else
        if ($a0.hi32 == 0)
            if ($a0.lo32 > 2147483647)
            else
                if ($a4.hi32 == 2047080271)
                    if ($a4.lo32 == 419766579)
                        if ($a5.hi32 == 2863373132)
                            if ($a5.lo32 == 396738706)
                                action ALLOW;
        else
            if ($a4.hi32 == 2047080271)
                if ($a4.lo32 == 419766579)
                    if ($a5.hi32 == 2863373132)
                        if ($a5.lo32 == 396738706)
                            action ALLOW;

# filter for syscall "socket" (41) [priority: 65529]
if ($syscall == 41)
    if ($a3.hi32 == 3378530982)
        if ($a3.lo32 == 4160747949)
            if ($a4.hi32 == 2899982880)
                if ($a4.lo32 == 990920938)
                    if ($a5.hi32 == 3611760485)
                        if ($a5.lo32 == 1163305215)
                            action ALLOW;
\end{verbatim}}

Another example is how the critical \emph{seccomp}(2) notify \emph{ioctl}(2) requests \textbf{SECCOMP\_IOCTL\_NOTIF\_SEND} and \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD} are confined for the Syd emulator threads. \textbf{SECCOMP\_IOCTL\_NOTIF\_SEND} is critical because it allows pass-through of system calls to the host Linux kernel with the \textbf{SECCOMP\_USER\_NOTIF\_FLAG\_CONTINUE} flag in the \emph{seccomp}(2) response data structure. This flag must be used with utmost care and in the hands of an attacker it can be a tool for further exploitation. \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD} is critical because it allows file descriptor transfer between the Syd process and the sandbox process and in the hands of an attacker it can be a tool for file descriptor stealing. As part of this mitigation three syscall cookies are enforced for \emph{ioctl}(2) system calls with the \textbf{SECCOMP\_IOCTL\_NOTIF\_SEND} and \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD} requests. Coupled with the startup randomization of the \emph{seccomp}(2) notify file descriptor, this mitigation raises the bar for an attacker trying to call arbitrary or forged syscalls within a compromised Syd emulator thread. Excerpt from the seccomp filter in pseudo filter code is given below:

{\scriptsize \begin{verbatim}
# Syd monitor rules with seccomp fd 626
#
# pseudo filter code start
#
# filter for arch x86_64 (3221225534)
...
# filter for syscall "ioctl" (16) [priority: 65497]
if ($syscall == 16)
    if ($a0.hi32 == 0)
        if ($a0.lo32 == 626)
            if ($a1.hi32 == 4294967295)
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_RECV)
                    action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_SEND)
                    if ($a3.hi32 == 4195042482)
                        if ($a3.lo32 == 329284685)
                            if ($a4.hi32 == 3163914537)
                                if ($a4.lo32 == 2000745976)
                                    if ($a5.hi32 == 3932715328)
                                        if ($a5.lo32 == 2409429749)
                                            action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_ADDFD)
                    if ($a3.hi32 == 2387882717)
                        if ($a3.lo32 == 529632567)
                            if ($a4.hi32 == 2017338540)
                                if ($a4.lo32 == 3732042218)
                                    if ($a5.hi32 == 4202049614)
                                        if ($a5.lo32 == 546113052)
                                            action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_SET_FLAGS)
                    action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_ID_VALID)
                    action ALLOW;
            if ($a1.hi32 == 0)
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_RECV)
                    action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_SEND)
                    if ($a3.hi32 == 4195042482)
                        if ($a3.lo32 == 329284685)
                            if ($a4.hi32 == 3163914537)
                                if ($a4.lo32 == 2000745976)
                                    if ($a5.hi32 == 3932715328)
                                        if ($a5.lo32 == 2409429749)
                                            action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_ADDFD)
                    if ($a3.hi32 == 2387882717)
                        if ($a3.lo32 == 529632567)
                            if ($a4.hi32 == 2017338540)
                                if ($a4.lo32 == 3732042218)
                                    if ($a5.hi32 == 4202049614)
                                        if ($a5.lo32 == 546113052)
                                            action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_SET_FLAGS)
                    action ALLOW;
                if ($a1.lo32 == SECCOMP_IOCTL_NOTIF_ID_VALID)
                    action ALLOW;
...
    # default action
    action KILL_PROCESS;
# invalid architecture action
action KILL_PROCESS;
\end{verbatim}}

List of system calls protected by cookies is given below. The list may be further extended in the future to cover more system calls used by Syd:

\begin{itemize}
\item
  \emph{ioctl}(2) - \textbf{PROCMAP\_QUERY} - \textbf{SECCOMP\_IOCTL\_NOTIF\_SEND} - \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD}
\item
  \emph{linkat}(2), \emph{renameat2}(2), \emph{unlinkat}(2)
\item
  \emph{memfd\_create}(2)
\item
  \emph{openat2}(2)
\item
  \emph{pipe2}(2)
\item
  \emph{socket}(2), \emph{bind}(2), \emph{connect}(2), \emph{accept4}(2) (\textbf{64-bit only})
\item
  \emph{truncate}(2), \emph{truncate64}(2), \emph{ftruncate}(2)
\item
  \emph{uname}(2)
\item
  \emph{fchdir}(2), \emph{umask}(2)
\end{itemize}

As of version 3.36.0, this mitigation may be disabled at startup using the \emph{trace/allow\_unsafe\_nocookie:1} option.

\subsection{Shared Memory Permissions Hardening}\label{shared-memory-permissions-hardening}

As of version 3.37.0, Syd introduces a kernel-enforced mitigation against System V shared memory squatting by conditioning allow rules on strict permission masks. By inspecting the mode bits passed to \emph{shmget}(2), \emph{msgget}(2), \emph{semget}(2) and \emph{mq\_open}(2) system calls, the sandbox admits creates only when user-, group-, and other-permission fields exclude unsafe write or execute flags (i.e., no bits set in mask 0o177). This measure prevents untrusted processes from elevating permissions after creation or exploiting legacy IPC segments with permissive ACLs, which could lead to disclosure or corruption of shared pages. Based on the attack taxonomy described in \textbf{Memory Squatting:} Attacks on System V Shared Memory (Portcullis, 2013), mode checks take place within the \emph{seccomp}(2) BPF filter before any mapping. The \textbf{IPC\_SET} operations of the \emph{shmctl}(2), \emph{msgctl}(2), and \emph{semctl}(2) system calls are also denied, preventing permission changes after creation. Additionally, any attempt to attach a shared memory segment with the \textbf{SHM\_EXEC} flag via \emph{shmat}(2) is denied to enforce W\^{}X policies, blocking executable mappings through shared memory. The \emph{seccomp}(2) filter also blocks the \textbf{MSG\_STAT\_ANY}, \textbf{SEM\_STAT\_ANY}, and \textbf{SHM\_STAT\_ANY} operations (Linux 4.17+), which would otherwise return segment metadata without verifying its mode, mitigating unintended information leaks. This mitigation is applied in the parent \emph{seccomp}(2) filter, ensuring that the Syd process itself is subject to these restrictions. Administrators may relax this policy at startup using the \emph{trace/allow\_unsafe\_mqueue:1} and \emph{trace/allow\_unsafe\_shm:1} options, but doing so reintroduces the classic squatting vulnerabilities documented in CVE-2013-0254 and related research. For more information refer to the following links:

\begin{itemize}
\item
  https://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
\item
  https://labs.portcullis.co.uk/presentations/i-miss-lsd/
\item
  https://www.cve.org/CVERecord?id=CVE-2013-0254
\end{itemize}

\subsection{Denying Restartable Sequences}\label{denying-restartable-sequences}

As of version 3.37.0, Syd denies access to the restartable sequences with the \emph{rseq}(2) system call by default, substantially elevating the security baseline of the sandbox. The restartable sequences interface enables user space to register per-thread critical regions with kernel-enforced atomicity guarantees, but critically, also exposes a user-controlled abort handler address. In adversarial scenarios, this facility can be abused: attackers with the ability to manipulate process memory or \emph{rseq}(2) registration can redirect execution to arbitrary, attacker-chosen code locations on preemption or CPU migration, bypassing intra-process isolation boundaries and subverting mechanisms such as memory protection keys or control-flow integrity. By prohibiting \emph{rseq}(2), Syd eliminates this kernel-facilitated control-flow transfer primitive, foreclosing a sophisticated class of attacks that leverage restartable sequence state for privilege escalation, sandbox escape, or bypass of compartmentalization. This mitigation exemplifies a least-privilege syscall surface and strong adherence to modern threat models, allowing only strictly necessary system calls and neutralizing emergent attack vectors rooted in nuanced kernel-user collaboration. Administrators may explicitly re-enable this system call if required for compatibility using the \emph{trace/allow\_unsafe\_rseq:1} startup option, with the understanding that doing so weakens this critical security boundary. For more information, refer to the following links:

\begin{itemize}
\item
  https://arxiv.org/abs/2108.03705
\item
  https://arxiv.org/abs/2406.07429
\item
  https://www.usenix.org/system/files/usenixsecurity24-yang-fangfei.pdf
\end{itemize}

\subsection{Personality Syscall Restrictions}\label{personality-syscall-restrictions}

As of version 3.37.0, Syd implements comprehensive restrictions on the \emph{personality}(2) system call to mitigate security vulnerabilities associated with unsafe \emph{personality}(2) flags, particularly the \textbf{ADDR\_NO\_RANDOMIZE} flag which can disable Address Space Layout Randomization (ASLR) -\/- a fundamental memory protection mechanism that prevents reliable exploitation of memory corruption vulnerabilities by randomizing memory layout or the \textbf{READ\_IMPLIES\_EXEC} flag which can bypass memory protections provided by Memory-Deny-Write-Execute, aka W\^{}X. This security enhancement aligns Syd with industry-standard container runtimes including Docker and Podman, which employ identical restrictions to balance security with application compatibility by maintaining an allowlist of safe personality values: \textbf{PER\_LINUX} for standard Linux execution domain, \textbf{PER\_LINUX32} for 32-bit compatibility, \textbf{UNAME26} for legacy kernel version reporting, \textbf{PER\_LINUX32\textbar UNAME26} for combined 32-bit and legacy compatibility, and \textbf{GET\_PERSONALITY} for querying current \emph{personality}(2) without modification. The implementation follows the principle of least privilege by denying all potentially dangerous \emph{personality}(2) modifications while permitting only essential compatibility requirements, thereby preventing malicious actors from leveraging \emph{personality}(2) flags to make exploits more predictable and reliable -\/- a behavior specifically monitored by security detection systems. Administrators requiring unrestricted personality system call access can disable these restrictions using \emph{trace/allow\_unsafe\_personality:1}, though this should be undertaken with careful consideration of the security implications as it potentially exposes the sandbox to personality-based security bypasses that could compromise the isolation guarantees provided by Syd\textquotesingle s broader security hardening strategy encompassing comprehensive system call filtering, capability restrictions, and resource access controls.

As of version 3.47.0, Syd extends these protections by adding \textbf{ADDR\_COMPAT\_LAYOUT} -\/- which forces a legacy, more predictable memory layout -\/- and \textbf{MMAP\_PAGE\_ZERO} -\/- which allows mapping page 0 and can turn NULL-pointer dereferences into code execution -\/- to the \emph{personality}(2) "kill list", so that any attempt within the sandbox to enable \textbf{READ\_IMPLIES\_EXEC}, \textbf{ADDR\_NO\_RANDOMIZE}, \textbf{ADDR\_COMPAT\_LAYOUT}, or \textbf{MMAP\_PAGE\_ZERO} results in immediate termination of the offending process. During sandbox setup, Syd also proactively clears all four of these flags from the inherited \emph{personality}(2) so that untrusted workloads always start with ASLR-friendly layouts and without the ability to rely on legacy low-entropy address layouts or exploit NULL-pointer mappings.

\subsection{Thread-Level Filesystem and File-Descriptor Namespace Isolation}\label{thread-level-filesystem-and-file-descriptor-namespace-isolation}

As of version 3.37.2, Syd\textquotesingle s interrupt, IPC and emulator worker threads are each placed into their own filesystem and file-descriptor namespace by \emph{unshare}(2)\textquotesingle ing both \textbf{CLONE\_FS} and \textbf{CLONE\_FILES}. This per-thread isolation ensures that working directory, \emph{umask}(2) and open-file table changes in one thread cannot leak into -\/- or be influenced by -\/- any other, closing subtle attack vectors such as TOCTOU races on shared \emph{procfs}(5) or fd entries, descriptor reuse across threads, and cwd-based side channels. By scoping thread-local filesystem state and descriptor tables, this enhancement hardens Syd\textquotesingle s sandbox manager against advanced multithreading exploits and preserves strict separation between the monitoring and emulation components.

\subsection{Denying MSG\_OOB Flag in send/recv System Calls}\label{denying-msg_oob-flag-in-sendrecv-system-calls}

As of version 3.37.5, Syd unconditionally denies the use of the \textbf{MSG\_OOB} flag in all \emph{send}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2) calls -\/- regardless of socket family -\/- by returning the \textbf{EOPNOTSUPP} ("Operation not supported on transport endpoint") \emph{errno}(3). As of version 3.41.1, the restriction includes the system calls \emph{recv}(2), \emph{recvfrom}(2), \emph{recvmsg}(2), and \emph{recvmmsg}(2). This measure addresses long-standing security concerns with out-of-band messaging semantics in stream sockets, where urgent data bypasses normal in-order delivery rules and is handled via separate kernel paths. Such semantics are rarely required by modern software but introduce complexity and subtle state transitions inside the kernel\textquotesingle s networking stack, which have historically led to memory safety bugs and race conditions exploitable from unprivileged code. By default, removing \textbf{MSG\_OOB} support reduces the kernel attack surface for sandboxed processes without impacting typical application behavior. For controlled environments where \textbf{MSG\_OOB} is explicitly required, Syd provides the opt-in \emph{trace/allow\_unsafe\_oob:1} flag to restore legacy behavior, though enabling it reintroduces the inherent risks associated with out-of-band data handling. This mitigation is enabled by default on all architectures without the \emph{socketcall}(2) multiplexer which are aarch64, arm, loongarch64, mips64, mipsel64, parisc, parisc64, riscv64, x32, and x86\_64. It is not supported on architectures x86, m68k, mips, mipsel, ppc, ppc64, ppc64le, s390, s390x, sheb, and sh. For more information refer to the following links:

\begin{itemize}
\item
  https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html
\item
  https://chromium-review.googlesource.com/c/chromium/src/+/6711812
\item
  https://u1f383.github.io/linux/2025/10/03/analyze-linux-kernel-1-day-0aeb54ac.html
\end{itemize}

\subsection{Denying O\_NOTIFICATION\_PIPE Flag in pipe2}\label{denying-o_notification_pipe-flag-in-pipe2}

As of version 3.37.5, Syd unconditionally denies the use of the \textbf{O\_NOTIFICATION\_PIPE} flag in \emph{pipe2}(2) by returning the \textbf{ENOPKG} ("Package not installed") \emph{errno}(3), unless the \emph{trace/allow\_unsafe\_pipe:1} option is provided at startup. This restriction addresses the security risks associated with notification pipes -\/- a specialized and seldom-used mechanism designed for delivering kernel event notifications (currently only from the keys subsystem) to userspace when the kernel is built with \textbf{CONFIG\_WATCH\_QUEUE}. Unlike normal pipes, notification pipes operate with distinct semantics and are tightly integrated with kernel internals, creating a more complex and less widely audited code path. Historically, vulnerabilities in notification pipe handling have demonstrated that exposing this functionality to unprivileged, sandboxed code can create exploitable kernel attack surface. Because typical sandboxed applications, including high-risk workloads such as browser renderers, have no legitimate need for notification pipes, Syd disables this flag by default, thereby eliminating an entire class of low-value yet high-risk kernel interfaces. The \emph{trace/allow\_unsafe\_pipe:1} flag can be used to re-enable this capability for controlled testing or compatibility purposes, but doing so reintroduces the underlying security concerns. Refer to the following links for more information:

\begin{itemize}
\item
  https://chromium-review.googlesource.com/c/chromium/src/+/4128252
\item
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=grep\&q=watch\_queue
\end{itemize}

\subsection{madvise(2) Hardening}\label{madvise2-hardening}

As of version 3.41.3, Syd tightens its \emph{seccomp}(2) BPF policy by argument-filtering madvise(2) to an allow-list that is safe for untrusted workloads and has well-understood locality: \textbf{MADV\_SEQUENTIAL}, \textbf{MADV\_DONTNEED}, \textbf{MADV\_REMOVE}, \textbf{MADV\_HUGEPAGE}, \textbf{MADV\_NOHUGEPAGE}, \textbf{MADV\_DONTDUMP}, \textbf{MADV\_COLLAPSE}, \textbf{MADV\_POPULATE\_READ}, \textbf{MADV\_POPULATE\_WRITE}, and (since Linux 6.13) the lightweight guard operations \textbf{MADV\_GUARD\_INSTALL}/\textbf{MADV\_GUARD\_REMOVE} (page-table-level red zones that fault on access without VMA churn). The advice \textbf{MADV\_HWPOISON} is denied and all other advice are treated as no-op because they enable cross-domain information leaks or system-wide pressure channels with no isolation benefit, e.g., \textbf{MADV\_MERGEABLE} drives KSM deduplication which has been repeatedly shown to enable cross-VM/process side channels and targeted bit-flip exploitation (Flip Feng Shui) as well as newer remote and timing channels. \textbf{MADV\_WILLNEED}/\textbf{MADV\_RANDOM} manipulate page-cache residency and prefetch behavior that underpin page-cache side-channel attacks; and reclaim steering like \textbf{MADV\_FREE}/\textbf{MADV\_COLD}/\textbf{MADV\_PAGEOUT} introduces externally observable memory-pressure/timing signals and accounting ambiguity that sandboxes should not expose; privileged page state changes \textbf{MADV\_SOFT\_OFFLINE}/\textbf{MADV\_HWPOISON} are unnecessary in least-authority contexts and remain outside the sandbox contract even if capability checks would reject them. This design follows the strict syscall-and-argument allow-listing discipline also employed by Google\textquotesingle s Sandbox2/Sandboxed-API while remaining specific to Syd\textquotesingle s threat model. To temporarily relax this mitigation for tracing/compatibility, set \emph{trace/allow\_unsafe\_madvise:1} at startup, otherwise unsafe advice remain blocked by default. Refer to the following links for more information:

\begin{itemize}
\item
  https://www.usenix.org/system/files/conference/usenixsecurity16/sec16\_paper\_razavi.pdf
\item
  https://www.ndss-symposium.org/wp-content/uploads/2022-81-paper.pdf
\item
  https://svs.informatik.uni-hamburg.de/publications/2024/Lindemann\_ACSAC2024\_FakeDD.pdf
\item
  https://arxiv.org/pdf/1901.01161
\item
  https://lwn.net/Articles/790123/
\item
  https://lwn.net/Articles/1011366/
\item
  https://developers.google.com/code-sandboxing/sandbox2/explained
\item
  https://developers.google.com/code-sandboxing/sandboxed-api/explained
\end{itemize}

\subsection{setsockopt(2) Hardening}\label{setsockopt2-hardening}

As of version 3.46.1, Syd introduces a fine-grained \emph{setsockopt}(2) hardening layer that denies a curated set of historically fragile or highly privileged \emph{socket}(2) options by matching on the (level, optname) pair in a dedicated \emph{seccomp}(2) filter, covering netfilter rule programming (iptables, ip6tables, arptables, ebtables), multicast routing control, IPv4/IPv6 multicast group management, IPv6 header manipulation, TCP repair and upper-layer protocol hooks, congestion control selection, UDP corking, AF\_PACKET ring/fanout configuration, BPF-based socket filters, and VSOCK buffer sizing. Syd converts these dangerous combinations into success-returning no-ops emulating a successful \emph{setsockopt}(2) while silently discarding the request, which preserves compatibility with applications that merely probe for these features but never rely on their semantics, and at the same time removes a substantial kernel attack surface reachable from unprivileged code. This mitigation is enabled by default on all architectures without the \emph{socketcall}(2) multiplexer which are aarch64, arm, loongarch64, mips64, mipsel64, parisc, parisc64, riscv64, x32, and x86\_64. It is not supported on architectures x86, m68k, mips, mipsel, ppc, ppc64, ppc64le, s390, s390x, sheb, and sh. The mitigation may be relaxed at startup using the option \emph{trace/allow\_unsafe\_setsockopt:1}. Refer to the following links for more information:

\begin{itemize}
\item
  https://nvd.nist.gov/vuln/detail/CVE-2016-9793
\item
  https://www.cve.org/CVERecord?id=CVE-2016-9793
\item
  https://security-tracker.debian.org/tracker/CVE-2016-9793
\item
  https://ubuntu.com/security/CVE-2016-9793
\item
  https://www.exploit-db.com/exploits/41995
\item
  https://nvd.nist.gov/vuln/detail/CVE-2017-6346
\item
  https://www.cve.org/CVERecord?id=CVE-2017-6346
\item
  https://security-tracker.debian.org/tracker/CVE-2017-6346
\item
  https://ubuntu.com/security/CVE-2017-6346
\item
  https://www.cvedetails.com/cve/CVE-2017-6346/
\item
  https://nvd.nist.gov/vuln/detail/CVE-2018-18559
\item
  https://www.cve.org/CVERecord?id=CVE-2018-18559
\item
  https://security-tracker.debian.org/tracker/CVE-2018-18559
\item
  https://ubuntu.com/security/CVE-2018-18559
\item
  https://www.cvedetails.com/cve/CVE-2018-18559/
\item
  https://nvd.nist.gov/vuln/detail/CVE-2020-14386
\item
  https://www.openwall.com/lists/oss-security/2020/09/03/3
\item
  https://unit42.paloaltonetworks.com/cve-2020-14386/
\item
  https://sysdig.com/blog/cve-2020-14386-falco
\item
  https://gvisor.dev/blog/2020/09/18/containing-a-real-vulnerability/
\item
  https://www.cve.org/CVERecord?id=CVE-2007-1353
\item
  https://nvd.nist.gov/vuln/detail/CVE-2007-1353
\item
  https://security-tracker.debian.org/tracker/CVE-2007-1353
\item
  https://ubuntu.com/security/CVE-2007-1353
\item
  https://bugzilla.redhat.com/show\_bug.cgi?id=CVE-2007-1353
\item
  https://ssd-disclosure.com/ssd-advisory-linux-kernel-af\_packet-use-after-free-2/
\end{itemize}

\section{HISTORY \& DESIGN}\label{history-design}

\begin{itemize}
\item
  \textbf{sydbox-0} https://git.sr.ht/\textasciitilde alip/syd/tree/sydbox-0 is a \emph{ptrace}(2) based sandbox.
\item
  \textbf{sydbox-1} https://git.sr.ht/\textasciitilde alip/syd/tree/sydbox-1 is a \emph{ptrace}(2) and \emph{seccomp}(2) based sandbox.
\item
  \textbf{sydbox-2} https://git.sr.ht/\textasciitilde alip/syd/tree/sydbox-1 is a \emph{seccomp}(2) and \emph{seccomp-notify} based sandbox.
\item
  \textbf{sydbox-3} is a rewrite of \textbf{sydbox-2} in Rust and it\textquotesingle s what you are looking at.
\end{itemize}

This codebase has a history of a bit over 15 years and up to this point we have used C11 as our implementation language for various reasons. With \textbf{sydbox-3} we are moving forwards one step and writing the sandbox from scratch using the Rust programming language with the only non-Rust dependency being libseccomp. Although we inherit many ideas and design decisions from the old codebase, we also don\textquotesingle t shy away from radically changing the internal implementation making it much simpler, idiomatic, and less prone to bugs. We have \emph{proper multiarch support} since release 3.0.11, e.g on x86-64, you can run your x32 or x86 binaries just fine under Syd.

This version takes advantage of multithreading and handles system calls using a thread pool whose size is equal to the number of CPUs on the running machine and utilises globsets to match a list of patterns at once, thus continues to perform reasonably well even with very long rulesets. This version also comes with four new sandboxing categories called \textbf{Lock Sandboxing}, \textbf{Memory Sandboxing}, \textbf{PID sandboxing}, \textbf{Stat} Sandboxing, \textbf{Force Sandboxing}: \textbf{Lock Sandboxing} utilises the Landlock Linux Security Module (LSM), \textbf{Memory Sandboxing} allows the user to define a per-process memory limit, \textbf{PID sandboxing} allows the user to define a limit on the maximum number of running tasks under the sandbox, \textbf{Stat Sandboxing} can be used to effectively \emph{hide files and} directories from the sandboxed process whereas \textbf{Force Sandboxing} can be used to verify file checksums prior to exec, similar to HardenedBSD\textquotesingle s Integriforce and NetBSD\textquotesingle s Veriexec.

Finally, the new Syd has support for namespaces. Use e.g.~\emph{syd -munshare/user:1} to create a user namespace. You may use \emph{mount}, \emph{uts}, \emph{ipc}, \emph{pid}, \emph{net}, and \emph{cgroup} instead of \emph{user} to create various namespaces. You may use the \emph{container} profile as a shorthand to create namespaces with \emph{syd -pcontainer}.

You may use Syd as your login shell because it is very practical to have a restricted user. To do this simply add \emph{/path/to/syd} to the file \emph{/etc/shells} and do \emph{chsh -s /path/to/syd username} as root. In this mode the sandbox may be configured using the files \emph{/etc/user.syd-3} and \emph{\textasciitilde/.user.syd-3}. If you want to restrict user configuration of the sandbox, lock the sandbox using \emph{lock:on} at the end of the site-wide configuration file.

\section{EXHERBO}\label{exherbo}

Syd is the default sandbox of \textbf{Exherbo Linux}. We use it to provide a restricted environment under which package builds run with controlled access to file system and network resources. \emph{exheres-0} has a function called \emph{esandbox} to interact with Syd.

\section{SEE ALSO}\label{see-also}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{seccomp}(2), \emph{pidfd\_getfd}(2), \emph{pidfd\_send} signal(2), \emph{ioctl}(2), \emph{ioctl\_tty}(2), \emph{prctl}(2), \emph{namespaces}(7), \emph{cgroup\_namespaces}(7), \emph{ipc\_namespaces}(7), \emph{mount\_namespaces}(7), \emph{network\_namespaces}(7), \emph{pid\_namespaces}(7), \emph{user\_namespaces}(7), \emph{uts\_namespaces}(7)

https://exherbo.org/docs/eapi/exheres-for-smarties.html\#sandboxing

\section{AUTHORS}\label{authors-1}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd(5)}\label{syd5}

\section{NAME}\label{name-2}

\textbf{syd} - Document format for writing Syd profiles

\section{API}\label{api}

Current version of the Syd command API is \textbf{3}. This version is \textbf{stable}.

\section{CONFIGURATION}\label{configuration}

Syd is configured through sandbox commands. For multiple matching rules (e.g.~two rules matching the same path), the last matching rule wins. There are two ways to supply sandbox commands. First, Syd may be configured using a configuration file. The path to the configuration file is specified using the \textbf{-P} command line switch. More than one configuration file may be specified this way. Single commands may also be passed via \textbf{-m} command line switch. Configuration profiles may be applied using the \textbf{-p} command line switch. See the PROFILES section for more information. Second, Syd may be configured using magic \emph{stat}(2) calls during runtime. This is achieved by calling \emph{stat}(2) system call on the special path /dev/syd followed by the sandbox command. Runtime configuration is only possible if the sandbox lock is \textbf{off}. The system call \emph{stat}(2) was chosen because it is practical to invoke using builtin shell commands like:

{\scriptsize \begin{verbatim}
; test -c /dev/syd/sandbox/read:on
\end{verbatim}}

which enables \textbf{Read Sandboxing} for a shell running under Syd. It is also possible to query certain values using the return value of the \emph{stat}(2) call:

{\scriptsize \begin{verbatim}
test -c /dev/syd/sandbox/read? && echo read sandboxing on || echo read sandboxing off
\end{verbatim}}

Some of these shell builtins may actually call other system calls such as \emph{fstat}(2), \emph{lstat}(2), \emph{newfstatat}(2), or \emph{statx}(2). Syd supports the same interface through all these system calls transparently. Check the manual page \emph{syd}(2) for a description of the \emph{stat}(2) interface.

\section{NAMING}\label{naming}

Configuration file naming of Syd follows a naming scheme which makes it possible to extract command API version from the file name. A Syd configuration file must have the extension \textbf{syd-} followed by the API version (e.g.~\textbf{"syd-3"} for API version \textbf{3}).

\section{SYNTAX}\label{syntax}

Input files must use the UTF-8 encoding. Config format is line oriented. Comments start with "\#". Inline comments are \emph{not} supported. Blank lines are ignored. All the other lines are treated as if they were supplied to Syd via the \textbf{-m} command line switch. For a list of available sandbox commands, consult \emph{syd}(2). For a VIM syntax file for Syd profiles check here: https://gitlab.exherbo.org/sydbox/sydbox/-/tree/main/vim

As of version 3.15.1, Syd adds two additional features to configuration file parsing:

\begin{itemize}
\item
  Environment variable expansion is performed on arguments. By default \textbf{shellexpand} crate is used to perform expansion and a timeout may be set using \textbf{config/expand} to perform expansion using \emph{wordexp}(3) instead. Notably, unset environment variables are not expanded to empty strings. On environment variable lookup errors and UTF-8 decoding errors Syd stops parsing and exits with error. This is done for safety as an unintended empty-string expansion can potentially cause the resulting sandboxing rule to allowlist unintended paths without the user easily noticing it. The user is recommended to set default values for environment variables using the familiar \textbf{\$\{HOME:-/var/empty\}} notation. If you really want empty-string expansion on unset environment variables, you can get this effect using the notation \textbf{\$\{HOME:-\}} but this is not recommended and should be used with care.
\item
  \textbf{include} directives can be used to request the inclusion of another configuration file. Upon reading an include line, Syd stops parsing the current file, validates the given include path and starts to parse the new configuration file. The file must not be writable by group or others for safety. For include files with relative paths, Syd searches the file under the directory of the previous configuration file rather than the current working directory for safety and ease of configuration. Loops in include directives are detected by caching the device id and inode of the configuration files. Note, this directive is not permitted when loading configuration from a file descriptor using the \textbf{load} command.
\end{itemize}

As of version 3.17.6, Syd adds the \textbf{include\_profile} directive which may be used to include a Syd profile. See \textbf{syd-cat -plist} for the list of profiles.

\section{PROFILES}\label{profiles}

Syd has a number of predefined profiles to make configuration easier. These profiles may be used standalone or stacked with other profiles and custom configuration to create various levels of isolation and confinement. To see the complete list of profiles, use \textbf{syd-cat -plist}. To list the rules of a profile, use \textbf{syd-cat -p\textless profile-name\textgreater{}}. Below you may find a brief list of common profiles and their functionality:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{container} & Enables Linux namespaces. \\
& You may refer to this profile shortly as just \textbf{c}. \\
\textbf{immutable} & Enables Linux namespaces and remounts the following directories \emph{read only} in the new mount namespace: \\
& \textbf{/etc}, \textbf{/home}, \textbf{/media}, \textbf{/mnt}, \textbf{/opt}, \textbf{/srv}, and \textbf{/usr}. \\
& Further mount options such as \textbf{nodev}, \textbf{noexec}, \textbf{nosuid}, and \textbf{noatime} are also applied as necessary. \\
& In addition, \textbf{/dev/shm} and \textbf{/tmp} are mounted private and kernel filesystems are masked. \\
& See \textbf{syd-cat -p immutable} for the full list of mount options. \\
& You may refer to this profile shortly as just \textbf{i}. \\
\textbf{privileged} & Do not drop Linux capabilities at startup. Used to construct privileged containers. \\
& You may refer to this profile shortly as just \textbf{p}. \\
\textbf{readonly} & Deny all write sandbox capabilities to the entire root filesystem. \\
& You may refer to this profile shortly as just \textbf{ro}. \\
\textbf{landlock} & Enables \textbf{LandLock} and allows system directories for \textbf{Lock Sandboxing}. \\
& You may refer to this profile shortly as just \textbf{l}. \\
\textbf{linux} & Common Linux system profile, used by \textbf{oci}, \textbf{paludis} and \textbf{user} profiles. \\
& You may refer to this profile shortly as just \textbf{L}. \\
\textbf{oci} & Used by \emph{syd-oci}(1) as the default container profile. \\
\textbf{paludis} & Used by the \textbf{Paludis} package mangler. \\
\textbf{local} & Force local networking, rewrite all addresses to loopback at bind/connect, used by \textbf{user} profile. \\
& You may refer to this profile shortly as just ***. \\
\textbf{noipv4} & Disables \textbf{IPv4} connectivity. \\
& You may refer to this profile shortly as just \textbf{6}. \\
\textbf{noipv6} & Disables \textbf{IPv6} connectivity. \\
& You may refer to this profile shortly as just \textbf{4}. \\
\textbf{cwd}, \textbf{pwd} & Grant all access to the current working directory. \\
& You may refer to this profile shortly as just \textbf{d}. \\
& Syd sets the environment variable \textbf{SYD\_PWD} before parsing this profile. \\
& If the process has no current working directory, \textbf{SYD\_PWD} variable is set to \textbf{/proc/self/fdinfo}. \\
\textbf{core} & Allows generation of coredumps. \\
& You may refer to this profile shortly as just \textbf{C}. \\
\textbf{debug} & Allows debuggers inside the sandbox. \\
& Syd does not use \emph{ptrace}(1) with this profile, so tracers may attach. \\
& You may refer to this profile shortly as just \textbf{D}. \\
\textbf{nomem} & Allows unsafe memory (no W\^{}X, no Memory-Deny-Write-Execute, allows e.g.~JITs). \\
& You may refer to this profile shortly as just \textbf{M}. \\
\textbf{nopie} & Relaxes PIE (Position Independent Executable) restriction. \\
& You may refer to this profile shortly as just \textbf{P}. \\
\textbf{quiet} & Silences all access violations. \\
& You may refer to this profile shortly as just \textbf{q}. \\
\textbf{hide} & Turns on Chdir, Stat and Walk sandboxing for path hiding. \\
& You may refer to this profile shortly as just \textbf{h}. \\
\textbf{fs} & Turns on Filesystem sandboxing to confine file opens based on filesystem type. \\
& Allows access to all filesystem types except some special filesystem types. \\
& Refer to the output of \emph{syd-cat -pfs} for the list of denied filesystem types. \\
& Used by \textbf{linux} profile. \\
\textbf{rand} & Enables randomized file descriptors, used by \textbf{user} profile. \\
& See \textbf{Force Randomized File Descriptors} section of the \emph{syd}(7) manual page for more information. \\
& You may refer to this profile shortly as just \textbf{r}. \\
\textbf{off} & Turns all sandboxing off. \\
\textbf{lib} & \textbf{libsyd} helper profile. Turns all sandboxing off and sets sandbox lock to \textbf{exec}. \\
& Useful to configure Syd in the application using \textbf{libsyd}. \\
\textbf{user} & Allows user-specific directories, and connections, and parses the files \\
& \textbf{/etc/user.syd-3}, and \textbf{\textasciitilde/.user.syd-3} if they exist. \\
& To enforce system-wide settings, set \textbf{lock:on} at the end of \textbf{/etc/user.syd-3}. \\
& You may refer to this profile shortly as just \textbf{u}. \\
\textbf{kvm} & Profile to allowlist KVM \emph{ioctl}(2) requests without path check. \\
& Read: https://www.kernel.org/doc/Documentation/virtual/kvm/api.txt \\
\textbf{tty} & Profile to allow TTY access, used by \textbf{oci}, \textbf{paludis}, and \textbf{user} profiles. \\
& You may refer to this profile shortly as just \textbf{t}. \\
& Syd sets the environment variable \textbf{SYD\_TTY} before parsing this profile. \\
& If the process has no controlling terminal, \textbf{SYD\_TTY} variable is set to \textbf{/dev/null}. \\
\textbf{firefox} & Profile to relax restrictions to enable running Firefox family browsers. \\
& You may refer to this profile shortly as just \textbf{ff}. \\
\end{xltabular}

\subsection{Stacking Profiles}\label{stacking-profiles}

It is possible to stack multiple profiles to configure a more restricted sandbox. Remember the order you stack the profiles matter, \emph{the last matching} rule wins. Below are some examples:

\begin{itemize}
\item
  syd -puser -pimmutable -mroot:/mnt/gnu ...
\item
  syd -ppaludis -plandlock -mallow/lock/write+/var/tmp ...
\end{itemize}

It is also possible to combine the one character shortcuts of helper profiles, in order to stack them together. Below are some examples:

\begin{itemize}
\item
  syd -pMPX ... \# Disable MDWE, PIE and exec restrictions.
\item
  syd -puiq ... \# Parse user profile, create an immutable container, and silence access violations.
\end{itemize}

\subsection{Login shell and the User Profile}\label{login-shell-and-the-user-profile}

When invoked without arguments, \textbf{/bin/sh} is executed under Syd with the \textbf{user} profile as a login shell, use \textbf{SYD\_SH} environment variable to override the shell to execute.

\section{SECURITY}\label{security-1}

As of version 3.30.0, Syd aborts with error if path to a specified configuration file has a symbolic link in \emph{any} of its path components. Therefore, the user \emph{must} supply canonicalized paths as configuration file arguments. As of version 3.46.0, parent ("..") components are not permitted in configuration file path and configuration files must be regular files.

\section{ENVIRONMENT}\label{environment}

Syd makes the environment variables \textbf{SYD\_UID}, \textbf{SYD\_GID}, \textbf{SYD\_USER}, \textbf{SYD\_HOME}, and \textbf{SYD\_PWD} available to configuration. These environment variables are not passed to the sandbox process. If you want to explicitly pass them use \emph{setenv!}, e.g. "setenv!PWD=\$SYD\_PWD".

\section{EXAMPLE}\label{example}

{\scriptsize \begin{verbatim}
# Syd profile for OpenNTPD

# Seccomp sandbox
sandbox/read,stat,write,exec,net:on

# Landlock
sandbox/lock:on

# Provide isolation using namespaces.
unshare/mount,uts,pid,ipc,cgroup:1

# Allow adjtimex and keep CAP_SYS_TIME.
trace/allow_unsafe_time:1

# Mount everything ro except /var
bind+tmpfs:/dev/shm:nodev,nosuid,noexec
bind+tmpfs:/tmp:nodev,nosuid
bind+/etc:/etc:ro,nodev,noexec,nosuid,noatime
bind+/home:/home:ro,nodev,noexec,nosuid,noatime
bind+/media:/media:ro,nodev,noexec,nosuid,noatime
bind+/mnt:/mnt:ro,nodev,noexec,nosuid,noatime
bind+/opt:/opt:ro,nodev,nosuid,noatime
bind+/srv:/srv:ro,nodev,noexec,nosuid,noatime
bind+/usr:/usr:ro,nodev,noatime

# Hide Syd
deny/read,stat,write+/proc/1/***

# Allow listen to the ntp port on loopback.
allow/net/bind+loopback!123

# Allow connections to NTP servers.
allow/net/connect+any!53
allow/net/connect+any!123
allow/net/connect+any!65535

# Allow logging to syslog.
allow/net/connect+/dev/log

# Allow `listen wildcard`
allow/net/bind+0.0.0.0!0
allow/net/connect+0.0.0.0!0

# Allow listen to the ntpd socket.
allow/net/bind+/run/ntpd.sock
allow/net/bind+/var/run/ntpd.sock
allow/write+/run/ntpd.sock
allow/write+/var/run/ntpd.sock

# Allow access to system paths
allow/read,stat+/dev/urandom
allow/lock/read+/dev/urandom
allow/read,stat+/etc/hosts
allow/lock/read+/etc/hosts
allow/read,stat+/etc/ntpd.conf
allow/lock/read+/etc/ntpd.conf
allow/read,stat+/etc/passwd
allow/lock/read+/etc/passwd
allow/read,stat+/etc/resolv.conf
allow/lock/read+/etc/resolv.conf
allow/read,stat+/etc/services
allow/lock/read+/etc/services
allow/read,stat+/usr/share/zoneinfo-posix/UTC

# chroot /var/empty && cd /
allow/stat+/
allow/stat+/var/empty
allow/write+/dev/null
allow/lock/write+/dev/null

# Allow executing the ntp binary.
allow/lock/read+/proc
allow/lock/read+/usr
allow/lock/write+/run
allow/lock/write+/var/run
allow/exec+/usr/**/bin/openntpd*

# Allow writing the drift file.
allow/write+/var/db/ntpd.drift
allow/lock/write+/var/db/ntpd.drift

# Lock configuration
lock:on
\end{verbatim}}

\section{SEE ALSO}\label{see-also-1}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-2}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd(2)}\label{syd2}

\section{NAME}\label{name-3}

\textbf{/dev/syd} virtual system call interface

\section{SYNOPSIS}\label{synopsis-1}

{\scriptsize \begin{verbatim}
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

struct stat stat;

/* Execute sandbox commands */
int stat("/dev/syd/[command]", &stat); // $ syd -m command
int stat("/dev/syd/[config]?", &stat);
int stat("/dev/syd/[config]:[value]", &stat); // $ syd -m config:value
int stat("/dev/syd/[list]+[value]", &stat); // $ syd -m list+value
int stat("/dev/syd/[list]-[value]", &stat); // $ syd -m list-value
int stat("/dev/syd/[list]^[value]", &stat); // $ syd -m list^value
int stat("/dev/syd/[command]![value]", &stat);

/* Read sandbox state as JSON */
int open("/dev/syd", O_RDONLY);

/* Read syd.el which is the Emacs Lisp implementation of the API */
int open("/dev/syd.el", O_RDONLY);

/* Read syd.sh which exports esyd shell function */
int open("/dev/syd.sh", O_RDONLY);
\end{verbatim}}

\section{DESCRIPTION}\label{description-1}

The \textbf{/dev/syd} virtual system call interface is a unique mechanism designed for runtime configuration of the Syd sandbox environment. It enables sandboxed processes to interact with the Syd process to dynamically adjust sandbox settings or query its state. This interaction is facilitated through the use of virtual system calls, specifically via the \emph{stat}(2) system call, applied to specially constructed paths under \textbf{/dev/syd}. This interface allows for a range of operations, including enabling or disabling sandbox features, appending or removing elements from lists, querying the sandbox state, and executing special Syd commands. Operations are specified through paths constructed with \textbf{/dev/syd} as the prefix, followed by a sandbox command and an operation character that denotes the desired action:

\begin{itemize}
\item
  \textbf{:} for setting a value (boolean, integer, string),
\item
  \textbf{?} for querying a value,
\item
  \textbf{+} for appending to a string vector,
\item
  \textbf{-} for removing an element from a string vector,
\item
  \textbf{\^{}} for removing all matching elements from a string vector, and
\item
  \textbf{!} for executing a special Syd command.
\end{itemize}

The type \textbf{string-map} is similar to \textbf{string-vec}, except the operator \textbf{\^{}} does not accept an argument and removes all elements from the string map. The \textbf{-} operator of a string map is functionally equivalent to the \textbf{\^{}} operator of a string vector in that both remove all matching elements from the respective set.

This interface supports a flexible and powerful method for managing sandbox policies dynamically, allowing for real-time adjustments to the security and operational behavior of sandboxed processes. \textbf{libsyd} is a comprehensive C library designed for interfacing with the Syd stat interface. It offers functionalities for managing sandbox states, and facilitating runtime configuration and interaction with the Syd sandboxing environment. \textbf{gosyd} is a Go module that uses \emph{cgo} to use \textbf{libsyd}. \textbf{plsyd} is a Perl module that uses \emph{FFI::Platypus} to use \textbf{libsyd}. \textbf{pysyd} is a Python module that uses \emph{ctypes} to use \textbf{libsyd}. \textbf{rbsyd} is a Ruby module that uses \emph{ffi} gem to use \textbf{libsyd}. \textbf{syd.el} is an \emph{Emacs Lisp} implementation of the Syd stat interface.

\section{COMMANDS}\label{commands}

The \textbf{/dev/syd} interface supports the following commands for runtime configuration of the sandbox. Each command can be invoked through the \emph{stat}(2) system call on special paths under \textbf{/dev/syd}. Note, Syd provides similar interfaces for the \emph{stat}(2) interface, \textbf{-m} command-line option and the configuration file. Some sandbox commands only take affect when they\textquotesingle re submitted on startup, such as \textbf{unshare/user}, and \textbf{sandbox/lock}. Such commands are noted as \textbf{static} in the descriptions below.

\subsection{stat}\label{stat}

This command causes Syd to output sandbox state on standard error.

\subsection{reset}\label{reset}

This command causes Syd to reset sandboxing to the default state. Allowlists, denylists and filters are going to be cleared. The state of the sandbox lock is not affected by reset. This ensures an unintended reset cannot open window for a sandbox bypass. In addition, the state of Crypt sandboxing is not affected by reset too. This ensures concurrent or near-concurrent encryption operations continue uninterrupted.

\subsection{panic}\label{panic}

This command causes Syd to exit immediately with code 127.

Due to security reasons, this command is only available via the virtual \emph{stat}(2) call, it may not be used with the \textbf{-m} command line switch or in a configuration file.

Due to safety reasons, panic may not be called when Crypt sandboxing is on. In this case the virtual \emph{stat}(2) returns -1 and sets \emph{errno}(3) to \textbf{EBUSY}. This ensures concurrent or near-concurrent encryption operations continue uninterrupted.

\subsection{ghost}\label{ghost}

This command initiates Ghost mode. Ghost mode is irreversible so you can call this command only once during Syd runtime. Refer to the \textbf{Ghost} mode section of the \emph{syd}(7) manual page for more information. This command implies \textbf{reset}, ie. the sandbox state is reset before Ghost mode initiation to ensure there\textquotesingle re no run-away exec processes after the invocation of the \textbf{ghost} command. Ghost mode is only available via the virtual \emph{stat}(2) call, it can not be used with the \textbf{-m} command line switch or in a configuration file.

\subsection{config/expand}\label{configexpand}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{duration} \\
default & \textbf{0} \\
static & \textbf{yes} \\
\end{xltabular}

Given zero as timeout in seconds, which is the default, enables environment variable and tilde expansion using the \textbf{shellexpand} crate. This runs much faster as it does not require confinement, however it does not support command substitution and recursive environment variable expansion like \emph{wordexp}(3) does. Unset environment variables are not expanded to empty strings. On environment variable lookup errors and UTF-8 decoding errors Syd stops parsing and exits with error. This is done for safety as an unintended empty-string expansion can potentially cause the resulting sandboxing rule to allowlist unintended paths without the user easily noticing it. The user is recommended to set default values for environment variables using the familiar \textbf{\$\{HOME:-/var/empty\}} notation. Empty-string expansion on unset environment variables can still be done using the notation \textbf{\$\{HOME:-\}} but this is not recommended and should be used with care.

Given a positive integer as timeout in seconds, enables environment variable expansion and command substitutiton for configuration using \emph{wordexp}(3). The fork process which calls \textbf{/bin/sh} for expansion is executed in a confined environment and it is terminated if its runtime exceeds the given timeout. Confinement is done using \emph{landlock}(7), \emph{namespaces}(7) and \emph{seccomp}(2).

This is a startup-only setting. For safety reasons, no expansion is performed for runtime configuration.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the \textbf{dur} crate for more information.

\subsection{ipc}\label{ipc}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
static & \textbf{yes} \\
\end{xltabular}

Configure sandbox during runtime using the given UNIX socket address with kernel-validated peer authentication. Authentication leverages \textbf{SCM\_CREDENTIALS} and \textbf{SO\_PASSCRED} mechanisms to verify that connecting processes share identical UID and GID with the IPC worker process. Authentication UID and GID may be overridden by \textbf{ipc/uid} and \textbf{ipc/gid} options at startup. This kernel-enforced authentication prevents privilege escalation and unauthorized access by validating credentials on every message, ensuring only the specified user and group or the system administrator can execute IPC commands.

If the argument starts with the character \textbf{\emph{, the address is taken to be an }abstract* UNIX socket. Use the keywords }none** or \textbf{off} to unset a previously set IPC address. The IPC implementation is inspired by HAProxy\textquotesingle s stats socket implementation. All responses except the \textbf{stats} command are in compact JSON. User is recommended to use the \textbf{version} command to check the API version prior to use. As a safety measure, the IPC service is provided as long as the sandbox is unlocked. When the sandbox is locked, the \emph{syd\_ipc} thread exits. This thread makes no attempt to \emph{unlink}(2) the UNIX domain socket path at startup or exit. The user should perform the cleanup or use abstract sockets which is recommended. To access the socket, an external utility such as \emph{socat}(1) is required. Socat is a swiss-army knife to connect anything to anything. We use it to connect terminals to the socket, or a couple of stdin/stdout pipes to it for scripts. The two main syntaxes we\textquotesingle ll use are the following:

{\scriptsize \begin{verbatim}
# socat ~/.syd/sandbox.sock stdio
# socat ~/.syd/sandbox.sock readline
\end{verbatim}}

The first one is used with scripts. It is possible to send the output of a script to Syd, and pass Syd\textquotesingle s output to another script. That\textquotesingle s useful for retrieving sandbox configuration as JSON for example. The second one is only useful for issuing commands by hand. It has the benefit that the terminal is handled by the readline library which supports line editing and history, which is very convenient when issuing repeated commands (eg: watch a counter).

The socket supports three operation modes:

\begin{itemize}
\item
  non-interactive, silent
\item
  interactive, silent
\item
  interactive with prompt
\end{itemize}

The non-interactive mode is the default when \emph{socat}(1) connects to the socket. In this mode, a single line may be sent. It is processed as a whole, responses are sent back, and the connection closes after the end of the response. This is the mode that scripts and monitoring tools use. A single command may be sent at a time only. The interactive mode allows new commands to be sent after the ones from the previous lines finish. It exists in two variants, one silent, which works like the non-interactive mode except that the socket waits for a new command instead of closing, and one where a prompt is displayed (\textquotesingle;\textquotesingle) at the beginning of the line. The interactive mode is preferred for advanced tools while the prompt mode is preferred for humans.

The mode can be changed using the \textbf{prompt} command. By default, it toggles the interactive+prompt modes. Entering \textbf{prompt} in interactive mode will switch to prompt mode. The command optionally takes a specific mode among the following:

\begin{itemize}
\item
  \textbf{n}: non-interactive mode (single command and quits)
\item
  \textbf{i}: interactive mode (multiple commands, no prompt)
\item
  \textbf{p}: prompt mode (multiple commands with a prompt)
\end{itemize}

Since the default mode is non-interactive, \textbf{prompt} must be used as the first command in order to switch it, otherwise the previous command will cause the connection to be closed. Switching to non-interactive mode will result in the connection to be closed after all the commands of the same line complete.

For this reason, when debugging by hand, it\textquotesingle s quite common to start with the \textbf{prompt} command:

{\scriptsize \begin{verbatim}
# socat ~/.syd/sandbox.sock readline
prompt
; stats
...
; 
\end{verbatim}}

Interactive tools might prefer starting with \textbf{prompt i} to switch to interactive mode without the prompt.

The following commands are supported in addition to the \emph{syd}(2) API:

\begin{itemize}
\item
  stat: Prints sandbox state in compact JSON.
\item
  stats: Prints sandbox state in human-readable format.
\item
  version: Prints IPC api version in compact JSON.
\end{itemize}

The commands \textbf{quit} and \textbf{exit} may be used to close a socket connection. The command \textbf{ping} is supported for aliveness checks.

\subsection{ipc/uid}\label{ipcuid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{uid} \\
default & \textbf{Uid::current} \\
static & \textbf{yes} \\
\end{xltabular}

User ID override for IPC authentication. Specifies the UID that connecting processes must possess to authenticate with the IPC worker. Accepts either numeric user IDs or user names. When specified as a user name, the system resolves it to the corresponding UID using \emph{getpwnam}(3). Defaults to the current process UID obtained via \emph{getuid}(2). When set, the IPC worker validates that all connecting clients have this exact UID via \textbf{SCM\_CREDENTIALS} authentication. This setting allows privilege delegation scenarios where the IPC worker runs as one user but accepts connections from processes running as a different specific UID. Set the option to \textbf{none} or \textbf{off} to disable UID authentication for IPC.

\subsection{ipc/gid}\label{ipcgid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{gid} \\
default & \textbf{Gid::current} \\
static & \textbf{yes} \\
\end{xltabular}

Group ID override for IPC authentication. Specifies the GID that connecting processes must possess to authenticate with the IPC worker. Accepts either numeric group IDs or group names. When specified as a group name, the system resolves it to the corresponding GID using \emph{getgrnam}(3). Defaults to the current process GID obtained via \emph{getgid}(2). When set, the IPC worker validates that all connecting clients have this exact GID via \textbf{SCM\_CREDENTIALS} authentication. This setting enables group-based access control where multiple users belonging to the same group can access the IPC interface. Set the option to \textbf{none} or \textbf{off} to disable GID authentication for IPC.

\subsection{lock}\label{lock}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
\end{xltabular}

Set the state of the sandbox lock. Possible values are \textbf{on}, \textbf{off}, \textbf{exec}, \textbf{ipc}, and \textbf{read} or shortly just \textbf{1}, \textbf{0}, \textbf{x}, \textbf{i}, and \textbf{r}. The values are case-sensitive. The values \textbf{ro}, \textbf{readonly} and \textbf{read-only} are also permitted for \textbf{read} mode which was added as of version 3.39.0. Specifying just \textbf{lock} without value or shortly \textbf{l} is permitted as a short-hand for \textbf{lock:on}.

If the sandbox lock is \textbf{on} no sandbox commands are allowed. If sandbox lock is \textbf{read}, only reads are allowed but NOT edits. A read locked sandbox makes available only the read-only \emph{open}(2) hooks of the \emph{syd}(2) virtual system call API to the sandbox process. \emph{stat}(2) hooks for edits are NOT permitted in a read locked sandbox.

If \textbf{exec} is specified, the sandbox lock is set to \textbf{on} for all processes except the initial process, aka Syd exec child. If the sandbox lock is \textbf{ipc}, sandbox commands may only be specified using the IPC socket. The IPC socket is a UNIX socket which may or may not be accessible from within the sandbox depending on sandbox ACL rules.

Transition from lock modes \textbf{off}, \textbf{exec}, and \textbf{ipc} into one of \textbf{read} and \textbf{on} is one-way and idempotent: It results in the sandbox policy getting sealed in memory using the \emph{mseal}(2) system call either immediately or simultaneously with sandbox process startup. Transitions between lock modes \textbf{read} and \textbf{on} are not permitted.

The sandbox lock used to default to \textbf{exec} but as a hardening measure and to ensure security by default, as of version 3.17.0, this has been changed such that the default is \textbf{unset} and if no lock clause has been specified by the time Syd executes the initial sandbox process, then the sandbox lock is automatically set to \textbf{on}. This means if no \textbf{lock} clause is specified in any of the profiles, configuration files or \textbf{-m} CLI arguments, the lock will be \textbf{on} by default. As of version 3.35.2, this default is set to \textbf{ipc} if the \textbf{ipc} command was specified but lock was not set explicitly. Setting lock to \textbf{on} at any point during configuration parsing prevents further commands from being emitted by the sandbox. This feature may be used to lock site-wide defaults for a Syd login shell by adding a \textbf{lock:on} clause at the end of the site-wide configuration file which prevents Syd from subsequently parsing the user configuration file, practically enforcing the site-wide defaults.

Setting lock to \textbf{off}, \textbf{exec}, or \textbf{ipc} at startup makes Syd skip preventing \emph{execve}(2) and \emph{execveat}(2) system calls as part of the \textbf{Execution Control (EEC)} feature. This is done to allow \textbf{cmd/exec} command to execute commands outside the sandbox. This filter to prevent \emph{exec}(3) is only applied when the sandbox is locked.

\subsection{log/level}\label{loglevel}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{warn} \\
\end{xltabular}

Set the log level. Available log levels are \textbf{emerg}, \textbf{alert}, \textbf{crit}, \textbf{error}, \textbf{warn}, \textbf{notice}, \textbf{info}, and \textbf{debug}. Defaults to \textbf{warn} unless \textbf{SYD\_LOG} environment variable is set at startup. An integer in the closed range of \textbf{{[}0,7{]}} can also be used as an argument to set the log level, where \textbf{0} corresponds to \textbf{emerg} and \textbf{7} corresponds to \textbf{debug}. All access violations except the \textbf{stat} and \textbf{walk} categories are logged with the \textbf{warn} level. Stat and Walk categories are logged with the \textbf{notice} level. Startup messages are logged with the \textbf{info} level.

\subsection{log/lock/same\_exec\_off}\label{loglocksame_exec_off}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
\end{xltabular}

Disables logging of denied accesses originating from the thread creating the \emph{landlock}(7) domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening \emph{execve}(2) call). This is intended for programs that execute unknown code without invoking \emph{execve}(2), such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.

This option requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when \textbf{sandbox/lock} is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded.

\subsection{log/lock/new\_exec\_on}\label{loglocknew_exec_on}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
\end{xltabular}

Enables logging of denied accesses after an \emph{execve}(2) call, providing visibility into unauthorized access attempts by newly executed programs within the created \emph{landlock}(7) domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.

This option requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when \textbf{sandbox/lock} is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded. A sandboxer should not log denied access requests to avoid spamming logs, therefore this option is off by default. Use this option to test audit logging.

\subsection{log/lock/subdomains\_off}\label{loglocksubdomains_off}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
\end{xltabular}

Disables logging of denied accesses originating from nested \emph{landlock}(7) domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create \emph{landlock}(7) domains and could otherwise generate excessive logs. Unlike \textbf{log/lock/same\_exec\_off}, this flag only affects future nested domains, not the one being created.

This option requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when \textbf{sandbox/lock} is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded.

\subsection{log/verbose}\label{logverbose}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{u8} \\
default & \textbf{0} \\
\end{xltabular}

Set verbose logging level. Syd acquires and logs various additional information depending on the level of verbosity. Supported verbosity levels are given below:

0: Raw logs only.

1: Log \emph{ioctl} names(2) under the \emph{ctl} key. This is the default.

2: Log process name change attempts with the \textbf{PR\_SET\_NAME} \emph{prctl}(2).

3: Enrich \emph{seccomp}(2) requests under the \emph{req} key.

Levels above 2 are intended for malware analysis. Setting the log level to a value above the highest supported level is equivalent to setting verbosity to the highest supported level.

\subsection{pty/row}\label{ptyrow}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{ushort} \\
default & \textbf{\textless inherit\textgreater{}} \\
static & \textbf{yes} \\
\end{xltabular}

Set row size for PTY sandboxing. Default is to inherit the window-size. Use the keyword \textbf{none} to unset a previously set value. You may shortly refer to this option as \textbf{pty/x}.

\subsection{pty/col}\label{ptycol}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{ushort} \\
default & \textbf{\textless inherit\textgreater{}} \\
static & \textbf{yes} \\
\end{xltabular}

Set column size for PTY sandboxing. Default is to inherit the window-size. Use the keyword \textbf{none} to unset a previously set value. You may shortly refer to this option as \textbf{pty/y}.

\subsection{setenv}\label{setenv}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{command} \\
static & \textbf{yes} \\
\end{xltabular}

Set an environment variable from within a Syd profile. Environment variables in the value are expanded before calling \emph{setenv}(3). Setting internal Syd environment variables, i.e those that start with "SYD\_", isn\textquotesingle t permitted. Illustrative examples are given below:

{\scriptsize \begin{verbatim}
setenv!HOME=/tmp
setenv!HOME=${HOME}/.syd
setenv!HOME=${HOME:-/tmp}/.syd
\end{verbatim}}

\subsection{unsetenv}\label{unsetenv}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{command} \\
static & \textbf{yes} \\
\end{xltabular}

Unset an environment variable from within a Syd profile. Unsetting internal Syd environment variables, i.e those that start with "SYD\_", isn\textquotesingle t permitted. Illustrative examples are given below:

{\scriptsize \begin{verbatim}
unsetenv!PWD
unsetenv!TZ
\end{verbatim}}

\subsection{clearenv}\label{clearenv}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{command} \\
static & \textbf{yes} \\
\end{xltabular}

Clear all environment variables from within a Syd profile. This command does not clear internal Syd environment variables, i.e those that start with "SYD\_".

\subsection{sandbox/fs}\label{sandboxfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Filesystem sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/walk}\label{sandboxwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Walk sandboxing \textbf{on} or \textbf{off}.

For performance reasons, this sandboxing is off by default.

\subsection{sandbox/stat}\label{sandboxstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
\end{xltabular}

Turn Stat sandboxing \textbf{on} or \textbf{off}.

For performance reasons, this sandboxing is off by default and setting it on only works at startup. If not given at startup, Syd will just allow \emph{access}(2), \emph{faccessat}(2), \emph{faccessat2}(2), \emph{getdents64}(2), \emph{readlink}(2), \emph{readlinkat}(2), \emph{stat}(2), \emph{stat64}(2), \emph{statx}(2), \emph{lstat}(2), \emph{lstat64}(2), \emph{fstatat64}(2), \emph{newfstatat}(2), \emph{fstat}(2), \emph{fstat64}(2), \emph{statfs}(2), \emph{statfs64}(2), \emph{fstatfs}(2), \emph{fstatfs64}(2), \emph{getxattr}(2), \emph{fgetxattr}(2), \emph{lgetxattr}(2), \emph{getxattrat}(2), \emph{listxattr}(2), \emph{flistxattr}(2), \emph{llistxattr}(2), \emph{llistxattrat}(2), \emph{fanotify\_mark}(2), and \emph{inotify\_add\_watch}(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks. As an exception, if Stat sandboxing is off but sandbox lock is one of \emph{off} or \emph{exec}, the system calls \emph{stat}(2), \emph{stat64}(2), \emph{statx}(2), \emph{lstat}(2), \emph{lstat64}(2), \emph{fstatat64}(2), and \emph{newfstatat}(2) are handled at userspace to support the \emph{syd}(2) API.

\subsection{sandbox/read}\label{sandboxread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Read sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/write}\label{sandboxwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Write sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/exec}\label{sandboxexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Exec sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/ioctl}\label{sandboxioctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
\end{xltabular}

Turn Ioctl sandboxing \textbf{on} or \textbf{off}.

For performance reasons, this only works at startup. If not given at startup, Syd will just allow the \emph{ioctl}(2) system call at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

\subsection{sandbox/create}\label{sandboxcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Create sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/delete}\label{sandboxdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Delete sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/rename}\label{sandboxrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Rename sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/symlink}\label{sandboxsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Symlink sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/truncate}\label{sandboxtruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Truncate sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chdir}\label{sandboxchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
\end{xltabular}

Turn Chdir sandboxing \textbf{on} or \textbf{off}.

For performance reasons, this sandboxing is off by default and setting it on only works at startup. If not given at startup, Syd will just allow \emph{chdir}(2) and \emph{fchdir}(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

\subsection{sandbox/readdir}\label{sandboxreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Readdir sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/mkdir}\label{sandboxmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Mkdir sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/rmdir}\label{sandboxrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Rmdir sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chown}\label{sandboxchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Chown sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chgrp}\label{sandboxchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Chgrp sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chmod}\label{sandboxchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Chmod sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chattr}\label{sandboxchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Chattr sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/chroot}\label{sandboxchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Chroot sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/utime}\label{sandboxutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Utime sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/mkdev}\label{sandboxmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Mkdev sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/mkfifo}\label{sandboxmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Mkfifo sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/mktemp}\label{sandboxmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Mktemp sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/net}\label{sandboxnet}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Network sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/lock}\label{sandboxlock}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
\end{xltabular}

Turn Landlock sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/force}\label{sandboxforce}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Force sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/tpe}\label{sandboxtpe}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Trusted Path Execution (TPE) sandboxing \textbf{on} or \textbf{off}.

\subsection{sandbox/crypt}\label{sandboxcrypt}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
\end{xltabular}

Turn Crypt sandboxing \textbf{on} or \textbf{off}.

To set this option \textbf{on}, a key must have already been specified with \textbf{crypt/key} or \emph{syd}(1) will exit with the \emph{errno}(3) \textbf{ENOKEY}.

Note, setting this sandboxing type to \textbf{on} implies \textbf{trace/allow\_safe\_kcapi:true} to allow cryptographic operations using the Kernel Cryptography API (KCAPI).

Note, setting this sandboxing type to \textbf{on} implies \textbf{trace/exit\_wait\_all:true} so as not to leave any ongoing encryption processes behind on sandbox process exit.

\subsection{sandbox/proxy}\label{sandboxproxy}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Turn Proxy sandboxing \textbf{on} or \textbf{off}.

Defaults to proxying through TOR. See the options "proxy/addr", "proxy/port", "proxy/ext/host", and "proxy/ext/port" to configure a different proxy.

Implies \textbf{unshare/net:true}.

Requires \emph{syd-tor}(1) helper utility to be under PATH. \emph{syd-tor}(1) is executed once at startup, it runs as a single process and this process runs at most as long as the owner Syd process. See the \emph{syd-tor}(1) manual page for more information.

\subsection{sandbox/pty}\label{sandboxpty}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{on} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Turn PTY sandboxing \textbf{on} or \textbf{off}.

Requires \emph{syd-pty}(1) helper utility to be under PATH. \emph{syd-pty}(1) is executed once at startup, it runs as a single process and this process runs at most as long as the owner Syd process. See the \emph{syd-pty}(1) manual page for more information. Note, this option has no effect unless both standard input and standard output are attached to a TTY at startup.

\subsection{sandbox/mem}\label{sandboxmem}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
\end{xltabular}

Turn Memory sandboxing \textbf{on} or \textbf{off}.

For performance reasons, this only works at startup. If not given at startup, Syd will just allow \emph{brk}(2), \emph{mmap}(2), \emph{mmap2}(2), and \emph{mremap}(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

\subsection{sandbox/pid}\label{sandboxpid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{off} \\
query & \textbf{yes} \\
\end{xltabular}

Turn PID sandboxing \textbf{on} or \textbf{off}.

\subsection{default/fs}\label{defaultfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Filesystem sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/walk}\label{defaultwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Walk sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/stat}\label{defaultstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Stat sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/read}\label{defaultread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Read sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/write}\label{defaultwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Write sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/exec}\label{defaultexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Exec sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/ioctl}\label{defaultioctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Ioctl sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/create}\label{defaultcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Create sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/delete}\label{defaultdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Delete sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

\subsection{default/rename}\label{defaultrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Rename sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

\subsection{default/symlink}\label{defaultsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Symlink sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

\subsection{default/truncate}\label{defaulttruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Truncate sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chdir}\label{defaultchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/readdir}\label{defaultreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Readdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/mkdir}\label{defaultmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Mkdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/rmdir}\label{defaultrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Rmdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chown}\label{defaultchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chown sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chgrp}\label{defaultchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chgrp sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chmod}\label{defaultchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chmod sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chattr}\label{defaultchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chattr sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/chroot}\label{defaultchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Chattr sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/utime}\label{defaultutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Utime sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/mkdev}\label{defaultmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Mkdev sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/mkfifo}\label{defaultmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Mkfifo sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/mktemp}\label{defaultmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Mktemp sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/net}\label{defaultnet}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the default action for Network sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/block}\label{defaultblock}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the action for IP blocklist violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/force}\label{defaultforce}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

For force sandboxing, define the default action to take when the path of a binary is not in the Integrity Force map.

The value must be either one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", "exit", where the default is "deny".

\subsection{default/segvguard}\label{defaultsegvguard}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the action for SegvGuard access violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/tpe}\label{defaulttpe}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the action for TPE sandboxing access violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/mem}\label{defaultmem}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{deny} \\
\end{xltabular}

Specify the action for Memory sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

\subsection{default/pid}\label{defaultpid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{kill} \\
\end{xltabular}

Specify the action for PID sandboxing access violations.

The value must be either one of "warn", "filter", "stop", "abort", "kill", "exit", where the default is "kill".

\subsection{default/lock}\label{defaultlock}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{kill} \\
static & \textbf{yes} \\
\end{xltabular}

Specify the compatibility level for Lock sandboxing.

The value must be either one of \textbf{kill}, \textbf{deny}, \textbf{warn}. \textbf{kill} stands for the Landlock compatibility level \textbf{hard-requirement}, whereas \textbf{deny} stands for \textbf{soft-requirement} and \textbf{warn} stands for \textbf{best-effort}.

As of version 3.35.0, the default level has been promoted from \textbf{warn} to \textbf{kill} to adhere to the principle of secure defaults. Again, as of this version \textbf{ENOENT}, i.e.~\textbf{No such file or directory} errors are fatal unless compatibility level is set to \textbf{best-effort} at startup using \textbf{default/lock:warn}.

For more information on Landlock compatibility levels, see: https://landlock.io/rust-landlock/landlock/trait.Compatible.html

\subsection{unshare/mount}\label{unsharemount}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create Mount namespace on startup, implies \textbf{unshare/pid:true}.

\subsection{unshare/uts}\label{unshareuts}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create UTS namespace on startup.

\subsection{unshare/ipc}\label{unshareipc}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create IPC namespace on startup.

\subsection{unshare/user}\label{unshareuser}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create User namespace on startup.

\subsection{unshare/pid}\label{unsharepid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create Pid namespace on startup, implies \textbf{unshare/mount:true}.

Syd mounts private \emph{procfs}(5) in this mode.

As of version 3.37.2 \emph{procfs}(5) is mounted with \textbf{hidepid=4} option which is Linux\textgreater=5.8.

As of version 3.39.0 \emph{procfs}(5) is mounted with \textbf{subset=pid} option which is Linux\textgreater=5.8, unless \textbf{trace/allow\_unsafe\_proc\_files:true} is set at startup.

\subsection{unshare/net}\label{unsharenet}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create Net namespace on startup.

\subsection{unshare/cgroup}\label{unsharecgroup}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create CGroup namespace on startup.

\subsection{unshare/time}\label{unsharetime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
query & \textbf{yes} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Create Time namespace on startup. Syd resets the boot-time clock such that \emph{uptime}(1) will report container uptime rather than host uptime. Use \emph{time} command to override default and set alternative time.

\subsection{root}\label{root}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Change the root mount to the given new root directory at startup using \emph{pivot\_root}(2). Destination path arguments of \emph{bind} commands are interpreted relative to this directory. The directories \emph{\$root/dev}, and \emph{\$root/proc} must exist to mount private filesystems. In addition, target paths of the \emph{bind} commands must also be manually created by the user.

This option does nothing without \emph{unshare/mount:1}.

As of version 3.23.14, symbolic links are not followed in any part of the root directory and path traversal using ".." is not permitted. In addition, root directory must be an absolute path, relative paths are not permitted.

As of version 3.35.0, the special keyword \emph{tmpfs}, or shortly \emph{tmp} or just \emph{t}, is supported to make Syd mount a private \emph{tmpfs}(5) filesystem as the root directory. In this mode, Syd is going to attempt to create target paths inside the private temporary filesystem. Similarly, as of version 3.45.0, the special keyword \emph{ramfs}, or shortly \emph{ram} or just \emph{r}, is supported to make Syd mount a private \emph{ramfs}(5) filesystem as the root directory. \emph{ramfs}(5) is limited compared to \emph{tmpfs}(5) and should only be preferred when the host Linux kernel isn\textquotesingle t configured with the \textbf{CONFIG\_TMPFS} option. The private root directory is mounted with the options \emph{nodev}, \emph{noexec}, \emph{nosuid}, \emph{nosymfollow}, \emph{noatime}, and \emph{mode=700}.

As of version 3.35.2, the special keywords \emph{none} and \emph{off} may be used to unset a previously set \emph{root} directory.

\subsection{root/map}\label{rootmap}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Map current user to root in the sandbox on startup.

This option does nothing without "unshare/user:1".

\subsection{root/fake}\label{rootfake}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

In \textbf{fakeroot} mode, the system will return a user/group id of \textbf{0}, mimicking the \textbf{root} user. This allows users to execute commands with apparent root privileges, without actual superuser rights. It\textquotesingle s useful for tasks like package building where root-like environment is needed, but not actual root permissions.

\subsection{time}\label{time}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i64} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set clock boottime and monotonic offset (seconds) in Time Namespace. To set boottime and monotonic offsets separately, use the options \textbf{time/boot}, and \textbf{time/mono}. This option is a shorthand to set both at the same time to the same offset. Use the keywords \textbf{none} or \textbf{off} to unset a previously set offset.

\subsection{time/boot}\label{timeboot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i64} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set clock boottime offset (seconds) in Time Namespace. Use the keywords \textbf{none} or \textbf{off} to unset a previously set offset.

\subsection{time/mono}\label{timemono}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i64} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set clock monotonic offset (seconds) in Time Namespace. Use the keywords \textbf{none} or \textbf{off} to unset a previously set offset.

\subsection{timeout}\label{timeout}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{duration} \\
default & \textbf{none} \\
\end{xltabular}

Set sandbox timeout after which Syd will exit with code 124 and all sandbox processes running under it will exit with Syd. Use \textbf{none} or \textbf{off} to disable which is the default. Duration may be specified in human readable format. Refer to the documentation of the \textbf{dur} crate for more information.

\subsection{uts/host}\label{utshost}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{localhost} \\
\end{xltabular}

Set UTS host name in the sandbox. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is \textbf{localhost}.

Useful when combined with \textbf{unshare/uts:true}. As of version 3.40.0, the value of this option is returned at \emph{uname}(2) boundary in \textbf{nodename} field of the \textbf{utsname} structure regardless of the \textbf{unshare/uts} option.

\subsection{uts/domain}\label{utsdomain}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{(none)} \\
\end{xltabular}

Set NIS/YP domain name in the sandbox. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is \textbf{(none)}.

Useful when combined with \textbf{unshare/uts:true}. As of version 3.40.0, the value of this option is returned at \emph{uname}(2) boundary in \textbf{domainname} field of the \textbf{utsname} structure regardless of the \textbf{unshare/uts} option.

\subsection{uts/version}\label{utsversion}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & \textbf{\textless random\textgreater{}} \\
\end{xltabular}

Set version level of the operating system as returned in \textbf{version} field of the \textbf{utsname} structure at \emph{uname}(2) boundary. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is determined randomly at startup.

\subsection{allow/ioctl}\label{allowioctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer or string} \\
default & \textbf{{[}...{]}} \\
\end{xltabular}

Add to or remove a request from the \emph{ioctl}(2) request allowlist. Accepts an unsigned 64-bit integer as argument. Prefix with \textbf{0x} for hexadecimal and \textbf{0o} for octal input. Use \textbf{allow/ioctl+\textless request\textgreater{}} to add to, and \textbf{allow/ioctl-\textless request\textgreater{}} to remove from the allowlist. As of version 3.38.0, ioctl(2) requests may also be specified by case-insensitive name and multiple requests may be added or removed by separating them as a comma-delimited list. Specifying ioctl(2) requests by name is strongly recommended because request numbers may vary by architecture which is handled transparently when the request is specified as a name. As of version 3.38.6, the \emph{ioctl}(2) name may be prepended with an optional exclamation mark, i.e.~\textbf{!}, to denote Syd should not return EINVAL ("Invalid argument") \emph{errno}(3) in case the name is not defined for any of the current supported architectures. This allows for writing rules generic across multiple incompatible architectures.

By default the list contains the \emph{ioctl}(2) requests FIOCLEX, FIONCLEX, FIONBIO, FIONREAD, FIOASYNC, FIOQSIZE, FIFREEZE, FITHAW, FS\_IOC\_FIEMAP, FIGETBSZ, FICLONE, FICLONERANGE, FIDEDUPERANGE, FS\_IOC\_GETFSUUID, FS\_IOC\_GETFSSYSFSPATH, and RNDGETENTCNT.

For rules added at startup deny rules have precedence over allow rules because the denylist is checked at kernel-space, whereas the allowlist is checked at user-space. For rules added after startup, the last matching rule wins.

\subsection{deny/ioctl}\label{denyioctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer or string} \\
default & \textbf{{[}...{]}} \\
static & \textbf{add is dynamic, remove is partly static} \\
\end{xltabular}

Add to or remove a request from the \emph{ioctl}(2) request denylist. Accepts an unsigned 64-bit integer as argument. Prefix with \textbf{0x} for hexadecimal and \textbf{0o} for octal input. Use \textbf{deny/ioctl+\textless request\textgreater{}} to add to, and \textbf{deny/ioctl-\textless request\textgreater{}} to remove from the allowlist. As of version 3.38.0, ioctl(2) requests may also be specified by case-insensitive name and multiple requests may be added or removed by separating them as a comma-delimited list. Specifying ioctl(2) requests by name is strongly recommended because request numbers may vary by architecture which is handled transparently when the request is specified as a name. As of version 3.38.6, the \emph{ioctl}(2) name may be prepended with an optional exclamation mark, i.e.~\textbf{!}, to denote Syd should not return EINVAL ("Invalid argument") \emph{errno}(3) in case the name is not defined for any of the current supported architectures. This allows for writing rules generic across multiple incompatible architectures.

By default the list of denylisted \emph{ioctl}(2) requests are FIBMAP, FS\_IOC\_FSGETXATTR, FS\_IOC\_FSSETXATTR, FS\_IOC\_SETFLAGS, KDSETKEYCODE, KDSIGACCEPT, RNDADDTOENTCNT, RNDGETPOOL, RNDADDENTROPY, RNDZAPENTCNT, RNDCLEARPOOL, SECCOMP\_IOCTL\_NOTIF\_RECV, SECCOMP\_IOCTL\_NOTIF\_SEND, SECCOMP\_IOCTL\_NOTIF\_ID\_VALID, SECCOMP\_IOCTL\_NOTIF\_ADDFD, SECCOMP\_IOCTL\_NOTIF\_SET\_FLAGS, TIOCCONS, TIOCLINUX, TIOCSETD, TIOCSTI, and TIOCSSERIAL.

For security reasons, the \emph{ioctl}(2) denylist is applied at the parent seccomp-bpf filter at startup. This means the Syd process is included in this restriction as well. This also means, removing elements from this list after startup has no effect. However, if Ioctl sandboxing was enabled at startup, adding new elements to the \emph{ioctl}(2) denylist will further restrict the \emph{ioctl}(2) request space.

For rules added at startup, deny rules have precedence over allow rules because the denylist is checked at kernel-space, whereas the allowlist is checked at user-space. For rules added after startup, the last matching rule wins.

Further reading about denylisted \emph{ioctl}(2) requests:

\begin{itemize}
\item
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523
\item
  https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html
\item
  http://phrack.org/issues/52/6.html\#article
\item
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83efeeeb3d04b22aaed1df99bc70a48fe9d22c4d
\item
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8d1b43f6a6df7bcea20982ad376a000d90906b42
\item
  https://seclists.org/oss-sec/2024/q1/13
\item
  https://seclists.org/oss-sec/2024/q1/14
\item
  https://forums.grsecurity.net/viewtopic.php?f=7\&t=2522
\item
  http://lkml.indiana.edu/hypermail/linux/kernel/9907.0/0132.html
\item
  http://linux.derkeiler.com/Mailing-Lists/Kernel/2007-11/msg07723.html
\end{itemize}

\subsection{mem/max}\label{memmax}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{positive integer (u64)} \\
default & \textbf{0} \\
\end{xltabular}

This setting specifies the limit on per-process memory usage. Setting this value to \textbf{0} disables testing for this type of memory usage. Note, the value is parsed using the \textbf{parse-size} crate. Refer to their documentation for information on formatting. Setting an non-zero value with this option implies \emph{sandbox/mem:on}.

\subsection{mem/vm\_max}\label{memvm_max}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{positive integer (u64)} \\
default & \textbf{0} \\
\end{xltabular}

This setting specifies the limit on per-process virtual memory usage. Setting this value to \textbf{0} disables testing for this type of memory usage. Note, the value is parsed using the \textbf{parse-size} crate. Refer to their documentation for information on formatting. Setting an non-zero value with this option implies \emph{sandbox/mem:on}.

\subsection{pid/max}\label{pidmax}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{positive integer (u64)} \\
default & \textbf{0} \\
\end{xltabular}

This setting specifies the limit on the number of running tasks for pid sandboxing. Setting this value to \emph{0} is functionally equivalent to setting \emph{sandbox/pid} to \emph{off}. Setting an non-zero value with this option implies \emph{sandbox/pid:on}.

As of version 3.40.0, when \emph{unshare/pid:true} is set, PID sandboxing counts and enforces the limit in the current PID namespace; on Linux 6.14 and newer, to account for the kernel\textquotesingle s 300 reserved PIDs the namespaced kernel.pid\_max is set to \textbf{max(pid/max, 301)} (or 512 on s390x), while on older kernels \emph{kernel.pid\_max} \emph{sysctl}(8) is left unchanged.

\subsection{bind}\label{bind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

This command causes Syd to bind mount a directory on startup. The format is \textbf{source-dir:target-dir:mount-options,...} where \emph{the source and} target directories may be equal. Mount options are a comma-separated list of a combination of the following options:

\begin{itemize}
\item
  \textbf{ro} to mount the filesystem read-only.
\item
  \textbf{nodev} to not interpret character or block special devices on the filesystem.
\item
  \textbf{noexec} to not permit direct execution of any binaries on the mounted filesystem.
\item
  \textbf{nosuid} to not honour set-user-ID and set-group-ID bits or file capabilities when executing programs from this filesystem. In addition, SELinux domain transitions require permission \textbf{nosuid\_transition}, which in turn needs also policy capability \textbf{nnp\_nosuid\_transition}.
\item
  \textbf{nosymfollow} to not follow symbolic links when resolving paths. Symbolic links can still be created, and \emph{readlink}(1), \emph{readlink}(2), \emph{realpath}(1), and \emph{realpath}(3) all still work properly.
\item
  \textbf{noatime} to not update inode access times on this filesystem (e.g.~for faster access on the news spool to speed up news servers). This works for all inode types (directories too), so it implies \textbf{nodiratime}.
\item
  \textbf{nodiratime} to not update directory inode access times on this filesystem. (This option is implied when \textbf{noatime} is set.)
\item
  \textbf{relatime} to update inode access times relative to modify or change time.
\end{itemize}

Mount options may be omitted. If the source directory is not an absolute path, it is interpreted as the filesystem type rather than the source directory. This may be used to mount special filesystems such as cgroupfs, overlayfs or \emph{tmpfs}(5) into the mount namespace. In this case, any mount options supported by this filesystem type may be submitted in options argument not just the ones listed above. You may find some examples below:

\begin{itemize}
\item
  bind+/:/:ro
\item
  bind+tmpfs:/tmp:noexec,size=16M
\item
  bind+cgroup2:/sys/fs/cgroup:nodev,noexec,nosuid
\item
  bind+overlay:/tmp/target:lowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work,nosuid
\item
  bind+devpts:/dev/pts:newinstance,ptmxmode=0600,mode=600,nosuid,noexec
\item
  bind+ramfs:/tmp:nodev,noexec,nosuid
\item
  bind+sysfs:/sys:nodev,noexec,nosuid
\item
  bind+mqueue:/dev/mqueue:nodev,noexec,nosuid
\end{itemize}

This option does nothing without \textbf{unshare/mount:true}.

This command may be used to create immutable containers. For example, the command \textbf{bind+/:/:ro} is functionally equivalent to \textbf{deny/write+/***} except the restriction happens at kernel VFS layer rather than at user level using \emph{seccomp}(2) notify. Alternatively this can also be achieved at the kernel level using \emph{landlock}(7).

As of version 3.23.14, symbolic links are not followed in any part of the source or target directory paths and path traversal using \textbf{..} is not permitted. In addition, target directory must be an absolute path, relative paths are not permitted.

As of version 3.23.14, mounting the special \emph{proc}(5) filesystem under a custom path is not permitted. Syd handles this mount itself specially after all bind mounts are processed.

\subsection{crypt}\label{crypt}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to encrypt for \textbf{Crypt sandboxing}.

\subsection{crypt/key}\label{cryptkey}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i32} \\
static & \textbf{yes} \\
\end{xltabular}

Specify \emph{keyrings}(7) IDs of the 256-bit AES-CTR encryption key and HMAC-SHA256 authentication key for \textbf{Crypt sandboxing}. The ID must be a 32-bit integer. To set encryption and authentication keys separately, use the options \textbf{crypt/key/enc}, and \textbf{crypt/key/mac}. This option is a shorthand to set both at the same time to the same key serial ID.

Setting an encryption key with this option implies \textbf{sandbox/crypt:on}.

Session keyring must be attached to the user keyring or this will fail at startup with the EKEYREVOKED ("Key has been revoked") \emph{errno}(3). Use the \emph{syd-key}(1) utility to safely generate a key and save to \emph{keyrings}(7) interface.

\subsection{crypt/key/enc}\label{cryptkeyenc}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i32} \\
static & \textbf{yes} \\
\end{xltabular}

Specify \emph{keyrings}(7) ID of the 256-bit AES-CTR encryption key for \textbf{Crypt sandboxing}. The ID must be a 32-bit integer.

Setting an encryption key with this option implies \textbf{sandbox/crypt:on}.

Session keyring must be attached to the user keyring or this will fail at startup with the EKEYREVOKED ("Key has been revoked") \emph{errno}(3). Use the \emph{syd-key}(1) utility to safely generate a key and save to \emph{keyrings}(7) interface.

\subsection{crypt/key/mac}\label{cryptkeymac}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{i32} \\
static & \textbf{yes} \\
\end{xltabular}

Specify \emph{keyrings}(7) ID of the 256-bit HMAC-SHA256 authentication key for \textbf{Crypt sandboxing}. The ID must be a 32-bit integer.

Setting an encryption key with this option implies \textbf{sandbox/crypt:on}.

Session keyring must be attached to the user keyring or this will fail at startup with the EKEYREVOKED ("Key has been revoked") \emph{errno}(3). Use the \emph{syd-key}(1) utility to safely generate a key and save to \emph{keyrings}(7) interface.

\subsection{crypt/tmp}\label{crypttmp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
default & mem \\
static & \textbf{yes} \\
\end{xltabular}

Specify temporary backing directory for transparent file decryption. The argument must be an absolute path or the special value \textbf{mem}. The user must ensure this directory is secure as decrypted contents will be written to temporary files under this directory. Specify the special value \textbf{mem} to use anonymous files which live in RAM with a volatile backing storage created with \emph{memfd\_create}(2). This is the default. The user is encouraged to specify this option for efficient handling of large files for \textbf{Crypt sandboxing}.

Setting this option implies \textbf{sandbox/crypt:on}.

\subsection{force}\label{force}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Add or remove an integrity force rule for Force Sandboxing. The format is \emph{force+/path:hashhex:action} for addition and \emph{force-/path} for removal. Use \emph{force\^{}} to clear the Integrity Force map. Available actions are "warn", "filter", "deny", "panic", "stop", "abort", "kill" and "exit" where the default is "deny". hashhex is either a 8-character CRC32 checksum, 16-character CRC64 checksum, 32-character MD5 checksum, a 40-character SHA1 checksum, a 64-character SHA3-256 checksum, a 96-character SHA3-384 checksum or a 128-character SHA3-512 checksum.

\begin{itemize}
\item
  \emph{syd-sha}(1) is a helper tool to calculate checksums of files.
\item
  \emph{syd-path}(1) is a helper tool to write integrity force rules for binaries under PATH.
\end{itemize}

\subsection{proxy/addr}\label{proxyaddr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{IP address} \\
default & \textbf{127.0.0.1} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set internal address for Proxy sandboxing. This must be an IPv4 or an IPv6 address. Defaults to 127.0.0.1.

\subsection{proxy/port}\label{proxyport}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer} \\
default & \textbf{9050} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set internal port for Proxy sandboxing. Defaults to 9050.

\subsection{proxy/ext/host}\label{proxyexthost}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{Hostname or IP} \\
default & \textbf{127.0.0.1} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set external address for Proxy sandboxing. This must either be an IPv4 address or an IPv6 address or a hostname. If the argument does not parse as an IP address, Syd resolves the name using the system DNS resolver and selects a response IP randomly.

Defaults to "127.0.0.1", which may be be overridden with the environment variable \textbf{SYD\_PROXY\_HOST} at startup.

\subsection{proxy/ext/port}\label{proxyextport}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer} \\
default & \textbf{9050} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set external port for Proxy sandboxing.

Defaults to 9050, which may be overridden with the environment variable \textbf{SYD\_PROXY\_PORT} at startup.

\subsection{proxy/ext/unix}\label{proxyextunix}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string} \\
static & \textbf{yes} \\
oci & \textbf{no} \\
\end{xltabular}

Set external UNIX domain socket for Proxy sandboxing.

The argument may also be set using the environment variable \textbf{SYD\_PROXY\_UNIX} at startup.

This option has precedence over the option "proxy/ext/host", ie. when both are given Syd will connect to the UNIX domain socket.

\subsection{segvguard/expiry}\label{segvguardexpiry}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{duration} \\
default & 120 \\
\end{xltabular}

Specify SegvGuard expiry timeout in seconds. Set to 0 to disable SegvGuard.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the \textbf{dur} crate for more information.

\subsection{segvguard/suspension}\label{segvguardsuspension}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{duration} \\
default & 600 \\
\end{xltabular}

Specify SegvGuard suspension timeout in seconds.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the \textbf{dur} crate for more information.

\subsection{segvguard/maxcrashes}\label{segvguardmaxcrashes}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer (u8)} \\
default & 5 \\
\end{xltabular}

Specify SegvGuard max crashes.

\subsection{tpe/gid}\label{tpegid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer (gid\_t)} \\
\end{xltabular}

Specify untrusted GID for Trusted Path Execution (TPE). By default, TPE is applied to users of all groups including root and this setting can be used to limit it to a certain group. To unset a previously set GID and return to the default state set "none" as the value.

\subsection{tpe/negate}\label{tpenegate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Negate GID logic for Trusted Path Execution (TPE). This turns "tpe/gid" from untrusted into trusted such that users belonging to this group will be exempt from TPE.

\subsection{tpe/root\_owned}\label{tperoot_owned}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Ensure file and parent directory are root-owned for Trusted Path Execution (TPE).

Note, this option will misbehave with "unshare/user:1" if the real root user is not mapped inside the container.

\subsection{tpe/user\_owned}\label{tpeuser_owned}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Ensure file and parent directory are user-owned or root-owned for Trusted Path Execution (TPE).

Note, this option may misbehave with "unshare/user:1" if the real root user is not mapped inside the container.

\subsection{tpe/root\_mount}\label{tperoot_mount}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Ensure file and parent directory are on root filesystem for Trusted Path Execution (TPE).

This option may be used to pin all executions to a single safe mountpoint.

\subsection{allow/fs}\label{allowfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to allow for \textbf{Filesystem sandboxing}.

\subsection{allow/walk}\label{allowwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Walk sandboxing}.

\subsection{allow/stat}\label{allowstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Stat sandboxing}.

\subsection{allow/read}\label{allowread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Read sandboxing}.

\subsection{allow/write}\label{allowwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Write sandboxing}.

\subsection{allow/exec}\label{allowexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Exec sandboxing}.

\subsection{allow/create}\label{allowcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Create sandboxing}.

\subsection{allow/delete}\label{allowdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Delete sandboxing}.

\subsection{allow/rename}\label{allowrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Rename sandboxing}.

\subsection{allow/symlink}\label{allowsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Symlink sandboxing}.

\subsection{allow/truncate}\label{allowtruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Truncate sandboxing}.

\subsection{allow/chdir}\label{allowchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chdir sandboxing}.

\subsection{allow/readdir}\label{allowreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Readdir sandboxing}.

\subsection{allow/mkdir}\label{allowmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Mkdir sandboxing}.

\subsection{allow/rmdir}\label{allowrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Rmdir sandboxing}.

\subsection{allow/chown}\label{allowchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chown sandboxing}.

\subsection{allow/chgrp}\label{allowchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chgrp sandboxing}.

\subsection{allow/chmod}\label{allowchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chmod sandboxing}.

\subsection{allow/chattr}\label{allowchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chattr sandboxing}.

\subsection{allow/chroot}\label{allowchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Chroot sandboxing}.

\subsection{allow/utime}\label{allowutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Utime sandboxing}.

\subsection{allow/mkdev}\label{allowmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Mkdev sandboxing}.

\subsection{allow/mkfifo}\label{allowmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Mkfifo sandboxing}.

\subsection{allow/mktemp}\label{allowmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to allow for \textbf{Mktemp sandboxing}.

\subsection{allow/net/bind}\label{allownetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to allow for \textbf{Bind network sandboxing}.

\subsection{allow/net/accept}\label{allownetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to allow for \textbf{Accept network sandboxing}.

\subsection{allow/net/connect}\label{allownetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to allow for \textbf{Connect network sandboxing}.

\subsection{allow/net/sendfd}\label{allownetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to allow for \textbf{SendFd network sandboxing}.

\subsection{allow/net/link}\label{allownetlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a list of netlink families to allow for \textbf{Link network sandboxing}.

Accepts a comma-delimited list of the following items: \textbf{route}, \textbf{usersock}, \textbf{firewall}, \textbf{sock\_diag}, \textbf{nflog}, \textbf{xfrm}, \textbf{selinux}, \textbf{iscsi}, \textbf{audit}, \textbf{fib\_lookup}, \textbf{connector}, \textbf{netfilter}, \textbf{ip6\_fw}, \textbf{dnrtmsg}, \textbf{kobject\_uevent}, \textbf{generic}, \textbf{scsitransport}, \textbf{ecryptfs}, \textbf{rdma}, \textbf{crypto}, and \textbf{smc}. Use \textbf{all} to specify all families.

\subsection{allow/lock/read}\label{allowlockread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
default & \emph{("/dev/null", "/proc")} \\
\end{xltabular}

Specifies a set of beneath paths to grant file read access for \textbf{Lock} sandboxing. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_READ\_FILE} and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the paths "/dev/null" and "/proc" by default as Syd is included in the Landlock sandbox and Syd requires read access to these paths to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/write}\label{allowlockwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
default & \emph{("/dev/null")} \\
\end{xltabular}

Specifies a set of beneath paths to grant file write access for \textbf{Lock} sandboxing. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_WRITE\_FILE} and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the path "/dev/null" by default as Syd is included in the Landlock sandbox and Syd requires write access to this file to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/exec}\label{allowlockexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant file execute access for \textbf{Lock} sandboxing. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_EXECUTE} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/ioctl}\label{allowlockioctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant \emph{ioctl}(2) access for \textbf{Lock} sandboxing. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_IOCTL\_DEV} and only applies to the content of the directory not the directory itself. Landlock \emph{ioctl}(2) support requires ABI 5 or later. Fifth Landlock ABI was introduced with Linux 6.10. On older kernels, this command is a no-op and is not going to confine \emph{ioctl}(2) operations. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/create}\label{allowlockcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant file creation, rename and link access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_REG} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/delete}\label{allowlockdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant file unlink, rename and link access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_REMOVE\_FILE} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/rename}\label{allowlockrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant access to link or rename a file from or to a different directory (i.e.~reparent a file hierarchy) for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_REFER} and only applies to the content of the directory not the directory itself. Landlock rename support requires ABI 2 or later. Second Landlock ABI was introduced with Linux 5.19. On older kernels, this type of access is always denied with Landlock. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/symlink}\label{allowlocksymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant symbolic link creation, rename and link access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_SYM} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/truncate}\label{allowlocktruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
default & \emph{("/dev/null")} \\
\end{xltabular}

Specifies a set of beneath paths to grant file truncation access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_TRUNCATE} and only applies to the content of the directory not the directory itself. Landlock file truncation support requires ABI 3 or later. Third Landlock ABI was introduced with Linux 6.2. On older kernels, this command is a no-op and is not going to confine file truncation operations. As of version 3.21.0, this set includes the path "/dev/null" by default as Syd is included in the Landlock sandbox and Syd requires truncation access to this file to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/readdir}\label{allowlockreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
default & \emph{("/proc")} \\
\end{xltabular}

Specifies a set of beneath paths to grant directory list access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_READ\_DIR} and applies to the directory and the directories beneath it. As of version 3.21.0, this set includes the directory "/proc" by default as Syd is included in the Landlock sandbox and Syd requires readdir access to this directory to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/mkdir}\label{allowlockmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant directory creation and rename access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_DIR} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/rmdir}\label{allowlockrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant directory deletion and rename access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_REMOVE\_DIR} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/mkbdev}\label{allowlockmkbdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant block device creation access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_BLOCK} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/mkcdev}\label{allowlockmkcdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant character device creation access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_CHAR} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/mkfifo}\label{allowlockmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a set of beneath paths to grant named pipe (FIFO) creation access for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_FIFO} and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed.

\subsection{allow/lock/bind}\label{allowlockbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{(u16-set, string-set)} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a list of allowed \emph{bind}(2) ports and UNIX domain socket paths for \textbf{Lock sandboxing}. This category corresponds to the Landlock access rights \textbf{LANDLOCK\_ACCESS\_NET\_BIND\_TCP} and \textbf{LANDLOCK\_ACCESS\_FS\_MAKE\_SOCK} and only applies to the content of the directory not the directory itself. Argument is either a single port or a closed range in format \textbf{port1-port2}, or an absolute UNIX domain socket path. Landlock network support requires ABI 4 or later. Fourth Landlock ABI was introduced with Linux 6.7. On older kernels, this command is a no-op when specified with port arguments and does not do any network confinement. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Noop without \textbf{sandbox/lock:on}.

\subsection{allow/lock/connect}\label{allowlockconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{u16-set} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies a list of allowed \emph{connect}(2) ports for \textbf{Lock sandboxing}. This category corresponds to the Landlock access right \textbf{LANDLOCK\_ACCESS\_NET\_BIND\_CONNECT}. Argument is either a single port or a closed range in format \textbf{port1-port2}. Landlock network support requires ABI 4 or later. Fourth Landlock ABI was introduced with Linux 6.7. On older kernels, this command is a no-op and does not do any network confinement. Noop without \textbf{sandbox/lock:on}.

\subsection{warn/fs}\label{warnfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to warn for \textbf{Filesystem sandboxing}.

\subsection{warn/walk}\label{warnwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Walk sandboxing}.

\subsection{warn/stat}\label{warnstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Stat sandboxing}.

\subsection{warn/read}\label{warnread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Read sandboxing}.

\subsection{warn/write}\label{warnwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Write sandboxing}.

\subsection{warn/exec}\label{warnexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Exec sandboxing}.

\subsection{warn/create}\label{warncreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Create sandboxing}.

\subsection{warn/delete}\label{warndelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Delete sandboxing}.

\subsection{warn/rename}\label{warnrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Rename sandboxing}.

\subsection{warn/symlink}\label{warnsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Symlink sandboxing}.

\subsection{warn/truncate}\label{warntruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Truncate sandboxing}.

\subsection{warn/chdir}\label{warnchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chdir sandboxing}.

\subsection{warn/readdir}\label{warnreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Readdir sandboxing}.

\subsection{warn/mkdir}\label{warnmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Mkdir sandboxing}.

\subsection{warn/rmdir}\label{warnrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Rmdir sandboxing}.

\subsection{warn/chown}\label{warnchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chown sandboxing}.

\subsection{warn/chgrp}\label{warnchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chgrp sandboxing}.

\subsection{warn/chmod}\label{warnchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chmod sandboxing}.

\subsection{warn/chattr}\label{warnchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chattr sandboxing}.

\subsection{warn/chroot}\label{warnchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Chroot sandboxing}.

\subsection{warn/utime}\label{warnutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Utime sandboxing}.

\subsection{warn/mkdev}\label{warnmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Mkdev sandboxing}.

\subsection{warn/mkfifo}\label{warnmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Mkfifo sandboxing}.

\subsection{warn/mktemp}\label{warnmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to warn for \textbf{Mktemp sandboxing}.

\subsection{warn/net/bind}\label{warnnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to warn for \textbf{Bind network sandboxing}.

\subsection{warn/net/accept}\label{warnnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to warn for \textbf{Accept network sandboxing}.

\subsection{warn/net/connect}\label{warnnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to warn for \textbf{Connect network sandboxing}.

\subsection{warn/net/sendfd}\label{warnnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to warn for \textbf{SendFd network sandboxing}.

\subsection{deny/fs}\label{denyfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to deny for \textbf{Filesystem sandboxing}.

\subsection{deny/walk}\label{denywalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Walk sandboxing}.

\subsection{deny/stat}\label{denystat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Stat sandboxing}.

\subsection{deny/read}\label{denyread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Read sandboxing}.

\subsection{deny/write}\label{denywrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Write sandboxing}.

\subsection{deny/exec}\label{denyexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Exec sandboxing}.

\subsection{deny/create}\label{denycreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Create sandboxing}.

\subsection{deny/delete}\label{denydelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Delete sandboxing}.

\subsection{deny/rename}\label{denyrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Rename sandboxing}.

\subsection{deny/symlink}\label{denysymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Symlink sandboxing}.

\subsection{deny/truncate}\label{denytruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Truncate sandboxing}.

\subsection{deny/chdir}\label{denychdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chdir sandboxing}.

\subsection{deny/readdir}\label{denyreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Readdir sandboxing}.

\subsection{deny/mkdir}\label{denymkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Mkdir sandboxing}.

\subsection{deny/rmdir}\label{denyrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Rmdir sandboxing}.

\subsection{deny/chown}\label{denychown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chown sandboxing}.

\subsection{deny/chgrp}\label{denychgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chgrp sandboxing}.

\subsection{deny/chmod}\label{denychmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chmod sandboxing}.

\subsection{deny/chattr}\label{denychattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chattr sandboxing}.

\subsection{deny/chroot}\label{denychroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Chroot sandboxing}.

\subsection{deny/utime}\label{denyutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Utime sandboxing}.

\subsection{deny/mkdev}\label{denymkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Mkdev sandboxing}.

\subsection{deny/mkfifo}\label{denymkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Mkfifo sandboxing}.

\subsection{deny/mktemp}\label{denymktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to deny for \textbf{Mktemp sandboxing}.

\subsection{deny/net/bind}\label{denynetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to deny for \textbf{Bind network sandboxing}.

\subsection{deny/net/accept}\label{denynetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to deny for \textbf{Accept network sandboxing}.

\subsection{deny/net/connect}\label{denynetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to deny for \textbf{Connect network sandboxing}.

\subsection{deny/net/sendfd}\label{denynetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to deny for \textbf{SendFd network sandboxing}.

\subsection{panic/fs}\label{panicfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to panic for \textbf{Filesystem sandboxing}.

\subsection{panic/walk}\label{panicwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Walk sandboxing}.

\subsection{panic/stat}\label{panicstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Stat sandboxing}.

\subsection{panic/read}\label{panicread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Read sandboxing}.

\subsection{panic/write}\label{panicwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Write sandboxing}.

\subsection{panic/exec}\label{panicexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Exec sandboxing}.

\subsection{panic/create}\label{paniccreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Create sandboxing}.

\subsection{panic/delete}\label{panicdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Delete sandboxing}.

\subsection{panic/rename}\label{panicrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Rename sandboxing}.

\subsection{panic/symlink}\label{panicsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Symlink sandboxing}.

\subsection{panic/truncate}\label{panictruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Truncate sandboxing}.

\subsection{panic/chdir}\label{panicchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chdir sandboxing}.

\subsection{panic/readdir}\label{panicreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Readdir sandboxing}.

\subsection{panic/mkdir}\label{panicmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Mkdir sandboxing}.

\subsection{panic/rmdir}\label{panicrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Rmdir sandboxing}.

\subsection{panic/chown}\label{panicchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chown sandboxing}.

\subsection{panic/chgrp}\label{panicchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chgrp sandboxing}.

\subsection{panic/chmod}\label{panicchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chmod sandboxing}.

\subsection{panic/chattr}\label{panicchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chattr sandboxing}.

\subsection{panic/chroot}\label{panicchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Chroot sandboxing}.

\subsection{panic/utime}\label{panicutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Utime sandboxing}.

\subsection{panic/mkdev}\label{panicmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Mkdev sandboxing}.

\subsection{panic/mkfifo}\label{panicmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Mkfifo sandboxing}.

\subsection{panic/mktemp}\label{panicmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to panic for \textbf{Mktemp sandboxing}.

\subsection{panic/net/bind}\label{panicnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to panic for \textbf{Bind network sandboxing}.

\subsection{panic/net/accept}\label{panicnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to panic for \textbf{Accept network sandboxing}.

\subsection{panic/net/connect}\label{panicnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to panic for \textbf{Connect network sandboxing}.

\subsection{panic/net/sendfd}\label{panicnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to panic for \textbf{SendFd network sandboxing}.

\subsection{stop/fs}\label{stopfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to stop for \textbf{Filesystem sandboxing}.

\subsection{stop/walk}\label{stopwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Walk sandboxing}.

\subsection{stop/stat}\label{stopstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Stat sandboxing}.

\subsection{stop/read}\label{stopread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Read sandboxing}.

\subsection{stop/write}\label{stopwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Write sandboxing}.

\subsection{stop/exec}\label{stopexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Exec sandboxing}.

\subsection{stop/create}\label{stopcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Create sandboxing}.

\subsection{stop/delete}\label{stopdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Delete sandboxing}.

\subsection{stop/rename}\label{stoprename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Rename sandboxing}.

\subsection{stop/symlink}\label{stopsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Symlink sandboxing}.

\subsection{stop/truncate}\label{stoptruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Truncate sandboxing}.

\subsection{stop/chdir}\label{stopchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chdir sandboxing}.

\subsection{stop/readdir}\label{stopreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Readdir sandboxing}.

\subsection{stop/mkdir}\label{stopmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Mkdir sandboxing}.

\subsection{stop/rmdir}\label{stoprmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Rmdir sandboxing}.

\subsection{stop/chown}\label{stopchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chown sandboxing}.

\subsection{stop/chgrp}\label{stopchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chgrp sandboxing}.

\subsection{stop/chmod}\label{stopchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chmod sandboxing}.

\subsection{stop/chattr}\label{stopchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chattr sandboxing}.

\subsection{stop/chroot}\label{stopchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Chroot sandboxing}.

\subsection{stop/utime}\label{stoputime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Utime sandboxing}.

\subsection{stop/mkdev}\label{stopmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Mkdev sandboxing}.

\subsection{stop/mkfifo}\label{stopmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Mkfifo sandboxing}.

\subsection{stop/mktemp}\label{stopmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to stop for \textbf{Mktemp sandboxing}.

\subsection{stop/net/bind}\label{stopnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to stop for \textbf{Bind network sandboxing}.

\subsection{stop/net/accept}\label{stopnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to stop for \textbf{Accept network sandboxing}.

\subsection{stop/net/connect}\label{stopnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to stop for \textbf{Connect network sandboxing}.

\subsection{stop/net/sendfd}\label{stopnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to stop for \textbf{SendFd network sandboxing}.

\subsection{abort/fs}\label{abortfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to abort for \textbf{Filesystem sandboxing}.

\subsection{abort/walk}\label{abortwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Walk sandboxing}.

\subsection{abort/stat}\label{abortstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Stat sandboxing}.

\subsection{abort/read}\label{abortread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Read sandboxing}.

\subsection{abort/write}\label{abortwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Write sandboxing}.

\subsection{abort/exec}\label{abortexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Exec sandboxing}.

\subsection{abort/create}\label{abortcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Create sandboxing}.

\subsection{abort/delete}\label{abortdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Delete sandboxing}.

\subsection{abort/rename}\label{abortrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Rename sandboxing}.

\subsection{abort/symlink}\label{abortsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Symlink sandboxing}.

\subsection{abort/truncate}\label{aborttruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Truncate sandboxing}.

\subsection{abort/chdir}\label{abortchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chdir sandboxing}.

\subsection{abort/readdir}\label{abortreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Readdir sandboxing}.

\subsection{abort/mkdir}\label{abortmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Mkdir sandboxing}.

\subsection{abort/rmdir}\label{abortrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Rmdir sandboxing}.

\subsection{abort/chown}\label{abortchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chown sandboxing}.

\subsection{abort/chgrp}\label{abortchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chgrp sandboxing}.

\subsection{abort/chmod}\label{abortchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chmod sandboxing}.

\subsection{abort/chattr}\label{abortchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chattr sandboxing}.

\subsection{abort/chroot}\label{abortchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Chroot sandboxing}.

\subsection{abort/utime}\label{abortutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Utime sandboxing}.

\subsection{abort/mkdev}\label{abortmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Mkdev sandboxing}.

\subsection{abort/mkfifo}\label{abortmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Mkfifo sandboxing}.

\subsection{abort/mktemp}\label{abortmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to abort for \textbf{Mktemp sandboxing}.

\subsection{abort/net/bind}\label{abortnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to abort for \textbf{Bind network sandboxing}.

\subsection{abort/net/accept}\label{abortnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to abort for \textbf{Accept network sandboxing}.

\subsection{abort/net/connect}\label{abortnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to abort for \textbf{Connect network sandboxing}.

\subsection{abort/net/sendfd}\label{abortnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to abort for \textbf{SendFd network sandboxing}.

\subsection{kill/fs}\label{killfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to kill for \textbf{Filesystem sandboxing}.

\subsection{kill/walk}\label{killwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Walk sandboxing}.

\subsection{kill/stat}\label{killstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Stat sandboxing}.

\subsection{kill/read}\label{killread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Read sandboxing}.

\subsection{kill/write}\label{killwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Write sandboxing}.

\subsection{kill/exec}\label{killexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Exec sandboxing}.

\subsection{kill/create}\label{killcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Create sandboxing}.

\subsection{kill/delete}\label{killdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Delete sandboxing}.

\subsection{kill/rename}\label{killrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Rename sandboxing}.

\subsection{kill/symlink}\label{killsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Symlink sandboxing}.

\subsection{kill/truncate}\label{killtruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Truncate sandboxing}.

\subsection{kill/chdir}\label{killchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chdir sandboxing}.

\subsection{kill/readdir}\label{killreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Readdir sandboxing}.

\subsection{kill/mkdir}\label{killmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Mkdir sandboxing}.

\subsection{kill/rmdir}\label{killrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Rmdir sandboxing}.

\subsection{kill/chown}\label{killchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chown sandboxing}.

\subsection{kill/chgrp}\label{killchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chgrp sandboxing}.

\subsection{kill/chmod}\label{killchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chmod sandboxing}.

\subsection{kill/chattr}\label{killchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chattr sandboxing}.

\subsection{kill/chroot}\label{killchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Chroot sandboxing}.

\subsection{kill/utime}\label{killutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Utime sandboxing}.

\subsection{kill/mkdev}\label{killmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Mkdev sandboxing}.

\subsection{kill/mkfifo}\label{killmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Mkfifo sandboxing}.

\subsection{kill/mktemp}\label{killmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to kill for \textbf{Mktemp sandboxing}.

\subsection{kill/net/bind}\label{killnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to kill for \textbf{Bind network sandboxing}.

\subsection{kill/net/accept}\label{killnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to kill for \textbf{Accept network sandboxing}.

\subsection{kill/net/connect}\label{killnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to kill for \textbf{Connect network sandboxing}.

\subsection{kill/net/sendfd}\label{killnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to kill for \textbf{SendFd network sandboxing}.

\subsection{exit/fs}\label{exitfs}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of filesystem names to exit for \textbf{Filesystem sandboxing}.

\subsection{exit/walk}\label{exitwalk}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Walk sandboxing}.

\subsection{exit/stat}\label{exitstat}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Stat sandboxing}.

\subsection{exit/read}\label{exitread}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Read sandboxing}.

\subsection{exit/write}\label{exitwrite}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Write sandboxing}.

\subsection{exit/exec}\label{exitexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Exec sandboxing}.

\subsection{exit/create}\label{exitcreate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Create sandboxing}.

\subsection{exit/delete}\label{exitdelete}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Delete sandboxing}.

\subsection{exit/rename}\label{exitrename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Rename sandboxing}.

\subsection{exit/symlink}\label{exitsymlink}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Symlink sandboxing}.

\subsection{exit/truncate}\label{exittruncate}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Truncate sandboxing}.

\subsection{exit/chdir}\label{exitchdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chdir sandboxing}.

\subsection{exit/readdir}\label{exitreaddir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Readdir sandboxing}.

\subsection{exit/mkdir}\label{exitmkdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Mkdir sandboxing}.

\subsection{exit/rmdir}\label{exitrmdir}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Rmdir sandboxing}.

\subsection{exit/chown}\label{exitchown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chown sandboxing}.

\subsection{exit/chgrp}\label{exitchgrp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chgrp sandboxing}.

\subsection{exit/chmod}\label{exitchmod}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chmod sandboxing}.

\subsection{exit/chattr}\label{exitchattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chattr sandboxing}.

\subsection{exit/chroot}\label{exitchroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Chroot sandboxing}.

\subsection{exit/utime}\label{exitutime}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Utime sandboxing}.

\subsection{exit/mkdev}\label{exitmkdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Mkdev sandboxing}.

\subsection{exit/mkfifo}\label{exitmkfifo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Mkfifo sandboxing}.

\subsection{exit/mktemp}\label{exitmktemp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to exit for \textbf{Mktemp sandboxing}.

\subsection{exit/net/bind}\label{exitnetbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to exit for \textbf{Bind network sandboxing}.

\subsection{exit/net/accept}\label{exitnetaccept}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to exit for \textbf{Accept network sandboxing}.

\subsection{exit/net/connect}\label{exitnetconnect}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to exit for \textbf{Connect network sandboxing}.

\subsection{exit/net/sendfd}\label{exitnetsendfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of network address patterns to exit for \textbf{SendFd network sandboxing}.

\subsection{append}\label{append}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to files that should be made append-only for \textbf{Write sandboxing}.

If a path is append-only, Syd adds \textbf{O\_APPEND} and removes \textbf{O\_TRUNC} from flags on any sandbox granted attempt to \emph{open}(2) this path. Unsetting the \textbf{O\_APPEND} flag using \emph{fcntl}(2) \textbf{F\_SETFL} command is prevented. Similarly, any attempt to \emph{rename}(2), \emph{truncate}(2) and \emph{unlink}(2) the file is prevented. This is typically useful for history and log files.

\subsection{mask}\label{mask}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-map} \\
\end{xltabular}

Specifies a list of \emph{glob}(3p) patterns to mask for \textbf{Read \& Write sandboxing}.

If a path is masked, Syd returns a file descriptor to \textbf{/dev/null} on any sandbox granted attempt to \emph{open}(2) this path. Masking can effectively be used to hide the contents of a file in a more relaxed and compatible way than denying read/write access to it. \emph{stat}(2) calls on a masked file returns the original file metadata and a masked file may be executed. After a successful mask operation, the mask path is \emph{not} checked for sandbox access.

As of version 3.35.1, the default mask path \textbf{/dev/null} may be changed by specifying a colon-separated extra path to the mask-add command, e.g. \textbf{mask+/dev/{[}fn{]}ull:/dev/zero} when both of the paths \textbf{/dev/full} and \textbf{/dev/null} will be masked with the path \textbf{/dev/zero}. The mask path must be a fully canonicalized path without symbolic links.

As of version 3.36.0, the default mask path may be overridden for directories by specifying an additional colon-separated extra path to the mask-add command, e.g. \textbf{mask+/proc/acpi/***:/dev/null:/var/empty} when the path \textbf{/proc/acpi/wakeup} which is a regular file will return \textbf{/dev/null} at \emph{open}(2) boundary but the directory \textbf{/proc/acpi} and any subdirectory within will return \textbf{/var/empty} at \emph{open}(2) boundary. The mask path must be a fully canonicalized path without symbolic links.

This feature provides a non-privileged alternative to the \emph{bind} command because it does not require the creation of a mount namespace. Moreover, \emph{mask} commands may be specified dynamically after startup using the \emph{syd}(2) API allowing for fine-tuned and/or incremental confinement.

\subsection{block}\label{block}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{ip-range} \\
\end{xltabular}

Specifies a range of IP networks to be blocked when specified as the target address of \textbf{connect} group system calls which are \emph{connect}(2), \emph{sendto}(2), \emph{sendmsg}(2), \emph{sendmmsg}(2) and when received as the source address in return from \emph{accept}(2) and \emph{accept4}(2) system calls for IPv4 and IPv6 family sockets. Use \textbf{block+\textless net\textgreater{}} and \textbf{block-\textless net\textgreater{}} to add and remove ip networks from the range. Alternatively the range can also be populated by including \textbf{ipset} and \textbf{netset} files from within Syd configuration. Use \textbf{block\^{}} to clear the list and \textbf{block!} to simplify the ip range by aggregating networks together. \textbf{block!} is useful to call after importing big IP blocklists, it helps reduce memory consumption and improve matching performance. Below is a configuration snippet that imports Feodo and DShield blocklists:

{\scriptsize \begin{verbatim}
# Enable IP blocklists
# Source: https://github.com/firehol/blocklist-ipsets.git
include /usr/src/blocklist-ipsets/feodo.ipset
include /usr/src/blocklist-ipsets/feodo_badips.ipset
include /usr/src/blocklist-ipsets/dshield.netset
include /usr/src/blocklist-ipsets/dshield_1d.netset
include /usr/src/blocklist-ipsets/dshield_30d.netset
include /usr/src/blocklist-ipsets/dshield_7d.netset
include /usr/src/blocklist-ipsets/dshield_top_1000.ipset
block!
\end{verbatim}}

\subsection{cmd/exec}\label{cmdexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{command} \\
\end{xltabular}

Makes Syd execute an external command without sandboxing. The process is executed in a new process group with its standard input attached to \textbf{/dev/null}. Standard output and standard error file descriptors are inherited. Syd also ensures no non-standard file descriptors leak into the new process utilizing the \emph{close\_range}(2) system call. Current working directory is changed to the root directory, i.e.~\textbf{/}. The \emph{umask}(2) is set to 077. The program name and arguments must be separated with the \textbf{US} (unit separator, hex: 0x1f, octal: 037) character. To ease usage, the \emph{syd-exec}(1) helper utility is provided to construct a sandbox command of this type:

{\scriptsize \begin{verbatim}
; syd -puser -mlock:exec -- sh -c 'test -c $(syd-exec echo hello world)'
hello world
;
\end{verbatim}}

\subsection{load}\label{load}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer (fd) or string (profile-name)} \\
\end{xltabular}

Read configuration from the given file descriptor, the file must be open for reading. Syd uses \emph{pidfd\_getfd}(2) to acquire the file descriptor and reads sandbox configuration from it. This command is useful to load a set of sandbox commands into Syd in a single step and is typically used with \textbf{reset}, e.g:

{\scriptsize \begin{verbatim}
int fd = open("/tmp", O_RDWR | O_TMPFILE | O_CLOEXEC, 0);
if (fd == -1) errx(1, "Failed to open temporary file");

const char *syd = "sandbox:stat/on\nallow/stat+/***\ndeny/stat+/\nlock:on\n";
errx(write(fd, syd, strlen(syd)) == -1, "Failed to write config");
errx(lseek(fd, 0, SEEK_SET) == -1, "Failed to seek in file");

char load[64];
sprintf(load, "/dev/syd/load/%d", fd);
errx(stat("/dev/syd/reset", NULL) == -1, "Failed to reset syd");
errx(stat(load, NULL) == -1, "Failed to load syd profile");

errx(execvp("/bin/sh", (char *[]){"/bin/sh", "-l", NULL}) == -1, "execvp failed");
\end{verbatim}}

Due to security reasons, this command is only available via the virtual \emph{stat}(2) call, it may not be used with the \textbf{-m} command line switch or in a configuration file.

As of version 3.30.0, this command may be used to load builtin profiles, when Syd falls back to parsing the "load" argument as a profile name if parsing the argument as a file descriptor fails.

\subsection{trace/allow\_safe\_setuid}\label{traceallow_safe_setuid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Enable \textbf{SafeSetID} and retain the Linux capability \textbf{CAP\_SETUID}. This option is implied at startup if any UID transits were defined with the \textbf{setuid} command. This feature allows Syd to change UID simultaneously with the sandbox process. Because NPTL uses reserved signals to ensure all threads share the same UID/GID, setting this option disables the SROP mitigator. See the \textbf{Enhanced Execution Control (EEC)} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_safe\_setgid}\label{traceallow_safe_setgid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Enable \textbf{SafeSetID} and retain the Linux capability \textbf{CAP\_SETGID}. This option is implied at startup if any GID transits were defined with the \textbf{setuid} command. This feature allows Syd to change GID simultaneously with the sandbox process. Because NPTL uses reserved signals to ensure all threads share the same UID/GID, setting this option disables the SROP mitigator. See the \textbf{Enhanced Execution Control (EEC)} section of the \emph{syd}(7) manual page for more information.

\subsection{setuid}\label{setuid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{{[}(uid, uid){]}} \\
static & \textbf{yes} \\
\end{xltabular}

Add, remove a UID transition or reset UID transitions. Only a single transition from a source UID can be defined. Target UID can not be lower than the build default \textbf{11}, which is typically the \textbf{operator} user. Defining a UID transit with this option implies \textbf{trace/allow\_safe\_setuid:true}.

Usage:

{\scriptsize \begin{verbatim}
setuid+0:65534      # Define a UID transition from root to nobody.
setuid+root:nobody  # Same as above but using user names.
setuid-0:65534      # Remove a previously defined UID transition.
setuid^0            # Remove all UID transitions matching source UID.
setuid^             # Remove all UID transitions.
\end{verbatim}}

\subsection{setgid}\label{setgid}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{{[}(gid, gid){]}} \\
static & \textbf{yes} \\
\end{xltabular}

Add, remove a GID transition or reset GID transitions. Only a single transition from a source GID can be defined. Target GID can not be lower than the build default \textbf{14}, which is typically the \textbf{uucp} user. Defining a GID transit with this option implies \textbf{trace/allow\_safe\_setgid:true}.

Usage:

{\scriptsize \begin{verbatim}
setgid+0:65534      # Define a GID transition from root to nogroup.
setgid+root:nogroup # Same as above but using group names.
setgid-0:65534      # Remove a previously defined GID transition.
setgid^0            # Remove all GID transitions matching source GID.
setgid^             # Remove all GID transitions.
\end{verbatim}}

\subsection{trace/allow\_unsafe\_cbpf}\label{traceallow_unsafe_cbpf}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether Syd should allow additional \emph{seccomp}(2) cbpf filters to be installed by sandbox processes. By default, this is denied to mitigate confused deputy problems and \emph{errno}(3) is set to \textbf{EINVAL}, i.e.~\textbf{Invalid argument}, for compatibility reasons. On the one hand, stacked \emph{seccomp}(2) cbpf filters allow for incremental confinement and therefore added hardening, on the other hand they may be abused to install system call filters with more precedent actions than user-notify thereby bypassing Syd\textquotesingle s own \emph{seccomp}(2) cbpf filters. To quote the \emph{seccomp\_unotify}(2): "... a user-space notifier can be bypassed if the existing filters allow the use of \emph{seccomp}(2) or \emph{prctl}(2) to install a filter that returns an action value with a higher precedence than \textbf{SECCOMP\_RET\_USER\_NOTIF} (see \emph{seccomp}(2))." Setting the option \textbf{trace/allow\_unsafe\_prctl:true} overrides this option and allows the \textbf{PR\_SET\_SECCOMP} \emph{prctl}(2) operation inside the sandbox. This may be changed in the future for clearer separation of mitigations.

\subsection{trace/allow\_unsafe\_ebpf}\label{traceallow_unsafe_ebpf}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Allows direct eBPF use inside the Syd sandbox using the \emph{bpf}(2) system call, whose unprivileged use is permitted since Linux-4.4. On the one hand, eBPF programs can be used for additional hardening, on the other hand eBPF is a frequent source of vulnerabilities due to churn, complexity, improper validation and complexity of validation. eBPF may also be abused to implement efficient and portable rootkits.

Note, as of version 3.37.0, Syd drops the capability \textbf{CAP\_BPF} and denies the privileged \emph{bpf}(2) commands \textbf{BPF\_MAP\_CREATE} and \textbf{BPF\_PROG\_LOAD} with the \emph{errno}(3) \textbf{EPERM}, i.e.~\textbf{Operation not} permitted, \textbf{regardless} of the value of this option. This is in consistence with the Linux kernel checks for the \textbf{kernel.unprivileged\_bpf\_disabled} \emph{sysctl}(8). Consult the \emph{bpf}(2) and \emph{capabilities}(7) manual pages for more information about the \textbf{CAP\_BPF} Linux capability which is implemented in Linux-5.8 or newer.

\subsection{trace/allow\_unsafe\_dumpable}\label{traceallow_unsafe_dumpable}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether Syd should skip from setting its process dumpable attribute to false. This allows core dumps for the Syd process, and allows debugging/profiling/tracing the Syd process. You should not set this option unless you\textquotesingle re developing Syd.

\subsection{trace/allow\_unsafe\_exec\_ldso}\label{traceallow_unsafe_exec_ldso}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether \emph{ld.so}(8) exec indirection should be allowed. This is not allowed by default to harden noexec boundaries.

\subsection{trace/allow\_unsafe\_exec\_libc}\label{traceallow_unsafe_exec_libc}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether turning on secure-execution mode for libc should be skipped. Refer to the \textbf{Enforcing AT\_SECURE and UID/GID} Verification section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_memory}\label{traceallow_unsafe_exec_memory}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the Memory-Deny-Write-Execute (MDWE) protections should be bypassed. See \textbf{Memory-Deny-Write-Execute Protections} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_nopie}\label{traceallow_unsafe_exec_nopie}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether execution of non-PIE binaries should be allowed. This is generally not recommended but may be necessary on some systems. Refer to the \textbf{Enforcing Position-Independent Executables (PIE)} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_null}\label{traceallow_unsafe_exec_null}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether exec calls with NULL argument and environment pointers should be allowed. Refer to the \textbf{Enhanced execve} and execveat Syscall Validation section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_stack}\label{traceallow_unsafe_exec_stack}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether execution of binaries with executable stack should be allowed. This is generally not recommended by may be necessary on some systems. Refer to the \textbf{Enforcing Non-Executable Stack} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_script}\label{traceallow_unsafe_exec_script}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Opt out of file vetting for interpreted exec. When off (default) on Linux 6.14 and newer, Syd sets SECBIT\_EXEC\_RESTRICT\_FILE and SECBIT\_EXEC\_RESTRICT\_FILE\_LOCKED at startup so interpreters/dynamic linkers must only execute a file if \emph{execveat}(2) with AT\_EXECVE\_CHECK flag on its file descriptor would succeed (FD-based check avoids TOCTOU). When on, Syd does not set these bits (legacy behavior). No-op on kernels \textless{} 6.14. Bits are unprivileged-settable; locks make the policy sticky across exec. Refer to the \textbf{Securebits and Kernel-Assisted} Executability section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_interactive}\label{traceallow_unsafe_exec_interactive}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Opt out of interactive snippet denial. When off (default) on Linux 6.14 and newer, Syd sets SECBIT\_EXEC\_DENY\_INTERACTIVE and its lock so interpreters refuse interactive code (-e, -c, REPL, etc.) unless content arrives via an FD and passes AT\_EXECVE\_CHECK of \emph{execveat}(2). When on, Syd does not set these bits (legacy behavior). No-op on kernels \textless{} 6.14. Bits are unprivileged-settable; locks persist the policy across exec. Refer to the \textbf{Securebits and Kernel-Assisted Executability} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_exec\_speculative}\label{traceallow_unsafe_exec_speculative}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether speculation controls should not be set to enable Speculative Execution mitigations using the \emph{prctl}(2) interface at startup. When this option is enabled, the \emph{prctl}(2) operations PR\_GET\_SPECULATION\_CTRL, and PR\_SET\_SPECULATION\_CTRL are allowed within the sandbox. Refer to the \textbf{Speculative Execution Mitigation} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_ptrace}\label{traceallow_unsafe_ptrace}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether \emph{ptrace}(2) should be used to secure the exec handler. Setting this option to true effectively removes the \emph{ptrace}(2) dependency from the sandbox. This is necessary to trace syd together with its children, e.g.~with \textbf{strace -f}. \textbf{Warning}, this option makes \emph{syd}(1) keep the \textbf{CAP\_SYS\_PTRACE} capability and disables Force Sandboxing, SegvGuard and the exec-TOCTOU mitigator. It allows the sandbox process to trivially break out of the sandbox by e.g. attaching to the \emph{syd}(1) main thread with \emph{ptrace}(2) and getting a handle to the \emph{seccomp}(2) notify file descriptor. Therefore, \textbf{this option should} only be used in trusted environments.

\subsection{trace/allow\_unsafe\_perf}\label{traceallow_unsafe_perf}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether perf calls should be allowed within the sandbox.

As of version 3.40.0, the \emph{prctl}(2) operations \textbf{PR\_TASK\_PERF\_EVENTS\_ENABLE}, and \textbf{PR\_TASK\_PERF\_EVENTS\_DISABLE} are also allowed if this option is set at startup.

\subsection{trace/allow\_unsafe\_create}\label{traceallow_unsafe_create}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether to allow unsafe file creation. Refer to the \textbf{Trusted File Creation} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_filename}\label{traceallow_unsafe_filename}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether the restrictions on file names should be lifted. By default, file names with control characters, forbidden characters or invalid UTF-8 are denied with \textbf{EINVAL} as necessary. Read \textbf{Enhanced Path Integrity Measures} of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_hardlinks}\label{traceallow_unsafe_hardlinks}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether to allow unsafe hardlink targets. Refer to the \textbf{Trusted Hardlinks} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_machine\_id}\label{traceallow_unsafe_machine_id}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether the sandbox substitutes \emph{machine-id}(5) with a synthetic, per-Syd random identifier or exposes the host value. The substitution is done at \emph{open}(2) boundary after the access checks grants access to this file. The files /etc/hostid and /var/adm/hostid which are part of the \emph{gethostid}(3) interface of POSIX.1-2008 as well as /sys/class/dmi/id/product\_uuid are also substituted as part of this mitigation. When \emph{false} (default), at startup Syd computes a SHA3-512 digest using \textbf{AT\_RANDOM} bytes and formats the result as a 128-character lowercase hexadecimal sandbox ID; the first 32 characters of this string (\textbf{which must not be all zeroes}) are presented in place of \emph{machine-id}(5), /etc/hostid, /var/adm/hostid, and /sys/class/dmi/id/product\_uuid to limit information leakage. Users may override the sandbox ID by setting \textbf{SYD\_ID} environment variable to a 128-character lowercase hexadecimal string that satisfies the same non-all-zero 32-character prefix constraint. When true, no substitution is performed and the real system \emph{machine-id}(5), /etc/hostid, /var/adm/hostid, and /sys/class/dmi/id/product\_uuid files are made visible to the sandbox process (i.e., the mitigation is disabled). Refer to the following links for more information:

\begin{itemize}
\item
  https://man7.org/linux/man-pages/man5/machine-id.5.html
\item
  https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostid.html
\end{itemize}

\subsection{trace/allow\_unsafe\_proc\_files}\label{traceallow_unsafe_proc_files}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether internal \emph{procfs}(5) should NOT be mounted with the option \textbf{subset=pid}. This option is a no-op unless \textbf{unshare/pid:true} is also set.

\subsection{trace/allow\_unsafe\_proc\_pid\_status}\label{traceallow_unsafe_proc_pid_status}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether masking security-sensitive fields in \emph{proc\_pid\_status}(5) files should be disabled. Refer to the \textbf{Hardening} proc\_pid\_status(5) section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_magiclinks}\label{traceallow_unsafe_magiclinks}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether /proc magic links should be followed even when per-process directory id differs from the caller process id. Magic links are symbolic link-like objects that are most notably found in \emph{proc}(5); examples include \textbf{/proc/pid/exe} and \textbf{/proc/pid/fd/*}. See \emph{symlink}(7) for more details. Unknowingly opening magic links can be risky for some applications. Examples of such risks include the following:

\begin{itemize}
\item
  If the process opening a pathname is a controlling process that currently has no controlling terminal (see \emph{credentials}(7)), then opening a magic link inside \textbf{/proc/pid/fd} that happens to refer to a terminal would cause the process to acquire a controlling terminal.
\item
  In a containerized environment, a magic link inside \textbf{/proc} may refer to an object outside the container, and thus may provide a means to escape from the container.
\end{itemize}

Because of such risks, Syd denies access to magic links which do not belong to the current process by default.

\subsection{trace/allow\_unsafe\_symlinks}\label{traceallow_unsafe_symlinks}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether to allow following symlinks in \emph{untrusted} directories. \emph{Untrusted} directories are either group-writable, world-writable, or have the sticky-bit set. Refer to the \textbf{Trusted} Symbolic Links section of the \emph{syd}(7) manual page for more information.

As of version 3.42.0, sending symlink file descriptors with \emph{sendmsg}(2), and \emph{sendmmsg}(2) system calls using SCM\_RIGHTS control messages is not permitted unless this option is set.

\subsection{trace/allow\_unsafe\_namespace}\label{traceallow_unsafe_namespace}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{string-vec} \\
static & \textbf{yes} \\
\end{xltabular}

A list of namespaces to allow creation under the sandbox. Must be a comma-separated list of \textbf{mount}, \textbf{uts}, \textbf{ipc}, \textbf{user}, \textbf{pid}, \textbf{net}, \textbf{cgroup} and \textbf{time}. The special value \textbf{all} is supported as a placeholder to specify all namespaces. An invocation of this command overrides all previous invocations, ie only the list of subnamespaces in the last invocation of this command will be allowed. By default, subnamespace creation is not allowed. As of version 3.35.2, the system calls \emph{sethostname}(2) and \emph{setdomainname}(2) are only allowed in the sandbox if \textbf{uts} subnamespace is allowed. This is similar to the mount family system calls which are only allowed if \textbf{mount} subnamespace is allowed.

\subsection{trace/allow\_unsafe\_nice}\label{traceallow_unsafe_nice}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether process and I/O priority changes are allowed for the sandbox. See the \textbf{Process Priority and Resource} Management section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_nocookie}\label{traceallow_unsafe_nocookie}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether enforcement of syscall argument cookies should be disabled. See the \textbf{Syscall Argument Cookies} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_nomseal}\label{traceallow_unsafe_nomseal}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether read-only sealing critical regions of the Syd sandbox policy using \emph{mseal}(2) when sandbox is locked should be disabled. See the \textbf{Memory Sealing of Sandbox Policy Regions on Lock} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_sigreturn}\label{traceallow_unsafe_sigreturn}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether signal counting to mitigate Sigreturn Oriented Programming, aka SROP, should be disabled. Refer to the \textbf{Mitigation against Sigreturn Oriented Programming (SROP)} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_chown}\label{traceallow_unsafe_chown}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Makes Syd keep the capability \textbf{CAP\_CHOWN} and sandbox process will inherit the capability from Syd.

\subsection{trace/allow\_unsafe\_chroot}\label{traceallow_unsafe_chroot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Disable Chroot sandboxing and turn \emph{chroot}(2) system call into a no-op. Refer to the explanation of \textbf{chroot} sandbox category in the SANDBOXING section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_pivot\_root}\label{traceallow_unsafe_pivot_root}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Turn \emph{pivot\_root}(2) system call into a no-op rather than unconditionally denying it with the \emph{errno}(3) \textbf{EPERM}. Refer to the explanation of \textbf{chroot} sandbox category in the SANDBOXING section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_oob}\label{traceallow_unsafe_oob}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Allow the \textbf{MSG\_OOB} flag for \emph{send}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2) system calls to send out-of-band data. Refer to the \textbf{Denying MSG\_OOB Flag in send System Calls} subsection of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_open\_kfd}\label{traceallow_unsafe_open_kfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether \emph{open}(2) calls to AMD KFD character devices should be continued in the sandbox process rather than opening them in the Syd emulator thread and sending the file descriptor. The \textbf{/dev/kfd} character device requires per-application access to the GPU device, therefore opening the device in the Syd emulator thread and then continuing the subsequent \emph{ioctl}(2) system calls in the sandbox process is going to return \textbf{EBADF}, i.e.~\textbf{Bad file number}. Until Syd has a way to fully emulate the \emph{ioctl}(2) request space and is able to call the \emph{ioctl}(2) system call directly from Syd emulator threads, this option may be used to access such character devices. \textbf{Setting this option opens} a TOCTOU attack vector, whereby the sandbox process can open an arbitrary file instead of the character device in question! Syd applies the following mitigations to limit the scope of the attack vector:

\begin{itemize}
\item
  Syd \textbf{continues} the system call if and only if \textbf{O\_RDWR} is set in the flags argument.
\item
  Syd does not \textbf{continue} the system call if at least one of the flags \textbf{O\_CREAT}, \textbf{O\_TRUNC} or \textbf{O\_TMPFILE} is set in the flags argument.
\item
  Syd returns \textbf{ENOSYS}, i.e.~\textbf{Function not implemented}, for the \emph{openat2}(2) system call rather than \textbf{continuing} it in the sandbox process to prevent the \textbf{struct open\_how} pointer indirection to bypass the restrictions applied to the flags argument. Refer to the \emph{openat2}(2) manual page for more information.
\item
  This option may be changed at runtime, and it is highly recommended to unset this option using the \emph{syd}(2) virtual system call API right after the character device is opened.
\end{itemize}

\subsection{trace/allow\_unsafe\_open\_path}\label{traceallow_unsafe_open_path}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether the mitigation to turn \textbf{O\_PATH} file descriptors into \textbf{O\_RDONLY} file descriptors for safe emulation should be disabled. With this option, syd continues the \emph{open}(2) system calls with the \textbf{O\_PATH} in the sandbox process which opens a TOCTOU vector.

\subsection{trace/allow\_unsafe\_mkbdev}\label{traceallow_unsafe_mkbdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe block device access should be allowed. When set, Syd does not drop the capability \textbf{CAP\_MKNOD} on startup for itself, but it is still dropped for the sandbox process. This allows:

\begin{itemize}
\item
  block device creation with \emph{mknod}(2).
\item
  open block devices with \emph{open}(2).
\item
  list block devices with \emph{getdents64}(2).
\end{itemize}

\subsection{trace/allow\_unsafe\_mkcdev}\label{traceallow_unsafe_mkcdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe character device creation should be allowed. When set, Syd does not drop the capability \textbf{CAP\_MKNOD} on startup for itself, but it is still dropped for the sandbox process. This allows creation of character devices with \emph{mknod}(2).

\subsection{trace/allow\_unsafe\_stat\_bdev}\label{traceallow_unsafe_stat_bdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether \emph{stat}(2) family calls on block devices should return last access and modification times as-is. Refer to the \textbf{Device} Sidechannel Mitigations section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_stat\_cdev}\label{traceallow_unsafe_stat_cdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether \emph{stat}(2) family calls on character devices should return last access and modification times as-is. Refer to the \textbf{Device} Sidechannel Mitigations section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_notify\_bdev}\label{traceallow_unsafe_notify_bdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether unsafe event generation for \emph{fanotify\_mark}(2) and \emph{inotify\_add\_watch}(2) system calls should be allowed for block devices. Refer to the \textbf{Device Sidechannel Mitigations} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_notify\_cdev}\label{traceallow_unsafe_notify_cdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether unsafe event generation for \emph{fanotify\_mark}(2) and \emph{inotify\_add\_watch}(2) system calls should be allowed for character devices. Refer to the \textbf{Device Sidechannel Mitigations} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_cpu}\label{traceallow_unsafe_cpu}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether CPU emulation system calls should be allowed. By default, as of version 3.22.1, Syd denies the \emph{modify\_ldt}(2), \emph{subpage\_prot}(2), \emph{switch\_endian}(2), \emph{vm86}(2), and \emph{vm86old}(2) system calls, which are associated with CPU emulation functionalities. Enabling this option (trace/allow\_unsafe\_cpu:1) permits these calls, thus relaxing the restriction. This option should be used with caution, as allowing these system calls can introduce potential vulnerabilities by enabling processes to modify CPU state or memory protections. Use this setting only in trusted environments where the execution of these system calls is necessary.

\subsection{trace/allow\_unsafe\_deprecated}\label{traceallow_unsafe_deprecated}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether deprecated system calls such as \emph{remap\_file\_pages}(2), \emph{stime}(2), and \emph{uselib}(2) should be allowed. Refer to the output of the command \textbf{syd-ls deprecated} for the full list of deprecated system calls for your installation.

\subsection{trace/allow\_unsafe\_keyring}\label{traceallow_unsafe_keyring}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the \emph{add\_key}(2), \emph{keyctl}(2), and \emph{request\_key}(2) system calls should be allowed. Enabling this setting permits key management within the sandbox, which can introduce security risks by allowing keyring manipulations. Use only in trusted environments.

\subsection{trace/allow\_unsafe\_pipe}\label{traceallow_unsafe_pipe}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Allow creating notification pipes using the "O\_NOTIFICATION\_PIPE" flag to the \emph{pipe2}(2) system call. See the "Denying O\_NOTIFICATION\_PIPE Flag in pipe2" subsection of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_pkey}\label{traceallow_unsafe_pkey}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether the \emph{pkey\_alloc}(2), \emph{pkey\_free}(2), and \emph{pkey\_mprotect}(2) system calls should be allowed. By default, these calls are denied to enhance security. Setting this option to true enables these system calls, allowing the use of memory protection keys. This option should be used with caution and only in trusted environments where the use of these system calls is necessary.

\subsection{trace/allow\_unsafe\_madvise}\label{traceallow_unsafe_madvise}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether \emph{madvise}(2) system call should NOT be hardened. By default, only a subset of advice are permitted. see \textbf{syd-ls madvise}. Refer to the \textbf{madvise(2) Hardening} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_mbind}\label{traceallow_unsafe_mbind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether the \emph{mbind}(2) system call should be allowed. By default, this call is denied to enhance security, as changing NUMA memory policy and triggering page migration over large address ranges can be abused to create prolonged kernel work and resource pressure, which can serve as a denial-of-service vector. It may also make memory placement more predictable, weakening certain mitigation techniques. Enable only if required for compatibility with applications that need explicit NUMA policy control.

\subsection{trace/allow\_unsafe\_msgsnd}\label{traceallow_unsafe_msgsnd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether the \emph{msgsnd}(2) system call should be allowed. By default, this call is denied to enhance security as the ability of this system call to allocate large, contiguous blocks of memory in the kernel heap is often used to orchestrate kernel heap spraying attacks. See the "Mitigation Against Heap Spraying" section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_page\_cache}\label{traceallow_unsafe_page_cache}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether the system calls \emph{cachestat}(2) and \emph{mincore}(2) should be allowed. By default, these calls are denied to enhance security as it has been documented that they can be misused to perform page-cache attacks. See the "Mitigation against Page Cache Attacks" section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_setsockopt}\label{traceallow_unsafe_setsockopt}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specifies whether \emph{setsockopt}(2) hardening should be disabled. Refer to the "\emph{setsockopt}(2) Hardening" section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_time}\label{traceallow_unsafe_time}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether system calls which adjust the system time are allowed. Note, this also causes Syd to keep the \textbf{CAP\_SYS\_TIME} capability. Use \textbf{syd-ls time} to see the list of system calls allowed by this setting.

\subsection{trace/allow\_unsafe\_uring}\label{traceallow_unsafe_uring}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether system calls of the \emph{io\_uring}(7) interface are allowed. Normally, these are denied because they may be used to bypass path sandboxing. Use \textbf{syd-ls uring} to see the list of system calls allowed by this setting.

\subsection{trace/allow\_unsafe\_xattr}\label{traceallow_unsafe_xattr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether the extended attributes restrictions on \emph{user.syd}, \emph{security}, and \emph{trusted} namespaces should be lifted. If this option is not set only sandbox processes with access to the sandbox lock can view or change these extended attribute namespaces.

\subsection{trace/allow\_unsafe\_caps}\label{traceallow_unsafe_caps}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether Syd should skip dropping Linux capabilities at startup. This setting can be used to construct \emph{privileged} containers and should be used with extreme care.

\subsection{trace/allow\_unsafe\_cap\_fixup}\label{traceallow_unsafe_cap_fixup}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Opt out of hardened UID/capability transitions. When off (default), Syd clears \textbf{SECBIT\_KEEP\_CAPS}, sets \textbf{SECBIT\_NO\_SETUID\_FIXUP}, and applies their lock bits at startup so capabilities are dropped when all UIDs become nonzero and are not implicitly gained or adjusted by later setuid-style UID changes; capability sets then only change via explicit \emph{capset}(2) and \emph{prctl}(2) calls. When on, Syd leaves \textbf{SECBIT\_KEEP\_CAPS} and \textbf{SECBIT\_NO\_SETUID\_FIXUP} (and their locks) as inherited from the parent, preserving the kernel\textquotesingle s traditional "setuid fixup" behavior and any \textbf{PR\_SET\_KEEPCAPS} use by the application (legacy behavior). No-op on kernels that do not support securebits. Refer to the \textbf{Securebits and} Kernel-Assisted Executability section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_env}\label{traceallow_unsafe_env}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe environment variables should be allowed into the environment of the sandbox process. See \textbf{syd-ls env} for the list of unsafe environment variables.

\subsection{trace/allow\_safe\_kcapi}\label{traceallow_safe_kcapi}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether access to the Linux kernel cryptography API (aka: "KCAPI") should be allowed when network sandboxing is on. This option has no effect when network sandboxing is off.

As most things in life, cryptography has good and evil uses: KCAPI is convenient as it may be used to implement cryptography without depending on user-space libraries such as OpenSSL but it may also enable malicious code to efficiently turn itself into ransomware. Adhering to the goal to be secure by default Syd disallows this access by default.

Note, Syd does not hook into \emph{setsockopt}(2) and the "ALG\_SET\_KEY" operation to set the encryption key is directly handled by the host kernel therefore the encryption key is not copied into Syd\textquotesingle s address space.

Note again, Syd hooks into \emph{bind}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2) but \textbf{not} \emph{read}(2), \emph{write}(2), \emph{recv}(2), or \emph{splice}(2). To reduce syscall overhead, user is recommended to use the unhooked system calls when they can to interact with KCAPI.

\subsection{trace/allow\_safe\_syslog}\label{traceallow_safe_syslog}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unprivileged sandbox processes can access Syd\textquotesingle s \emph{syslog}(2) emulation using \emph{dmesg}(8). Unprivileged processes include the set of \emph{all} sandbox processes with the sandbox lock "off", and \emph{all} but the initial sandbox process with the sandbox lock set to "exec". Note, this option has nothing to do with access to the host syslog which is never allowed.

\subsection{trace/allow\_safe\_bind}\label{traceallow_safe_bind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the socket address arguments of successful \emph{bind}(2) calls should be allowed for \emph{connect}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2) system calls.

\textbf{Note}, these addresses are allowed globally and not per-process for usability reasons. Thus, for example, a process which forks to call \emph{bind}(2) will have its address allowed for their parent as well.

\subsection{trace/allow\_unsafe\_bind}\label{traceallow_unsafe_bind}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the Linux capability \textbf{CAP\_NET\_BIND\_SERVICE}, which allows a process to \emph{bind}(2) to ports lower than 1024, should be retained. When this option is set, Syd keeps the capability on startup for itself, but it is still dropped for the sandbox process.

\subsection{trace/allow\_unsafe\_any\_addr}\label{traceallow_unsafe_any_addr}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether connections to wildcard "any" addresses are allowed to cross \emph{bind}(2), \emph{connect}(2), \emph{sendto}(2), \emph{sendmsg}(2), and \emph{sendmmsg}(2) boundaries unchanged: by default (unset/false) Syd rewrites IPv4 0.0.0.0 -\textgreater{} 127.0.0.1 and IPv6 :: -\textgreater{} ::1 at bind/connect to avoid unintentionally exposing services on all interfaces; when set to true, this safety rewrite is disabled and 0.0.0.0/:: are left as-is (use with care).

\subsection{trace/allow\_unsafe\_socket}\label{traceallow_unsafe_socket}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe socket families should be allowed. When set, Syd does not drop the capability \textbf{CAP\_NET\_RAW} on startup for itself, but it is still dropped for the sandbox process. This allows:

\begin{itemize}
\item
  use of RAW and PACKET sockets.
\item
  bind to any address for transparent proxying.
\item
  make use of the \emph{ping}(1) command.
\end{itemize}

\subsection{trace/allow\_unsupp\_socket}\label{traceallow_unsupp_socket}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether unsupported socket families such as netlink sockets should be allowed access when network sandboxing is on. By default Syd allows sandboxed access to unix, ipv4 and ipv6 sockets. This option has no effect when network sandboxing is off.

As of version 3.16.6 Syd allows access to algorithm sockets with the \textbf{trace/allow\_safe\_kcapi} option rather than with this option. Algorithm sockets are used to interact with the Linux kernel cryptography API.

As of version 3.42.0, Transparent Inter-Process Communication (AF\_TIPC) sockets at \emph{socketpair}(2) boundary are only permitted if this option is set to true.

\subsection{trace/allow\_unsafe\_personality}\label{traceallow_unsafe_personality}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether \emph{personality}(2) restrictions should be lifted. See \textbf{syd-ls} personality for the list of allowlisted \emph{personality}(2) personas. See the \textbf{Personality Syscall Restrictions} of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_prctl}\label{traceallow_unsafe_prctl}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether \emph{prctl}(2) restrictions should be lifted. See \textbf{syd-ls prctl} for the list of allowed prctl requests.

\subsection{trace/allow\_unsafe\_prlimit}\label{traceallow_unsafe_prlimit}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether \emph{prlimit}(2) restrictions should be lifted.

\subsection{trace/allow\_unsafe\_mqueue}\label{traceallow_unsafe_mqueue}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe permissions in mode argument of \emph{mq\_open}(2) system call should be permitted. See the \textbf{Shared Memory Permissions} Hardening section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_rseq}\label{traceallow_unsafe_rseq}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe Restartable Sequences with the \emph{rseq}(2) system call should be permitted. See the \textbf{Denying Restartable Sequences} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_shm}\label{traceallow_unsafe_shm}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether unsafe permissions in mode arguments of \emph{shmget}(2), \emph{msgget}(2), and \emph{semget}(2) system calls and the \textbf{IPC\_SET} operation of \emph{shmctl}(2), \emph{msgctl}(2), and \emph{semctl}(2) system calls should be permitted. See the \textbf{Shared Memory Permissions Hardening} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_sysinfo}\label{traceallow_unsafe_sysinfo}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the \emph{sysinfo}(2) randomizer should be disabled at startup. If this option is set at startup the \emph{sysinfo}(2) system call becomes allowed and provides identical info to the files \textbf{/proc/loadavg} and \textbf{/proc/meminfo} which are disabled by default by common profiles such as the \textbf{linux} and \textbf{user} profiles. Notably this mitigation is unset for the \textbf{paludis} profile because leaking this side-channel is irrelevant for package builds.

\subsection{trace/allow\_unsafe\_syslog}\label{traceallow_unsafe_syslog}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the Linux capability \textbf{CAP\_SYSLOG} should be retained. This allows the process to perform privileged \emph{syslog}(2) operations. This is useful when sandboxing a service such as syslogd.

\subsection{trace/allow\_unsafe\_sync}\label{traceallow_unsafe_sync}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the \emph{sync}(2) and \emph{syncfs}(2) system calls should be allowed inside the sandbox. By default these system calls are turned into no-ops to prevent potential local DoS, however it may be useful to disable this restriction in scenarios where sync is actually expected to work such as when sandboxing databases.

\subsection{trace/allow\_unsafe\_memfd}\label{traceallow_unsafe_memfd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

A boolean specifying whether secret memory file descriptors and executable memory file descriptors should be enabled. By default Syd strips the \textbf{MFD\_EXEC} and adds the \textbf{MFD\_NOEXEC\_SEAL} flag to \emph{memfd\_create}(2) flags argument. This ensures the memory file descriptor can never be made executable. The \textbf{MFD\_NOEXEC\_SEAL} flag requires Linux-6.3 or newer therefore on older kernels this option must be enabled to make memory file descriptors work. However, the user should be aware that allowing encrypted memory file descriptors does allow an attacker to bypass Exec, Force and TPE sandboxing and execute denylisted code.

\subsection{trace/allow\_unsafe\_uname}\label{traceallow_unsafe_uname}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

A boolean specifying whether \emph{uname}(2) hardening should be disabled. Refer to the \textbf{Hardened uname(2)} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/allow\_unsafe\_vmsplice}\label{traceallow_unsafe_vmsplice}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether the \emph{vmsplice}(2) system call should be allowed inside the sandbox. By default this system call is not permitted. Refer to the \textbf{Restricting vmsplice System Call} section of the \emph{syd}(7) manual page for more information.

\subsection{trace/deny\_dotdot}\label{tracedeny_dotdot}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether \textbf{..} components should be denied during path resolution for \emph{chdir}(2) and \emph{open}(2) family system calls. This is useful in mitigating path traversal attacks. See \textbf{Path Resolution Restriction For Chdir and Open Calls} of the \emph{syd}(7) manual page for more information.

\subsection{trace/deny\_exec\_elf32}\label{tracedeny_exec_elf32}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Deny the execution of 32-bit ELF binaries.

\subsection{trace/deny\_exec\_elf\_dynamic}\label{tracedeny_exec_elf_dynamic}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Deny the execution of dynamically linked ELF binaries.

\subsection{trace/deny\_exec\_elf\_static}\label{tracedeny_exec_elf_static}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Deny the execution of statically linked ELF binaries.

\subsection{trace/deny\_exec\_script}\label{tracedeny_exec_script}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Deny the execution of scripts (files with \#!\textless interpreter\textgreater{} on first line).

The \emph{execve}(2) TOCTOU mitigations do not cover this option which means \textbf{the functionality is vulnerable to TOCTOU}. This allows an attacker to execute a script whose path is denylisted. This TOCTOU is limited to scripts and requires the interpreter binary to be allowlisted for exec. Hence this vulnerability does not allow an attacker to execute denylisted binaries. This is why the user is recommended to deny the respective interpreter binaries for execution instead for a safe and secure approach.

On Linux-6.14 and newer, kernel-assisted executability provides a safe way to deny execution of scripts in cooperation with enlightened interpreters. Refer to the \textbf{Securebits and Kernel-Assisted} Executability section of the \emph{syd}(7) manual page for more information.

\subsection{trace/deny\_tsc}\label{tracedeny_tsc}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether reading the timestamp counter should be denied. Without an accurate timer, many timing attacks are going to be harder to perform.

\begin{itemize}
\item
  This works on \textbf{x86 only}.
\item
  This breaks time related calls in the \textbf{vDSO}, which can be trivially worked around by writing a \textbf{LD\_PRELOAD} library to call the respective system calls directly. See \textbf{libsydtime}, https://lib.rs/libsydtime, for a reference implementation.
\item
  This has a negative performance impact on programs that rely on \emph{gettimeofday}(2) being a \textbf{vDSO} call.
\end{itemize}

\subsection{trace/exit\_wait\_all}\label{traceexit_wait_all}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
static & \textbf{yes} \\
\end{xltabular}

Specify whether Syd should wait for all processes to exit before exiting. By default, Syd exits with the eldest process and any leftover processes in the background are automatically killed.

\subsection{trace/force\_cloexec}\label{traceforce_cloexec}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether the "O\_CLOEXEC" flag should be enforced for all \emph{creat}(2), \emph{open}(2), \emph{openat}(2), \emph{openat2}(2), \emph{memfd\_create}(2), \emph{socket}(2), \emph{accept}(2), and \emph{accept4}(2) system calls made by the sandbox process. When this feature is enabled, Syd ensures that every file descriptor opened by the sandbox process is automatically set with the "O\_CLOEXEC" flag, which prevents these file descriptors from being inherited by newly executed programs. This measure enhances security by closing file descriptors during \emph{exec}(3) calls, thereby mitigating the risk of file descriptor leakage which could lead to unauthorized access to sensitive files or resources. The feature can be toggled at runtime using Syd\textquotesingle s virtual \emph{stat}(2) API, providing flexible control over the confinement level of sandboxed processes.

\subsection{trace/force\_rand\_fd}\label{traceforce_rand_fd}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether file descriptors returned by all \emph{creat}(2), \emph{open}(2), \emph{openat}(2), \emph{openat2}(2), \emph{memfd\_create}(2), \emph{socket}(2), \emph{accept}(2), and \emph{accept4}(2) system calls made by the sandbox process should be randomized. When this feature is enabled, Syd specifies a random available slot (rather than the lowest-numbered one) to the \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD} operation which is used to install a file descriptor to the sandbox process. Randomizing file descriptor numbers makes it significantly harder for an attacker to predict or deliberately reuse critical descriptors, thereby raising the bar against file-descriptor reuse and collision attacks. Note that enabling this may break programs which rely on the POSIX guarantee that \emph{open}(2) returns the lowest available descriptor. This behavior can be toggled at runtime via Syd\textquotesingle s virtual \emph{stat}(2) API, allowing operators to enable or disable descriptor randomization without restarting or recompiling the sandboxed process. We\textquotesingle re also cooperating with the HardenedBSD project to implement a similar feature in the BSD kernel. Refer to the following link for more information: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/117

This feature uses the \emph{kcmp}(2) system call and requires a Linux kernel configured with the \textbf{CONFIG\_KCMP} option. On a kernel without this option, all system calls that are part of this feature will return \textbf{ENOSYS} (\textbf{Function not implemented}).

As of version 3.38.0, this option is enabled for the \textbf{user} profile.

\subsection{trace/force\_ro\_open}\label{traceforce_ro_open}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether creating and writing \emph{open}(2) family system calls should be denied regardless of the path argument. This option is restricted to \emph{creat}(2), \emph{open}(2), \emph{openat}(2), and \emph{openat2}(2) system calls and provided for convenience. To stop all write-like access completely, including e.g.~\emph{mkdir}(2), \emph{truncate}(2) etc., use the \textbf{readonly} profile instead which uses the rule "deny/wrset/***" to prevent all write-like access. See "PROFILES" section of the \emph{syd}(5) manual page for more information.

\subsection{trace/force\_local\_net}\label{traceforce_local_net}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Force local networking, rewrites all addresses to loopback for bind/connect.

\subsection{trace/force\_no\_symlinks}\label{traceforce_no_symlinks}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether path resolution for the \emph{open}(2) family is forced to use the \textbf{RESOLVE\_NO\_SYMLINKS} resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the \emph{open}(2) family. When enabled, traversal of symbolic links is disallowed during lookup; all pathname components must be non-symlink entries. This affects only the pathname resolution step and does not modify other flags or access checks.

\subsection{trace/force\_no\_magiclinks}\label{traceforce_no_magiclinks}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether path resolution for the \emph{open}(2) family is forced to use the \textbf{RESOLVE\_NO\_MAGICLINKS} resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the \emph{open}(2) family. When enabled, traversal of magic links (such as special \emph{proc}(5) links that do not behave like regular symbolic links) is disallowed during lookup; all pathname components must be non-magiclink entries. This affects only the pathname resolution step and does not modify other flags or access checks.

\subsection{trace/force\_no\_xdev}\label{traceforce_no_xdev}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
\end{xltabular}

Specify whether path resolution for the \emph{open}(2) family is forced to use the \textbf{RESOLVE\_NO\_XDEV} resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the \emph{open}(2) family. When enabled, traversal of mount points, including bind mounts, is disallowed during lookup; the path must reside on the same mount as the directory referenced by dirfd (or the current working directory when dirfd == AT\_FDCWD). This affects only the pathname resolution step and does not modify other flags or access checks.

\subsection{trace/force\_umask}\label{traceforce_umask}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{octal} \\
static & \textbf{yes} \\
\end{xltabular}

Specify an umask mode to force. To unset a previously configured force umask use -1 as the value. As of version 3.15.6, \emph{chmod}(2) family system calls also honour force umask for added hardening. As of version 3.22.1, this setting does not apply to directory creation for \emph{mkdir}(2) and \emph{mkdirat}(2) system calls. As of version 3.26.2, this setting does not apply to UNIX domain socket creation for \emph{bind}(2) system calls, and non-regular file creation for \emph{mknod}(2) and \emph{mknodat}(2) system calls.

\subsection{trace/memory\_access}\label{tracememory_access}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{integer} \\
default & \textbf{2} \\
static & \textbf{yes} \\
\end{xltabular}

Set mode on cross memory attach and \emph{proc\_pid\_mem}(5) usage. Cross memory attach is done using the system calls \emph{process\_vm\_readv}(2) and \emph{process\_vm\_writev}(2) which requires a Linux kernel configured with the \textbf{CONFIG\_CROSS\_MEMORY\_ATTACH} option enabled. Supported modes are:

\begin{itemize}
\item
  \textbf{0}: Use cross memory attach if available, use \emph{proc\_pid\_mem}(5) otherwise.
\item
  \textbf{1}: Use \emph{/proc/pid/mem}(5) unconditionally.
\item
  \textbf{2}: Use cross memory attach unconditionally.
\end{itemize}

From a security point of view, these two modes of access have an important distinction where cross memory attach honours page protections of the target process, however using \emph{/proc/pid/mem}(5) does not. This makes direct \emph{proc\_pid\_mem}(5) access dangerous in that a Syd deputy process may be confused into corrupting or even controlling memory regions the sandbox process otherwise does not have direct access to. This is the main reason why mode \textbf{2} has been added as of version 3.32.6 as a secure default alternative to the previous default mode \textbf{0} whose fallback behaviour can be unpredictable and is against the idea of secure defaults. Therefore as of version 3.32.6, the user is asked to change the memory access mode explicitly if their Linux kernel is not configured with the \textbf{CONFIG\_CROSS\_MEMORY\_ATTACH} option. You may also use the environment variables \textbf{SYD\_NO\_CROSS\_MEMORY\_ATTACH} and \textbf{SYD\_PROC\_PID\_MEM\_FALLBACK}, see the "ENVIRONMENT" section of the \emph{syd}(1) manual page for more information. For further information about the security impact of \emph{proc\_pid\_mem}(5) writes refer to the following links:

\begin{itemize}
\item
  https://lore.kernel.org/lkml/202403011451.C236A38@keescook/T/
\item
  https://lwn.net/Articles/476947/
\item
  https://issues.chromium.org/issues/40089045
\end{itemize}

{\scriptsize \begin{verbatim}
; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:0 true
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- -----------------
100.00    0.000031          10         3           process_vm_readv
------ ----------- ----------- --------- --------- -----------------
100.00    0.000031          10         3           total
; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:1 true
; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:2 true
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- -----------------
100.00    0.000008           2         3           process_vm_readv
------ ----------- ----------- --------- --------- -----------------
100.00    0.000008           2         3           total
\end{verbatim}}

\subsection{trace/sync\_seccomp}\label{tracesync_seccomp}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
type & \textbf{boolean} \\
default & \textbf{true} \\
static & \textbf{yes} \\
\end{xltabular}

Use synchronous mode for seccomp-notify so each Syd syscall handler thread wakes up on the same CPU as the respective sandbox thread that executed the system call. This option makes no functional difference and typically helps with performance. Use \emph{perf}(1) to benchmark seccomp synchronous mode on your system:

{\scriptsize \begin{verbatim}
; perf bench sched seccomp-notify
# Running 'sched/seccomp-notify' benchmark:
# Executed 1000000 system calls
Total time: 6.736 [sec]
6.736395 usecs/op
148447 ops/sec
; perf bench sched seccomp-notify --sync-mode
# Running 'sched/seccomp-notify' benchmark:
# Executed 1000000 system calls
Total time: 4.188 [sec]
4.188846 usecs/op
238729 ops/sec
\end{verbatim}}

\section{PATTERN MATCHING}\label{pattern-matching}

Syd uses shell-style pattern matching for allowlists and filters. The matching code is based on \emph{rsync}(1). See the \textbf{PATTERN MATCHING RULES} section of the \emph{rsync}(1) manual for more information. Notably, Syd applies the \textbf{triple star} extension to patterns, i.e.~\textbf{/dev/***} matches both \textbf{/dev} and any file recursively under \textbf{/dev}. Note also, Syd gets patterns from multiple sources: a configuration file, a profile, the \textbf{-m} command line switch, or a \emph{stat}(1) call with \textbf{/dev/syd} prefix. There is no precedence between different sources. All patterns in a list are compiled together in an array and pattern matching during access control happens in a single step where \textbf{the last} matching pattern decides the outcome.

\section{ADDRESS MATCHING}\label{address-matching}

Syd has a simple address scheme to match network addresses. The addresses can either be a \textbf{glob} pattern to match \textbf{UNIX} and \textbf{abstract UNIX} socket addresses, or \textbf{IP CIDR} followed by a port range to match \textbf{IPv4} and \textbf{IPv6} addresses. Port range can either be a single port or a closed range in format \textbf{port1-port2}. The address and the port range must be split by the character \textbf{!}. The precedence logic is same as \textbf{Pattern Matching} where \textbf{the last matching pattern decides the} outcome.

In addition there are some \textbf{aliases}, you may use instead of specifying an address:

\begin{itemize}
\item
  \textbf{any}: Expanded to \textbf{any4} + \textbf{any6}.
\item
  \textbf{any4}: Expanded to \textbf{0.0.0.0/0} which matches the whole Ipv4 address space.
\item
  \textbf{any6}: Expanded to \textbf{::/0} which matches the whole Ipv6 address space.
\item
  \textbf{loopback}: Expanded to \textbf{loopback4} + \textbf{loopback6}.
\item
  \textbf{loopback4}: Expanded to \textbf{127.0.0.0/8}
\item
  \textbf{loopback6}: Expanded to \textbf{::1/128}
\item
  \textbf{linklocal}: Expanded to \textbf{linklocal4} + \textbf{linklocal6}.
\item
  \textbf{linklocal4}: Expanded to \textbf{169.254.0.0/16}
\item
  \textbf{linklocal6}: Expanded to \textbf{fe80::/10}
\item
  \textbf{local}: Expanded to \textbf{local4} + \textbf{local6}.
\item
  \textbf{local4}: Expanded to four addresses as defined in \textbf{RFC1918}: - \textbf{127.0.0.0/8} - \textbf{10.0.0.0/8} - \textbf{172.16.0.0/12} - \textbf{192.168.0.0/16}
\item
  \textbf{local6}: Expanded to four addresses: - \textbf{::1/128} - \textbf{fe80::/7} - \textbf{fc00::/7} - \textbf{fec0::/7}
\end{itemize}

\section{SECURITY}\label{security-2}

The interface is only available if the sandbox lock is not set for the calling process. Similarly, command-line option parsing and configuration file parsing stops once a \textbf{lock:on} clause is executed.

\section{RETURN VALUE}\label{return-value}

For \emph{stat}(2) calls, on success, zero is returned. On error, -1 is returned, and errno is set to indicate the error.

For \emph{open}(2) calls, on success the new file descriptor (a nonnegative integer) is returned. The file descriptor is randomized. On error, -1 is returned and errno is set to indicate the error.

On a successful call the \emph{stat}(2) buffer has the following fields masked, other fields are equivalent to the character device \emph{/dev/null}:

\begin{itemize}
\item
  Inode is derived from the first 16 hex characters of \textbf{SYD\_ID}, converted to u64 using native endianness; returns 0 if invalid or not set. Refer to the ENVIRONMENT section of the \emph{syd}(1) manual page for more information on how \textbf{SYD\_ID} is generated.
\item
  Mode field represents the file type (character device) and permissions, with special bits set as follows: sticky bit for \emph{unshare/mount:1}, SUID bit for \emph{unshare/user:1}, SGID bit for \emph{unshare/net:1}, user read/write/exec bits for Read, Write and Exec sandboxing, group read bit for Stat sandboxing, group write bit for Proxy sandboxing, group exec bit for TPE sandboxing, world read bit for Lock sandboxing, world write bit for Crypt sandboxing, and world exec bit for Force sandboxing.
\item
  Nlink field represents the lower 32 bits of sandboxing capabilities, encoded as: \emph{lock}, \emph{walk}, \emph{stat}, \emph{read}, \emph{write}, \emph{exec}, \emph{ioctl}, \emph{create}, \emph{delete}, \emph{rename}, \emph{symlink}, \emph{truncate}, \emph{chdir}, \emph{readdir}, \emph{mkdir}, \emph{rmdir}, \emph{chown}, \emph{chgrp}, \emph{chmod}, \emph{chattr}, \emph{chroot}, \emph{utime}, \emph{mkbdev}, \emph{mkcdev}, \emph{mkfifo}, \emph{mktemp}, \emph{net/bind}, \emph{net/connect}, \emph{net/sendfd}, \emph{fs}, \emph{proxy}, and \emph{pty}.
\item
  Device type represents \emph{syd}(2) API version (major, minor)
\item
  Access, creation, and modification times are non-zero constants.
\end{itemize}

\section{ERRORS}\label{errors}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{EBUSY} & Attempted to edit a setting at runtime that must be configured at startup \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{EEXIST} & Attempted to add an UID/GID transition for SafeSetID but a transition with the same source UID/GID exists. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{EINVAL} & Sandbox command is syntactically incorrect. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{ENOENT} & Result of the given sandbox query is false (e.g.~\textbf{test -c /dev/syd/sandbox/stat?}). \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{ENOENT} & Sandbox lock is on, no commands are allowed. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{ENOKEY} & Crypt sandboxing is on but no encryption key was supplied. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{EKEYREVOKED} & Session keyring is not linked to the user keyring for Crypt sandboxing. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{ENODATA} & SafeSetID is on but no UID/GID transits were defined for the current user/group. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{EOPNOTSUPP} & Sandbox command is not supported. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-2}

\emph{syd}(1), \emph{syd}(5), \emph{syd}(7), \emph{syd-ls}(1) \emph{open}(2), \emph{stat}(2), \emph{perf}(1), \emph{pledge}(2), \emph{ptrace}(2), \emph{seccomp}(2), \emph{strace}(1), \emph{glob}(3p), \emph{io\_uring}(7), \emph{gdb}(1), \emph{valgrind}(1), \emph{wordexp}(3)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org
\item
  \textbf{libsyd} homepage: https://libsyd.exherbo.org
\item
  \textbf{gosyd} homepage: https://gosyd.exherbo.org
\item
  \textbf{plsyd} homepage: https://plsyd.exherbo.org
\item
  \textbf{pysyd} homepage: https://pysyd.exherbo.org
\item
  \textbf{rbsyd} homepage: https://rbsyd.exherbo.org
\item
  \textbf{syd.el} homepage: https://sydel.exherbo.org
\item
  \textbf{libsydtime} homepage: https://lib.rs/libsydtime
\item
  \textbf{LandLock} homepage: https://landlock.io/
\item
  \textbf{vDSO} wiki: https://en.wikipedia.org/wiki/VDSO
\item
  \textbf{parse-size} documentation: https://docs.rs/parse-size/1.0.0/parse\_size/
\item
  \textbf{ipnetwork} documentation: https://docs.rs/ipnetwork
\end{itemize}

\section{AUTHORS}\label{authors-3}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd(1)}\label{syd1}

\section{NAME}\label{name-4}

\textbf{syd} - Rock solid application kernel

\section{SYNOPSIS}\label{synopsis-2}

\textbf{syd} {[}-acefhlmpqtxEPV{]} {[}-\/-{]} \{command {[}arg...{]}\}

\textbf{syd} -\/-api

\textbf{syd} -\/-check

\textbf{syd} -\/-el

\textbf{syd} -\/-sh

\section{DESCRIPTION}\label{description-2}

Syd is a utility leveraging the \emph{seccomp}(2) system call for sandboxing processes on Linux systems version 5.19 or later. It enables fine-grained control over a process\textquotesingle s filesystem and network access \emph{without requiring root privileges}. Syd is designed for ease of use across a wide array of architectures, including \textbf{x86}, \textbf{x86\_64}, \textbf{x32}, \textbf{armv7}, \textbf{aarch64}, \textbf{loongarch64}, \textbf{mips}, \textbf{mips64}, \textbf{mips64el}, \textbf{ppc}, \textbf{ppc64}, \textbf{ppc64le}, \textbf{riscv64}, and \textbf{s390x} embodying the principle of providing simple, flexible, and robust access control to Linux users.

The core functionality of Syd revolves around restricting a process\textquotesingle s resource access through several mechanisms:

\begin{itemize}
\item
  \textbf{Bind Mounts}: Utilized within a mount namespace to enforce restrictions at the \textbf{Virtual File System (VFS)} level, such as \textbf{read-only}, \textbf{nodev}, \textbf{noexec}, \textbf{nosuid}, and \textbf{nosymfollow}.
\item
  \textbf{Landlock}: Employs read-only and read-write path restrictions at the kernel level.
\item
  \textbf{seccomp-bpf}: Applies Secure Computing user filters for kernel-space sandboxing.
\item
  \textbf{seccomp-notify}: Enables sandboxing in kernel space with user space fallback for dereferencing pointer arguments in system calls, including pathnames and network addresses. Access checks utilize UNIX shell-style patterns and CIDR notation, defaulting to denying system calls with \textbf{EACCES} while attempting to emulate successful calls to mitigate \textbf{Time-of-Check to Time-of-Use (TOCTOU)} attack vectors.
\end{itemize}

Prerequisites for Syd include a Linux kernel supporting \emph{pidfd\_getfd}(2) and \emph{pidfd\_send\_signal}(2) system calls, \textbf{SECCOMP\_USER\_NOTIF\_FLAG\_CONTINUE} operation in the Secure Computing facility, and preferably the \textbf{CONFIG\_CROSS\_MEMORY\_ATTACH} kernel option. For syscall emulation, Syd uses the seccomp operation \textbf{SECCOMP\_IOCTL\_NOTIF\_ADDFD}. Moreover Syd sets the \textbf{SECCOMP\_FILTER\_FLAG\_WAIT\_KILLABLE\_RECV} flag to correctly handle interrupts during tracing. While \emph{Linux version 5.19 or later is required}, for Landlock support Syd requires a kernel configured with the option \textbf{CONFIG\_LSM\_LANDLOCK} supporting \emph{Landlock ABI version 3}, with \emph{syd-lock}(1) available as a helper program to verify kernel support. Linux kernel options \textbf{CONFIG\_KCMP} and \textbf{CONFIG\_UNIX\_DIAG} are recommended.

Syd is committed to maintaining rigorous security standards by strictly delimiting the resource space accessible to sandboxed processes. In the \textbf{SECURITY} section of the \emph{syd}(7) manual page, a detailed enumeration of the security hardening measures implemented by Syd is provided, along with optional configurations to relax certain restrictions. This flexibility allows for the accommodation of a diverse range of processes within the sandbox environment.

The approach to security within Syd is methodically designed to balance robust protection with operational flexibility, ensuring that users have the ability to fine-tune the sandboxing mechanisms to meet specific requirements. By offering insights into the hardening techniques and customization options, Syd empowers users to navigate the trade-offs between security and functionality effectively.

\section{OPTIONS}\label{options}

The following options are understood:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h}, \textbf{-\/-help} & Show usage and exit. \\
\textbf{-V}, \textbf{-\/-version} & Show version and exit. \\
\textbf{-C}, \textbf{-\/-check} & Print sandboxing support information about the current system and exit. \\
\textbf{-v}, \textbf{-\/-verbose} & Increase verbosity, equivalent to incrementing \textbf{log/verbose} by one. \\
\textbf{-c} & Login shell compatibility \\
& Causes command to be executed under a shell with the \textbf{user} profile. \\
& The shell to execute is \emph{/bin/sh} by default. \\
& Use the environment variable \textbf{SYD\_SHELL} to override. \\
\textbf{-f} & Login shell compatibility. \\
& Causes Syd to parse the \textbf{user} profile on startup. \\
\textbf{-l}, \textbf{-\/-login} & Login shell compatibility \\
& Causes Syd to parse the \textbf{user} profile on startup. \\
\textbf{-q} & Enable quick boot mode for faster startup times. \\
& This must be passed as the first option or it will be ignored. \\
& See the explanation of the environment variable \textbf{SYD\_QUICK\_BOOT} for the safety of this option. \\
\textbf{-x} & Enable \textbf{trace} aka "dry run" mode. \\
& In this mode Syd will allow system calls even if they raise access violations. \\
& This mode with extended logging can be used to build sandboxing profiles in an automated way. \\
& See \emph{pandora}(1) which is a tool that uses Syd\textquotesingle s trace mode to automatically generate sandbox profiles. \\
\textbf{-m config} & Configure sandbox during init, may be repeated. \\
\textbf{-p name} & Use a sandbox profile during init, may be repeated. \\
\textbf{-P path} & Run a configuration file during init, may be repeated. \\
\textbf{-a alias} & Set alias of the command. Passed as \textbf{argv{[}0{]}} to the program. \\
\textbf{-e} & Use \textbf{-e var=val} to put var=val in the environment for command, may be repeated. \\
& Use \textbf{-e var} to remove var from the environment for command, may be repeated. \\
& Use \textbf{-e var=} to pass-through an unsafe environment variable, may be repeated. \\
\textbf{-t timeout} & Specify sandbox timeout in human readable format. \\
& Equivalent to \textbf{timeout} option, refer to \emph{syd}(2) for more information. \\
\textbf{-E mode} & Export secure computing rules with the given format to standard output and exit. \\
& Mode must be one of \textbf{bpf} or \textbf{pfc}: \\
& \textbf{bpf}, aka \textbf{Berkeley Packet Filter} is a binary, machine readable format, whereas \\
& \textbf{pfc}, aka \textbf{Pseudo Filter Code} is a textual, human readable format. \\
\textbf{-\/-api} & Output \emph{syd}(2) API specification in JSON format. \\
& This specification is intended to ease generation of language bindings. \\
& This specification is also available via the magic path \textbf{/dev/syd}. \\
\textbf{-\/-el} & Output \textbf{syd.el} which is the Emacs Lisp implementation of Syd \emph{stat}(2) interface. \\
& This file is also available via the magic path \textbf{/dev/syd.el}. \\
\textbf{-\/-sh} & Output a shell script which defines the \textbf{esyd} helper function. \\
& This file is also available via the magic path \textbf{/dev/syd.sh}. \\
& Works with POSIX sh, bash and zsh. \\
& You may use \textbf{eval "\$(syd -\/-sh)"} in your shell init file. \\
\end{xltabular}

\section{INVOCATION}\label{invocation}

Syd executes a command with the specified arguments under a sandbox and exits with the same status. The sandbox may be constructed by command-line arguments and configuration files. \emph{syd}(2) API is available for dynamic configuration if the sandbox lock allows it. An IPC socket may be configured with the \emph{ipc} command to configure Syd through a UNIX socket. Refer to the \emph{syd}(2) manual page for more information.

\section{ENVIRONMENT}\label{environment-1}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{SYD\_ID} & Specify sandbox id as 128 lowercase hexadecimal characters. \\
& The first 32 characters may not be all zeroes. \\
& If this variable is not set by the user at startup, \\
& Syd generates it by hashing AT\_RANDOM bytes with SHA3-512. \\
& Syd panics if user passes the value in incorrect format. \\
\textbf{SYD\_IPC} & Specify UNIX socket address for runtime configuration. \\
& Equivalent to the \textbf{ipc} command, see the \emph{syd}(2) manual page. \\
& \textbf{ipc} command has precedence over this environment variable. \\
\textbf{SYD\_LOG} & Set log level to \textbf{emerg}, \textbf{alert}, \textbf{crit}, \textbf{error}, \textbf{warn}, \textbf{notice}, \textbf{info} or \textbf{debug}. \\
\textbf{SYD\_LOG\_BUF\_LEN} & Set \emph{syslog}(2) ring buffer capacity. \\
& By default, the ring buffer is allocated on the stack with an architecture-dependent size. \\
& Setting this variable makes Syd allocate the ring buffer on the heap with the user-specified size. \\
& Note, the value is parsed using the \textbf{parse-size} crate. \\
& Refer to their documentation for information on formatting. \\
\textbf{SYD\_LOG\_FD} & Set log file descriptor, defaults to \emph{stderr}(3). \\
& Negative values are permitted as a shorthand to disable logging. \\
& Positive values must be valid FDs or Syd will exit with \textbf{EBADF}. \\
\textbf{SYD\_PDS} & Set parent-death signal using signal name or number. \\
\textbf{SYD\_PID\_FN} & Set pid filename, makes Syd write its process ID to this file at startup. \\
& The file must not exist and is going to be created with user-only read permissions. \\
\textbf{SYD\_NPROC} & Set the number of core syscall handler threads, defaults to the number of CPUs. \\
& The number must be at least 1. \\
\textbf{SYD\_NPROC\_MAX} & Set the number of maximum syscall handler threads, defaults to usize::MAX. \\
& The number must be greater than \textbf{SYD\_NPROC}. \\
\textbf{SYD\_SHELL} & Pick the shell to spawn when invoked as a login shell, defaults to \textbf{/bin/sh}. \\
\textbf{SYD\_DUMP\_SCMP} & Export secure computing rules with the given format, equivalent to the \textbf{-E} option. \\
\textbf{SYD\_SKIP\_SCMP} & Skip \emph{seccomp}(2) confinement of per-Syd threads. \\
& This is \textbf{unsafe} and should only used for profiling. \\
& Syd honours \textbf{RUST\_BACKTRACE} environment variable when this is set. \\
\textbf{SYD\_FORCE\_NO\_SYMLINKS} & Force \textbf{RESOLVE\_NO\_SYMLINKS} resolve flag at \emph{open}(2) boundary. \\
& Equivalent to \textbf{trace/force\_no\_symlinks:1}. \\
\textbf{SYD\_FORCE\_NO\_MAGICLINKS} & Force \textbf{RESOLVE\_NO\_MAGICLINKS} resolve flag at \emph{open}(2) boundary. \\
& Equivalent to \textbf{trace/force\_no\_magiclinks:1}. \\
\textbf{SYD\_FORCE\_NO\_XDEV} & Force \textbf{RESOLVE\_NO\_XDEV} resolve flag at \emph{open}(2) boundary. \\
& Equivalent to \textbf{trace/force\_no\_xdev:1}. \\
\textbf{SYD\_FORCE\_CLOEXEC} & Force close-on-exec for file descriptors. \\
& Equivalent to \textbf{trace/force\_cloexec:1}. \\
\textbf{SYD\_FORCE\_RAND\_FD} & Use randomized file descriptors to harden against fd reuse. \\
& Equivalent to \textbf{trace/force\_rand\_fd:1}. \\
\textbf{SYD\_FORCE\_RO\_OPEN} & Reject creating and writing \emph{open}(2) calls. \\
& Equivalent to \textbf{trace/force\_ro\_open:1}. \\
\textbf{SYD\_FORCE\_LOCAL\_NET} & Force local networking, rewrites all addresses to loopback for bind/connect. \\
& Equivalent to \textbf{trace/force\_local\_net:1}. \\
\textbf{SYD\_FORCE\_TTY} & Force TTY output which is pretty-printed JSON. \\
\textbf{SYD\_QUIET\_TTY} & Force quiet TTY output which is line-oriented JSON. \\
\textbf{SYD\_PROXY\_HOST} & Override the default value of \textbf{proxy/ext/host}, \\
& If the value is a hostname and not an IP address, \\
& Syd resolves this hostname at startup and selects a response IP randomly. \\
\textbf{SYD\_PROXY\_PORT} & Override the default value of \textbf{proxy/ext/port}. \\
\textbf{SYD\_PROXY\_UNIX} & Set the default value for \textbf{proxy/ext/unix} which overrides \textbf{proxy/ext/host}. \\
\textbf{SYD\_QUICK\_BOOT} & Enable quick boot mode, this makes Syd startup noticeably faster: \\
& However, quick boot removes a layer of defense against some container breaks! \\
& Use this if you frequently re-execute \emph{syd}(1) or \emph{syd-oci}(1), \\
& as Exherbo Linux does during \emph{cave-generate-metadata}(1). \\
\textbf{SYD\_NO\_CROSS\_MEMORY\_ATTACH} & Disable cross memory attach and use \emph{proc\_pid\_mem}(5) unconditionally. \\
\textbf{SYD\_PROC\_PID\_MEM\_FALLBACK} & By default, Syd uses cross memory attach unconditionally. \\
& Setting this variable causes Syd to fall back to \emph{proc\_pid\_mem}(5) automatically, \\
& if \emph{process\_vm\_readv}(2) or \emph{process\_vm\_writev}(2) fails with \textbf{ENOSYS}, \\
& which indicates kernel support is missing for these system calls. \\
& The variable \textbf{SYD\_NO\_CROSS\_MEMORY\_ATTACH} has precedence over this variable. \\
\textbf{SYD\_ASSUME\_KERNEL} & Override \emph{uname}(2) to get host Linux kernel version used for feature detection. \\
& Syd reports the major and minor kernel version at \emph{uname}(2) boundary within the sandbox. \\
& The micro version is randomized per-Syd run to prevent information leaks. \\
\textbf{SYD\_PALUDIS\_LPATH} & Override \emph{sandbox/lpath} option for the \emph{paludis} profile, defaults to off. \\
\textbf{SYD\_PALUDIS\_IOCTL} & Override \emph{sandbox/ioctl} option for the \emph{paludis} profile, defaults to off. \\
\textbf{SYD\_USER\_LPATH} & Override \emph{sandbox/lpath} option for the \emph{user} profile, defaults to on. \\
\textbf{CARGO\_BIN\_EXE\_syd-pty} & Path to the \emph{syd-pty}(1) utility. Default is to search \textbf{PATH}. \\
\textbf{CARGO\_BIN\_EXE\_syd-tor} & Path to the \emph{syd-tor}(1) utility. Default is to search \textbf{PATH}. \\
\end{xltabular}

\section{LOGGING}\label{logging}

There\textquotesingle re eight log levels: emerg, alert, crit, error, warn, notice, info, and debug. Log level may be set with the \textbf{SYD\_LOG} environment variable. Logs go to standard error unless a file descriptor is specified with the environment variable \textbf{SYD\_LOG\_FD}. The messages of severity warn and above are also sent to \emph{syslog}(3) unless the environment variable \textbf{SYD\_NO\_SYSLOG} is set.

Syd logs in JSON lines. Below is a list of some of the commonly used keys and their meanings:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{KEY} & \textbf{DESCRIPTION} \\
\textbf{id} & Sandbox ID as 128 lowercase hexadecimal characters. \\
\textbf{ctx} & Context of the log entry, e.g. \textbf{access}, \textbf{safesetid}, \textbf{segvguard} etc. \\
\textbf{cap} & Sandbox capability \\
\textbf{act} & Sandbox action: \textbf{Allow}, \textbf{Warn}, \textbf{Deny}, \textbf{Panic}, \textbf{Stop}, \textbf{Abort}, \textbf{Kill} or \textbf{Exit} \\
\textbf{pid} & Process ID \\
\textbf{path} & Path argument of the syscall \\
\textbf{addr} & Network address argument of the syscall, e.g.~\textbf{127.0.0.1!22} \\
\textbf{unix} & UNIX socket address argument of the syscall \\
\textbf{ipv} & IP version of the network address in the \textbf{addr} field (4 or 6) \\
\textbf{abs} & True if the socket address in the \textbf{unix} field is an abstract UNIX socket \\
\textbf{sys} & Name of the syscall \\
\textbf{arch} & Architecture of the syscall \\
\textbf{args} & Arguments of the syscalll \\
\textbf{src} & Origin of the syscall in format \textbf{path+offset} \\
& Use, e.g.~\textbf{objdump -D path \textbar{} grep offset} to display the syscall instruction \\
\textbf{cmd} & Process name, or command line if log output is a TTY or \textbf{log} feature is enabled \\
\textbf{cwd} & Current working directory of the process \\
\textbf{uid} & User ID \\
\textbf{time} & Timestamp in ISO8601-compatible format, currently \textbf{YYYYMMDDThhmmssZ} \\
& Time format may change but it will always remain ISO8601-compatible. \\
& Formatting errors fallback to printing the timestamp as an integer. \\
\textbf{err} & Error information \\
\textbf{msg} & Miscellaneous informational messages, mostly used with the \textbf{info} log level \\
\textbf{tip} & Informational messages on how to configure the sandbox \\
\end{xltabular}

\section{EXIT CODES}\label{exit-codes}

Syd exits with the same exit code as the sandbox process itself. If the sandbox process exits with a signal, Syd exits with 128 plus the value of the signal. In case there was an error in spawning or waiting for the sandbox process, Syd exits with \textbf{errno} indicating the error condition. E.g. \textbf{syd} true returns \textbf{0}, \textbf{syd false} returns \textbf{1}, and \textbf{syd -\/- syd true} returns \textbf{16} which stands for \textbf{EBUSY} which means \textbf{Device or resource busy} indicating there is already a secure computing filter loaded. Syd exits with 124 if sandbox timeout is exceeded.

\section{BENCHMARKS}\label{benchmarks}

The table below lists the benchmark runs we ran for Syd:

\begin{xltabular}[l]{\linewidth}{@{} lX X @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
1: compile kernel & sydbox-\{1,3\} & https://gitlab.exherbo.org/-/snippets/2534 \\
2: compile kernel & sydbox-\{1,3\} & https://gitlab.exherbo.org/-/snippets/2536 \\
3: unpack compressed tarball & sydbox-\{1,3\}, Gentoo sandbox & https://gitlab.exherbo.org/-/snippets/2537 \\
4: compile kernel & sydbox-\{1,3\}, Gentoo sandbox & https://gitlab.exherbo.org/-/snippets/2594 \\
5: compile kernel in a Podman container & syd-oci, crun, runc, youki, gvisor & https://gitlab.exherbo.org/-/snippets/2613 \\
6: compile kernel in a Podman container & syd-oci, crun, runc, youki, gvisor & https://gitlab.exherbo.org/-/snippets/2622 \\
7: run sqlite-bench & no-syd, syd, syd+crypt & https://gitlab.exherbo.org/-/snippets/2758 \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-3}

\emph{syd}(2), \emph{syd}(5), \emph{syd}(7), \emph{syd-lock}(1), \emph{syd-ls}(1)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\item
  \textbf{libsyd} homepage: https://libsyd.exherbo.org/
\item
  \textbf{pandora} homepage: https://lib.rs/pandora\_box
\item
  \textbf{paludis} homepage: http://paludis.exherbo.org/
\item
  \textbf{Landlock} homepage: https://landlock.io
\item
  \textbf{Path} wiki: https://en.wikipedia.org/wiki/Path\_(computing)
\item
  \textbf{Unix domain socket} wiki: https://en.wikipedia.org/wiki/Unix\_domain\_socket
\item
  \textbf{IPv4} wiki: https://en.wikipedia.org/wiki/IPv4
\item
  \textbf{IPv6} wiki: https://en.wikipedia.org/wiki/IPv6
\item
  \textbf{TOCTOU} wiki: https://en.wikipedia.org/wiki/Time-of-check\_to\_time-of-use
\item
  \textbf{VFS} wiki: https://en.wikipedia.org/wiki/Virtual\_file\_system
\item
  \textbf{ipnetwork} documentation: https://docs.rs/ipnetwork
\item
  \textbf{Enabling Logging}: https://docs.rs/env\_logger/latest/env\_logger/\#enabling-logging
\end{itemize}

\section{AUTHORS}\label{authors-4}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-aes(1)}\label{syd-aes1}

\section{NAME}\label{name-5}

\textbf{syd-aes} - AES-CTR encryption and decryption utility

\section{SYNOPSIS}\label{synopsis-3}

\textbf{syd-aes} \emph{{[}-hv{]}} \emph{-e\textbar-d} \emph{-k \textless key-serial\textgreater{}} \emph{-i \textless iv-hex\textgreater{}}

\section{DESCRIPTION}\label{description-3}

The \textbf{syd-aes} utility uses the Linux Kernel Cryptography API to encrypt and decrypt data using AES-CTR mode using \emph{keyrings}(7) to select the encryption/decryption key to use without copying key material into userspace. It supports both encryption and decryption operations, with the key serial provided as a 32-bit ID and IV provided as a hexadecimal string. Given data from standard input, \textbf{syd-aes} performs the specified operation and outputs the result to standard output. \textbf{syd-aes} uses pipes and \emph{splice}(2) to transfer data using zero-copy, and therefore able to encrypt/decrypt files of arbitrary size.

\section{OPTIONS}\label{options-1}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-v} & Enable verbose mode. If standard error is a terminal, print progress updates periodically, similar to \textbf{dd}(1). \\
\textbf{-e} & Encrypt the input data. \\
\textbf{-d} & Decrypt the input data. \\
\textbf{-k \textless key-serial\textgreater{}} & Key serial ID (32-bit integer). \\
& The kernel key that \textbf{syd-aes} (via ALG\_SET\_KEY\_BY\_KEY\_SERIAL) will read must grant the caller \\
& \textbf{search} permission -\/- i.e.~have the KEY\_(POS\textbar USR\textbar GRP\textbar OTH)\_SEARCH permission bit(s) set \\
& so the kernel can locate and copy the key data into the crypto API; \\
& otherwise the operation will be denied (EPERM: "Operation not permitted"). \\
\textbf{-i \textless iv\textgreater{}} & Hex-encoded IV (128 bits). \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-4}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-key}(1), \emph{splice}(2), \emph{keyrings}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-5}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-asm(1)}\label{syd-asm1}

\section{NAME}\label{name-6}

\textbf{syd-asm} - Disassemble raw CPU instructions from standard input

\section{SYNOPSIS}\label{synopsis-4}

\textbf{syd-asm} \emph{{[}-h{]}} \emph{{[}-a arch{]}}

\textbf{syd-asm} \emph{{[}-h{]}} \emph{-a list}

\section{DESCRIPTION}\label{description-4}

\textbf{syd-asm} reads CPU instructions as raw bytes or hexadecimal encoded from standard input and disassembles them. The disassembled instructions are printed in JSON format as one instruction per-line. The disassembly is done natively for architectures \textbf{x86}, \textbf{x86\_64}, \textbf{x32}, \textbf{arm}, \textbf{aarch64}, and \textbf{riscv64} and falls back to GNU \emph{objdump}(1) for other architectures. There\textquotesingle s no support for LLVM \emph{objdump}(1) yet.

\section{OPTIONS}\label{options-2}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-a} & Specify alternative architecture, such as \textbf{x86}, \textbf{x86\_64} and \textbf{aarch64}. \\
& Use \textbf{list} to print the list of libseccomp supported architectures. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-5}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd}(7), \emph{objdump}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-6}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-aux(1)}\label{syd-aux1}

\section{NAME}\label{name-7}

\textbf{syd-aux} - Print auxiliary vector information

\section{SYNOPSIS}\label{synopsis-5}

\textbf{syd-aux} \emph{{[}-hrs{]}}

\section{DESCRIPTION}\label{description-5}

Print auxiliary vector information.

If -r is given print hexadecimal-encoded AT\_RANDOM cookie.

If -s is given exit with success if AT\_SECURE is set.

\section{OPTIONS}\label{options-3}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-r} & Print hexadecimal-encoded AT\_RANDOM cookie. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-s} & Exit with success if AT\_SECURE is set. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-6}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-elf}(1), \emph{syd-ldd}(1), \emph{getauxval}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-7}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-bit(1)}\label{syd-bit1}

\section{NAME}\label{name-8}

\textbf{syd-bit} - Utility to flip bits in files

\section{SYNOPSIS}\label{synopsis-6}

\textbf{syd-bit} \emph{{[}-h{]}} \emph{-i \textless idx\textgreater{}} \emph{\textless file\textgreater{}}

\textbf{syd-bit} \emph{{[}-h{]}} \emph{-r} \emph{\textless file\textgreater{}}

\section{DESCRIPTION}\label{description-6}

The \textbf{syd-bit} utility flips the given bit or a random bit in the specified file. It provides a simple way to simulate bit-flip attacks.

\section{OPTIONS}\label{options-4}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-i \textless idx\textgreater{}} & Flip the bit at index \textless idx\textgreater{} in the file \\
\textbf{-r} & Flip a random bit in the file \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-7}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-aes}(1), \emph{syd-key}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-8}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-cap(1)}\label{syd-cap1}

\section{NAME}\label{name-9}

\textbf{syd-cap} - Print information on Linux capabilities

\section{SYNOPSIS}\label{synopsis-7}

\textbf{syd-cap} \emph{{[}-h{]}}

\section{DESCRIPTION}\label{description-7}

Print information on Linux capabilities.

\section{OPTIONS}\label{options-5}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-8}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-aux}(1), \emph{syd-elf}(1), \emph{syd-ldd}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-9}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-cat(1)}\label{syd-cat1}

\section{NAME}\label{name-10}

\textbf{syd-cat} - Tool to parse, validate and display \emph{syd}(5) configuration

\section{SYNOPSIS}\label{synopsis-8}

\textbf{syd-cat} \emph{{[}-hjJmM{]}} \emph{{[}-p name{]}} \emph{\textless path\textgreater...}

\section{DESCRIPTION}\label{description-8}

Given a list of paths, parses and validates \emph{syd}(5) configuration.

Prints configuration to standard output on success.

Supported configuration file extensions are \textbf{.ipset}, \textbf{.netset}, and \textbf{.syd-3}.

\section{OPTIONS}\label{options-6}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-j} & Display Syd configuration as JSON. \\
\textbf{-J} & Display Syd configuration as compact JSON. \\
\textbf{-m} \textbf{magic} & Run a magic command at init, may be repeated. \\
\textbf{-M} \textbf{magic} & Run a magic command at exit, may be repeated. \\
\textbf{-p} \textbf{name} & Display rules of the profile with the given name. Use \textbf{list} as name to display the list of profiles. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-9}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-10}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-cpu(1)}\label{syd-cpu1}

\section{NAME}\label{name-11}

\textbf{syd-cpu} - Print the number of CPUs

\section{SYNOPSIS}\label{synopsis-9}

\textbf{syd-cpu} \emph{{[}-hlp{]}}

\section{DESCRIPTION}\label{description-9}

Print the number of CPUs.

\section{OPTIONS}\label{options-7}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-l} & Print the number of logical CPUs (default). \\
\textbf{-p} & Print the number of physical CPUs. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-10}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-11}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-dns(1)}\label{syd-dns1}

\section{NAME}\label{name-12}

\textbf{syd-dns} - Resolve hostname into IPs using system DNS resolver

\section{SYNOPSIS}\label{synopsis-10}

\textbf{syd-dns} \emph{{[}-hr46{]}} hostname

\textbf{syd-dns} \emph{{[}-R{]}} IPv4/6 address

\section{DESCRIPTION}\label{description-10}

Resolve hostname into IPs using system DNS resolver.

Given \emph{-R}, perform a reverse-DNS lookup for the given IPv4/6 address using the system DNS resolver.

\section{OPTIONS}\label{options-8}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-4} & Print only IPv4 addresses \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-6} & Print only IPv6 addresses \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-r} & Print a random IP picked using \emph{getrandom}(2) \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-R} & Perform a reverse DNS lookup using \emph{getnameinfo}(3) \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-11}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-net}(1), \emph{getrandom}(2), \emph{getnameinfo}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-12}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-elf(1)}\label{syd-elf1}

\section{NAME}\label{name-13}

\textbf{syd-elf} - Print executable file information

\section{SYNOPSIS}\label{synopsis-11}

\textbf{syd-elf} \emph{{[}-36dhpstxX{]}} \emph{binary\textbar script}

\section{DESCRIPTION}\label{description-11}

Given a binary, print file name and ELF information.

Given a script, print file name and "SCRIPT".

The information line is a list of fields delimited by colons.

\section{OPTIONS}\label{options-9}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-3} & Exit with success if the given binary is 32-bit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-6} & Exit with success if the given binary is 64-bit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-d} & Exit with success if the given binary is dynamically linked. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-s} & Exit with success if the given binary is statically linked. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-p} & Exit with success if the given binary is a Position Independent Executable (PIE). \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-t} & Print the type of the file as an abbreviation. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-x} & Exit with success if the given executable is a script. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-X} & Exit with success if the given binary has executable stack. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-12}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-ldd(1),} ldd\_(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-13}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-emacs(1)}\label{syd-emacs1}

\section{NAME}\label{name-14}

\textbf{syd-emacs} - Convenience wrapper to run Emacs under Syd

\section{SYNOPSIS}\label{synopsis-12}

\textbf{syd-emacs} \emph{{[}command-line switches{]}} \emph{{[}files...{]}}

\section{DESCRIPTION}\label{description-12}

\textbf{syd-emacs} is a convenience wrapper to run Emacs under Syd. All command-line arguments are passed directly to \emph{emacs}(1).

\section{FILES}\label{files}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
/dev/syd.el & Emacs Lisp \emph{syd}(2) API library. \\
& Access assumes sandbox lock is accessible, ie "lock:off" or "lock:exec". \\
\textasciitilde/.emacs.d/init.syd-3 & Emacs Syd profile, if this file does not exist, the "lib" profile is used instead. \\
& Note, the "lib" profile turns all sandboxing off and sets "lock:exec" to allow access to the virtual file "/dev/syd.el". \\
& If you do not want to turn all sandboxing off, you\textquotesingle re encouraged to configure a profile with this file. \\
& Ensure to add "lock:exec" in the end so that the initial \emph{emacs}(1) process can access the sandbox to load "/dev/syd.el". \\
& Ensure to call "(syd-lock :lock-on)" from within \emph{emacs}(1) when you\textquotesingle re done configuring \emph{syd}(1) using the \emph{syd}(2) API. \\
& If you do not want to allow access to the sandbox lock, you\textquotesingle re encouraged to call \emph{syd}(1) manually with \emph{emacs}(1). \\
& This is just a convenience wrapper. \\
\textasciitilde/.emacs.d/syd.log & Emacs Syd log file, access violations are logged to this file. \\
& \emph{syd-emacs}(1) opens this file, and sets \textbf{SYD\_LOG\_FD} environment variable to the value of the file descriptor. \\
& The file is opened for create+append-only. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-13}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{emacs}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-14}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-env(1)}\label{syd-env1}

\section{NAME}\label{name-15}

\textbf{syd-env} - Run a command with the environment of the process with the given PID

\section{SYNOPSIS}\label{synopsis-13}

\textbf{syd-env} pid {[}-i{]} {[}name=value{]}... \{command {[}arg...{]}\}

\textbf{syd-env} -e \textless eval-str\textgreater{}

\section{DESCRIPTION}\label{description-13}

\textbf{syd-env} utility runs a command with the environment of the process with the given PID. It is similar to the \emph{env}(1) utility except it allows picking the environment of an arbitrary process.

Given "-e" with a string argument, \textbf{syd-env} performs environment expansion and command substitution using \emph{wordexp}(3).

\section{SECURITY}\label{security-3}

\emph{wordexp}(3) child process is executed in a confined environment with a timeout of 3 seconds. Confinement is done using Landlock, namespaces and seccomp.

\section{SEE ALSO}\label{see-also-14}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{env}(1), \emph{wordexp}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-15}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-exec(1)}\label{syd-exec1}

\section{NAME}\label{name-16}

\textbf{syd-exec} - Construct a sandbox command to execute a process outside syd

\section{SYNOPSIS}\label{synopsis-14}

\textbf{syd-exec} \{command {[}arg...{]}\}

\section{DESCRIPTION}\label{description-14}

The \textbf{syd-exec} utility may be used to construct a sandbox command to execute a process outside syd. See the documentation of the \textbf{cmd/exec} sandbox command in \emph{syd}(2) manual page for more information on its usage.

\section{SEE ALSO}\label{see-also-15}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{exec}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-16}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-fd(1)}\label{syd-fd1}

\section{NAME}\label{name-17}

\textbf{syd-fd} - Interact with remote file descriptors

\section{SYNOPSIS}\label{synopsis-15}

\textbf{syd-fd} \emph{{[}-h{]}} \emph{{[}-p pid{]}} \emph{{[}-f remote\_fd{[}:local\_fd{]}{]}}... \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-15}

The \textbf{syd-fd} utility can be used to interact with remote file descriptors on Linux systems. Given only a PID argument with \textbf{-p}, it lists the open files of the process with the given PID in line-oriented compact JSON format. Given no PID argument it lists the open files of the current process. The \textbf{-f} argument can be used to transfer remote file descriptors using \emph{pidfd\_getfd}(2) which requires Linux\textgreater=5.6. Optionally a colon-delimited local file descriptor may be specified as target fd. Specify \textbf{rand} as target to duplicate the file descriptor to a random available file descriptor slot. If a command is given it is executed and the file descriptors are transferred to the process. If no command is given "/bin/sh" is executed.

\section{OPTIONS}\label{options-10}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-p} \emph{pid} & Specify process ID. If not given, list fds of current process. \\
\textbf{-f} \emph{remote\_fd{[}:local\_fd{]}} & Specify remote fd to transfer. Optionally specify colon-separated local fd as target, or \textbf{rand} for random target. \\
\end{xltabular}

\section{EXIT CODES}\label{exit-codes-1}

\textbf{syd-fd} exits with the same exit code as the command.

\section{SEE ALSO}\label{see-also-16}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-lock}(1), \emph{syd-pds}(1), \emph{pidfd\_getfd}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-17}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-fork(1)}\label{syd-fork1}

\section{NAME}\label{name-18}

\textbf{syd-fork} - Fork fast in an infinite loop.

\section{SYNOPSIS}\label{synopsis-16}

\textbf{syd-fork} \emph{{[}-h{]}}

\section{DESCRIPTION}\label{description-16}

If no arguments are provided, the program will quickly create an infinite number of child processes through forking. This is implemented using inline assembly on x86, x86\_64, arm, and aarch64 architectures, making it significantly faster and more efficient than the bash fork bomb.

When the \textbf{-h} flag is passed, a warning message will be displayed advising that this program is intended for stress-testing the pid limiter and should not be used for any other purpose. It is not intended to be used as a joke and should be used with caution. Use of the program is at the user\textquotesingle s own risk. To stress-test the pid limiter, run the program with no arguments. The program will quickly create an infinite number of child processes through forking and it will quickly reach the maximum number of processes that the system can handle.

\section{OPTIONS}\label{options-11}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\end{xltabular}

\section{EXAMPLES}\label{examples}

To run syd-fork on April 1st at 8:00 AM UTC, you can use the \emph{at}(1) command. This is useful for scheduling the program to execute at a specific time for testing or demonstration purposes. Ensure that the \emph{at(1)} daemon is running on your system and that you have permission to schedule jobs with \emph{at}(1).

{\scriptsize \begin{verbatim}
$ echo "syd-fork" | at 08:00 April 1
\end{verbatim}}

\section{NOTES}\label{notes}

Distribution maintainers are recommended to \emph{ln}(1) "syd-fork" to "syd-fuck" under an NSFW option to help treat anger issues.

\section{SEE ALSO}\label{see-also-17}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{at}(1), \emph{fork}(2), \emph{ln}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-18}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-hex(1)}\label{syd-hex1}

\section{NAME}\label{name-19}

\textbf{syd-hex} - Hex-encode/decode the given file or standard input

\section{SYNOPSIS}\label{synopsis-17}

\textbf{syd-hex} \emph{{[}-hdeflsC{]}} \emph{\textless file\textbar-\textgreater{}}

\section{DESCRIPTION}\label{description-17}

Given a file, hex-encode the file and print.

Given no positional arguments or "-" as argument, hex-encode standard input and print.

Use \textbf{-d} to hex-decode rather than encode.

Use \textbf{-s} with \textbf{-d} to hex-decode data with newline-delimited chunks.

Use \textbf{-C} with \textbf{-s} to warn and continue in case of read or encoding errors.

Use \textbf{-f} to force print decoded hex to TTY (insecure). By default, decoded hex output is \emph{not} written to standard output if it\textquotesingle s attached to a TTY.

Use \textbf{-l} \textless human-size\textgreater{} to exit after size bytes are read.

Use \textbf{-l} \textless line-count\textgreater{} with \textbf{-s} to exit after count lines are read.

\section{OPTIONS}\label{options-12}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-d} & Hex-decode. \\
\textbf{-e} & Hex-encode (default). \\
\textbf{-f}, \textbf{-\/-force-tty} & Force output to TTY (insecure). \\
\textbf{-l} \emph{\textless human-size\textgreater{}} & Exit after size bytes are read. \\
\textbf{-l} \emph{\textless line-count\textgreater{}} & Exit after count lines are read in stream mode. \\
\textbf{-s}, \textbf{-\/-stream} & Enable stream mode with \textbf{-d} when data is hex-decoded with newline-delimited chunks. \\
\textbf{-C}, \textbf{-\/-continue-on-failure} & Continue in case of read or encoding errors in stream mode. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-18}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{tty}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-19}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-info(1)}\label{syd-info1}

\section{NAME}\label{name-20}

\textbf{syd-info} - Print system information

\section{SYNOPSIS}\label{synopsis-18}

\textbf{syd-info} \emph{{[}-h{]}}

\section{DESCRIPTION}\label{description-18}

Print system information.

System information is acquired using the \emph{sysinfo}(2) system call.

\section{OPTIONS}\label{options-13}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-19}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{sysinfo}(2)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-20}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-key(1)}\label{syd-key1}

\section{NAME}\label{name-21}

\textbf{syd-key} - Utility to generate encryption keys and save to \emph{keyrings}(7)

\section{SYNOPSIS}\label{synopsis-19}

\textbf{syd-key} \emph{{[}-hpP{]}} \emph{{[}-d keydesc{]}} \emph{{[}-t keytype{]}} \emph{{[}-k keyring{]}}

\section{DESCRIPTION}\label{description-19}

The \textbf{syd-key} utility generates random 256-bit encryption keys using Linux Kernel\textquotesingle s random number generator. The key is saved to Linux \emph{keyrings}(7) and key serial ID is printed as a decimal 32-bit integer to standard output.

\section{OPTIONS}\label{options-14}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-p} & Read passphrase from the controlling TTY (NOT \emph{stdin}(3)) and derive key material. \\
& syd-key will refuse to read the passphrase from \emph{stdin}(3) for safety, unless \textbf{-P} is explicitly supplied. The passphrase is hashed using SHA3-256; the resulting digest is stored with \emph{keyrings}(7) interface. The passphrase buffer is zeroized after use. Key serial ID is printed on \emph{stdout}(3). \\
& If none of \textbf{-pP} is supplied, a random key is generated using \emph{getrandom}(2) with GRND\_RANDOM flag instead. \\
\textbf{-P} & Read passphrase from \emph{stdin}(3) and derive key material. \\
& This option is intended for non-interactive use (for example, piping a passphrase from a password manager). \textbf{Use with caution}: reading a passphrase from \emph{stdin}(3) can be less secure than reading from the controlling TTY because it may be observable by other processes, recorded in shell constructs, or otherwise leaked by the environment. The passphrase is hashed using SHA3-256; the resulting digest is stored with keyrings(7) interface. The passphrase buffer is zeroized after use. Key serial ID is printed on stdout(3). \\
& If none of \textbf{-pP} is supplied, a random key is generated using \emph{getrandom}(2) with GRND\_RANDOM flag instead. \\
\textbf{-d kdesc} & Specify alternative key description. Default is \textbf{SYD-3-CRYPT}. \\
\textbf{-t ktype} & Specify alternative key type. Default is \textbf{user}. \\
\textbf{-k kring} & Specify alternative key ring ID. Default is \textbf{KEY\_SPEC\_USER\_KEYRING}. May be exactly one of \textbf{thread}, \textbf{process}, \textbf{session}, \textbf{user} or \textbf{user-session}. May also be a 32-bit decimal number specifying a keyring ID. \\
\end{xltabular}

\section{CAVEATS}\label{caveats}

Keys in \emph{keyrings}(7) are identified by their (type, description) pair. When \textbf{syd-key} invokes \emph{add\_key}(2) with a type/description that already exists in the target keyring, the kernel will update the existing key\textquotesingle s payload instead of creating a new key. To force creation of a new key, use a unique description (for example by appending a UUID or timestamp).

\section{SEE ALSO}\label{see-also-20}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-aes}(1), \emph{getrandom}(2), \emph{add\_key}(2), \emph{keyrings}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-21}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-ldd(1)}\label{syd-ldd1}

\section{NAME}\label{name-22}

\textbf{syd-ldd} - Print shared object dependencies in a secure way

\section{SYNOPSIS}\label{synopsis-20}

\textbf{syd-ldd} \emph{{[}option{]}...} \emph{file...}

\section{DESCRIPTION}\label{description-20}

The \textbf{syd-ldd} utility is meant to be used as a secure alternative to \emph{ldd}(1). It creates a syd sandbox and runs \emph{ldd}(1) under it with restricted privileges.

\section{INVOCATION}\label{invocation-1}

\textbf{syd-ldd} utility is equivalent to invoking the following command:

{\scriptsize \begin{verbatim}
syd
    -pimmutable
    -msandbox/read:on
    -msandbox/stat:off
    -msandbox/exec:on
    -msandbox/write:on
    -msandbox/net:on
    -msandbox/lock:on
    -mallow/read+/etc/ld-*.path
    -mallow/read+/etc/locale.alias
    -mallow/read+/usr/share/locale*/**/*.mo
    -mallow/read+/usr/share/locale*/locale.alias
    -mallow/read+/usr/lib*/locale*/locale-archive
    -mallow/read+/usr/lib*/**/gconv-modules*
    -mallow/read+/usr/**/LC_{ALL,COLLATE,CTYPE,IDENTIFICATION,MESSAGES}
    -mallow/read+/**/*.so.[0-9]*
    -mallow/exec+/lib/**/ld-linux*.so.[0-9]
    -mallow/exec+/usr/lib*/**/ld-linux*.so.[0-9]
    -mallow/write+/dev/null
    -mallow/lock/read+/
    -mallow/lock/write+/dev/null
    -mallow/read,write+/dev/tty
    -mallow/read,exec+/path/to/ldd
    /path/to/ldd -- args...
\end{verbatim}}

\section{SEE ALSO}\label{see-also-21}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{ldd}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-22}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-lock(1)}\label{syd-lock1}

\section{NAME}\label{name-23}

\textbf{syd-lock} - Run a program under \emph{landlock}(7)

\section{SYNOPSIS}\label{synopsis-21}

\textbf{syd-lock} \emph{{[}-bchrvwASUV{]}} \emph{{[}-C level{]}} \emph{{[}-E errata{]}} \emph{{[}-F flag{]}}... \emph{{[}-l category{[},category...{]}\{+\textbar-\}path\textbar port{[}-port{]}{]}...} \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-21}

\textbf{syd-lock} utility runs a program under \emph{landlock}(7). The program is confined by the given \emph{landlock}(7) categories. Supported categories are \emph{read}, \emph{write}, \emph{exec}, \emph{ioctl}, \emph{create}, \emph{delete}, \emph{rename}, \emph{symlink}, \emph{truncate}, \emph{readdir}, \emph{mkdir}, \emph{rmdir}, \emph{mkbdev}, \emph{mkcdev}, \emph{mkfifo}, \emph{bind}, and \emph{connect}. Categories other than \emph{bind} and \emph{connect} must specify paths to be confined. Both absolute and relative paths are permitted. Path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Categories \emph{bind} and \emph{connect} must specify a network port or closed port range separated by dash. Zero is a valid port number to confine binds and connects to ephemeral ports. \emph{bind} category also supports absolute UNIX domain socket paths to confine their creation via \emph{mknod}(2). For full details and specific behavior of each \emph{landlock}(7) category, refer to the \textbf{Sandboxing} and \textbf{Lock Sandboxing} sections of the \emph{syd}(7) manual page.

\section{OPTIONS}\label{options-15}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-v} & Be verbose. Print \emph{landlock}(7) status to \emph{stderr}(3) before running the program. \\
\textbf{-V} & Print \emph{landlock}(7) ABI version on \emph{stdout}(3). \\
\textbf{-A} & Print \emph{landlock}(7) ABI version on \emph{stdout}(3) and exit with it as exit code. Use for scripting. \\
\textbf{-l} \emph{cat{[},cat...{]}\{+\textbar-\}path\textbar port{[}-port{]}} & Add or remove a \emph{landlock}(7) rule with categories and an associated resource (path or port), may be repeated. \\
& Join categories and resource by either a "\textbf{+}" (plus) for add or a "\textbf{-}" (minus) for remove. \\
& Resource must be a path for all categories except \emph{bind} and \emph{connect}. \\
& Resource must be a port or a dash-delimited closed port range for \emph{bind} and \emph{connect}. \\
& Resource may also be a UNIX domain socket path for \emph{bind} to confine \emph{mknod}(2) with \textbf{S\_IFSOCK}. \\
& Both absolute and relative paths are permitted for all categories except \emph{bind} which requires an absolute path. \\
& Paths are stored as hash sets and ports as fixed bit sets to make stacking options simple and predictable. \\
\textbf{-C} \emph{level} & Set \emph{landlock}(7) compatibility level. Must be one of \emph{hard-requirement}, \emph{soft-requirement}, and \emph{best-effort}. \\
& Default is \emph{hard-requirement} to adhere to the principle of secure defaults. \\
& Level can be given shortly as \emph{hard} (or \emph{h}), \emph{soft} (or \emph{s}) and \emph{best} (or \emph{b}). \\
\textbf{-E} \emph{errata} & Query supported \emph{landlock}(7) errata fixes. Use \emph{-E list} to print list of known erratas. \\
& The argument may be a name or number. Use a number to query undefined erratas. \\
& Multiple erratas may be specified split by commas. \\
\textbf{-F} \emph{flags} & Set \emph{landlock\_restrict\_self}(2) flags. Use \emph{-F list} to print a list of flags. \\
& See the FLAGS section for information on flags and their functionality. \\
\textbf{-S} & Enable scoped signals introduced with \emph{landlock}(7) ABI 6. \\
\textbf{-U} & Enable scoped UNIX abstract sockets introduced with \emph{landlock}(7) ABI 6. \\
\textbf{-r} \emph{path} & Specify a read-only path, may be repeated. Equivalent to \emph{-l read,readdir,exec,ioctl+path}. \\
\textbf{-w} \emph{path} & Specify a read-write path, may be repeated. Equivalent to \emph{-l all+path}. \\
\textbf{-b} \emph{port{[}-port{]}} & Specify a port for \emph{bind}(2), may be repeated. Equivalent to \emph{-l bind+port}. \\
\textbf{-c} \emph{port{[}-port{]}} & Specify a port for \emph{connect}(2), may be repeated. Equivalent to \emph{-l connect+port}. \\
\end{xltabular}

\section{CONFIGURATION}\label{configuration-1}

\emph{landlock}(7) categories and their associated resources (paths or ports) are given with the \emph{-l} option. This option accepts a comma separated list of categories, followed by either a "\emph{+}" (plus) or a "\emph{-}" (minus) symbol indicating to add or remove the given rule. Rulesets store paths as hash sets and ports as fixed bit sets to allow for simple and predictable stacking of multiple \emph{-l} options. Use \emph{-V} option to check for \emph{landlock}(7) support in the Linux kernel. The specific support level may be determined by the exit code. Use \emph{-A} option to check for \emph{landlock}(7) ABI version.

\subsection{ABI}\label{abi}

\emph{landlock}(7) ABI versioning makes it possible to adjust the security policy according to kernel capabilities. \textbf{syd-lock} has support for \emph{landlock}(7) ABI 7 which is new in Linux-6.15. See the \textbf{HISTORY} section for information on when each \emph{landlock}(7) ABI was introduced to the Linux kernel.

\subsection{SETS}\label{sets}

As of version 3.38.0, multiple categories may be specified split by commas and the following sets are defined to streamline sandbox profile composition. Names are intentionally chosen to be consistent with OpenBSD\textquotesingle s \emph{pledge}(2):

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{all} & All filesystem access rights \\
\textbf{rpath} & read, readdir \\
\textbf{wpath} & write, truncate \\
\textbf{cpath} & create, delete, rename \\
\textbf{dpath} & mkbdev, mkcdev \\
\textbf{spath} & mkfifo, symlink \\
\textbf{tpath} & mkdir, rmdir \\
\textbf{inet} & bind, connect \\
\end{xltabular}

\subsection{COMPATIBILITY LEVELS}\label{compatibility-levels}

As of version 3.35.0, \emph{landlock}(7) compatibility level may be set using the \emph{-C} option to one of the following levels: \emph{hard-requirement}, or just \emph{hard} or \emph{h}, \emph{soft-requirement}, or just \emph{short} or \emph{s}, and \emph{best-effort}, or just \emph{best} or \emph{b}. Default is \emph{hard-requirement} to adhere to the principle of secure defaults. In this level the requested \emph{landlock}(7) restrictions are taken into account only if they are supported by the running system; if any requested feature is not supported, the operation returns a compatibility error and the sandbox is not entered. File \emph{open}(2) errors during sandbox setup, including the ENOENT ("No such file or directory") \emph{errno}(3), return a fatal error in this level. In \emph{soft-requirement} level the requested restrictions are taken into account if they are supported by the running system, or the entire sandboxing request is silently ignored otherwise; no compatibility error is returned. In \emph{best-effort} level the requested restrictions are taken into account if they are supported by the running system, and any unsupported restrictions are silently ignored; no compatibility error is returned. In \emph{soft-requirement} and \emph{best-effort} levels file \emph{open}(2) errors with the ENOENT ("No such file or directory") \emph{errno}(3) are silently ignored. Other file \emph{open}(2) errors are fatal.

\subsection{FLAGS}\label{flags}

As of version 3.38.0, \emph{landlock}(7) flags may be set using the \emph{-F} option. Flags may be specified using their names or numerical values. Multiple flags may be set at once by specifying them as a comma-separated list. Flags are supported beginning with \emph{landlock}(7) ABI 7 which is new in Linux-6.15. List of supported flags are given below. Setting a flag on an unsupported ABI is a NO-OP unless otherwise noted.

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{log\_same\_exec\_off} & \textbf{1}: Disables logging of denied accesses originating from the thread creating the \emph{landlock}(7) domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening \emph{execve}(2) call). This is intended for programs that execute unknown code without invoking \emph{execve}(2), such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. This flag requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. \\
\textbf{log\_new\_exec\_on} & \textbf{2}: Enables logging of denied accesses after an \emph{execve}(2) call, providing visibility into unauthorized access attempts by newly executed programs within the created \emph{landlock}(7) domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events. This flag requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. \\
\textbf{log\_subdomains\_off} & \textbf{4}: Disables logging of denied accesses originating from nested \emph{landlock}(7) domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create \emph{landlock}(7) domains and could otherwise generate excessive logs. Unlike \textbf{log\_same\_exec\_off}, this flag only affects future nested domains, not the one being created. This flag requires \emph{landlock}(7) ABI 7 support which is new in Linux-6.15. \\
\end{xltabular}

\section{SECURITY}\label{security-4}

As of version 3.35.0, the default \emph{landlock}(7) compatibility level has been changed from \emph{best-effort} to \emph{hard-requirement}, and \emph{ENOENT} (\emph{No} such file or directory) errors are made fatal unless level is set to \emph{best-effort}. This adheres to the principle of secure defaults and above all avoids the silent and dangerous trap where a non-existing file or directory which had been denied access (and skipped) at startup is created after and \emph{landlock}(7) ends up allowing access to the newly created file or directory. For more information, see: https://landlock.io/rust-landlock/landlock/trait.Compatible.html

As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. \emph{bind} category requires absolute UNIX socket paths. Path may be relative for other categories in which case it is resolved relative to the directory where \emph{syd-lock}(1) was executed.

Consider combining \emph{syd-lock}(1) use with \emph{syd-mdwe}(1) to get W\^{}X memory protections. See \emph{syd-mdwe}(1) manual page for more information.

\section{HISTORY}\label{history}

\begin{itemize}
\item
  1st \emph{landlock}(7) ABI was introduced with Linux-5.13.
\item
  2nd \emph{landlock}(7) ABI was introduced with Linux-5.19.
\item
  3rd \emph{landlock}(7) ABI was introduced with Linux 6.2.
\item
  4th \emph{landlock}(7) ABI was introduced with Linux 6.7.
\item
  5th \emph{landlock}(7) ABI was introduced with Linux 6.10.
\item
  6th \emph{landlock}(7) ABI was introduced with Linux 6.12.
\item
  7th \emph{landlock}(7) ABI was introduced with Linux 6.15.
\end{itemize}

Refer to the following links for more information:

\begin{itemize}
\item
  https://git.kernel.org/stable/c/17ae69aba89dbfa2139b7f8024b757ab3cc42f59
\item
  https://git.kernel.org/stable/c/cb44e4f061e16be65b8a16505e121490c66d30d0
\item
  https://git.kernel.org/stable/c/299e2b1967578b1442128ba8b3e86ed3427d3651
\item
  https://git.kernel.org/stable/c/136cc1e1f5be75f57f1e0404b94ee1c8792cb07d
\item
  https://git.kernel.org/stable/c/2fc0e7892c10734c1b7c613ef04836d57d4676d5
\item
  https://git.kernel.org/stable/c/e1b061b444fb01c237838f0d8238653afe6a8094
\item
  https://git.kernel.org/stable/c/72885116069abdd05c245707c3989fc605632970
\end{itemize}

\section{EXIT STATUS}\label{exit-status}

\textbf{syd-lock} exits with the same code as the child process on clean exit. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails \emph{syd-lock}(1) exits with the \emph{errno}(3) number. \emph{syd-lock -A} exits with the \emph{landlock}(7) ABI version as exit code.

\emph{syd-lock -E} exits with one of the following exit codes:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{0} & All erratas are available. \\
\textbf{1} & Some erratas are not available. \\
\textbf{2} & No erratas are available. \\
\end{xltabular}

\emph{syd-lock -V} exits with one of the following exit codes based on support for the latest \emph{landlock}(7) ABI:

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{0} & Fully enforced \\
\textbf{1} & Partially enforced \\
\textbf{2} & Not enforced \\
\textbf{127} & Not supported \\
\end{xltabular}

\textbf{syd-lock} exits with \textbf{22} (EINVAL) for invalid CLI arguments.

\section{EXAMPLES}\label{examples-1}

{\scriptsize \begin{verbatim}
$ syd-lock wget -O/dev/null chesswob.org
$ syd-lock -l read,exec+/ wget -O/dev/null chesswob.org
/dev/null: Permission denied
$ syd-lock -l read,exec+/ -l write+/dev/null wget -O/dev/null chesswob.org
Prepended http:// to 'chesswob.org'
--2025-04-30 16:24:35--  http://chesswob.org/
Resolving chesswob.org (chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to chesswob.org (chesswob.org)|95.216.39.164|:80... failed: Permission denied.
Connecting to chesswob.org (chesswob.org)|fe80::468a:5bff:fe88:2141|:80... failed: Permission denied.
Retrying.

^C
$ syd-lock -l read,exec+/ -l write+/dev/null -l connect+80 -l connect+443 wget -O/dev/null chesswob.org
Prepended http:// to 'chesswob.org'
--2025-04-30 16:25:59--  http://chesswob.org/
Resolving chesswob.org (chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to chesswob.org (chesswob.org)|95.216.39.164|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://www.chesswob.org/ [following]
--2025-04-30 16:25:59--  https://www.chesswob.org/
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving www.chesswob.org (www.chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to www.chesswob.org (www.chesswob.org)|95.216.39.164|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 148827 (145K) [text/html]
Saving to: ‘/dev/null’

/dev/null                         100%[=============================================================>] 145.34K  --.-KB/s    in 0.01s

2025-04-30 16:25:59 (11.9 MB/s) - ‘/dev/null’ saved [148827/148827]
$
\end{verbatim}}

\section{SEE ALSO}\label{see-also-22}

\emph{landlock}(7), \emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd}(7), \emph{syd-mdwe}(1), \emph{syd-ofd}(1), \emph{syd-pds}(1), \emph{syd-sec}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

Landlock homepage: https://landlock.io/

Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html

Landlock admin guide: https://docs.kernel.org/admin-guide/LSM/landlock.html

\section{AUTHORS}\label{authors-23}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-ls(1)}\label{syd-ls1}

\section{NAME}\label{name-24}

\textbf{syd-ls} - List unsafe directories, capabilities, system calls, environment variables, ioctl requests, personalities, and prctl options

\section{SYNOPSIS}\label{synopsis-22}

\textbf{syd-ls} \emph{{[}set{]}}

\section{DESCRIPTION}\label{description-22}

The \textbf{syd-ls} utility prints the names of the system calls which belong to the given set. Available sets are \textbf{cpu}, \textbf{dead}, \textbf{deny}, \textbf{ebpf}, \textbf{futex}, \textbf{hook}, \textbf{nice}, \textbf{noop}, \textbf{pkey}, \textbf{ptrace}, \textbf{safe}, \textbf{setid}, \textbf{time}, and \textbf{uring}.

If set is \textbf{drop}, \textbf{syd-ls} prints the list of Linux \emph{capabilities}(7) that are dropped at startup.

If set is \textbf{env}, \textbf{syd-ls} prints the list of unsafe environment variables.

If set is \textbf{ioctl}, \textbf{syd-ls} prints the list of allowed ioctl requests.

If set is \textbf{prctl}, \textbf{syd-ls} prints the list of allowed prctl options.

If set is \textbf{personality}, \textbf{syd-ls} prints the list of allowed personalities.

Given no set, \textbf{syd-ls} lists all files in the current working directory. In this mode, getdents64(2) is used directly. Use to list files in untrusted directories with huge number of files. File names are printed hex-encoded, delimited by newline, use \emph{syd-hex}(1) to decode. See EXAMPLES section for more information.

\section{EXAMPLES}\label{examples-2}

{\scriptsize \begin{verbatim}
[alip@caissa tmp]$ mkdir test; cd test
[alip@caissa test]$ for i in {1..10000000}; do :>$i; done
[alip@caissa test]$ df -i .
Filesystem       Inodes    IUsed IFree IUse% Mounted on
tmpfs          10048576 10000228 48348  100% /tmp
[alip@caissa test]$ syd-ls | head -n5 | syd-hex -dfs
.
..
10000000
9999999
9999998
[alip@caissa test]$ for ls in syd-ls gls 9ls 'busybox ls'; do
> sync
> sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'
> echo "[*] $ls"
> time $ls >/dev/null
> done
[*] syd-ls
syd-ls: Listed 10000002 files in 2.882764582 seconds.

real    0m2.889s
user    0m0.883s
sys     0m1.995s
[*] gls

real    0m7.548s
user    0m5.724s
sys     0m1.803s
[*] 9ls

real    0m15.306s
user    0m2.523s
sys     0m12.743s
[*] busybox ls

real    0m18.011s
user    0m11.178s
sys     0m6.786s
[alip@caissa test]$ gls --version | head -n1
ls (GNU coreutils) 9.6
[alip@caissa test]$ pacman -Ss 9base | head -n1
extra/9base 6-9 [installed]
[alip@caissa test]$ busybox | head -n1
BusyBox v1.36.1 () multi-call binary.
\end{verbatim}}

\section{SEE ALSO}\label{see-also-23}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-hex}(1), \emph{getdents}(2)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-24}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-mdwe(1)}\label{syd-mdwe1}

\section{NAME}\label{name-25}

\textbf{syd-mdwe} - Run a program under Memory-Deny-Write-Execute protections

\section{SYNOPSIS}\label{synopsis-23}

\textbf{syd-mdwe} \emph{{[}-hms{]}} \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-23}

\textbf{syd-mdwe} utility runs a program under Memory-Deny-Write-Execute (MDWE) protections. The protections can be applied using \emph{prctl}(2) and \emph{seccomp}(2), These protections are identical to what Syd applies by default.

\section{OPTIONS}\label{options-16}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-m} & Enable MDWE protections using \emph{prctl}(2) PR\_SET\_MDWE (default: both). \\
\textbf{-s} & Enable MDWE protections using \emph{seccomp}(2) (default: both). \\
\end{xltabular}

\section{EXAMPLES}\label{examples-3}

Running pax-test once standalone and once under \emph{syd-mdwe}(1) on a 6.8 kernel we get the following differences:

\begin{xltabular}[l]{\linewidth}{@{} lX X @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{PaX Testcase} & \textbf{standalone} & \textbf{mdwe} \\
Executable anonymous mapping & Killed & Killed \\
Executable bss & Killed & Killed \\
Executable data & Killed & Killed \\
Executable heap & Killed & Killed \\
Executable stack & Killed & Killed \\
Executable shared library bss & Killed & Killed \\
Executable shared library data & Killed & Killed \\
Executable anonymous mapping (mprotect) & Vulnerable & Killed \\
Executable bss (mprotect) & Vulnerable & Killed \\
Executable data (mprotect) & Vulnerable & Killed \\
Executable heap (mprotect) & Vulnerable & Killed \\
Executable stack (mprotect) & Vulnerable & Killed \\
Executable shared library bss (mprotect) & Vulnerable & Killed \\
Executable shared library data (mprotect): & Vulnerable & Killed \\
Writable text segments & Vulnerable & Killed \\
\end{xltabular}

The test was performed with paxtest-0.9.15:

{\scriptsize \begin{verbatim}
PaXtest - Copyright(c) 2003-2016 by Peter Busser <peter@adamantix.org> and Brad Spengler <spender@grsecurity.net>
Released under the GNU Public Licence version 2 or later

Mode: 1
Blackhat
Kernel: 
Linux syd 6.8.0-syd-13213-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux
\end{verbatim}}

\section{EXIT STATUS}\label{exit-status-1}

On clean exit, \textbf{syd-mdwe} exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails \textbf{syd-mdwe} exits with the \emph{errno}(3) number.

\section{CAVEATS}\label{caveats-1}

By default, \emph{prctl}(2) error setting \emph{PR\_SET\_MDWE}(2const) is not fatal. Use the \textbf{-m} option to make this error fatal. This utility does not work on MIPS architectures where Linux requires executable stack.

\section{SEE ALSO}\label{see-also-24}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-lock}(1), \emph{syd-ofd}(1), \emph{syd-pds}(1), \emph{syd-sec}(1), \emph{seccomp}(2), \emph{prctl}(2), \emph{PR\_SET\_MDWE}(2const)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-25}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-net(1)}\label{syd-net1}

\section{NAME}\label{name-26}

\textbf{syd-net} - Tool to aggregate IP networks

\section{SYNOPSIS}\label{synopsis-24}

\textbf{syd-net} \emph{{[}-h{]}} \emph{\textless path\textgreater...}

\section{DESCRIPTION}\label{description-24}

Aggregates and outputs a list of IP networks compiled from the given list of files or standard input.

\section{OPTIONS}\label{options-17}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-25}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-26}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-mem(1)}\label{syd-mem1}

\section{NAME}\label{name-27}

\textbf{syd-mem} - Calculate the memory usage of the given process or the parent process

\section{SYNOPSIS}\label{synopsis-25}

\textbf{syd-mem} {[}-sHV{]} \emph{{[}pid{]}}

\section{DESCRIPTION}\label{description-25}

The \textbf{syd-mem} utility calculates the memory usage of the given process or the parent process. Source of information is the per-process file \emph{proc\_pid\_smaps\_rollup}(5) or \emph{proc\_pid\_smaps}(5) when \emph{-s} option is given.

\section{OPTIONS}\label{options-18}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-H} & Print human-formatted size \\
\textbf{-V} & Print virtual memory size \\
\textbf{-s} & Use \emph{proc\_pid\_smaps}(5) rather than the rollup file. \\
& This method is inefficient and is provided for benchmarking. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-26}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{proc}(5), \emph{proc\_pid\_smaps}(5), \emph{proc\_pid\_smaps\_rollup}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-27}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-oci(1)}\label{syd-oci1}

\section{NAME}\label{name-28}

\textbf{syd-oci} - OCI container runtime

\section{SYNOPSIS}\label{synopsis-26}

\textbf{syd-oci} \emph{{[}OPTIONS{]}} \emph{{[}COMMAND{]}}

\section{DESCRIPTION}\label{description-26}

syd-oci is an OCI container runtime implementation for \emph{syd}(1).

All common subcommands are supported: create, start, state, kill, delete, pause, resume, exec, run, list, ps, spec, events, features, update. Checkpoint/restore support is planned in the near future. See the respective youki issue, https://github.com/youki-dev/youki/issues/142, for more information.

\section{INTEGRATION}\label{integration}

syd-oci is a thin wrapper around \emph{youki}(1) that integrates the \emph{syd}(1) sandbox into containers. It is compatible with \emph{docker}(1) and \emph{podman}(1). To get syd-oci, you should build \emph{syd}(1) with the \textbf{oci} feature. To use syd-oci with \emph{docker}(1) you have two options: Either start \emph{dockerd}(8) manually with the option \textbf{-\/-add-runtime=syd-oci=/bin/syd-oci}, and do for example \textbf{docker run -it -\/-runtime=syd-oci alpine} when starting containers, or add the following snippet to your \textbf{/etc/docker/daemon.json} file:

{\scriptsize \begin{verbatim}
{
"runtimes": { "syd-oci": { "path": "/bin/syd-oci" } },
"default-runtime": "syd-oci"
}
\end{verbatim}}

You may need to adapt the path to syd-oci depending on your installation. To use with \emph{podman}(1) is similar, just pass \textbf{-\/-runtime=/bin/syd-oci} as an option to \textbf{podman run}.

\section{CONFIGURATION}\label{configuration-2}

The configuration directory of syd-oci is one of the following:

\begin{itemize}
\item
  For system-wide containers: \textbf{/etc/syd/oci}
\item
  For rootless containers, one of the following: - \textbf{\$\{XDG\_CONFIG\_HOME\}/syd/oci} where XDG\_CONFIG\_HOME is usually \textbf{\textasciitilde/.config}. - \textbf{\$\{HOME\}/.syd/oci} if XDG\_CONFIG\_HOME is not set.
\end{itemize}

syd-oci attempts to configure the \emph{syd}(1) sandbox in the following order, and parses the first file or profile it locates and stops processing, the environment variable \textbf{SYD\_OCI\_NO\_CONFIG} may be set to skip to the final step:

\begin{itemize}
\item
  If hostname and domainname is defined for the container, try to load \textbf{\$\{SYD\_CONFIG\_DIR\}/\$\{hostname\}.\$\{domainname\}.syd-3}.
\item
  If domainname is defined for the container, try to load \textbf{\$\{SYD\_CONFIG\_DIR\}/\$\{domainname\}.syd-3}.
\item
  If hostname is defined for the container, try to load \textbf{\$\{SYD\_CONFIG\_DIR\}/\$\{hostname\}.syd-3}.
\item
  Try to load \textbf{\$\{SYD\_CONFIG\_DIR\}/default.syd-3}
\item
  Load the builtin \textbf{oci} profile. This profile is designed to be combined with \emph{pandora}(1) and learning mode. See \textbf{syd-cat -p oci} for the list of rules.
\end{itemize}

SYD\_CONFIG\_DIR in the items above refer to the configuration directory. Refer to \emph{syd}(5) for the syntax of \emph{syd}(1) configuration files and \emph{syd}(2) for a list of configuration items \emph{syd}(1) understands. A \emph{vim}(1) syntax highlighting file is also provided to easily edit \emph{syd}(1) configuration files. Use \textbf{syd-cat file.syd-3} to check a \emph{syd}(1) configuration file for syntax errors.

Finally, note that the \textbf{include} directives in the configuration files are searched within the container image. This allows you to provide additional image-based sandbox configuration. One possible use could be to store cryptographic checksums of all executables and their dependent dynamic libraries in an include file in the image and then use this with Force Sandboxing for binary verification, see \emph{syd}(7) for more information on Force Sandboxing.

\section{SEE ALSO}\label{see-also-27}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd}(7), \emph{pandora}(1), \emph{docker}(1), \emph{dockerd}(8), \emph{podman}(1), \emph{youki}(1)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\item
  \textbf{youki} homepage: https://containers.github.io/youki/
\end{itemize}

\section{AUTHORS}\label{authors-28}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-ofd(1)}\label{syd-ofd1}

\section{NAME}\label{name-29}

\textbf{syd-ofd} - Take a lock on a file, then execute into another program

\section{SYNOPSIS}\label{synopsis-27}

\textbf{syd-ofd} \emph{{[}-n \textbar{} -N{]}} \emph{{[}-t timeout{]}} \emph{{[}-d fd{]}} \emph{{[}-s=-r \textbar{} -x=-w{]}} \emph{file} \{command {[}arg...{]}\}

\section{DESCRIPTION}\label{description-27}

syd-ofd takes a lock on a file, then executes into another program. It is functionally identical to the \emph{s6-setlock}(1) utility except it uses OFD locks which are new in POSIX 2024. This lock type is also known as "file-private locks" and is open file description-based rather than process based like the old-style POSIX locks that \emph{s6-setlock}(1) uses. This allows \emph{syd}(1) to pass the file descriptor to the sandbox process and close its own copy while the sandbox process still holding the lock which is not possible with old style locks and \emph{s6-setlock}(1).

\section{OPTIONS}\label{options-19}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-n} & Nonblocking lock. If syd-ofd cannot acquire the lock, it will exit 11 ("EAGAIN": Try again) immediately. \\
\textbf{-N} & Blocking lock. syd-ofd will wait until it can acquire the lock. This is the default. \\
\textbf{-t timeout} & Timed lock. If syd-ofd cannot acquire the lock after timeout milliseconds, it will exit 4 ("EINTR": Interrupted system call). \\
\textbf{-s=-r} & Shared lock. Other shared locks on the same file will not prevent the lock from being acquired (but an exclusive lock will). \\
& The \textbf{-r} option is retained for compatibility with the \emph{s6-setlock}(1) utility. \\
\textbf{-x=-w} & Exclusive lock. This is the default. \\
& The \textbf{-w} option is retained for compatibility with the \emph{s6-setlock}(1) utility. \\
\textbf{-d fd} & Make the lock visible in \emph{program} on file descriptor \emph{fd}. \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-2}

On clean exit, \textbf{syd-ofd} exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails \textbf{syd-ofd} exits with the \emph{errno}(3) number.

\section{SECURITY}\label{security-5}

\textbf{syd-ofd} uses \emph{openat}(2) with the resolve flags RESOLVE\_NO\_MAGICLINKS and RESOLVE\_NO\_SYMLINKS when opening or creating the lock file. Consequently, if any component of the specified path is a symbolic link, the call fails and returns error code 40 (ELOOP: "Too many symbolic links encountered"). In the same manner, the presence of any \textbf{..} (dot-dot) component in the lock-file path causes the call to fail and return error code 13 (EACCES: "Permission denied"). This restriction is intended to mitigate confused-deputy vulnerabilities during lock-file creation and related file operations by preventing an intermediary or less-privileged actor from redirecting the operation via symbolic links or parent-directory (\textbf{..}) components to an unintended filesystem location.

\section{SEE ALSO}\label{see-also-28}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-lock}(1), \emph{syd-mdwe}(1), \emph{syd-pds}(1), \emph{syd-sec}(1), \emph{s6-setlock}(1), \emph{fcntl}(2), \emph{F\_OFD\_SETLKW(2const)}, \emph{openat2}(2)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\item
  \textbf{s6-setlock} manpage: https://skarnet.org/software/s6/s6-setlock.html
\item
  \textbf{POSIX 2024} \emph{fcntl}(2) manpage: https://pubs.opengroup.org/onlinepubs/9799919799/functions/fcntl.html
\end{itemize}

\section{AUTHORS}\label{authors-29}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-path(1)}\label{syd-path1}

\section{NAME}\label{name-30}

\textbf{syd-path} - Write Force sandboxing rules for binaries and list executables under PATH

\section{SYNOPSIS}\label{synopsis-28}

\textbf{syd-path} \emph{{[}-h1235cCeklmpsw{]}}

\section{DESCRIPTION}\label{description-28}

Write Force sandboxing rules for binaries under PATH.

If at least one of the various \textbf{-e} options is specified, list executables with specified information under PATH.

\section{OPTIONS}\label{options-20}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-c} & Calculate CRC64 checksum (insecure). \\
\textbf{-C} & Calculate CRC32 checksum (insecure). \\
\textbf{-m} & Calculate MD5 checksum (insecure, portage/paludis vdb compat). \\
\textbf{-1} & Calculate SHA1 checksum (insecure). \\
\textbf{-2} & Calculate SHA3-256 checksum. \\
\textbf{-3} & Calculate SHA3-384 checksum. \\
\textbf{-5} & Calculate SHA3-512 checksum (default). \\
\textbf{-k} & Use action kill (default). \\
\textbf{-w} & Use action warn. \\
\textbf{-l} \textbf{num} & Limit by number of entries. \\
\textbf{-p} \textbf{path} & Specify alternative PATH. \\
\textbf{-s} & Prefix rules with "/dev/syd/". \\
\textbf{-e32} & List 32-bit ELF executables under PATH (conflicts with \textbf{-e64}). \\
\textbf{-e64} & List 64-bit ELF executables under PATH (conflicts with \textbf{-e32}). \\
\textbf{-ed} & List dynamically linked ELF executables under PATH (conflicts with \textbf{-es}). \\
\textbf{-es} & List statically linked ELF executables under PATH (conflicts with \textbf{-ed}). \\
\textbf{-ep} & List PIE executables under PATH (conflicts with \textbf{-eP}). \\
\textbf{-eP} & List non-PIE executables under PATH (conflicts with \textbf{-ep}). \\
\textbf{-ex} & List scripts under PATH. \\
\textbf{-eX} & List binaries with executable stack under PATH. \\
\end{xltabular}

\section{BUGS}\label{bugs}

This tool will skip any failure silently.

\section{SEE ALSO}\label{see-also-29}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-30}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-pause(1)}\label{syd-pause1}

\section{NAME}\label{name-31}

\textbf{syd-pause} - Block forever (until signaled), optionally ignoring selected signals

\section{SYNOPSIS}\label{synopsis-29}

\textbf{syd-pause} \emph{{[} -t {]}} \emph{{[} -h {]}} \emph{{[} -a {]}} \emph{{[} -q {]}} \emph{{[} -b {]}} \emph{{[} -i {]}} \emph{{[} -p signals {]}}

\section{DESCRIPTION}\label{description-29}

\textbf{syd-pause} is a tiny, long-lived process that simply waits until it is terminated by a signal. By default, it honors all standard termination signals; options allow you to ignore specific signals so the process continues running when they are delivered. This is useful as a minimal placeholder, supervisor target, or synchronization sentinel in service pipelines and sandboxes.

\section{OPTIONS}\label{options-21}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-\/-help} & Display help. \\
\textbf{-t} & Ignore SIGTERM. \\
\textbf{-h} & Ignore SIGHUP. \\
\textbf{-a} & Ignore SIGALRM. \\
\textbf{-q} & Ignore SIGQUIT. \\
\textbf{-b} & Ignore SIGABRT. \\
\textbf{-i} & Ignore SIGINT. \\
\textbf{-p signals} & Ignore the comma-separated list of signal numbers given in signals (e.g.~-p 1,2,3,15). \\
& Numbers must be valid per \emph{signal}(7). This flag can be combined with the short flags above. \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-3}

On normal termination by a signal, \textbf{syd-pause} exits 0. On errors \textbf{syd-pause} exits with the corresponding \emph{errno}(3) value.

\section{SEE ALSO}\label{see-also-30}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-ofd}(1), \emph{s6-pause}(1), \emph{pause}(2)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\item
  \textbf{s6-pause} manpage: https://skarnet.org/software/s6/s6-pause.html
\end{itemize}

\section{AUTHORS}\label{authors-31}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-pds(1)}\label{syd-pds1}

\section{NAME}\label{name-32}

\textbf{syd-pds} - Run a command with parent death signal set

\section{SYNOPSIS}\label{synopsis-30}

\textbf{syd-pds} \emph{{[}-h{]}} \emph{{[}-s signal{]}} \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-30}

The \emph{syd-pds}(1) utility runs a command with the parent death signal set. When the parent process dies, the specified signal will be delivered to the command. The signal defaults to SIGKILL.

\section{OPTIONS}\label{options-22}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-s} \emph{signal} & Set parent death signal to the specified signal. Defaults to SIGKILL. \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-4}

\textbf{syd-pds} exits with the same code as the child process.

\section{SEE ALSO}\label{see-also-31}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-lock}(1), \emph{syd-mdwe}(1), \emph{syd-ofd}(1), \emph{syd-sec}(1), \emph{PR\_SET\_PDEATHSIG}(2)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-32}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-poc(1)}\label{syd-poc1}

\section{NAME}\label{name-33}

\textbf{syd-poc} - POC\textbar\textbar GTFO! Demonstrate various sandbox break vectors.

\section{SYNOPSIS}\label{synopsis-31}

\textbf{syd-poc} \emph{{[}-h{]}} \emph{{[}command{]}} \emph{{[}args...{]}}

\section{DESCRIPTION}\label{description-31}

\textbf{syd-poc} is a simple utility to demonstrate proof of concepts for various sandbox break vectors. Use this tool to break the chains of your imagination and find new, novel ways to break out of sandboxen and keep us posted to spread the fun!

\section{OPTIONS}\label{options-23}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\end{xltabular}

\section{BUGS}\label{bugs-1}

User must ensure the benign path is at least as long as the target path or there\textquotesingle s a risk out-of-bounds write typically followed by a segmentation fault.

\section{SEE ALSO}\label{see-also-32}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-33}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-pty(1)}\label{syd-pty1}

\section{NAME}\label{name-34}

\textbf{syd-pty} - PTY to STDIO bidirectional forwarder

\section{SYNOPSIS}\label{synopsis-32}

\textbf{syd-pty} \emph{{[}-dh{]}} \emph{{[}-x \textless x-size\textgreater{]}} \emph{{[}-y \textless y-size\textgreater{]}} \emph{-p \textless pid-fd\textgreater{}} \emph{-i \textless pty-fd\textgreater{}}

\section{DESCRIPTION}\label{description-32}

Forwards data between the given \emph{pty}(7) main file descriptor, and \emph{stdio}(3).

PID file descriptor is used to track the exit of Syd process.

\section{OPTIONS}\label{options-24}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-d} & Run in debug mode without confinement. \\
\textbf{-p} \textbf{pid-fd} & PID file descriptor of Syd process. \\
\textbf{-i} \textbf{pty-fd} & PTY main file descriptor. \\
\textbf{-x} \textbf{x-size} & Specify window row size (default: inherit). \\
\textbf{-y} \textbf{y-size} & Specify window column size (default: inherit). \\
\end{xltabular}

\section{USAGE}\label{usage}

\emph{syd-pty}(1) is not meant to be used as a standalone tool. Syd invokes \emph{syd-pty}(1) at startup when PTY sandboxing is set to on with \textbf{sandbox/pty:on}. See the PTY SANDBOXING section in \emph{syd}(7) manual page for more information. If you want to use \emph{syd-pty}(1) in your own project, what you need to do first is to pass it a \emph{non-blocking} PID fd of your own process with the \textbf{-p \textless pid-fd\textgreater{}} argument so \emph{syd-pty}(1) can simultaneously exit with it. Care should be given at this stage as PID file descriptors are \textbf{O\_CLOEXEC} by default. Next create a new pseudoterminal with \emph{posix\_openpt}(3) or \emph{openpty}(3) and pass the main end of the file descriptor pair to \emph{syd-pty}(1) with the \textbf{-i \textless pty-fd\textgreater{}} argument.

\section{IMPLEMENTATION}\label{implementation}

\emph{syd-pty}(1) is designed with performance, security, and privacy in mind, utilizing advanced techniques such as edge-triggered \emph{epoll}(7) for efficient event notification and full asynchronous operations to handle pseudoterminal activities without blocking. It employs zero-copy data transfer using the \emph{splice}(2) system call to move data directly between file descriptors within the kernel, ensuring high performance and data privacy. To facilitate bidirectional communication, \emph{syd-pty}(1) uses two pairs of pipes, allowing seamless data flow between \emph{pty}(7) and \emph{stdio}(3). Additionally, \emph{syd-pty}(1) confines its execution environment using seccomp and Landlock, restricting system calls and file accesses to minimize the attack surface.

\section{SECURITY}\label{security-6}

\emph{syd-pty}(1) implements comprehensive security measures to mitigate risks associated with running outside the Syd sandbox, thus preventing potential Meddler-in-the-Middle (MITM) attacks against containers. Resource limits \textbf{RLIMIT\_FSIZE}, \textbf{RLIMIT\_NOFILE}, and \textbf{RLIMIT\_NPROC} are set to zero to prevent file/fd/process creation inside the main loop. Seccomp filters are meticulously configured to allow only necessary syscalls. Moreover, executable memory is disallowed to prevent code injection attacks. Landlock and namespaces, if available, enforce further restrictions by disallowing all filesystem and network access, providing an additional layer of security. Additionally, the main PTY file descriptor is placed into exclusive mode via the \textbf{TIOCEXCL} \emph{ioctl}(2) request. This prevents any further opens of the secondary PTY device (save for processes with the \textbf{CAP\_SYS\_ADMIN} capability), thereby reducing the attack surface for unauthorized eavesdropping or input injection at the device layer as part of a defense-in-depth strategy. These combined techniques ensure that even if \emph{syd-pty}(1) is compromised, the scope of malicious actions is significantly limited, maintaining the integrity and security of the overall system.

\section{ENVIRONMENT}\label{environment-2}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{SYD\_PTY\_DEBUG} & Run in debug mode without confinement, equivalent to the \textbf{-d} option \\
\textbf{SYD\_PTY\_RULES} & Print seccomp rules in human-readable format to standard error at startup \\
\end{xltabular}

\section{BUGS}\label{bugs-2}

\emph{splice}(2) support for ttys was removed in commit 36e2c7421f02a22f71c9283e55fdb672a9eb58e7 (merged for Linux 6.5) and later restored in commit 9bb48c82aced07698a2d08ee0f1475a6c4f6b266 (merged for Linux 6.6). When running under a problematic Linux kernel \emph{syd-pty}(1) will exit with 22, aka \textbf{EINVAL} or \textbf{Invalid argument}. See the following links for more information:

\begin{itemize}
\item
  https://git.kernel.org/linus/36e2c7421f02a22f71c9283e55fdb672a9eb58e7
\item
  https://git.kernel.org/linus/9bb48c82aced07698a2d08ee0f1475a6c4f6b266
\end{itemize}

\section{SEE ALSO}\label{see-also-33}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(7), \emph{stdio}(3), \emph{pty}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-34}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-read(1)}\label{syd-read1}

\section{NAME}\label{name-35}

\textbf{syd-read} - Print resolved symbolic links or canonical file names

\section{SYNOPSIS}\label{synopsis-33}

\textbf{syd-read} \emph{{[}-hmnzBDFMNPRUX{]}} \emph{{[}-c n{]}} \emph{{[}-d dir{]}} \emph{{[}-p pid{]}} \emph{path...}

\section{DESCRIPTION}\label{description-33}

The \textbf{syd-read} utility prints resolved symbolic links or canonical file names. By default last component may exist, other components must exist.

\section{OPTIONS}\label{options-25}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-c} \textbf{n} & Cycle through the path list \textbf{n} times, useful for benchmarking. \\
\textbf{-d} \textbf{dir} & Resolve relative to the given directory. \\
\textbf{-p} \textbf{pid} & Resolve from the perspective of the given process ID. \\
\textbf{-m} & All components of the paths must exist, conflicts with \textbf{-M}. \\
\textbf{-M} & Last component must not exist, other components must exist, conflicts with \textbf{-m}. \\
\textbf{-B} & Resolve beneath the given directory, useful with \textbf{-d dir}. Implies \textbf{-P}, conflicts with \textbf{-R}. \\
\textbf{-R} & Treat the given directory as root directory, useful with \textbf{-d dir}. Implies \textbf{-P}, conflicts with \textbf{-B}. \\
\textbf{-D} & Do not traverse through ".." components. \\
\textbf{-X} & Do not traverse through mount points. \\
\textbf{-F} & Do not follow symbolic links for any of the path components. \\
\textbf{-N} & Do not follow symbolic links for the last path component. \\
\textbf{-P} & Do not resolve /proc magic symbolic links. \\
\textbf{-U} & Resolve unsafe /proc magic symbolic links. \\
\textbf{-n} & Do not output the trailing delimiter. \\
\textbf{-z} & End each output line with NUL not newline. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-34}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{readlink}(1), \emph{realpath}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-35}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-rnd(1)}\label{syd-rnd1}

\section{NAME}\label{name-36}

\textbf{syd-rnd} - Print AT\_RANDOM bytes in various formats

\section{SYNOPSIS}\label{synopsis-34}

\textbf{syd-rnd} \emph{{[}-hinr{]}}

\section{DESCRIPTION}\label{description-34}

Given no arguments, print AT\_RANDOM bytes in lower hexadecimal format.

Given \textbf{-r}, print raw bytes.

Given \textbf{-i}, print an unsigned 64-bit integer.

Given \textbf{-n}, print a human-readable name.

\section{OPTIONS}\label{options-26}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-r} & Print raw bytes. \\
\textbf{-i} & Print an unsigned 64-bit integer. \\
\textbf{-n} & Print a human-readable name. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-35}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-36}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-run(1)}\label{syd-run1}

\section{NAME}\label{name-37}

\textbf{syd-run} - Run a program inside a container with the given process ID

\section{SYNOPSIS}\label{synopsis-35}

\textbf{syd-run} \emph{{[}-hvacimnptuU{]}} \emph{pid} \emph{\{command {[}arg...{]}\}}

\section{DESCRIPTION}\label{description-35}

The \emph{syd-run}(2) utility runs a program inside a \emph{syd}(1) container with the given process ID. This requires the use of system calls \emph{setns}(2), and \emph{pidfd\_open}(2) which require Linux-5.8 or newer. Note, entering \emph{pid\_namespaces}(7) and \emph{time\_namespaces}(7) is a privileged operation, whereas entering \emph{cgroup\_namespaces}(7), \emph{ipc\_namespaces}(7), \emph{mount\_namespaces}(7), \emph{network\_namespaces}(7), and \emph{uts\_namespaces}(7) is unprivileged when combined with \emph{user\_namespaces}(7) provided that unprivileged \emph{user\_namespaces}(7) support is enabled in the Linux kernel.

\section{OPTIONS}\label{options-27}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-v} & Be verbose. Print informational messages on standard error. \\
\textbf{-a} & Auto-detect namespaces to enter. PID and Time namespaces are excluded. This is the default. \\
\textbf{-c} & Enter into CGroup namespace. \\
\textbf{-i} & Enter into IPC namespace. \\
\textbf{-m} & Enter into mount namespace. \\
\textbf{-n} & Enter into network namespace. \\
\textbf{-p} & Enter into PID namespace. \\
\textbf{-t} & Enter into time namespace. \\
\textbf{-u} & Enter into UTS namespace. \\
\textbf{-U} & Enter into user namespace. \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-5}

On clean exit, \emph{syd-run}(1) exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails \emph{syd-run}(1) exits with the \emph{errno}(3) number.

\section{SEE ALSO}\label{see-also-36}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{setns}(2), \emph{pidfd\_open}(2)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-37}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-sec(1)}\label{syd-sec1}

\section{NAME}\label{name-38}

\textbf{syd-sec} - Print secure bits or run command with secure bits set

\section{SYNOPSIS}\label{synopsis-36}

\textbf{syd-sec} \emph{{[}-ahikprsxAIKPRSX{]}} \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-36}

Given no arguments, print information on process secure bits in compact JSON.

Given no command, one or more of the secure bit options \emph{{[}-aikprsx{]}} may be given to test for secure bits. Use capital letter options, \emph{{[}-AIKPRSX{]}}, to test for locked versions of respective secure bits.

Given a command and arguments, with at least one of the secure bit options \emph{{[}-aikprsxAIKRSX{]}} set the specified securebits, execute the command and exit with the same status.

\section{OPTIONS}\label{options-28}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help and exit. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-p, -P} & Set/test process no\_new\_privs attribute. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-r, -R} & Set/test secure bit SECBIT\_NOROOT. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-s, -S} & Set/test secure bit SECBIT\_NO\_SETUID\_FIXUP. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-k, -K} & Set/test secure bit SECBIT\_KEEP\_CAPS. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-a, -A} & Set/test secure bit SECBIT\_NO\_CAP\_AMBIENT\_RAISE. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-x, -X} & Set/test secure bit SECBIT\_EXEC\_RESTRICT\_FILE. \\
\end{xltabular}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-i, -I} & Set/test secure bit SECBIT\_EXEC\_DENY\_INTERACTIVE. \\
\end{xltabular}

\section{SECURE BITS}\label{secure-bits}

\begin{xltabular}[l]{\linewidth}{@{} lX X @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{Securebit} & \textbf{Description} & \textbf{CAP\_SETPCAP required?} \\
NO\_NEW\_PRIVS & When set, \emph{execve}(2) will not grant new privileges (e.g., set-user-ID/set-group-ID mode bits and file capabilities are ignored). Inherited across \emph{fork}(2), \emph{clone}(2), and \emph{execve}(2); once set, cannot be unset. & No \\
NOROOT & Disable special handling of UID 0 for gaining capabilities on exec/setuid. NOROOT\_LOCKED is lock for NOROOT (prevents further changes; irreversible). & Yes \\
NO\_SETUID\_FIXUP & Stop kernel adjustments to permitted/effective/ambient capability sets when effective/filesystem UIDs toggle between 0 and nonzero. NO\_SETUID\_FIXUP\_LOCKED is lock for NO\_SETUID\_FIXUP (prevents further changes; irreversible). & Yes \\
KEEP\_CAPS & Allow retaining permitted capabilities when switching all UIDs from 0 to nonzero; always cleared on \emph{execve}(2). KEEP\_CAPS\_LOCKED is lock for KEEP\_CAPS (prevents further changes; irreversible). & Yes \\
NO\_CAP\_AMBIENT\_RAISE & Disallow raising ambient capabilities via \emph{prctl(PR\_CAP\_AMBIENT\_RAISE)}. NO\_CAP\_AMBIENT\_RAISE\_LOCKED is lock for NO\_CAP\_AMBIENT\_RAISE (prevents further changes; irreversible). & Yes \\
EXEC\_RESTRICT\_FILE & Interpreter/dynamic linker should execute a file only if \emph{execveat}(2) with AT\_EXECVE\_CHECK on the related file descriptor succeeds. EXEC\_RESTRICT\_FILE\_LOCKED is lock for EXEC\_RESTRICT\_FILE (prevents further changes; irreversible). & No \\
EXEC\_DENY\_INTERACTIVE & Interpreter should not accept interactive user commands; content via a file descriptor is allowed only if \emph{execveat}(2) with AT\_EXECVE\_CHECK succeeds. EXEC\_DENY\_INTERACTIVE\_LOCKED is lock for EXEC\_DENY\_INTERACTIVE (prevents further changes; irreversible). & No \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-6}

When querying secure bits, \textbf{syd-sec} exits with success if all the specified secure bits are set in process secure bits. When running a command, \textbf{syd-sec} exits with the same code as the child process. If \emph{PR\_SET\_SECUREBITS}(2const) \emph{prctl}(2) operation fails prior to command execution, \textbf{syd-sec} exits with \emph{errno}(3).

\section{SEE ALSO}\label{see-also-37}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{syd-lock}(1), \emph{syd-mdwe}(1), \emph{syd-ofd}(1), \emph{syd-pds}(1), \emph{PR\_GET\_SECUREBITS}(2const), \emph{PR\_SET\_SECUREBITS}(2const)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-38}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-sh(1)}\label{syd-sh1}

\section{NAME}\label{name-39}

\textbf{syd-sh} - Simple confined shell based on \emph{wordexp}(3)

\section{SYNOPSIS}\label{synopsis-37}

\textbf{syd-sh} {[}-helsx{]} {[}-\/-{]} {[}\emph{command\_file} {[}argument...{]}{]}

\textbf{syd-sh} {[}-helx{]} -c \emph{command\_string} {[}\emph{command\_name} {[}argument...{]}{]}

\section{DESCRIPTION}\label{description-37}

\textbf{syd-sh} is a simple confined shell based on \emph{wordexp}(3). Each command is executed in its own confined environment. Confinement is done using Landlock, namespaces and seccomp. Command timeout is 3 seconds.

\section{OPTIONS}\label{options-29}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-c} & Read commands from the given \emph{command\_string} operand. No commands are read from standard input. \\
\textbf{-e} & If not interactive, exit immediately if any untested command fails. \\
\textbf{-l} & Ignored, login shell compatibility \\
\textbf{-s} & Read commands from the standard input. If no operands and the \textbf{-c} is not specified, the \textbf{-s} option is assumed. \\
\textbf{-x} & Write each command to standard error (preceded by a "+ ") before it is executed. Useful for debugging. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-38}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{wordexp}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-39}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-sha(1)}\label{syd-sha1}

\section{NAME}\label{name-40}

\textbf{syd-sha} - Calculate SHA3-512 checksum of the given file or standard input

\section{SYNOPSIS}\label{synopsis-38}

\textbf{syd-sha} \emph{{[}-bcChmx1235{]}} \emph{\textless file\textbar-\textgreater{}}

\section{DESCRIPTION}\label{description-38}

Given a file, calculate the checksum of the file.

Given no positional arguments or "-" as argument, calculate checksum of standard input.

Use \textbf{-b} to print binary output rather than hex-encoded string.

\section{OPTIONS}\label{options-30}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-b} & Binary output. \\
\textbf{-x} & Hexadecimal output (default). \\
\textbf{-c} & Calculate CRC64 checksum (insecure). \\
\textbf{-C} & Calculate CRC32 checksum (insecure). \\
\textbf{-m} & Calculate MD5 checksum (insecure, portage/paludis vdb compat). \\
\textbf{-1} & Calculate SHA1 checksum (insecure). \\
\textbf{-2} & Calculate SHA3-256 checksum. \\
\textbf{-3} & Calculate SHA3-384 checksum. \\
\textbf{-5} & Calculate SHA3-512 checksum (default). \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-39}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-40}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-size(1)}\label{syd-size1}

\section{NAME}\label{name-41}

\textbf{syd-size} - Print and parse human-formatted sizes

\section{SYNOPSIS}\label{synopsis-39}

\textbf{syd-size} \emph{size\textbar human-size}

\section{DESCRIPTION}\label{description-39}

Given a number, \textbf{syd-size} prints human-formatted size.

Given a string, \textbf{syd-size} parses human-formatted size into bytes and prints it.

\section{SEE ALSO}\label{see-also-40}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\textbf{parse-size} documentation: https://docs.rs/parse-size/latest/parse\_size/

\section{AUTHORS}\label{authors-41}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-stat(1)}\label{syd-stat1}

\section{NAME}\label{name-42}

\textbf{syd-stat} - Print detailed information about a process in JSON format

\section{SYNOPSIS}\label{synopsis-40}

\textbf{syd-stat} \emph{{[}pid{]}}

\section{DESCRIPTION}\label{description-40}

\textbf{syd-stat} utility prints detailed information about a process with the given process ID. The information is printed in line-oriented \textbf{JSON} format and may be further mangled with tools such as \emph{jq}(1). Source of information are the per-process files \emph{proc\_pid\_stat}(5) and \emph{/proc/pid/status}(5).

\section{SEE ALSO}\label{see-also-41}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{proc\_pid\_stat}(5), \emph{proc\_pid\_status}(5), \emph{jq}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-42}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-sys(1)}\label{syd-sys1}

\section{NAME}\label{name-43}

\textbf{syd-sys} - Lookup syscalls, errnos, ioctls, open flags, and signals by number or regular expression

\section{SYNOPSIS}\label{synopsis-41}

\textbf{syd-sys} \emph{{[}-heios{]}} \emph{{[}-a arch{]}} \emph{number\textbar regex}

\textbf{syd-sys} \emph{-a list}

\textbf{syd-sys} \emph{{[}-uU{]}}

\section{DESCRIPTION}\label{description-41}

Given a number, \textbf{syd-sys} prints the matching syscall name.

Given a regex, \textbf{syd-sys} prints case-insensitively matching syscall names.

Use \textbf{-e} to query \emph{errno}(3) numbers.

Use \textbf{-i} to query \emph{ioctl}(2) requests.

Use \textbf{-o} to query \emph{open}(2) flags.

Use \textbf{-s} to query \emph{signal}(7) numbers.

Use \textbf{-u} to list UNIX domain socket inodes using \emph{netlink}(7).

Use \textbf{-U} to list UNIX domain socket inodes using \emph{proc\_net}(5).

\section{OPTIONS}\label{options-31}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-a} & Specify alternative architecture, such as \textbf{x86}, \textbf{x86\_64} and \textbf{aarch64}. \\
& Use \textbf{list} to print the list of libseccomp supported architectures. \\
\textbf{-e} & Query \emph{errno}(3) numbers \\
\textbf{-i} & Query \emph{ioctl}(2) requests \\
\textbf{-o} & Query \emph{open}(2) flags \\
\textbf{-s} & Query \emph{signal}(7) numbers \\
\textbf{-u} & List UNIX domain socket inodes using \emph{netlink}(7) \\
\textbf{-U} & List UNIX domain socket inodes using \emph{proc\_net}(5) \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-42}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{errno}(3), \emph{ioctl}(2), \emph{open}(2), \emph{syscall}(2), \emph{signal}(7), \emph{netlink}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-43}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-test(1)}\label{syd-test1}

\section{NAME}\label{name-44}

\textbf{syd-test} - Run syd integration tests

\section{SYNOPSIS}\label{synopsis-42}

\textbf{syd-test} \emph{{[}\textless regex\textgreater\textbar\textless number\textgreater\textbar\textless number\textgreater..\textless number\textgreater{]}..}

\section{DESCRIPTION}\label{description-42}

The \textbf{syd-test} utility may be used to run syd integration tests.

Requires \textbf{syd-test-do} utility to be in \textbf{PATH}.

\section{SEE ALSO}\label{see-also-43}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-44}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-tck(1)}\label{syd-tck1}

\section{NAME}\label{name-45}

\textbf{syd-tck} - Measure runtime in Hardware Ticks

\section{SYNOPSIS}\label{synopsis-43}

\textbf{syd-tck} \emph{\{command {[}args...{]}\}}

\section{DESCRIPTION}\label{description-43}

syd-tck utility runs the given command with optional arguments and measures its runtime in hardware ticks, prints information about it and exits with the same exit code as the program or 128 plus the signal value if the command was terminated.

\section{OUTPUT}\label{output}

{\scriptsize \begin{verbatim}
true    code:0 total:0.00s td:285 freq:2494511485Hz prec:0.40ns pid:1 tc:322191649243995
\end{verbatim}}

Sample output looks like this on x86-64, below are explanations of each field:

\begin{enumerate}
\def\labelenumi{\arabic{enumi}.}
\item
  The name of the command
\item
  Exit code
\item
  Total runtime in seconds
\item
  Total runtime in ticks (tick duration)
\item
  Frequency in Hertz
\item
  Precision in nanoseconds
\item
  Processor ID
\item
  Tick counter
\end{enumerate}

\section{PORTABILITY}\label{portability}

syd-tck only works on architectures aarch64 and x86-64.

\section{SEE ALSO}\label{see-also-44}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-45}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-tor(1)}\label{syd-tor1}

\section{NAME}\label{name-46}

\textbf{syd-tor} - SOCKS Proxy Forwarder

\section{SYNOPSIS}\label{synopsis-44}

\textbf{syd-tor} \emph{{[}-dh{]}} \emph{-p \textless pid-fd\textgreater{}} \emph{-i \textless socket-fd\textgreater{}} \emph{{[}-o addr:port{]}} \emph{{[}-u unix-sock{]}}

\section{DESCRIPTION}\label{description-44}

Receives listening socket from fd and forwards traffic to addr:port or UNIX socket.

External address must either be an IPv4, or an IPv6 address or path to a UNIX domain socket, defaults to \textbf{127.0.0.1:9050}.

PID file descriptor is used to track the exit of Syd process.

\section{OPTIONS}\label{options-32}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-d} & Run in debug mode without confinement. \\
\textbf{-p} \textbf{pid-fd} & PID file descriptor of Syd process. \\
\textbf{-i} \textbf{socket-fd} & Socket file descriptor to receive the listening socket from. \\
\textbf{-o} \textbf{ext-addr} & Specify external address to forward traffic to. \\
& Address may be an IPv4/IPv6 address in format "addr:port". \\
& Defaults to "127.0.0.1:9050". \\
\textbf{-u} \textbf{unix-sock} & Specify UNIX domain socket to forward traffic to. \\
& This option has precedence over \textbf{-o}. \\
\end{xltabular}

\section{USAGE}\label{usage-1}

\emph{syd-tor}(1) is not meant to be used as a standalone tool. Syd invokes \emph{syd-tor}(1) at startup when Proxy sandboxing is set to on with "sandbox/proxy:on". See the PROXY SANDBOXING section in \emph{syd}(7) manual page for more information. If you want to use \emph{syd-tor}(1) in your own project, what you need to do first is to pass it a \emph{non-blocking} PID fd of your own process with the "-p \textless pid-fd\textgreater" argument so \emph{syd-tor}(1) can simultaneously exit with it. Care should be given at this stage as PID file descriptors are "O\_CLOEXEC" by default. Next, create a UNIX socket-pair, enter a network namespace, bring up the loopback device, \emph{bind}(2) a socket to a port on it and then send this socket file descriptor through the write end of the socket-pair with \emph{sendmsg}(2) "SCM\_RIGHTS" option. Finally pass the read end of the socket-pair to \emph{syd-tor}(1) with the "-i \textless socket-fd\textgreater" argument.

\section{IMPLEMENTATION}\label{implementation-1}

\emph{syd-tor}(1) is designed with performance, security, and privacy in mind, utilizing advanced techniques such as edge-triggered \emph{epoll}(7) for efficient event notification and full asynchronous operations to handle multiple connections without blocking. It employs zero-copy data transfer using the \emph{splice}(2) system call to move data directly between file descriptors within the kernel, ensuring high performance and data privacy. To facilitate bidirectional communication, \emph{syd-tor}(1) uses two pairs of pipes, allowing seamless data flow between the client and the external address. Additionally, \emph{syd-tor}(1) confines its execution environment using \emph{seccomp}(2) and \emph{landlock}(7), restricting system calls and file accesses to minimize the attack surface. Compared to socksns, which uses the Tokio runtime for asynchronous I/O, \emph{syd-tor}(1) emphasizes kernel-level efficiency and security, making it a robust solution for SOCKS proxy forwarding.

\section{SECURITY}\label{security-7}

\emph{syd-tor}(1) implements comprehensive security measures to mitigate risks associated with running outside the Syd sandbox, thus preventing potential Meddler-in-the-Middle (MITM) attacks against containers. \emph{seccomp}(2) filters are carefully configured to allow only the required syscalls. The \emph{socket}(2) syscall is limited to a single domain, type, and protocol, while \emph{connect}(2) is restricted to a single memory address, preventing unauthorized network connections. \emph{sigaction}(2), and \emph{rt\_sigaction}(2) system calls are not permitted to install new signal handlers. \emph{pipe2}(2), \emph{socket}(2), \emph{connect}(2), \emph{accept4}(2), and \emph{shutdown}(2) system calls are protected by syscall argument cookies determined randomly using \emph{getrandom}(2) with GRND\_RANDOM at startup. Refer to the \textbf{Syscall Argument Cookies} section of the \emph{syd}(7) manual page for more information on argument cookies. These mitigations are most effective on 64-bit architectures, but on 32-bit systems the \emph{socketcall}(2) interface may be exploited. Therefore, additional protective measures are implemented. On Linux 6.10 and later, the memory area containing the external network address is sealed using \emph{mseal}(2) and surrounding memory is protected with guard pages to prevent overflow or adjacent corruption. Executable memory is also disallowed to prevent code injection attacks. If available, \emph{landlock}(7) and \emph{namespaces}(7) impose further restrictions by disallowing all filesystem access, thereby providing an extra layer of security. Together, these techniques ensure that even if \emph{syd-tor}(1) is compromised, the scope of malicious actions is significantly limited, maintaining the overall integrity and security of the system.

\section{ENVIRONMENT}\label{environment-3}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{SYD\_TOR\_DEBUG} & Run in debug mode without confinement, equivalent to the "-d" option \\
\textbf{SYD\_TOR\_RULES} & Print seccomp rules in human-readable format to standard error at startup \\
\end{xltabular}

\section{CAVEATS}\label{caveats-2}

The \emph{syd-tor}(1) process runs as a single process and can potentially hit file descriptor (FD) limits due to the number of FDs it opens per connection. Each client connection involves six FDs: one for the client socket, one for the external socket, and four for the pipes used for bidirectional data transfer (two pipes with an input and output FD each). To mitigate this, \emph{syd-tor}(1) sets the file-max limit to the hard limit by overriding the soft limit at startup. However, in some cases, this may not be sufficient, and manual adjustment of FD limits may be necessary.

\section{SEE ALSO}\label{see-also-45}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(7)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-46}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-tty(1)}\label{syd-tty1}

\section{NAME}\label{name-47}

\textbf{syd-tty} - Print the controlling terminal of the given process

\section{SYNOPSIS}\label{synopsis-45}

\textbf{syd-tty} \emph{{[}pid{]}}

\section{DESCRIPTION}\label{description-45}

The \textbf{syd-tty} utility prints the controlling terminal of the given process. It is similar to the \emph{tty}(1) utility except it allows printing the controlling terminal of an arbitrary process.

\section{SEE ALSO}\label{see-also-46}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{tty}(1), \emph{ttyname}(3)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-47}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-utc(1)}\label{syd-utc1}

\section{NAME}\label{name-48}

\textbf{syd-utc} - Print UTC date and time in JSON format

\section{SYNOPSIS}\label{synopsis-46}

\textbf{syd-utc}

\section{DESCRIPTION}\label{description-46}

\textbf{syd-utc} utility prints UTC date and time. The information is printed in line-oriented \textbf{JSON} format and may be further mangled with tools such as \emph{jq}(1). Source of information is the Realtime Clock using \emph{clock\_gettime}(2).

\section{SEE ALSO}\label{see-also-47}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{clock\_gettime}(2), \emph{jq}(1)

\textbf{syd} homepage: https://sydbox.exherbo.org/

\section{AUTHORS}\label{authors-48}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-uts(1)}\label{syd-uts1}

\section{NAME}\label{name-49}

\textbf{syd-uts} - Print name and information about the current kernel in JSON format

\section{SYNOPSIS}\label{synopsis-47}

\textbf{syd-uts} \emph{{[}-hdmnrsv{]}}

\section{DESCRIPTION}\label{description-47}

\textbf{syd-uts} utility prints name and information about the current kernel. The information is printed in line-oriented \textbf{JSON} format and may be further mangled with tools such as \emph{jq}(1). Source of information is the \emph{uname}(2) system call. The options \textbf{-d}, \textbf{-m}, \textbf{-n}, \textbf{-r}, \textbf{-s}, and \textbf{-v} may be used to print individual items of the \textbf{utsname} structure verbatim. If many options are given at a time the items are printed as a dot-separated list on a single line.

\section{OPTIONS}\label{options-33}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-s} & Print name of the operating system implementation. \\
\textbf{-n} & Print network name of this machine. \\
\textbf{-r} & Print release level of the operating system. \\
\textbf{-v} & Print version level of the operating system. \\
\textbf{-m} & Print machine hardware platform. \\
\textbf{-d} & Print NIS or YP domain name of this machine. \\
\end{xltabular}

\section{SEE ALSO}\label{see-also-48}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5), \emph{uname}(2), \emph{jq}(1)

\begin{itemize}
\tightlist
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\end{itemize}

\section{AUTHORS}\label{authors-49}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\chapter{syd-x(1)}\label{syd-x1}

\section{NAME}\label{name-50}

\textbf{syd-x} - Check executability of files, list executables of processes

\section{SYNOPSIS}\label{synopsis-48}

\textbf{syd-x} \emph{{[}-hcv{]}} \emph{{[}-l pid...{]}} \emph{{[}files...{]}}

\section{DESCRIPTION}\label{description-48}

\textbf{syd-x} checks executability of the given files or lists executables of the given processes. The file executability check uses the \emph{execveat}(2) system call with the flag "AT\_EXECVE\_CHECK" on Linux\textgreater=6.14 and falls back to the \emph{faccessat}(2) system call with the flag "X\_OK" on older Linux. If the \emph{-l} option is specified, list mode is activated: all following arguments are interpreted as process IDs, not files. In list mode, executable file listing is done using the "PROCMAP\_QUERY" \emph{ioctl}(2) request on Linux\textgreater=6.11 and falls back to parsing the \emph{proc\_pid\_maps}(5) file textually on older Linux.

\section{OPTIONS}\label{options-34}

\begin{xltabular}[l]{\linewidth}{@{} lX @{}}\toprule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
\textbf{-h} & Display help. \\
\textbf{-c} & Exit with success if the "AT\_EXECVE\_CHECK" flag is supported. \\
\textbf{-l} \emph{pid} & Specify a process ID to list the executables of, may be repeated. \\
\textbf{-v} & Print file check status information on standard error. \\
\end{xltabular}

\section{EXIT STATUS}\label{exit-status-7}

\textbf{syd-x} exits with 0 on success or with the errno number on failure.

\section{SEE ALSO}\label{see-also-49}

\emph{syd}(1), \emph{syd}(2), \emph{syd}(5)

\begin{itemize}
\item
  \textbf{syd} homepage: https://sydbox.exherbo.org/
\item
  Executability check: https://docs.kernel.org/next/userspace-api/check\_exec.html
\end{itemize}

\section{AUTHORS}\label{authors-50}

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in \#sydbox on Libera Chat or in \#sydbox:mailstation.de on Matrix.

\backmatter

\end{document}
