SYD(2)

NAME

/dev/syd virtual system call interface

SYNOPSIS

    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>
    struct stat stat;
    /* Execute sandbox commands */
    int stat("/dev/syd/[command]", &stat); // $ syd -m command
    int stat("/dev/syd/[config]?", &stat);
    int stat("/dev/syd/[config]:[value]", &stat); // $ syd -m config:value
    int stat("/dev/syd/[list]+[value]", &stat); // $ syd -m list+value
    int stat("/dev/syd/[list]-[value]", &stat); // $ syd -m list-value
    int stat("/dev/syd/[list]^[value]", &stat); // $ syd -m list^value
    int stat("/dev/syd/[command]![value]", &stat);
    /* Read sandbox state as JSON */
    int open("/dev/syd", O_RDONLY);
    /* Read syd.el which is the Emacs Lisp implementation of the API */
    int open("/dev/syd.el", O_RDONLY);
    /* Read syd.sh which exports esyd shell function */
    int open("/dev/syd.sh", O_RDONLY);

DESCRIPTION

The /dev/syd virtual system call interface is a unique mechanism designed for runtime configuration of the Syd sandbox environment. It enables sandboxed processes to interact with the Syd process to dynamically adjust sandbox settings or query its state. This interaction is facilitated through the use of virtual system calls, specifically via the stat(2) system call, applied to specially constructed paths under /dev/syd. This interface allows for a range of operations, including enabling or disabling sandbox features, appending or removing elements from lists, querying the sandbox state, and executing special Syd commands. Operations are specified through paths constructed with /dev/syd as the prefix, followed by a sandbox command and an operation character that denotes the desired action:

•   : for setting a value (boolean, integer, string),
•   ? for querying a value,
•   + for appending to a string vector,
•   - for removing an element from a string vector,
•   ^ for removing all matching elements from a string vector, and
•   ! for executing a special Syd command.

The type string-map is similar to string-vec, except the operator ^ does not accept an argument and removes all elements from the string map. The - operator of a string map is functionally equivalent to the ^ operator of a string vector in that both remove all matching elements from the respective set.

This interface supports a flexible and powerful method for managing sandbox policies dynamically, allowing for real-time adjustments to the security and operational behavior of sandboxed processes. libsyd is a full-featured C library designed for interfacing with the Syd stat interface. It offers functionalities for managing sandbox states, and facilitating runtime configuration and interaction with the Syd sandboxing environment. Similarly gosyd is a Go module, plsyd is a Perl module, pysyd is a Python module, rbsyd is a Ruby module, syd.el is an Emacs Lisp module, and esyd.sh is a POSIX sh module to use the Syd stat interface.

COMMANDS

The /dev/syd interface supports the following commands for runtime configuration of the sandbox. Each command can be invoked through the stat(2) system call on special paths under /dev/syd. Syd provides similar interfaces for the stat(2) interface, -m command-line option and the configuration file. Some commands may be used with lock:drop mode to further reduce privileges like pledge(2). Such commands are noted as drop in the descriptions below. Some sandbox commands only take affect when they're submitted on startup, such as unshare/user, and sandbox/lock. Such commands are noted as static in the descriptions below. Some sandbox commands are only available when Syd is built with the trusted Cargo feature. Such commands are noted as trusted in the descriptions below.

  dump

This command causes Syd to output sandbox state in pretty formatted JSON to standard error.

  stat

This command causes Syd to output sandbox state in human readable format to standard error.

  panic

This command causes Syd to exit immediately with code 127.

Due to security reasons, this command is only available via the virtual stat(2) call, it may not be used with the -m command line switch or in a configuration file.

  ghost

This command initiates Ghost mode. Ghost mode is irreversible so you can call this command only once during Syd runtime. Refer to the "Ghost mode" section of the syd(7) manual page for more information. This command implies lock:on to ensure sandbox can not be edited after initiation of ghost mode. Ghost mode is only available via the virtual stat(2) call, it can not be used with the -m command line switch or in a configuration file.

  ipc

type | string
static | yes

Configure sandbox during runtime using the given UNIX socket address with kernel-validated peer authentication. Authentication leverages SCM_CREDENTIALS and SO_PASSCRED mechanisms to verify that connecting processes share identical UID and GID with the IPC worker process. Authentication UID and GID may be overridden by ipc/uid and ipc/gid options at startup. This kernel-enforced authentication prevents privilege escalation and unauthorized access by validating credentials on every message, so that only the specified user and group or the system administrator can execute IPC commands.

If the argument starts with the character @, the address is taken to be an abstract UNIX socket. Use the keywords none or off to unset a previously set IPC address. The IPC implementation is inspired by HAProxy's stats socket implementation. All responses except the stats command are in compact JSON. User is recommended to use the version command to check the API version prior to use. As a safety measure, the IPC service is provided as long as the sandbox is unlocked. When the sandbox is locked, the syd_ipc thread exits. This thread makes no attempt to unlink(2) the UNIX domain socket path at startup or exit. The user should perform the cleanup or use abstract sockets which is recommended. To access the socket, an external utility such as socat(1) is required. Socat is a swiss-army knife to connect anything to anything. We use it to connect terminals to the socket, or a couple of stdin/stdout pipes to it for scripts. The two main syntaxes we'll use are the following:

    # socat ~/.syd/sandbox.sock stdio
    # socat ~/.syd/sandbox.sock readline

The first one is used with scripts. It is possible to send the output of a script to Syd, and pass Syd's output to another script. That's useful for retrieving sandbox configuration as JSON for example. The second one is only useful for issuing commands by hand. It has the benefit that the terminal is handled by the readline library which supports line editing and history, which is very convenient when issuing repeated commands (eg: watch a counter).

The socket supports three operation modes:
•   non-interactive, silent
•   interactive, silent
•   interactive with prompt

The non-interactive mode is the default when socat(1) connects to the socket. In this mode, a single line may be sent. It is processed as a whole, responses are sent back, and the connection closes after the end of the response. This is the mode that scripts and monitoring tools use. A single command may be sent at a time only. The interactive mode allows new commands to be sent after the ones from the previous lines finish. It exists in two variants, one silent, which works like the non-interactive mode except that the socket waits for a new command instead of closing, and one where a prompt is displayed (';') at the beginning of the line. The interactive mode is preferred for advanced tools while the prompt mode is preferred for humans.

The mode can be changed using the prompt command. By default, it toggles the interactive+prompt modes. Entering prompt in interactive mode will switch to prompt mode. The command optionally takes a specific mode among the following:

•   n: non-interactive mode (single command and quits)
•   i: interactive mode (multiple commands, no prompt)
•   p: prompt mode (multiple commands with a prompt)

Since the default mode is non-interactive, prompt must be used as the first command in order to switch it, otherwise the previous command will cause the connection to be closed. Switching to non-interactive mode will result in the connection to be closed after all the commands of the same line complete.

For this reason, when debugging by hand, it's quite common to start with the prompt command:

    # socat ~/.syd/sandbox.sock readline
    prompt
    ; stats
    ...
    ;

Interactive tools might prefer starting with prompt i to switch to interactive mode without the prompt.

The following commands are supported in addition to the syd(2) API:

•   load: Loads sandbox configuration from the attached file descriptor.
•   stat: Prints sandbox state in compact JSON.
•   stats: Prints sandbox state in human-readable format.
•   version: Prints IPC api version in compact JSON.

The commands quit and exit may be used to close a socket connection. The command ping is supported for aliveness checks.

As of version 3.56.0, IPC socket supports unix(7) file descriptor passing. An authenticated SCM_RIGHTS file descriptor received over the socket is a configuration load request, the file descriptor passing analogue of /dev/syd/load with identical validations. The request must be unambiguous. Message carrying the descriptor must consist of the sole command load, or it is rejected with EBADMSG ("Not a data message") and the connection is closed, reserving other messages for future uses of file descriptor passing. Conversely, a load command without a descriptor is rejected with EBADF ("Bad file number"), and a message containing unexpected control messages is rejected with EPROTO ("Protocol error"). The file descriptor must refer to a regular file, include directives are rejected, and loads are denied whilst the lock is in drop mode. At most one file descriptor is accepted per message, and Syd replies with ACK on success or a JSON-encoded errno(3) on failure. syd-fd(1) utility implements this mode with its -u option. Check for IPC API version 3.2 prior to use.

  ipc/uid

type | uid_t
default | Uid::current
static | yes

User ID override for IPC authentication. Specifies the UID that connecting processes must possess to authenticate with the IPC worker. Accepts only numeric user IDs, not user names. Defaults to the current process UID obtained via getuid(2). When set, the IPC worker validates that all connecting clients have this exact UID via SCM_CREDENTIALS authentication. This setting allows privilege delegation scenarios where the IPC worker runs as one user but accepts connections from processes running as a different specific UID. Set the option to none or off to disable UID authentication for IPC.

  ipc/gid

type | gid_t
default | Gid::current
static | yes

Group ID override for IPC authentication. Specifies the GID that connecting processes must possess to authenticate with the IPC worker. Accepts only numeric group IDs or not group names. Defaults to the current process GID obtained via getgid(2). When set, the IPC worker validates that all connecting clients have this exact GID via SCM_CREDENTIALS authentication. This setting enables group-based access control where multiple users belonging to the same group can access the IPC interface. Set the option to none or off to disable GID authentication for IPC.

  ipc/max

type | integer
default | 64
static | yes

Maximum number of concurrent IPC connections. Connections accepted beyond this limit are closed immediately, bounding the memory and file descriptor usage of the IPC worker. Accepts a positive integer. The value 0 is rejected. Set the option to ipc:off to disable the IPC interface instead.

  ipc/idle

type | duration
default | 60
static | yes

Idle timeout for IPC connections. A connection that delivers no message within this duration is closed. The deadline is refreshed on every received message. Accepts a duration in human readable format. The value 0 is rejected. Refer to the documentation of the dur crate for more information.

  lock

type | string

Set the state of the sandbox lock. Possible values are on, off, exec, ipc, drop and read or shortly just 1, 0, x, d, i, and r. The values are case-sensitive. The values ro, readonly and read-only are also permitted for read mode which was added as of version 3.39.0. Specifying just lock without value or shortly l is permitted as a short-hand for lock:on.

If the sandbox lock is on no sandbox commands are allowed. If sandbox lock is read, only reads are allowed but not edits. A read locked sandbox makes available only the read-only open(2) hooks of the syd(2) virtual system call API to the sandbox process. stat(2) hooks for edits are not permitted in a read locked sandbox.

If drop is specified, which was added as of version 3.50.0, sandbox commands may only be used to further drop privileges.

If exec is specified, the sandbox lock is set to on for all processes except the initial process, aka Syd exec child. If the sandbox lock is ipc, sandbox commands may only be specified using the IPC socket. The IPC socket is a UNIX socket which may or may not be accessible from within the sandbox depending on sandbox ACL rules.

Transition from lock modes off, exec, and ipc into one of read and on is one-way and idempotent: It results in the sandbox policy getting sealed in memory using the mseal(2) system call either immediately or right before sandbox process startup. Transitions between lock modes read and on are not permitted.

The sandbox lock used to default to exec but as a hardening measure and to ensure security by default, as of version 3.17.0, this has been changed such that the default is unset and if no lock clause has been specified by the time Syd executes the initial sandbox process, then the sandbox lock is automatically set to on. This means if no lock clause is specified in any of the profiles, configuration files or -m CLI arguments, the lock will be on by default. As of version 3.35.2, this default is set to ipc if the ipc command was specified but lock was not set explicitly. Setting lock to on at any point during configuration parsing prevents further commands from being emitted by the sandbox. This feature may be used to lock site-wide defaults for a Syd login shell by adding a lock:on clause at the end of the site-wide configuration file which prevents Syd from subsequently parsing the user configuration file, practically enforcing the site-wide defaults.

Setting lock to off, exec, or ipc at startup makes Syd skip preventing execve(2) and execveat(2) system calls as part of the Execution Control (EEC) feature. This is done to allow cmd/exec command to execute commands outside the sandbox. This filter to prevent exec(3) is only applied when the sandbox is locked.

  log/level

type | string
default | warn

Set the log level. Available log levels are emerg, alert, crit, error, warn, notice, info, and debug. Defaults to warn unless SYD_LOG environment variable is set at startup. An integer in the closed range of [0,7] can also be used as an argument to set the log level, where 0 corresponds to emerg and 7 corresponds to debug. All access violations except the walk, list, stat and chdir categories are logged with the warn level. Walk, List, Stat, and Chdir categories are logged with the notice level. Startup messages are logged with the info level.

  log/lock/same_exec_off

type | boolean
default | off

Disables logging of denied accesses originating from the thread creating the landlock(7) domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening execve(2) call). This is intended for programs that execute unknown code without invoking execve(2), such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.

This option requires landlock(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded.

  log/lock/new_exec_on

type | boolean
default | off

Enables logging of denied accesses after an execve(2) call, providing visibility into unauthorized access attempts by newly executed programs within the created landlock(7) domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.

This option requires landlock(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded. A sandboxer should not log denied access requests to avoid spamming logs, therefore this option is off by default. Use this option to test audit logging.

  log/lock/subdomains_off

type | boolean
default | off

Disables logging of denied accesses originating from nested landlock(7) domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create landlock(7) domains and could otherwise generate excessive logs. Unlike log/lock/same_exec_off, this flag only affects future nested domains, not the one being created.

This option requires landlock(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded.

  log/verbose

type | u8
default | 0

Set verbose logging level. Syd acquires and logs various additional information depending on the level of verbosity. Supported verbosity levels are given below:

0: Raw logs only.

1: Log ioctl names(2) under the ctl key. This is the default.

2: Log process name change attempts with the PR_SET_NAME prctl(2).

3: Enrich seccomp(2) requests under the req key.

Levels above 2 are intended for malware analysis. Setting the log level to a value above the highest supported level is equivalent to setting verbosity to the highest supported level.

  log/rlimit_interval

type | duration
default | 5s

Set rate-limiting interval for identical log messages. Within each interval window, at most log/rlimit_burst copies of any given message are emitted, further duplicates are suppressed and a single summary line recording the suppressed count is emitted when the interval expires.

The value may be specified as a raw integer in nanoseconds or as a human-readable duration string parsed by the dur crate. Refer to the documentation of the dur crate for more information. Setting the interval to 0 disables rate limiting entirely.

  log/rlimit_burst

type | u32
default | 10

Set the maximum number of identical log messages permitted within a single log/rlimit_interval window before suppression begins. After this many copies of the same message have been emitted, subsequent duplicates are silently counted and a summary is emitted when the interval expires. Setting the burst to 0 suppresses all messages unconditionally.

  pty/row

type | ushort
default | <inherit>
static | yes

Set row size for PTY sandboxing. Default is to inherit the window-size. Use the keyword none to unset a previously set value. You may shortly refer to this option as pty/x.

  pty/col

type | ushort
default | <inherit>
static | yes

Set column size for PTY sandboxing. Default is to inherit the window-size. Use the keyword none to unset a previously set value. You may shortly refer to this option as pty/y.

  setenv

type | command
static | yes

Set an environment variable from within a Syd profile. Environment variables in the value are expanded before calling setenv(3). Setting internal Syd environment variables, i.e those that start with the prefix "SYD_", isn't permitted. Illustrative examples are given below:

    setenv!HOME=/tmp
    setenv!HOME=${HOME}/.syd
    setenv!HOME=${HOME:-/tmp}/.syd

  unsetenv

type | command
static | yes

Unset an environment variable from within a Syd profile. Unsetting internal Syd environment variables, i.e those that start with the prefix "SYD_", isn't permitted. Illustrative examples are given below:

    unsetenv!PWD
    unsetenv!TZ

  clearenv

type | command
static | yes

Clear all environment variables from within a Syd profile. This command does not clear internal Syd environment variables, i.e those that start with the prefix "SYD_".

  passenv

type | string-vec
static | yes

Specify unsafe environment variables to pass-through to the sandbox process. This argument is a glob(3) pattern. Passing through internal Syd environment variables, i.e those that start with the prefix "SYD_", isn't permitted. By default, Syd clears a set of environment variables from the environment of the sandbox process, see syd-ls env for the list. Refer to the "Restricting environment and trace/allow_unsafe_env" section of the syd(7) manual page for more information.

  passfd

type | u32-set
default | stdio
static | yes

Specify the file descriptors to pass to the sandbox process. All other inherited file descriptors are closed just before execve(2) so they do not leak into the sandbox process. By default only the standard I/O descriptors (0, 1, 2) are passed. The argument is a comma-separated list of tokens, each of which is a single descriptor N, an inclusive range N-M, or one of the keywords all (every descriptor), stdio (descriptors 0, 1, 2), stdin (0), stdout (1), and stderr (2). Descending ranges are rejected. Any descriptor listed in nullfd is implicitly passed regardless of this list, so its redirection to /dev/null is not undone by the close before execve(2). Examples:

•   passfd+stdio adds the standard I/O descriptors.
•   passfd+0-2,10-30,40-50 adds the listed descriptors and ranges.
•   passfd+all passes every descriptor, closing none.
•   passfd-stdio,4-6 stops passing the standard I/O descriptors and 4-6.
•   passfd-all stops passing every descriptor.
•   passfd^ resets the list so that no descriptor is passed.

  nullfd

type | u32-set
static | yes

Specify the file descriptors to redirect to /dev/null in the sandbox process. Each listed descriptor is pointed at /dev/null just before execve(2). The argument is a comma-separated list of tokens, each of which is a single descriptor N or one of the keywords stdio (descriptors 0, 1, 2), stdin (0), stdout (1), and stderr (2). Unlike passfd there is no all keyword and ranges are not supported. A descriptor listed here is implicitly passed to the sandbox process, so it need not also be added to passfd. The /dev/null redirection takes precedence over passfd and is preserved across execve(2). Examples:

•   nullfd+stdout redirects standard output to /dev/null.
•   nullfd+1,2 redirects standard output and standard error.
•   nullfd-stderr stops redirecting standard error.
•   nullfd^ resets the list so that no descriptor is redirected.

  sandbox/fs

type | boolean
drop | yes, on only
query | yes

Turn Filesystem sandboxing on or off.

  sandbox/walk

type | boolean
default | off
drop | yes, on only
query | yes

Turn Walk sandboxing on or off.

For performance reasons, this sandboxing is off by default.

  sandbox/list

type | boolean
default | off
drop | yes, on only
query | yes
static | yes

Turn List sandboxing on or off.

For performance reasons, this sandboxing is off by default.

  sandbox/stat

type | boolean
default | on
drop | yes, on only
query | yes
static | yes

Turn Stat sandboxing on or off.

  sandbox/read

type | boolean
default | on
drop | yes, on only
query | yes

Turn Read sandboxing on or off.

  sandbox/write

type | boolean
default | on
drop | yes, on only
query | yes

Turn Write sandboxing on or off.

  sandbox/exec

type | boolean
default | on
drop | yes, on only
query | yes

Turn Exec sandboxing on or off.

  sandbox/ioctl

type | boolean
default | on
drop | yes, on only
query | yes
static | yes

Turn Ioctl sandboxing on or off.

For performance reasons, this only works at startup. If not given at startup, Syd will just allow the ioctl(2) system call at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

  sandbox/create

type | boolean
default | on
drop | yes, on only
query | yes

Turn Create sandboxing on or off.

  sandbox/delete

type | boolean
default | on
drop | yes, on only
query | yes

Turn Delete sandboxing on or off.

  sandbox/rename

type | boolean
default | on
drop | yes, on only
query | yes

Turn Rename sandboxing on or off.

  sandbox/readlink

type | boolean
default | on
drop | yes, on only
query | yes
static | yes

Turn Readlink sandboxing on or off.

For performance reasons, this sandboxing is off by default.

  sandbox/symlink

type | boolean
default | on
drop | yes, on only
query | yes

Turn Symlink sandboxing on or off.

  sandbox/truncate

type | boolean
default | on
drop | yes, on only
query | yes

Turn Truncate sandboxing on or off.

  sandbox/chdir

type | boolean
default | off
drop | yes, on only
query | yes
static | yes

Turn Chdir sandboxing on or off.

For performance reasons, this sandboxing is off by default and setting it on only works at startup. If not given at startup, Syd will just allow chdir(2) and fchdir(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

  sandbox/readdir

type | boolean
default | on
drop | yes, on only
query | yes

Turn Readdir sandboxing on or off.

  sandbox/mkdir

type | boolean
default | on
drop | yes, on only
query | yes

Turn Mkdir sandboxing on or off.

  sandbox/rmdir

type | boolean
default | on
drop | yes, on only
query | yes

Turn Rmdir sandboxing on or off.

  sandbox/chown

type | boolean
default | on
drop | yes, on only
query | yes

Turn Chown sandboxing on or off.

  sandbox/chgrp

type | boolean
default | on
drop | yes, on only
query | yes

Turn Chgrp sandboxing on or off.

  sandbox/chmod

type | boolean
default | on
drop | yes, on only
query | yes

Turn Chmod sandboxing on or off.

  sandbox/chattr

type | boolean
default | on
drop | yes, on only
query | yes

Turn Chattr sandboxing on or off.

  sandbox/chroot

type | boolean
default | on
drop | yes, on only
query | yes

Turn Chroot sandboxing on or off.

  sandbox/notify

type | boolean
default | on
drop | yes, on only
query | yes
static | yes

Turn Notify sandboxing on or off.

  sandbox/utime

type | boolean
default | on
drop | yes, on only
query | yes

Turn Utime sandboxing on or off.

  sandbox/mkdev

type | boolean
default | on
drop | yes, on only
query | yes

Turn Mkdev sandboxing on or off.

  sandbox/mkfifo

type | boolean
default | on
drop | yes, on only
query | yes

Turn Mkfifo sandboxing on or off.

  sandbox/mktemp

type | boolean
default | on
drop | yes, on only
query | yes

Turn Mktemp sandboxing on or off.

  sandbox/net

type | boolean
default | on
drop | yes, on only
query | yes

Turn Network sandboxing on or off.

  sandbox/sendfd

type | boolean
default | on
drop | yes, on only
query | yes

Turn SendFd sandboxing on or off.

  sandbox/recvfd

type | boolean
default | on
drop | yes, on only
query | yes

Turn RecvFd sandboxing on or off.

  sandbox/lock

type | boolean
drop | yes, on only
query | yes
static | yes

Turn Landlock sandboxing on or off.

  sandbox/uring

type | boolean
default | on
drop | yes, on only
query | yes
static | yes

Turn Uring sandboxing on or off.

  sandbox/force

type | boolean
drop | yes, on only
query | yes
static | yes

Turn Force sandboxing on or off.

  sandbox/tpe

type | boolean
default | on
drop | yes, on only
query | yes

Turn Trusted Path Execution (TPE) sandboxing on or off.

  sandbox/proxy

type | boolean
default | off
drop | yes, on only
query | yes
static | yes
oci | no

Turn Proxy sandboxing on or off.

Defaults to proxying through TOR. Refer to the options proxy/addr, proxy/port, proxy/ext/host, and proxy/ext/port to configure a different proxy.

Implies unshare/net:true.

Requires syd-tor(1) helper utility to be under PATH. syd-tor(1) is executed once at startup, it runs as a single process and this process runs at most as long as the owner Syd process. Refer to the syd-tor(1) manual page for more information.

  sandbox/pty

type | boolean
default | on
drop | yes, on only
query | yes
static | yes
oci | no

Turn PTY sandboxing on or off.

Requires syd-pty(1) helper utility to be under PATH. syd-pty(1) is executed once at startup, it runs as a single process and this process runs at most as long as the owner Syd process. Refer to the syd-pty(1) manual page for more information. This option has no effect unless both standard input and standard output are attached to a TTY at startup.

  sandbox/mem

type | boolean
default | off
drop | yes, on only
query | yes
static | yes

Turn Memory sandboxing on or off.

For performance reasons, this only works at startup. If not given at startup, Syd will just allow brk(2), mmap(2), mmap2(2), and mremap(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible, in this case the respective system calls handlers will skip the access checks.

  sandbox/pid

type | boolean
default | off
drop | yes, on only
query | yes
static | yes

Turn PID sandboxing on or off.

  default/fs

type | string
default | deny
drop | yes, raise only

Specify the default action for Filesystem sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/walk

type | string
default | deny
drop | yes, raise only

Specify the default action for Walk sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/list

type | string
default | deny
drop | yes, raise only

Specify the default action for List sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/stat

type | string
default | deny
drop | yes, raise only

Specify the default action for Stat sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/read

type | string
default | deny
drop | yes, raise only

Specify the default action for Read sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/write

type | string
default | deny
drop | yes, raise only

Specify the default action for Write sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/exec

type | string
default | deny
drop | yes, raise only

Specify the default action for Exec sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/ioctl

type | string
default | deny
drop | yes, raise only

Specify the default action for Ioctl sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/create

type | string
default | deny
drop | yes, raise only

Specify the default action for Create sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/delete

type | string
default | deny
drop | yes, raise only

Specify the default action for Delete sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

  default/rename

type | string
default | deny
drop | yes, raise only

Specify the default action for Rename sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

  default/readlink

type | string
default | deny
drop | yes, raise only

Specify the default action for Readlink sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

  default/symlink

type | string
default | deny
drop | yes, raise only

Specify the default action for Symlink sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

  default/truncate

type | string
default | deny
drop | yes, raise only

Specify the default action for Truncate sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chdir

type | string
default | deny
drop | yes, raise only

Specify the default action for Chdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/readdir

type | string
default | deny
drop | yes, raise only

Specify the default action for Readdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/mkdir

type | string
default | deny
drop | yes, raise only

Specify the default action for Mkdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/rmdir

type | string
default | deny
drop | yes, raise only

Specify the default action for Rmdir sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chown

type | string
default | deny
drop | yes, raise only

Specify the default action for Chown sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chgrp

type | string
default | deny
drop | yes, raise only

Specify the default action for Chgrp sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chmod

type | string
default | deny
drop | yes, raise only

Specify the default action for Chmod sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chattr

type | string
default | deny
drop | yes, raise only

Specify the default action for Chattr sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/chroot

type | string
default | deny
drop | yes, raise only

Specify the default action for Chroot sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/notify

type | string
default | deny
drop | yes, raise only

Specify the default action for Notify sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/utime

type | string
default | deny
drop | yes, raise only

Specify the default action for Utime sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/mkdev

type | string
default | deny
drop | yes, raise only

Specify the default action for Mkdev sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/mkfifo

type | string
default | deny
drop | yes, raise only

Specify the default action for Mkfifo sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/mktemp

type | string
default | deny
drop | yes, raise only

Specify the default action for Mktemp sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/net

type | string
default | deny
drop | yes, raise only

Specify the default action for Network sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/sendfd

type | string
default | deny
drop | yes, raise only

Specify the default action for SendFd sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/recvfd

type | string
default | deny
drop | yes, raise only

Specify the default action for RecvFd sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/block

type | string
default | deny
drop | yes, raise only

Specify the action for IP blocklist violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/force

type | string
default | deny
drop | yes, raise only

For force sandboxing, define the default action to take when the path of a binary is not in the Integrity Force map.

The value must be either one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", "exit", where the default is "deny".

  default/segvguard

type | string
default | deny
drop | yes, raise only

Specify the action for SegvGuard access violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/tpe

type | string
default | deny
drop | yes, raise only

Specify the action for TPE sandboxing access violations.

The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/mem

type | string
default | deny
drop | yes, raise only

Specify the action for Memory sandboxing access violations.

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

  default/pid

type | string
default | kill
drop | yes, raise only

Specify the action for PID sandboxing access violations.

The value must be either one of "warn", "filter", "stop", "abort", "kill", "exit", where the default is "kill".

  default/lock

type | string
default | kill
drop | yes, raise only
static | yes

Specify the compatibility level for Lock sandboxing.

The value must be either one of kill, deny, warn. kill stands for the Landlock compatibility level hard-requirement, whereas deny stands for soft-requirement and warn stands for best-effort.

As of version 3.35.0, the default level has been promoted from warn to kill to adhere to the principle of secure defaults. Again, as of this version ENOENT ("No such file or directory") errors are fatal unless compatibility level is set to best-effort at startup using default/lock:warn.

For more information on Landlock compatibility levels, see: https://landlock.io/rust-landlock/landlock/trait.Compatible.html

  unshare/mount

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create Mount namespace on startup, implies unshare/pid:true.

  unshare/uts

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create UTS namespace on startup.

  unshare/ipc

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create IPC namespace on startup.

  unshare/user

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create User namespace on startup.

  unshare/pid

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create Pid namespace on startup, implies unshare/mount:true.

Syd mounts private procfs(5) in this mode.

As of version 3.37.2 procfs(5) is mounted with hidepid=4 option which is Linux>=5.8.

As of version 3.39.0 procfs(5) is mounted with subset=pid option which is Linux>=5.8, unless trace/allow_unsafe_proc_files:true is set at startup.

  unshare/net

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create Net namespace on startup.

  unshare/cgroup

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create CGroup namespace on startup.

  unshare/time

type | boolean
drop | yes, on only
query | yes
static | yes
oci | no

Create Time namespace on startup. Syd resets the boot-time clock such that uptime(1) will report container uptime rather than host uptime. Use time command to override default and set alternative time.

  root

type | string
static | yes
oci | no

Change the root mount to the given new root directory at startup using pivot_root(2). Destination path arguments of bind commands are interpreted relative to this directory. The directories $root/dev, and $root/proc must exist to mount private filesystems. In addition, target paths of the bind commands must also be manually created by the user.

This option does nothing without unshare/mount:1.

As of version 3.23.14, symbolic links are not followed in any part of the root directory and path traversal using ".." is not permitted. In addition, root directory must be an absolute path, relative paths are not permitted.

As of version 3.35.0, the special keyword tmpfs, or shortly tmp or just t, is supported to make Syd mount a private tmpfs(5) filesystem as the root directory. In this mode, Syd is going to attempt to create target paths inside the private temporary filesystem. Similarly, as of version 3.45.0, the special keyword ramfs, or shortly ram or just r, is supported to make Syd mount a private ramfs(5) filesystem as the root directory. ramfs(5) is limited compared to tmpfs(5) and should only be preferred when the host Linux kernel isn't configured with the CONFIG_TMPFS option. The private root directory is mounted with the options nodev, noexec, nosuid, nosymfollow, noatime, and mode=700.

As of version 3.35.2, the special keywords none and off may be used to unset a previously set root directory.

  root/map

type | boolean
static | yes
oci | no

Map current user to root in the sandbox on startup.

This option does nothing without "unshare/user:1".

  root/fake

type | boolean
static | yes

In fakeroot mode, the system will return a user/group id of 0, mimicking the root user. This allows users to execute commands with apparent root privileges, without actual superuser rights. It's useful for tasks like package building where root-like environment is needed, but not actual root permissions.

  time

type | i64
static | yes
oci | no

Set clock boottime and monotonic offset (seconds) in Time Namespace. To set boottime and monotonic offsets separately, use the options time/boot, and time/mono. This option is a shorthand to set both at the same time to the same offset. Use the keywords none or off to unset a previously set offset.

  time/boot

type | i64
static | yes
oci | no

Set clock boottime offset (seconds) in Time Namespace. Use the keywords none or off to unset a previously set offset.

  time/mono

type | i64
static | yes
oci | no

Set clock monotonic offset (seconds) in Time Namespace. Use the keywords none or off to unset a previously set offset.

  timeout

type | duration
default | none

Set sandbox timeout after which Syd will exit with code 124 and all sandbox processes running under it will exit with Syd. Use none or off to disable which is the default. Duration may be specified in human readable format. Refer to the documentation of the dur crate for more information.

  uts/host

type | string
default | localhost

Set UTS host name in the sandbox. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is localhost. Use the keywords none or off to unset when Syd will pass-through the original hostname to the sandbox process.

Useful when combined with unshare/uts:true. As of version 3.40.0, the value of this option is returned at uname(2) boundary in nodename field of the utsname structure regardless of the unshare/uts option.

As of version 3.39.3, this value may be changed at runtime.

As of version 3.49.0, this value must NOT be empty and must be a safe filename. Refer to the "Enhanced Path Integrity Measures" section of the syd(7) manual page for information on safe filenames.

  uts/domain

type | string
default | (none)

Set NIS/YP domain name in the sandbox. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is (none). Use the keywords none or off to unset when Syd will pass-through the original domainname to the sandbox process.

Useful when combined with unshare/uts:true. As of version 3.40.0, the value of this option is returned at uname(2) boundary in domainname field of the utsname structure regardless of the unshare/uts option.

As of version 3.39.3, this value may be changed at runtime.

As of version 3.49.0, this value must NOT be empty and must be a safe filename. Refer to the "Enhanced Path Integrity Measures" section of the syd(7) manual page for information on safe filenames.

  uts/version

type | string
default | <random>

Set version level of the operating system as returned in version field of the utsname structure at uname(2) boundary. Name is limited to 64 characters. Name may be empty. Name may not have nul bytes. Default is determined randomly at startup. Use the keywords none or off to unset when Syd will pass-through the original version to the sandbox process.

As of version 3.56.0, this value must NOT be empty and must be a safe filename. Refer to the "Enhanced Path Integrity Measures" section of the syd(7) manual page for information on safe filenames.

  allow/ioctl

type | integer or string
default | [...]
drop | yes, remove only

Add to or remove a request from the ioctl(2) request allowlist. Accepts an unsigned 32-bit integer as argument. Prefix with 0x for hexadecimal and 0o for octal input. Use allow/ioctl+<request> to add to, and allow/ioctl-<request> to remove from the allowlist. As of version 3.38.0, ioctl(2) requests may also be specified by case-insensitive name and multiple requests may be added or removed by separating them as a comma-delimited list. Specifying ioctl(2) requests by name is strongly recommended because request numbers may vary by architecture which is handled transparently when the request is specified as a name. As of version 3.38.6, the ioctl(2) name may be prepended with an optional exclamation mark, i.e. !, to denote Syd should not return EINVAL ("Invalid argument") errno(3) in case the name is not defined for any of the current supported architectures. This allows for writing rules generic across multiple incompatible architectures. As of version 3.50.0, shell-style glob(3) patterns are accepted for ioctl(2) names. The glob(3) characters *, ?, and [...] may be used to match multiple ioctl(2) names at once, e.g. allow/ioctl+DRM_IOCTL_I915_* to allow all Intel GPU ioctls, or allow/ioctl+FIO* to allow all generic file ioctls. Glob matching is case-insensitive and may be combined with comma-separated literals, e.g. allow/ioctl+FIO*,FIBMAP. The ! suffix applies per element.

By default the allowlist contains the ioctl(2) requests FIOCLEX, FIONCLEX, FIONBIO, FIONREAD, FIOASYNC, FIOQSIZE, FIDEDUPERANGE, PIDFD_GET_INFO, and RNDGETENTCNT.

For rules added at startup deny rules have precedence over allow rules because the denylist is checked at kernel-space, whereas the allowlist is checked at user-space. For rules added after startup, the last matching rule wins.

  deny/ioctl

type | integer or string
default | [...]
drop | yes, add only
static | add is dynamic, remove is partly static

Add to or remove a request from the ioctl(2) request denylist. Accepts an unsigned 64-bit integer as argument. Prefix with 0x for hexadecimal and 0o for octal input. Use deny/ioctl+<request> to add to, and deny/ioctl-<request> to remove from the allowlist. As of version 3.38.0, ioctl(2) requests may also be specified by case-insensitive name and multiple requests may be added or removed by separating them as a comma-delimited list. Specifying ioctl(2) requests by name is strongly recommended because request numbers may vary by architecture which is handled transparently when the request is specified as a name. As of version 3.38.6, the ioctl(2) name may be prepended with an optional exclamation mark, i.e. !, to denote Syd should not return EINVAL ("Invalid argument") errno(3) in case the name is not defined for any of the current supported architectures. This allows for writing rules generic across multiple incompatible architectures. As of version 3.50.0, shell-style glob(3) patterns are accepted for ioctl(2) names. The glob(3) characters *, ?, and [...] may be used to match multiple ioctl(2) names at once, e.g. deny/ioctl+SECCOMP_IOCTL_* to deny all seccomp(2) ioctls. Glob matching is case-insensitive and may be combined with comma-separated literals. The ! suffix applies per element. As of version 3.58.0, ioctl(2) names corresponding to variable-sized ioctl(2) requests, also known as extensible-argument ioctls, e.g. SPI_IOC_MESSAGE, EVIOCGNAME, SECCOMP_IOCTL_NOTIF_ADDFD or PIDFD_GET_INFO, are supported on denylist and matched with size field wildcarded, so request is denied for every payload size. Parameterized ioctl(2) requests whose command number varies with an argument, e.g. EVIOCGABS, EVIOCSABS and EVIOCGBIT, are likewise matched with varying command-number -- and, where applicable, size -- bits wildcarded, so whole request family is covered by a single rule.

By default the list of denylisted ioctl(2) requests are FIFREEZE, FITHAW, FS_IOC_FIEMAP, FIGETBSZ, FICLONE, FICLONERANGE, FS_IOC_GETFSUUID, FS_IOC_GETFSSYSFSPATH, FIBMAP, FS_IOC_FSGETXATTR, FS_IOC_FSSETXATTR, FS_IOC_SETFLAGS, FS_IOC32_SETFLAGS, KDSETKEYCODE, KDSIGACCEPT, RNDADDTOENTCNT, RNDGETPOOL, RNDADDENTROPY, RNDZAPENTCNT, RNDCLEARPOOL, SECCOMP_IOCTL_NOTIF_RECV, SECCOMP_IOCTL_NOTIF_SEND, SECCOMP_IOCTL_NOTIF_ID_VALID, SECCOMP_IOCTL_NOTIF_ADDFD, SECCOMP_IOCTL_NOTIF_SET_FLAGS, TIOCCONS, TIOCLINUX, TIOCSETD, TIOCSTI, TIOCSSERIAL, KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_RESET_TRACE, KCOV_REMOTE_ENABLE, and DRM_IOCTL_GEM_CHANGE_HANDLE.

For security reasons, the ioctl(2) denylist is applied at the parent seccomp-bpf filter at startup. This means the Syd process is included in this restriction as well. This also means, removing elements from this list after startup has no effect. However, if Ioctl sandboxing was enabled at startup, adding new elements to the ioctl(2) denylist will further restrict the ioctl(2) request space.

For rules added at startup, deny rules have precedence over allow rules because the denylist is checked at kernel-space, whereas the allowlist is checked at user-space. For rules added after startup, the last matching rule wins.

Further reading about denylisted ioctl(2) requests:

•   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523
•   https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html
•   http://phrack.org/issues/52/6.html#article
•   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83efeeeb3d04b22aaed1df99bc70a48fe9d22c4d
•   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8d1b43f6a6df7bcea20982ad376a000d90906b42
•   https://seclists.org/oss-sec/2024/q1/13
•   https://seclists.org/oss-sec/2024/q1/14
•   https://forums.grsecurity.net/viewtopic.php?f=7&t=2522
•   http://lkml.indiana.edu/hypermail/linux/kernel/9907.0/0132.html
•   http://linux.derkeiler.com/Mailing-Lists/Kernel/2007-11/msg07723.html

  mem/max

type | positive integer (u64)
default | 0
drop | yes, reduce only

This setting specifies the limit on per-process memory usage. Setting this value to 0 disables testing for this type of memory usage. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Setting a non-zero value with this option implies sandbox/mem:on.

As of version 3.58.1, when this setting is non-zero, sysinfo(2) handler honours the limit. Refer to "Cryptographically Randomized Sysinfo" section of syd(7) manual page for more information.

  mem/vm_max

type | positive integer (u64)
default | 0
drop | yes, reduce only

This setting specifies the limit on per-process virtual memory usage. Setting this value to 0 disables testing for this type of memory usage. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Setting a non-zero value with this option implies sandbox/mem:on.

  pid/max

type | positive integer (u64)
default | 0
drop | yes, reduce only

This setting specifies the limit on the number of running tasks for pid sandboxing. Setting this value to 0 is functionally equivalent to setting sandbox/pid to off. Setting a non-zero value with this option implies sandbox/pid:on.

As of version 3.40.0, when unshare/pid:true is set, PID sandboxing counts and enforces the limit in the current PID namespace; on Linux 6.14 and newer, to account for the kernel's 300 reserved PIDs the namespaced kernel.pid_max is set to max(pid/max, 301) (or 512 on s390x), while on older kernels kernel.pid_max sysctl(8) is left unchanged.

  pipe/max

type | positive integer (i32)
default | ${SYD_PAGE_SIZE}
drop | yes, reduce only
static | reduce is dynamic, raise is static

This setting specifies the maximum pipe(2) buffer size in bytes. Value must be at least the system page size, which is also the Syd default. Smaller limits cannot be enforced. It may be reduced but not raised after startup because Syd installs a seccomp(2) filter that confines F_SETPIPE_SZ(2const) fcntl(2) operation at startup. When pipe(2) creation is confined by Create sandboxing, each created pipe(2) has its buffer size set to this value.

  xattr/max

type | positive integer (size_t)
default | 512
drop | yes, reduce only

This setting specifies the maximum extended attribute value size in bytes for the setxattr(2), lsetxattr(2), fsetxattr(2) and setxattrat(2) system calls. Default is 512 bytes. Minimum permitted value is 0. Maximum permitted value is 65536. A write whose value exceeds this limit is denied with E2BIG ("Argument list too long"). This mitigates kernel heap spraying via attacker-sized, attacker-controlled extended attribute allocations.

  rlimit/as

type | positive integer (rlim_t)
static | yes

Limit the maximum size of the sandbox process's virtual memory (address space) using rlimit(2). The limit is specified in bytes, and is rounded down to the system page size. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/core

type | positive integer (rlim_t)
default | 0
static | yes

Limit the maximum size of a core(5) file in bytes using rlimit(2). When 0 (default) no core dump files are created. When nonzero, larger dumps are truncated to this size. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/cpu

type | positive integer (rlim_t)
static | yes

Limit the amount of CPU time in seconds using rlimit(2). The value is parsed using the dur crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/data

type | positive integer (rlim_t)
static | yes

Limit the maximum size of the sandbox process's data segment (initialized data, uninitialized data, and heap) using rlimit(2). The limit is specified in bytes, and is rounded down to the system page size. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/fsize

type | positive integer (rlim_t)
static | yes

Limit the maximum size in bytes of files that the sandbox process may create using rlimit(2). The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource. This limit is applied to the Syd process as well to ensure system calls such as truncate(2), and fallocate(2) are correctly limited. Care should be taken, because setting this limit to a value lower than what Syd's internal file handling requires may result in unexpected errors.

  rlimit/memlock

type | positive integer (rlim_t)
default | 0
static | yes

Limit the maximum number of bytes of memory that may be locked into RAM using rlimit(2). This limit is in effect rounded down to the nearest multiple of the system page size. Default is zero. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/msgqueue

type | positive integer (rlim_t)
default | 0
static | yes

Limit the number of bytes that can be allocated for POSIX message queues for the real user ID of the sandbox process using rlimit(2). The limit is enforced for mq_open(3). Default is zero. The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/nice

type | integer (-20..=20)
default | 20
static | yes

Specify a ceiling to which sandbox process's nice value can be raised using setpriority(2) or nice(2) using rlimit(2). The accepted range for this limit is from -20 to 20 (default). Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

Default is 20. The option trace/allow_unsafe_nice must also be set to permit the sandbox process to change its nice value.

  rlimit/nofile

type | positive integer (rlim_t)
static | yes

Limit the maximum file descriptor number that can be opened using resource limits using rlimit(2). Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/nproc

type | positive integer (rlim_t)
static | yes

Limit the number of extant process (or, more precisely on Linux, threads) for the real user ID of the sandbox process using rlimit(2). Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/rtprio

type | positive integer (rlim_t)
default | 0
static | yes

Specify a ceiling on the real-time priority that may be set for the sandbox process using sched_setscheduler(2) and sched_setparam(2) using rlimit(2). Default is zero. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/rttime

type | positive integer (rlim_t)
default | 0
static | yes

Limit (in microseconds) on the amount of CPU time that a sandbox process scheduled under a real-time scheduling policy may consume without making a blocking system call using rlimit(2). Default is zero. The value is parsed using the dur crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/sigpending

type | positive integer (rlim_t)
static | yes

Limit the number of signals that may be queued for the real user ID of the sandbox process using rlimit(2). Both standard and real-time signals are counted for the purpose of checking this limit. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  rlimit/stack

type | positive integer (rlim_t)
static | yes

Limit the maximum size of the sandbox process stack, in bytes using rlimit(2). The value is parsed using the parse-size crate. Refer to their documentation for information on formatting. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

  bind

type | string-vec
static | yes
oci | no

This command causes Syd to bind mount a directory on startup. The format is source-dir:target-dir:mount-options,... where the source and target directories may be equal. As of version 3.55.0, bind mounts are secure by default. Regardless of whether the source is an absolute path or a filesystem type, every bind is mounted with nodev, noexec, nosuid, and nosymfollow options applied. User must therefore explicitly opt back into the relaxed behaviour upfront using the options below. Each option weakens exactly one of the secure defaults:

•   dev to interpret character and block special devices on the filesystem. By default with nodev, device nodes are not interpreted.
•   exec to permit direct execution of binaries on the mounted filesystem. By default with noexec, execution is not permitted.
•   suid to honour set-user-ID and set-group-ID bits and file capabilities when executing programs from this filesystem. By default with nosuid they are ignored. In addition, SELinux domain transitions require permission nosuid_transition, which in turn needs also policy capability nnp_nosuid_transition.
•   symfollow to follow symbolic links when resolving paths. By default with nosymfollow, symbolic links are not followed. They can still be created, and readlink(1), readlink(2), realpath(1), and realpath(3) all still work properly. In addition, ro mounts the filesystem read-only. rw resets a previous ro option, and is a no-op otherwise.

Access time of a bind mount is not part of the secure defaults because changing it is privileged in unprivileged user_namespaces(7). The following access time options remain available as opt-in flags:

•   noatime to not update inode access times on this filesystem (e.g. for faster access on the news spool to speed up news servers). This works for all inode types (directories too), so it implies nodiratime.
•   nodiratime to not update directory inode access times on this filesystem. (This option is implied when noatime is set.)
•   relatime to update inode access times relative to modify or change time. This is the default.
•   strictatime to always update inode access times on every access. This may increase I/O and is rarely needed.

The legacy restrictive options nodev, noexec, nosuid, and nosymfollow are now the default and are accepted only as no-ops for backwards compatibility. Access time options (noatime, relatime, strictatime) are mutually exclusive. Specifying conflicting options is an error.

Mount options may be omitted. If the source directory is not an absolute path, it is interpreted as the filesystem type rather than the source directory. This may be used to mount special filesystems such as cgroupfs, overlayfs or tmpfs(5) into the mount namespace. In this case, any mount options supported by this filesystem type may be submitted in options argument not just the ones listed above. You may find some examples below:

•   bind+/:/:ro
•   bind+tmpfs:/tmp:size=16M
•   bind+tmpfs:/run:exec,size=16M
•   bind+/dev:/dev:dev
•   bind+overlay:/tmp/target:exec,lowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work
•   bind+devpts:/dev/pts:dev,newinstance,ptmxmode=0600,mode=600
•   bind+ramfs:/tmp
•   bind+sysfs:/sys
•   bind+mqueue:/dev/mqueue

This command may be used to create immutable containers. For example, the command bind+/:/:ro is functionally equivalent to deny/write+/*** except the restriction happens at kernel VFS layer rather than at user level using seccomp(2) notify. Alternatively this can also be achieved at the kernel level using landlock(7).

As of version 3.23.14, symbolic links are not followed in any part of the source or target directory paths and path traversal using .. is not permitted. In addition, target directory must be an absolute path, relative paths are not permitted.

As of version 3.23.14, mounting the special proc(5) filesystem under a custom path is not permitted. Syd handles this mount itself specially after all bind mounts are processed.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This command does nothing without unshare/mount:true.

  bind-try

type | string-vec
static | yes
oci | no

This command behaves identically to bind except that it warns and continues on ENOENT ("No such file or directory") errno(3) on the source directory. All other errors remain fatal. This is useful for portable profiles that reference optional paths which may not exist on every system. The format is the same as bind: source-dir:target-dir:mount-options,...

Take "bind-try+/opt/custom:/opt/custom:ro" as an example. If /opt/custom does not exist, the mount is skipped with a warning and execution continues. If the source exists but cannot be opened for any other reason (e.g. EACCES, ELOOP), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option does nothing without unshare/mount:true.

  mkdir

type | string-vec
static | yes
oci | no

This command causes Syd to create a directory node in the mount namespace on startup using mkdirat(2). The format is path or path:mode where path is an absolute path and mode is an optional octal permission mode. If mode is omitted, it defaults to 0700.

•   mkdir+/dev/shm
•   mkdir+/dev/shm:0755
•   mkdir+/tmp/work:0700

The path must be absolute. Relative paths and path components containing .. are rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories are created automatically using mkdirat(2) with safe fd-based traversal. The node is created using mkdirat(2) which does not follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup which strips group and other permission bits from the requested mode. In addition, setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit are preserved in the final mode.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkdir operations are silently ignored. This option does nothing without unshare/mount:true.

  mkdir-try

type | string-vec
static | yes
oci | no

This command behaves identically to mkdir except that it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. This is useful for creating directories that may already exist, such as standard paths in a tmpfs root. The format is the same as mkdir: path or path:mode

Take "mkdir-try+/dev/shm:0755" as an example. If /dev/shm already exists, the creation is skipped with a warning and execution continues. If the path cannot be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkdir-try operations are silently ignored. This option does nothing without unshare/mount:true.

  mkfile

type | string-vec
static | yes
oci | no

This command causes Syd to create a regular file node in the mount namespace on startup using mknodat(2). The format is path or path:mode where path is an absolute path and mode is an optional octal permission mode. If mode is omitted, it defaults to 0400.

•   mkfile+/dev/null
•   mkfile+/dev/null:0666
•   mkfile+/tmp/placeholder:0600

The path must be absolute. Relative paths and path components containing .. are rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories are created automatically using mkdirat(2) with safe fd-based traversal. The node is created using mknodat(2) which does not follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup which strips group and other permission bits from the requested mode. In addition, setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit are preserved in the final mode.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfile operations are silently ignored. This option does nothing without unshare/mount:true.

  mkfile-try

type | string-vec
static | yes
oci | no

This command behaves identically to mkfile except that it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. This is useful for creating file nodes that may already exist, such as device nodes in a tmpfs root. The format is the same as mkfile: path or path:mode

Take "mkfile-try+/dev/null:0666" as an example. If /dev/null already exists, the creation is skipped with a warning and execution continues. If the path cannot be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfile-try operations are silently ignored. This option does nothing without unshare/mount:true.

  mkfifo

type | string-vec
static | yes
oci | no

This command causes Syd to create a named pipe (FIFO) node in the mount namespace on startup using mknodat(2) with S_IFIFO. The format is path or path:mode where path is an absolute path and mode is an optional octal permission mode. If mode is omitted, it defaults to 0600.

•   mkfifo+/tmp/myfifo
•   mkfifo+/tmp/myfifo:0644
•   mkfifo+/run/syd/ctl:0600

The path must be absolute. Relative paths and path components containing .. are rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories are created automatically using mkdirat(2) with safe fd-based traversal. The node is created using mknodat(2) which does not follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup which strips group and other permission bits from the requested mode. In addition, setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit are preserved in the final mode.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfifo operations are silently ignored. This option does nothing without unshare/mount:true.

  mkfifo-try

type | string-vec
static | yes
oci | no

This command behaves identically to mkfifo except that it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. This is useful for creating FIFO nodes that may already exist in a tmpfs root. The format is the same as mkfifo: path or path:mode

Take "mkfifo-try+/tmp/myfifo:0644" as an example. If /tmp/myfifo already exists, the creation is skipped with a warning and execution continues. If the path cannot be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfifo-try operations are silently ignored. This option does nothing without unshare/mount:true.

  link

type | string-vec
static | yes
oci | no

This command causes Syd to create a hard link in the mount namespace on startup using linkat(2). The format is dst:src where dst is the absolute path of the new link and src is the absolute path of the existing file to link to.

•   link+/lib/libfoo.so:/usr/lib/libfoo.so
•   link+/opt/bin/tool:/usr/bin/tool

Both dst and src must be absolute paths. Relative paths and path components containing .. are rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of either path. The source file is opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories of dst are created automatically using mkdirat(2) with safe fd-based traversal.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, link operations are silently ignored. This option does nothing without unshare/mount:true.

  link-try

type | string-vec
static | yes
oci | no

This command behaves identically to link except that it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. This is useful for creating hard links that may already exist in a tmpfs root. The format is the same as link: dst:src

Take "link-try+/lib/libfoo.so:/usr/lib/libfoo.so" as an example. If /lib/libfoo.so already exists, the creation is skipped with a warning and execution continues. If the link cannot be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, link-try operations are silently ignored. This option does nothing without unshare/mount:true.

  symlink

type | string-vec
static | yes
oci | no

This command causes Syd to create a symbolic link in the mount namespace on startup using symlinkat(2). The format is dst:src where dst is the absolute path of the new symbolic link and src is the target the symbolic link points to.

•   symlink+/lib/libfoo.so:/usr/lib/libfoo.so
•   symlink+/usr/lib/libfoo.so.1:libfoo.so

The dst path must be absolute. Relative dst paths and path components containing .. in either dst or src are rejected with EINVAL ("Invalid argument"). Unlike link, the src path may be relative; this creates a relative symbolic link which is resolved at the time the link is accessed rather than at creation time. Symbolic links are not followed in the final component of dst. Parent directories of dst are created automatically using mkdirat(2) with safe fd-based traversal.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, symlink operations are silently ignored. This option does nothing without unshare/mount:true.

  symlink-try

type | string-vec
static | yes
oci | no

This command behaves identically to symlink except that it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. This is useful for creating symbolic links that may already exist in a tmpfs root. The format is the same as symlink: dst:src

Take "symlink-try+/lib/libfoo.so:/usr/lib/libfoo.so" as an example. If /lib/libfoo.so already exists, the creation is skipped with a warning and execution continues. If the symbolic link cannot be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, symlink-try operations are silently ignored. This option does nothing without unshare/mount:true.

  workdir

type | string
static | yes
oci | no

Set the current working directory inside the mount namespace on startup. The working directory is changed after all bind, link, symlink, mkdir, mkfile, and mkfifo commands have been applied. Use the keywords none or off to unset a previously set value.

•   workdir:/tmp
•   workdir:/opt/build
•   workdir:none

The path must be absolute. Relative paths and path traversal using ".." are not permitted. Symbolic links are not followed. This command may be combined with mkdir to first create the target directory and then change into it.

This option does nothing without the root command. This option does nothing without unshare/mount:true.

  force

type | string-vec
drop | yes, add only

Add or remove an integrity force rule for Force Sandboxing. The format is force+/path:algorithm:hashhex:action for addition and force-/path for removal. Use force^ to clear the Integrity Force map. Available actions are "warn", "filter", "deny", "panic", "stop", "abort", "kill" and "exit" where the default is "deny". Algorithm is any supported hash algorithm (see syd-sum(1) -a list), e.g. sha256, sha3-512, blake2b-256, crc32c. hashhex is the hexadecimal digest.

As of version 3.57.0, escape sequences are supported in the path: "\:" inserts a literal colon and "\\" inserts a literal backslash.

•   syd-sum(1) is a helper tool to calculate checksums of files.
•   syd-path(1) is a helper tool to write integrity force rules for binaries under PATH.

  proxy/addr

type | IP address
default | 127.0.0.1
static | yes
oci | no

Set internal address for Proxy sandboxing. This must be an IPv4 or an IPv6 address. Defaults to 127.0.0.1.

  proxy/port

type | integer
default | 9050
static | yes
oci | no

Set internal port for Proxy sandboxing. Defaults to 9050.

  proxy/ext/host

type | IP
default | 127.0.0.1
static | yes
oci | no

Set external address for Proxy sandboxing. This must be either an IPv4 address or an IPv6 address.

Defaults to "127.0.0.1", which may be be overridden with the environment variable SYD_PROXY_HOST at startup.

  proxy/ext/port

type | integer
default | 9050
static | yes
oci | no

Set external port for Proxy sandboxing.

Defaults to 9050, which may be overridden with the environment variable SYD_PROXY_PORT at startup.

  proxy/ext/unix

type | string
static | yes
oci | no

Set external UNIX domain socket for Proxy sandboxing.

The argument may also be set using the environment variable SYD_PROXY_UNIX at startup.

This option has precedence over the option "proxy/ext/host", ie. when both are given Syd will connect to the UNIX domain socket.

  segvguard/expiry

type | duration
default | 120
drop | yes, raise only

Specify SegvGuard expiry timeout in seconds. Set to 0 to disable SegvGuard.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the dur crate for more information.

  segvguard/suspension

type | duration
default | 600
drop | yes, raise only

Specify SegvGuard suspension timeout in seconds. 0 is an invalid value.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the dur crate for more information.

  segvguard/maxcrashes

type | integer (u8)
default | 5
drop | yes, reduce only

Specify SegvGuard max crashes. 0 is an invalid value.

  tpe/gid

type | integer (gid_t)

Specify untrusted GID for Trusted Path Execution (TPE). By default, TPE is applied to users of all groups including root and this setting can be used to limit it to a certain group. To unset a previously set GID and return to the default state set "none" as the value.

  tpe/negate

type | boolean

Negate GID logic for Trusted Path Execution (TPE). This turns "tpe/gid" from untrusted into trusted such that users belonging to this group will be exempt from TPE.

  tpe/root_owned

type | boolean
drop | yes, on only

Ensure file and parent directory are root-owned for Trusted Path Execution (TPE).

This option will misbehave with "unshare/user:1" if the real root user is not mapped inside the container.

  tpe/user_owned

type | boolean

Ensure file and parent directory are user-owned or root-owned for Trusted Path Execution (TPE).

This option may misbehave with "unshare/user:1" if the real root user is not mapped inside the container.

  tpe/root_mount

type | boolean

Ensure file and parent directory are on root filesystem for Trusted Path Execution (TPE).

This option may be used to pin all executions to a single safe mountpoint.

  allow/fs

type | string-vec
drop | yes, remove only

Specifies a list of filesystem types to allow for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  allow/walk

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Walk sandboxing.

  allow/list

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for List sandboxing.

  allow/stat

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Stat sandboxing.

  allow/read

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Read sandboxing.

  allow/write

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Write sandboxing.

  allow/exec

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Exec sandboxing.

  allow/create

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Create sandboxing.

  allow/delete

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Delete sandboxing.

  allow/rename

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Rename sandboxing.

  allow/readlink

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Readlink sandboxing.

  allow/symlink

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Symlink sandboxing.

  allow/truncate

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Truncate sandboxing.

  allow/chdir

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chdir sandboxing.

  allow/readdir

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Readdir sandboxing.

  allow/mkdir

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Mkdir sandboxing.

  allow/rmdir

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Rmdir sandboxing.

  allow/chown

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chown sandboxing.

  allow/chgrp

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chgrp sandboxing.

  allow/chmod

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chmod sandboxing.

  allow/chattr

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chattr sandboxing.

  allow/chroot

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Chroot sandboxing.

  allow/notify

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Notify sandboxing.

  allow/utime

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Utime sandboxing.

  allow/mkdev

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Mkdev sandboxing.

  allow/mkfifo

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Mkfifo sandboxing.

  allow/mktemp

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to allow for Mktemp sandboxing.

  allow/net/bind

type | string-vec
drop | yes, remove only

Specifies a list of network address patterns to allow for Bind network sandboxing.

  allow/net/accept

type | string-vec
drop | yes, remove only

Specifies a list of network address patterns to allow for Accept network sandboxing.

  allow/net/connect

type | string-vec
drop | yes, remove only

Specifies a list of network address patterns to allow for Connect network sandboxing.

  allow/sendfd

type | string-vec
drop | yes, remove only

Specifies a list of file descriptor names to allow for SendFd sandboxing.

The file descriptor being sent is matched, not the peer it is sent to.

Accepts a file descriptor name, which begins with the character !:

Name | File descriptor
!file | regular file
!dir | directory
!symlink | symbolic link
!magiclink | proc(5) magic symbolic link
!magicdir | proc(5) magic symbolic link to a directory
!bdev | block device
!cdev | character device
!socket | socket
!fifo | filesystem FIFO
!pipe | anonymous pipe
!notification_pipe | notification pipe
!nsfs | namespace file descriptor
!pidfd | process file descriptor
!secretmem | secret memory file descriptor
!memfd:NAME | memory file descriptor named NAME
!memfd-hugetlb:NAME | hugetlb memory file descriptor named NAME
!unknown | file descriptor with no name
!all | every file descriptor (wildcard)

Other kernel objects take the name the kernel gives the object, e.g. !eventpoll for an epoll(7) file descriptor, !inotify, or !io_uring. This set is open. A name a newer kernel introduces may be used before Syd knows of it.

  allow/recvfd

type | string-vec
drop | yes, remove only

Specifies a list of file descriptor names to allow for RecvFd sandboxing.

The file descriptor being received is matched, not the peer it is received from.

Accepts a file descriptor name, which begins with the character !:

Name | File descriptor
!file | regular file
!dir | directory
!symlink | symbolic link
!magiclink | proc(5) magic symbolic link
!magicdir | proc(5) magic symbolic link to a directory
!bdev | block device
!cdev | character device
!socket | socket
!fifo | filesystem FIFO
!pipe | anonymous pipe
!notification_pipe | notification pipe
!nsfs | namespace file descriptor
!pidfd | process file descriptor
!secretmem | secret memory file descriptor
!memfd:NAME | memory file descriptor named NAME
!memfd-hugetlb:NAME | hugetlb memory file descriptor named NAME
!unknown | file descriptor with no name
!all | every file descriptor (wildcard)

Other kernel objects take the name the kernel gives the object, e.g. !eventpoll for an epoll(7) file descriptor, !inotify, or !io_uring. This set is open. A name a newer kernel introduces may be used before Syd knows of it.

  allow/net/link

type | string-vec
drop | yes, remove only
static | yes

Specifies a list of netlink families to allow for Link network sandboxing.

Accepts a comma-delimited list of the following items: route, usersock, firewall, sock_diag, nflog, xfrm, selinux, iscsi, audit, fib_lookup, connector, netfilter, ip6_fw, dnrtmsg, kobject_uevent, generic, scsitransport, ecryptfs, rdma, crypto, and smc. Use all to specify all families.

  allow/uring/op

type | string-vec
drop | yes, remove only
static | yes
default | epoll_ctl, read, readv, write, writev

Specifies list of io_uring(7) submission queue operations to allow for the sandbox process using task-level io_uring(7) restrictions new in Linux-7.0. Any operation not in the list is denied, so by default the io_uring(7) interface cannot be used to bypass path and network sandboxing. None of the default operations can reference a path or network address, so they cannot bypass path or network sandboxing. An empty list, e.g. after allow/uring/op^, denies the io_uring(7) interface altogether.

Accepts a comma-delimited list of the following items: nop, readv, writev, fsync, read_fixed, write_fixed, poll_add, poll_remove, sync_file_range, sendmsg, recvmsg, timeout, timeout_remove, accept, async_cancel, link_timeout, connect, fallocate, openat, close, files_update, statx, read, write, fadvise, madvise, send, recv, openat2, epoll_ctl, splice, provide_buffers, remove_buffers, tee, shutdown, renameat, unlinkat, mkdirat, symlinkat, linkat, msg_ring, fsetxattr, setxattr, fgetxattr, getxattr, socket, uring_cmd, send_zc, sendmsg_zc, read_multishot, waitid, futex_wait, futex_wake, futex_waitv, fixed_fd_install, ftruncate, bind, listen, recv_zc, epoll_wait, readv_fixed, writev_fixed, pipe, nop128 and uring_cmd128. Use all to specify all operations.

Note that io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock.

  allow/uring/reg

type | string-vec
drop | yes, remove only
static | yes
default | register_probe

Specifies list of io_uring(7) registrations to allow for the sandbox process using task-level io_uring(7) restrictions new in Linux-7.0. Any registration not in the list is denied. Registrations configure a ring rather than submit work, so on their own they cannot be used to bypass path or network sandboxing. The default allows only register_probe, a read-only capability query, because the kernel enforces register restrictions only when at least one registration is allowlisted. Four further registrations are issued without reference to a ring and thus cannot be restricted: register_send_msg_ring, register_query, register_restrictions and register_bpf_filter. They are always permitted and are not accepted here.

Accepts a comma-delimited list of the following items: register_buffers, unregister_buffers, register_files, unregister_files, register_eventfd, unregister_eventfd, register_files_update, register_eventfd_async, register_probe, register_personality, unregister_personality, register_enable_rings, register_files2, register_files_update2, register_buffers2, register_buffers_update, register_iowq_aff, unregister_iowq_aff, register_iowq_max_workers, register_ring_fds, unregister_ring_fds, register_pbuf_ring, unregister_pbuf_ring, register_sync_cancel, register_file_alloc_range, register_pbuf_status, register_napi, unregister_napi, register_clock, register_clone_buffers, register_zcrx_ifq, register_resize_rings, register_mem_region and register_zcrx_ctrl. Use all to specify all registrations.

Note that io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock.

  allow/uring/flag

type | string-vec
drop | yes, remove only
static | yes
default | async

Specifies list of io_uring(7) submission queue entry flags to allow for the sandbox process using task-level io_uring(7) restrictions new in Linux-7.0. Any flag not in the list is rejected when a submission sets it. Defaults are the set required to make PostgreSQL work under Syd and may change in the future. These flags govern how a submission is sequenced and dispatched, not which operation it runs, so on their own they cannot be used to bypass path or network sandboxing.

Accepts a comma-delimited list of the following items: fixed_file, io_drain, io_link, io_hardlink, async, buffer_select and cqe_skip_success. Use all to specify all flags.

Note that io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock.

  allow/lock/read

type | string-set
static | yes
default | ("/dev/null", "/proc")

Specifies a set of beneath paths to grant file read access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_READ_FILE and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the paths "/dev/null" and "/proc" by default as Syd is included in the Landlock sandbox and Syd requires read access to these paths to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/write

type | string-set
static | yes
default | ("/dev/null")

Specifies a set of beneath paths to grant file write access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_WRITE_FILE and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the path "/dev/null" by default as Syd is included in the Landlock sandbox and Syd requires write access to this file to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/exec

type | string-set
static | yes

Specifies a set of beneath paths to grant file execute access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_EXECUTE and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/ioctl

type | string-set
static | yes

Specifies a set of beneath paths to grant ioctl(2) access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_IOCTL_DEV and only applies to the content of the directory not the directory itself. Landlock ioctl(2) support requires ABI 5 or later. Fifth Landlock ABI was introduced with Linux 6.10. On older kernels, this command is a no-op and is not going to confine ioctl(2) operations. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/create

type | string-set
static | yes

Specifies a set of beneath paths to grant file creation, rename and link access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_REG and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/delete

type | string-set
static | yes

Specifies a set of beneath paths to grant file unlink, rename and link access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REMOVE_FILE and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/rename

type | string-set
static | yes

Specifies a set of beneath paths to grant access to link or rename a file from or to a different directory (i.e. reparent a file hierarchy) for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REFER and only applies to the content of the directory not the directory itself. Landlock rename support requires ABI 2 or later. Second Landlock ABI was introduced with Linux 5.19. On older kernels, this type of access is always denied with Landlock. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/symlink

type | string-set
static | yes

Specifies a set of beneath paths to grant symbolic link creation, rename and link access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_SYM and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/truncate

type | string-set
static | yes
default | ("/dev/null")

Specifies a set of beneath paths to grant file truncation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_TRUNCATE and only applies to the content of the directory not the directory itself. Landlock file truncation support requires ABI 3 or later. Third Landlock ABI was introduced with Linux 6.2. On older kernels, this command is a no-op and is not going to confine file truncation operations. As of version 3.21.0, this set includes the path "/dev/null" by default as Syd is included in the Landlock sandbox and Syd requires truncation access to this file to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/readdir

type | string-set
static | yes
default | ("/proc")

Specifies a set of beneath paths to grant directory list access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_READ_DIR and applies to the directory and the directories beneath it. As of version 3.21.0, this set includes the directory "/proc" by default as Syd is included in the Landlock sandbox and Syd requires readdir access to this directory to function correctly. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/mkdir

type | string-set
static | yes

Specifies a set of beneath paths to grant directory creation and rename access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_DIR and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/rmdir

type | string-set
static | yes

Specifies a set of beneath paths to grant directory deletion and rename access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REMOVE_DIR and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/mkbdev

type | string-set
static | yes

Specifies a set of beneath paths to grant block device creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_BLOCK and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/mkcdev

type | string-set
static | yes

Specifies a set of beneath paths to grant character device creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_CHAR and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/mkfifo

type | string-set
static | yes

Specifies a set of beneath paths to grant named pipe (FIFO) creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_FIFO and only applies to the content of the directory not the directory itself. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

  allow/lock/bind

type | (u16-set, string-set)
static | yes

Specifies a list of allowed bind(2) ports and UNIX domain socket paths for Lock sandboxing. This category corresponds to the landlock(7) access rights LANDLOCK_ACCESS_NET_BIND_TCP, LANDLOCK_ACCESS_NET_BIND_UDP, and LANDLOCK_ACCESS_FS_MAKE_SOCK, the last of which only applies to the content of the directory not the directory itself. Argument is either a single port, a closed range in format port1-port2, a comma-separated list of ports and/or ranges such as 80,443,8000-9000, or an absolute UNIX domain socket path. landlock(7) network support requires ABI 4 or later. Fourth landlock(7) ABI was introduced with Linux 6.7. UDP port support requires ABI 10 or later. Tenth landlock(7) ABI was introduced with Linux 7.2. On older kernels, this command is a no-op when specified with the unsupported argument kind and does not do any network confinement. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Noop without sandbox/lock:on.

  allow/lock/connect

type | (u16-set, string-set)
static | yes

Specifies a list of allowed connect(2) ports and pathname UNIX domain socket paths for Lock sandboxing. This category corresponds to the landlock(7) access rights LANDLOCK_ACCESS_NET_CONNECT_TCP, LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, and LANDLOCK_ACCESS_FS_RESOLVE_UNIX, the last of which restricts both connect(2) and sendmsg(2) with an explicit recipient address to UNIX domain sockets created outside the landlock(7) domain. Argument is either a single port, a closed range in format port1-port2, a comma-separated list of ports and/or ranges such as 80,443,8000-9000, or an absolute UNIX domain socket path. landlock(7) network support requires ABI 4 or later. Fourth landlock(7) ABI was introduced with Linux 6.7. UNIX domain socket support requires ABI 9 or later. Ninth landlock(7) ABI was introduced with Linux 7.1. UDP port support requires ABI 10 or later. Tenth landlock(7) ABI was introduced with Linux 7.2. On older kernels, this command is a no-op when specified with the unsupported argument kind and does not do any confinement. As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Noop without sandbox/lock:on.

  warn/fs

type | string-vec

Specifies a list of filesystem types to warn for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  warn/walk

type | string-vec

Specifies a list of glob(3p) patterns to warn for Walk sandboxing.

  warn/list

type | string-vec

Specifies a list of glob(3p) patterns to warn for List sandboxing.

  warn/stat

type | string-vec

Specifies a list of glob(3p) patterns to warn for Stat sandboxing.

  warn/read

type | string-vec

Specifies a list of glob(3p) patterns to warn for Read sandboxing.

  warn/write

type | string-vec

Specifies a list of glob(3p) patterns to warn for Write sandboxing.

  warn/exec

type | string-vec

Specifies a list of glob(3p) patterns to warn for Exec sandboxing.

  warn/create

type | string-vec

Specifies a list of glob(3p) patterns to warn for Create sandboxing.

  warn/delete

type | string-vec

Specifies a list of glob(3p) patterns to warn for Delete sandboxing.

  warn/rename

type | string-vec

Specifies a list of glob(3p) patterns to warn for Rename sandboxing.

  warn/readlink

type | string-vec

Specifies a list of glob(3p) patterns to warn for Readlink sandboxing.

  warn/symlink

type | string-vec

Specifies a list of glob(3p) patterns to warn for Symlink sandboxing.

  warn/truncate

type | string-vec

Specifies a list of glob(3p) patterns to warn for Truncate sandboxing.

  warn/chdir

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chdir sandboxing.

  warn/readdir

type | string-vec

Specifies a list of glob(3p) patterns to warn for Readdir sandboxing.

  warn/mkdir

type | string-vec

Specifies a list of glob(3p) patterns to warn for Mkdir sandboxing.

  warn/rmdir

type | string-vec

Specifies a list of glob(3p) patterns to warn for Rmdir sandboxing.

  warn/chown

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chown sandboxing.

  warn/chgrp

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chgrp sandboxing.

  warn/chmod

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chmod sandboxing.

  warn/chattr

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chattr sandboxing.

  warn/chroot

type | string-vec

Specifies a list of glob(3p) patterns to warn for Chroot sandboxing.

  warn/notify

type | string-vec

Specifies a list of glob(3p) patterns to warn for Notify sandboxing.

  warn/utime

type | string-vec

Specifies a list of glob(3p) patterns to warn for Utime sandboxing.

  warn/mkdev

type | string-vec

Specifies a list of glob(3p) patterns to warn for Mkdev sandboxing.

  warn/mkfifo

type | string-vec

Specifies a list of glob(3p) patterns to warn for Mkfifo sandboxing.

  warn/mktemp

type | string-vec

Specifies a list of glob(3p) patterns to warn for Mktemp sandboxing.

  warn/net/bind

type | string-vec

Specifies a list of network address patterns to warn for Bind network sandboxing.

  warn/net/accept

type | string-vec

Specifies a list of network address patterns to warn for Accept network sandboxing.

  warn/net/connect

type | string-vec

Specifies a list of network address patterns to warn for Connect network sandboxing.

  warn/sendfd

type | string-vec

Specifies a list of file descriptor names to warn for SendFd sandboxing.

  warn/recvfd

type | string-vec

Specifies a list of file descriptor names to warn for RecvFd sandboxing.

  deny/fs

type | string-vec
drop | yes, add only

Specifies a list of filesystem types to deny for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  deny/walk

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Walk sandboxing.

  deny/list

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for List sandboxing.

  deny/stat

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Stat sandboxing.

  deny/read

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Read sandboxing.

  deny/write

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Write sandboxing.

  deny/exec

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Exec sandboxing.

  deny/create

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Create sandboxing.

  deny/delete

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Delete sandboxing.

  deny/rename

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Rename sandboxing.

  deny/readlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Readlink sandboxing.

  deny/symlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Symlink sandboxing.

  deny/truncate

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Truncate sandboxing.

  deny/chdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chdir sandboxing.

  deny/readdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Readdir sandboxing.

  deny/mkdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Mkdir sandboxing.

  deny/rmdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Rmdir sandboxing.

  deny/chown

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chown sandboxing.

  deny/chgrp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chgrp sandboxing.

  deny/chmod

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chmod sandboxing.

  deny/chattr

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chattr sandboxing.

  deny/chroot

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Chroot sandboxing.

  deny/notify

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Notify sandboxing.

  deny/utime

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Utime sandboxing.

  deny/mkdev

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Mkdev sandboxing.

  deny/mkfifo

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Mkfifo sandboxing.

  deny/mktemp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to deny for Mktemp sandboxing.

  deny/net/bind

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to deny for Bind network sandboxing.

  deny/net/accept

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to deny for Accept network sandboxing.

  deny/net/connect

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to deny for Connect network sandboxing.

  deny/sendfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to deny for SendFd sandboxing.

  deny/recvfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to deny for RecvFd sandboxing.

  filter/fs

type | string-vec

Specifies a list of filesystem types to filter for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  filter/walk

type | string-vec

Specifies a list of glob(3p) patterns to filter for Walk sandboxing.

  filter/list

type | string-vec

Specifies a list of glob(3p) patterns to filter for List sandboxing.

  filter/stat

type | string-vec

Specifies a list of glob(3p) patterns to filter for Stat sandboxing.

  filter/read

type | string-vec

Specifies a list of glob(3p) patterns to filter for Read sandboxing.

  filter/write

type | string-vec

Specifies a list of glob(3p) patterns to filter for Write sandboxing.

  filter/exec

type | string-vec

Specifies a list of glob(3p) patterns to filter for Exec sandboxing.

  filter/create

type | string-vec

Specifies a list of glob(3p) patterns to filter for Create sandboxing.

  filter/delete

type | string-vec

Specifies a list of glob(3p) patterns to filter for Delete sandboxing.

  filter/rename

type | string-vec

Specifies a list of glob(3p) patterns to filter for Rename sandboxing.

  filter/readlink

type | string-vec

Specifies a list of glob(3p) patterns to filter for Readlink sandboxing.

  filter/symlink

type | string-vec

Specifies a list of glob(3p) patterns to filter for Symlink sandboxing.

  filter/truncate

type | string-vec

Specifies a list of glob(3p) patterns to filter for Truncate sandboxing.

  filter/chdir

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chdir sandboxing.

  filter/readdir

type | string-vec

Specifies a list of glob(3p) patterns to filter for Readdir sandboxing.

  filter/mkdir

type | string-vec

Specifies a list of glob(3p) patterns to filter for Mkdir sandboxing.

  filter/rmdir

type | string-vec

Specifies a list of glob(3p) patterns to filter for Rmdir sandboxing.

  filter/chown

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chown sandboxing.

  filter/chgrp

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chgrp sandboxing.

  filter/chmod

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chmod sandboxing.

  filter/chattr

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chattr sandboxing.

  filter/chroot

type | string-vec

Specifies a list of glob(3p) patterns to filter for Chroot sandboxing.

  filter/notify

type | string-vec

Specifies a list of glob(3p) patterns to filter for Notify sandboxing.

  filter/utime

type | string-vec

Specifies a list of glob(3p) patterns to filter for Utime sandboxing.

  filter/mkdev

type | string-vec

Specifies a list of glob(3p) patterns to filter for Mkdev sandboxing.

  filter/mkfifo

type | string-vec

Specifies a list of glob(3p) patterns to filter for Mkfifo sandboxing.

  filter/mktemp

type | string-vec

Specifies a list of glob(3p) patterns to filter for Mktemp sandboxing.

  filter/net/bind

type | string-vec

Specifies a list of network address patterns to filter for Bind network sandboxing.

  filter/net/accept

type | string-vec

Specifies a list of network address patterns to filter for Accept network sandboxing.

  filter/net/connect

type | string-vec

Specifies a list of network address patterns to filter for Connect network sandboxing.

  filter/sendfd

type | string-vec

Specifies a list of file descriptor names to filter for SendFd sandboxing.

  filter/recvfd

type | string-vec

Specifies a list of file descriptor names to filter for RecvFd sandboxing.

  panic/fs

type | string-vec
drop | yes, add only

Specifies a list of filesystem types to panic for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  panic/walk

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Walk sandboxing.

  panic/list

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for List sandboxing.

  panic/stat

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Stat sandboxing.

  panic/read

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Read sandboxing.

  panic/write

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Write sandboxing.

  panic/exec

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Exec sandboxing.

  panic/create

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Create sandboxing.

  panic/delete

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Delete sandboxing.

  panic/rename

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Rename sandboxing.

  panic/readlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Readlink sandboxing.

  panic/symlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Symlink sandboxing.

  panic/truncate

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Truncate sandboxing.

  panic/chdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chdir sandboxing.

  panic/readdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Readdir sandboxing.

  panic/mkdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Mkdir sandboxing.

  panic/rmdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Rmdir sandboxing.

  panic/chown

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chown sandboxing.

  panic/chgrp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chgrp sandboxing.

  panic/chmod

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chmod sandboxing.

  panic/chattr

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chattr sandboxing.

  panic/chroot

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Chroot sandboxing.

  panic/notify

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Notify sandboxing.

  panic/utime

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Utime sandboxing.

  panic/mkdev

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Mkdev sandboxing.

  panic/mkfifo

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Mkfifo sandboxing.

  panic/mktemp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to panic for Mktemp sandboxing.

  panic/net/bind

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to panic for Bind network sandboxing.

  panic/net/accept

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to panic for Accept network sandboxing.

  panic/net/connect

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to panic for Connect network sandboxing.

  panic/sendfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to panic for SendFd sandboxing.

  panic/recvfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to panic for RecvFd sandboxing.

  stop/fs

type | string-vec
drop | yes, add only

Specifies a list of filesystem types to stop for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  stop/walk

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Walk sandboxing.

  stop/list

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for List sandboxing.

  stop/stat

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Stat sandboxing.

  stop/read

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Read sandboxing.

  stop/write

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Write sandboxing.

  stop/exec

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Exec sandboxing.

  stop/create

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Create sandboxing.

  stop/delete

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Delete sandboxing.

  stop/rename

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Rename sandboxing.

  stop/readlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Readlink sandboxing.

  stop/symlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Symlink sandboxing.

  stop/truncate

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Truncate sandboxing.

  stop/chdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chdir sandboxing.

  stop/readdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Readdir sandboxing.

  stop/mkdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Mkdir sandboxing.

  stop/rmdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Rmdir sandboxing.

  stop/chown

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chown sandboxing.

  stop/chgrp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chgrp sandboxing.

  stop/chmod

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chmod sandboxing.

  stop/chattr

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chattr sandboxing.

  stop/chroot

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Chroot sandboxing.

  stop/notify

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Notify sandboxing.

  stop/utime

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Utime sandboxing.

  stop/mkdev

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Mkdev sandboxing.

  stop/mkfifo

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Mkfifo sandboxing.

  stop/mktemp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to stop for Mktemp sandboxing.

  stop/net/bind

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to stop for Bind network sandboxing.

  stop/net/accept

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to stop for Accept network sandboxing.

  stop/net/connect

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to stop for Connect network sandboxing.

  stop/sendfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to stop for SendFd sandboxing.

  stop/recvfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to stop for RecvFd sandboxing.

  abort/fs

type | string-vec

Specifies a list of filesystem types to abort for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  abort/walk

type | string-vec

Specifies a list of glob(3p) patterns to abort for Walk sandboxing.

  abort/list

type | string-vec

Specifies a list of glob(3p) patterns to abort for List sandboxing.

  abort/stat

type | string-vec

Specifies a list of glob(3p) patterns to abort for Stat sandboxing.

  abort/read

type | string-vec

Specifies a list of glob(3p) patterns to abort for Read sandboxing.

  abort/write

type | string-vec

Specifies a list of glob(3p) patterns to abort for Write sandboxing.

  abort/exec

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to abort for Exec sandboxing.

  abort/create

type | string-vec

Specifies a list of glob(3p) patterns to abort for Create sandboxing.

  abort/delete

type | string-vec

Specifies a list of glob(3p) patterns to abort for Delete sandboxing.

  abort/rename

type | string-vec

Specifies a list of glob(3p) patterns to abort for Rename sandboxing.

  abort/readlink

type | string-vec

Specifies a list of glob(3p) patterns to abort for Readlink sandboxing.

  abort/symlink

type | string-vec

Specifies a list of glob(3p) patterns to abort for Symlink sandboxing.

  abort/truncate

type | string-vec

Specifies a list of glob(3p) patterns to abort for Truncate sandboxing.

  abort/chdir

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chdir sandboxing.

  abort/readdir

type | string-vec

Specifies a list of glob(3p) patterns to abort for Readdir sandboxing.

  abort/mkdir

type | string-vec

Specifies a list of glob(3p) patterns to abort for Mkdir sandboxing.

  abort/rmdir

type | string-vec

Specifies a list of glob(3p) patterns to abort for Rmdir sandboxing.

  abort/chown

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chown sandboxing.

  abort/chgrp

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chgrp sandboxing.

  abort/chmod

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chmod sandboxing.

  abort/chattr

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chattr sandboxing.

  abort/chroot

type | string-vec

Specifies a list of glob(3p) patterns to abort for Chroot sandboxing.

  abort/notify

type | string-vec

Specifies a list of glob(3p) patterns to abort for Notify sandboxing.

  abort/utime

type | string-vec
drop | yes, remove only

Specifies a list of glob(3p) patterns to abort for Utime sandboxing.

  abort/mkdev

type | string-vec

Specifies a list of glob(3p) patterns to abort for Mkdev sandboxing.

  abort/mkfifo

type | string-vec

Specifies a list of glob(3p) patterns to abort for Mkfifo sandboxing.

  abort/mktemp

type | string-vec

Specifies a list of glob(3p) patterns to abort for Mktemp sandboxing.

  abort/net/bind

type | string-vec

Specifies a list of network address patterns to abort for Bind network sandboxing.

  abort/net/accept

type | string-vec

Specifies a list of network address patterns to abort for Accept network sandboxing.

  abort/net/connect

type | string-vec

Specifies a list of network address patterns to abort for Connect network sandboxing.

  abort/sendfd

type | string-vec

Specifies a list of file descriptor names to abort for SendFd sandboxing.

  abort/recvfd

type | string-vec

Specifies a list of file descriptor names to abort for RecvFd sandboxing.

  kill/fs

type | string-vec
drop | yes, add only

Specifies a list of filesystem types to kill for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  kill/walk

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Walk sandboxing.

  kill/list

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for List sandboxing.

  kill/stat

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Stat sandboxing.

  kill/read

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Read sandboxing.

  kill/write

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Write sandboxing.

  kill/exec

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Exec sandboxing.

  kill/create

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Create sandboxing.

  kill/delete

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Delete sandboxing.

  kill/rename

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Rename sandboxing.

  kill/readlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Readlink sandboxing.

  kill/symlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Symlink sandboxing.

  kill/truncate

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Truncate sandboxing.

  kill/chdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chdir sandboxing.

  kill/readdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Readdir sandboxing.

  kill/mkdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Mkdir sandboxing.

  kill/rmdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Rmdir sandboxing.

  kill/chown

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chown sandboxing.

  kill/chgrp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chgrp sandboxing.

  kill/chmod

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chmod sandboxing.

  kill/chattr

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chattr sandboxing.

  kill/chroot

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Chroot sandboxing.

  kill/notify

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Notify sandboxing.

  kill/utime

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Utime sandboxing.

  kill/mkdev

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Mkdev sandboxing.

  kill/mkfifo

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Mkfifo sandboxing.

  kill/mktemp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to kill for Mktemp sandboxing.

  kill/net/bind

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to kill for Bind network sandboxing.

  kill/net/accept

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to kill for Accept network sandboxing.

  kill/net/connect

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to kill for Connect network sandboxing.

  kill/sendfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to kill for SendFd sandboxing.

  kill/recvfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to kill for RecvFd sandboxing.

  exit/fs

type | string-vec
drop | yes, add only

Specifies a list of filesystem types to exit for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input.

  exit/walk

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Walk sandboxing.

  exit/list

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for List sandboxing.

  exit/stat

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Stat sandboxing.

  exit/read

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Read sandboxing.

  exit/write

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Write sandboxing.

  exit/exec

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Exec sandboxing.

  exit/create

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Create sandboxing.

  exit/delete

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Delete sandboxing.

  exit/rename

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Rename sandboxing.

  exit/readlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Readlink sandboxing.

  exit/symlink

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Symlink sandboxing.

  exit/truncate

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Truncate sandboxing.

  exit/chdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chdir sandboxing.

  exit/readdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Readdir sandboxing.

  exit/mkdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Mkdir sandboxing.

  exit/rmdir

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Rmdir sandboxing.

  exit/chown

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chown sandboxing.

  exit/chgrp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chgrp sandboxing.

  exit/chmod

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chmod sandboxing.

  exit/chattr

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chattr sandboxing.

  exit/chroot

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Chroot sandboxing.

  exit/notify

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Notify sandboxing.

  exit/utime

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Utime sandboxing.

  exit/mkdev

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Mkdev sandboxing.

  exit/mkfifo

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Mkfifo sandboxing.

  exit/mktemp

type | string-vec
drop | yes, add only

Specifies a list of glob(3p) patterns to exit for Mktemp sandboxing.

  exit/net/bind

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to exit for Bind network sandboxing.

  exit/net/accept

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to exit for Accept network sandboxing.

  exit/net/connect

type | string-vec
drop | yes, add only

Specifies a list of network address patterns to exit for Connect network sandboxing.

  exit/sendfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to exit for SendFd sandboxing.

  exit/recvfd

type | string-vec
drop | yes, add only

Specifies a list of file descriptor names to exit for RecvFd sandboxing.

  mask

type | string-map

Specifies a list of glob(3p) patterns to mask for Read & Write sandboxing.

If a path is masked, Syd returns a file descriptor to /dev/null on any sandbox granted attempt to open(2) this path. Masking can effectively be used to hide the contents of a file in a more relaxed and compatible way than denying read/write access to it. stat(2) calls on a masked file returns the original file metadata and a masked file may be executed. After a successful mask operation, the mask path is not checked for sandbox access.

As of version 3.35.1, the default mask path /dev/null may be changed by specifying a colon-separated extra path to the mask-add command, e.g. mask+/dev/[fn]ull:/dev/zero when both of the paths /dev/full and /dev/null will be masked with the path /dev/zero. The mask path must be a fully canonicalized path without symbolic links.

As of version 3.36.0, the default mask path may be overridden for directories by specifying an additional colon-separated extra path to the mask-add command, e.g. mask+/proc/acpi/***:/dev/null:/var/empty when the path /proc/acpi/wakeup which is a regular file will return /dev/null at open(2) boundary but the directory /proc/acpi and any subdirectory within will return /var/empty at open(2) boundary. The mask path must be a fully canonicalized path without symbolic links.

As of version 3.49.0, escape sequences are supported: "\:" inserts a literal colon and "\\" inserts a literal backslash. This allows patterns containing colons, e.g. mask+/path\:with\:colons.

These escape sequences are resolved by the command parser before the resulting pattern is matched as a glob(3p) expression. Within the glob a backslash escapes the character that follows it, so a literal glob metacharacter ("*", "?" or "[") is matched by preceding it with a doubled backslash. The parser first collapses the doubled backslash to a single backslash, which the glob matcher then applies to the following metacharacter. A lone backslash that is not part of a "\:" or "\\" sequence is rejected with EINVAL ("Invalid argument").

As of version 3.51.0, masked paths return the information of the target path at stat(2) boundary and masked paths are protected against filesystem writes.

This feature provides a non-privileged alternative to the bind command because it does not require the creation of a mount namespace. In addition, mask commands may be specified dynamically after startup using the syd(2) API allowing for fine-tuned and/or incremental confinement.

  block

type | ip-range
drop | yes, add only

Specifies a range of IP networks to be blocked when specified as the target address of connect group system calls which are connect(2), sendto(2), sendmsg(2), sendmmsg(2) and when received as the source address in return from accept(2) and accept4(2) system calls for IPv4 and IPv6 family sockets. Use block+<net> and block-<net> to add and remove ip networks from the range. Alternatively the range can also be populated by including ipset and netset files from within Syd configuration. Use block^ to clear the list and block! to simplify the ip range by aggregating networks together. block! is useful to call after importing big IP blocklists, it helps reduce memory consumption and improve matching performance. Below is a configuration snippet that imports Feodo and DShield blocklists:

    # Enable IP blocklists
    # Source: https://github.com/firehol/blocklist-ipsets.git
    include /usr/src/blocklist-ipsets/feodo.ipset
    include /usr/src/blocklist-ipsets/feodo_badips.ipset
    include /usr/src/blocklist-ipsets/dshield.netset
    include /usr/src/blocklist-ipsets/dshield_1d.netset
    include /usr/src/blocklist-ipsets/dshield_30d.netset
    include /usr/src/blocklist-ipsets/dshield_7d.netset
    include /usr/src/blocklist-ipsets/dshield_top_1000.ipset
    block!

  domain

type | string-vec

Define, remove, or clear sandbox domains. A domain is a named, self-contained sandbox policy. Refer to the "Domain Transitions" section of the syd(7) manual page for the model. The operators are:

•   domain+@<name>: Define a new, empty domain named <name>.
•   domain+@<name>:<seed>: Define <name> and initialise its policy from <seed>, which is @<other> to clone an existing domain (e.g. @default), an absolute path to read a configuration file, or a built-in profile name. The leading character selects the form (@ a domain, / a file, otherwise a profile name).
•   domain-@<name>: Remove the domain <name>.
•   domain^: Remove every domain except default.

The domain default always exists and may neither be redefined (EEXIST: "File exists") nor removed (EPERM: "Operation not permitted"). A domain name is 1 to 16 bytes, letter-first ASCII alphanumeric with underscore ([A-Za-z][A-Za-z0-9_]*). A longer name fails with ENAMETOOLONG ("File name too long"), and the empty name or any byte that breaks the pattern (a leading digit or underscore, punctuation, whitespace, a control byte, NUL, or non-ASCII) fails with EILSEQ ("Invalid or incomplete multibyte or wide character"). At most 64 domains may be defined, including default, exceeding this fails with ENOSPC ("No space left on device"). A domain that is the target of a move (see the move command) may not be removed while that move exists (EBUSY: "Device or resource busy").

Configuration is directed to a defined domain by prefixing a per-domain command with @<name>/, e.g. @web/allow/read+/etc/hosts. An unprefixed command applies to default. A reference to an undefined domain fails with EINVAL ("Invalid argument"). A process-global setting (one documented as static) is not part of any domain's policy and may not be addressed to a domain, the attempt fails with EINVAL ("Invalid argument").

  move

type | string-vec

Declare automatic domain transitions, termed moves, for a domain. Refer to the "Domain Transitions" section of the syd(7) manual page for the model. The forms are:

    move/@<to>/<kind>+<pattern>    # Add a move.
    move/@<to>/<kind>-<pattern>    # Remove that move.
    move/@<to>/<kind>^             # Remove all moves of this kind.

each optionally prefixed with @<from>/ to attach it to a domain other than default. While the sandbox is in the source domain, an allowed operation of kind <kind> whose target matches <pattern> switches the active domain to <to>. The move takes effect only when the operation is itself permitted, and never grants a denied operation. The kinds and their patterns are:

•   exit: exit_group(2) of a process whose executable path matches the glob(3p) pattern <pattern>.
•   exec: execve(2)/execveat(2) of a binary whose path matches the glob(3p) pattern <pattern>.
•   chdir: chdir(2)/fchdir(2) to a directory whose path matches the glob(3p) pattern <pattern>.
•   mmap: Executable mmap(2) of a file whose path matches the glob(3p) pattern <pattern>.
•   bind: bind(2) to an address matching the address pattern <pattern>.
•   connect: connect(2) or connected send(2) to an address matching the address pattern <pattern>.
•   accept: accept(2)/accept4(2) of a peer matching the address pattern <pattern>.

Target domain <to> and any source domain <from> must already be defined, otherwise call fails with EINVAL ("Invalid argument"). Examples are given below:

    move/@net/exec+/usr/bin/curl          # In the default domain, exec curl -> @net
    @web/move/@db/connect+0.0.0.0/0!5432  # In @web, an allowed :5432 connect -> @db

Network patterns for bind, connect, and accept use the same syntax as the network sandboxing rules. Refer to "ADDRESS MATCHING" section for more information.

  cmd/exec

type | command

Makes Syd execute an external command without sandboxing. The process is executed in a new process group with its standard input attached to /dev/null. Standard output and standard error file descriptors are inherited. Syd also ensures no non-standard file descriptors leak into the new process utilizing the close_range(2) system call. Current working directory is changed to the root directory, i.e. /. The umask(2) is set to 077. The program name and arguments must be separated with the US (unit separator, hex: 0x1f, octal: 037) character. To ease usage, the syd-exec(1) helper utility is provided to construct a sandbox command of this type:

    ; syd -puser -mlock:exec -- sh -c 'test -c $(syd-exec echo hello world)'
    hello world
    ;

  cmd/move

type | command

Move the sandbox to a named domain. This is the manual form of a domain transition. Refer to the "Domain Transitions" section of the syd(7) manual page. The active domain is switched with cmd/move!<name>. The @ sigil is optional after the ! operator, so cmd/move!web and cmd/move!@web are equivalent. The named domain must be defined, otherwise the command fails with EINVAL ("Invalid argument").

  load

type | integer (fd) or string (profile-name)

Read configuration from the given file descriptor, the file must be a regular file opened for reading. Syd uses pidfd_getfd(2) to acquire the file descriptor and reads sandbox configuration from it. This command is useful to load a set of sandbox commands into Syd in a single step, e.g:

    int fd = open("/tmp", O_RDWR | O_TMPFILE | O_CLOEXEC, 0);
    if (fd == -1) errx(1, "Failed to open temporary file");
    const char *syd = "sandbox:stat/on\nallow/stat+/***\ndeny/stat+/\nlock:on\n";
    errx(write(fd, syd, strlen(syd)) == -1, "Failed to write config");
    errx(lseek(fd, 0, SEEK_SET) == -1, "Failed to seek in file");
    char load[64];
    sprintf(load, "/dev/syd/load/%d", fd);
    errx(stat(load, NULL) == -1, "Failed to load Syd profile");
    errx(execvp("/bin/sh", (char *[]){"/bin/sh", "-l", NULL}) == -1, "execvp failed");

Due to security reasons, this command is only available via the virtual stat(2) call, it may not be used with the -m command line switch or in a configuration file.

As of version 3.30.0, this command may be used to load builtin profiles, when Syd falls back to parsing the "load" argument as a profile name if parsing the argument as a file descriptor fails.

  trace/allow_safe_setuid

type | boolean
static | yes

Enable SafeSetID and retain the Linux capability CAP_SETUID. This option is implied at startup if any UID transits were defined with the setuid command. This feature allows Syd to change UID simultaneously with the sandbox process. Because NPTL uses reserved signals to ensure all threads share the same UID/GID, setting this option disables the SROP mitigator. Refer to the "Enhanced Execution Control (EEC)" section of the syd(7) manual page for more information.

  trace/allow_safe_setgid

type | boolean
static | yes

Enable SafeSetID and retain the Linux capability CAP_SETGID. This option is implied at startup if any GID transits were defined with the setuid command. This feature allows Syd to change GID simultaneously with the sandbox process. Because NPTL uses reserved signals to ensure all threads share the same UID/GID, setting this option disables the SROP mitigator. Refer to the "Enhanced Execution Control (EEC)" section of the syd(7) manual page for more information.

  setuid

type | [(uid_t, uid_t)]
static | yes

Add, remove a UID transition or reset UID transitions. Accepts only numeric user IDs, not user names. Only a single transition from a source UID can be defined. Target UID can not be less than or equal to the build default 11, which is typically the operator user. Defining a UID transit with this option implies trace/allow_safe_setuid:true.

Usage:

    setuid+0:65534      # Define a UID transition from root to nobody.
    setuid-0:65534      # Remove a previously defined UID transition.
    setuid^0            # Remove all UID transitions matching source UID.
    setuid^             # Remove all UID transitions.

  setgid

type | [(gid_t, gid_t)]
static | yes

Add, remove a GID transition or reset GID transitions. Accepts only numeric group IDs, not group names. Only a single transition from a source GID can be defined. Target GID can not be less than or equal to the build default 14, which is typically the uucp group. Defining a GID transit with this option implies trace/allow_safe_setgid:true.

Usage:

    setgid+0:65534      # Define a GID transition from root to nogroup.
    setgid-0:65534      # Remove a previously defined GID transition.
    setgid^0            # Remove all GID transitions matching source GID.
    setgid^             # Remove all GID transitions.

  trace/allow_unsafe_setid

type | boolean
static | yes

A boolean specifying whether Syd should deny with EPERM ("Operation not permitted") rather than terminate setuid(2) changes with target UID less than or equal to the build default 11, which is typically the operator user and setgid(2) changes with target GID less than or equal to the build default 14, which is typically the uucp group.

  trace/allow_unsafe_cbpf

type | boolean
static | yes

A boolean specifying whether Syd should allow additional seccomp(2) cbpf filters to be installed by sandbox processes. By default, this is denied to mitigate confused deputy problems and errno(3) is set to EINVAL ("Invalid argument") for compatibility reasons. On the one hand, stacked seccomp(2) cbpf filters allow for incremental confinement and therefore added hardening, on the other hand they may be abused to install system call filters with more precedent actions than user-notify thereby bypassing Syd's own seccomp(2) cbpf filters. To quote the seccomp_unotify(2): "... a user-space notifier can be bypassed if the existing filters allow the use of seccomp(2) or prctl(2) to install a filter that returns an action value with a higher precedence than SECCOMP_RET_USER_NOTIF (see seccomp(2))." Setting the option trace/allow_unsafe_prctl:true overrides this option and allows the PR_SET_SECCOMP prctl(2) operation inside the sandbox. This may be changed in the future for clearer separation of mitigations.

  trace/allow_unsafe_cbpf_speculative

type | boolean
static | yes
trusted | yes

Disables Speculative Store Bypass mitigations for seccomp(2) filters.

This option has been split from trace/allow_unsafe_exec_speculative as of version 3.58.0 for clear separation of mitigations.

This option requires the trusted Cargo feature to take effect. Without the feature, setting this option to true is ignored with a warning.

  trace/allow_unsafe_ebpf

type | boolean
static | yes

Allows direct eBPF use inside the Syd sandbox using the bpf(2) system call, whose unprivileged use is permitted since Linux-4.4. On the one hand, eBPF programs can be used for additional hardening, on the other hand eBPF is a frequent source of vulnerabilities due to churn, complexity, improper validation and complexity of validation. eBPF may also be abused to implement efficient and portable rootkits.

As of version 3.37.0, Syd drops the capability CAP_BPF and denies the privileged bpf(2) commands BPF_MAP_CREATE, BPF_PROG_LOAD, and BPF_BTF_LOAD with the errno(3) EPERM ("Operation not permitted") regardless of the value of this option. This is in consistence with the Linux kernel checks for the kernel.unprivileged_bpf_disabled sysctl(8). Consult the bpf(2) and capabilities(7) manual pages for more information about the CAP_BPF Linux capability which is implemented in Linux-5.8 or newer.

  trace/allow_unsafe_dumpable

type | boolean
static | yes
trusted | yes

A boolean specifying whether Syd should skip from setting its process dumpable attribute to false. This allows core dumps for the Syd process, and allows debugging/profiling/tracing the Syd process. You should not set this option unless you're developing Syd.

  trace/allow_unsafe_exec_ldso

type | boolean
static | yes

A boolean specifying whether ld.so(8) exec indirection should be allowed. This is not allowed by default to harden noexec boundaries.

  trace/allow_unsafe_exec_libc

type | boolean
static | yes

A boolean specifying whether turning on secure-execution mode for libc should be skipped. Refer to the "Enforcing AT_SECURE and UID/GID Verification" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_memory

type | boolean
static | yes

Specify whether the Memory-Deny-Write-Execute (MDWE) protections should be bypassed. Refer to the "Memory-Deny-Write-Execute Protections" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_nopie

type | boolean
static | yes

A boolean specifying whether execution of non-PIE binaries should be allowed. This is generally not recommended but may be necessary on some systems. Refer to the "Enforcing Position-Independent Executables (PIE)" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_noreg

type | boolean
static | yes

A boolean specifying whether executable memory mapping of non-regular files should be allowed. By default Syd blocks executable mappings backed by non-regular files, consistent with WhiteEgret. This is generally not recommended but may be necessary on some systems.

  trace/allow_unsafe_exec_null

type | boolean
static | yes

A boolean specifying whether exec calls with NULL argument and environment pointers should be allowed. Refer to the "Enhanced execve and execveat Syscall Validation" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_stack

type | boolean
static | yes

A boolean specifying whether execution of binaries with executable stack should be allowed. This is generally not recommended by may be necessary on some systems. Refer to the "Enforcing Non-Executable Stack" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_textrel

type | boolean
static | yes

A boolean specifying whether execution of binaries with text relocations should be allowed. Text relocations require writable code segments and defeat address space layout randomization. This is generally not recommended but may be necessary on some systems.

  trace/allow_unsafe_exec_script

type | boolean
static | yes

Opt out of file vetting for interpreted exec. When off (default) on Linux 6.14 and newer, Syd sets SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_RESTRICT_FILE_LOCKED at startup so interpreters/dynamic linkers must only execute a file if execveat(2) with AT_EXECVE_CHECK flag on its file descriptor would succeed (FD-based check avoids TOCTOU). When on, Syd does not set these bits (legacy behavior). No-op on kernels < 6.14. Bits are unprivileged-settable. Locks make the policy sticky across exec. Refer to the "Securebits and Kernel-Assisted Executability" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_interactive

type | boolean
static | yes

Opt out of interactive snippet denial. When off (default) on Linux 6.14 and newer, Syd sets SECBIT_EXEC_DENY_INTERACTIVE and its lock so interpreters refuse interactive code (-e, -c, REPL, etc.) unless content arrives via a file descriptor and passes AT_EXECVE_CHECK of execveat(2). When on, Syd does not set these bits (legacy behavior). No-op on kernels < 6.14. Bits are unprivileged-settable. Locks persist the policy across exec. Refer to the "Securebits and Kernel-Assisted Executability" section of the syd(7) manual page for more information.

  trace/allow_unsafe_exec_speculative

type | boolean
static | yes

A boolean specifying whether speculation controls should not be set to enable Speculative Execution mitigations using the prctl(2) interface at startup. When this option is enabled, the prctl(2) operations PR_GET_SPECULATION_CTRL, and PR_SET_SPECULATION_CTRL are allowed within the sandbox. Refer to the "Speculative Execution Mitigation" section of the syd(7) manual page for more information.

  trace/allow_unsafe_kptr

type | boolean
static | yes

A boolean specifying whether syscall arguments taking pointers should NOT be checked for kernel pointers. Refer to the "Hardening against kernel pointer misuse" section of the syd(7) manual page for more information.

  trace/allow_unsafe_sys_ptrace

type | boolean
static | yes
trusted | yes

A boolean specifying whether the Linux capability CAP_SYS_PTRACE should be passed to the sandbox process. By default this capability is not inherited by sandboxed processes. Syd itself always retains CAP_SYS_PTRACE for internal use (e.g. pidfd_getfd(2)). This option only controls whether the capability is also made available inside the sandbox.

Warning, this option allows the sandbox process to trivially break out of the sandbox by e.g. attaching to the Syd main thread with ptrace(2) and getting a handle to the seccomp(2) notify file descriptor. Therefore, this option should only be used in trusted environments.

As of version 3.55.0, this option is split from trace/allow_unsafe_ptrace to allow fine-grained control over capability inheritance independently of ptrace(2) handler configuration.

This option requires the trusted Cargo feature to take effect. Without the feature, setting this option to true is ignored with a warning.

  trace/allow_unsafe_ptrace

type | boolean
static | yes
trusted | yes

A boolean to disable Syd's use of ptrace(2). Setting this option to true effectively removes the ptrace(2) dependency from the sandbox. This is necessary to trace Syd together with its children, e.g. with strace -f. This option also disables or changes the following features that depend on Syd's use of ptrace(2):

•   Force sandboxing is disabled because it depends on PTRACE_EVENT_EXEC.
•   SegvGuard is disabled because it depends on PTRACE_EVENT_EXIT.
•   Domain transitions with kind exit are disabled because they depend on PTRACE_EVENT_EXIT.
•   chdir(2), fchdir(2), execve(2), execveat(2), mmap(2), and mmap2(2) handlers switch to seccomp_unotify(2) versions which do not have TOCTOU protections at syscall exit. A sandbox process may trivially change to an arbitrary directory, execute an arbitrary file or map an arbitrary library using the well-known race conditions in system call wrappers that continue the system call in the sandbox process.

As of version 3.50.0, this option requires the trusted Cargo feature to take effect. Without the feature, setting this option to true is ignored with a warning.

  trace/allow_unsafe_perf

type | boolean
static | yes

A boolean specifying whether perf calls should be allowed within the sandbox.

As of version 3.40.0, the prctl(2) operations PR_TASK_PERF_EVENTS_ENABLE, and PR_TASK_PERF_EVENTS_DISABLE are also allowed if this option is set at startup.

  trace/allow_unsafe_create

type | boolean
drop | yes, off only

A boolean specifying whether to allow unsafe file creation. Refer to the "Trusted File Creation" section of the syd(7) manual page for more information.

  trace/allow_unsafe_deleted

type | boolean
drop | yes, off only

A boolean specifying whether access to deleted files through open file descriptors and proc_pid_fd(5) magic links should be allowed. Refer to the "Deleted File Access Mediation" section of the syd(7) manual page for more information.

  trace/allow_unsafe_fcntl

type | boolean
static | yes

A boolean specifying whether fcntl(2) restrictions should be lifted. When disabled (default), Syd denies F_SETOWN, F_SETOWN_EX, and F_SETSIG operations to prevent bypassing landlock(7) signal scoping via the SIGIO delivery path. Refer to the output of "syd-ls fcntl" for the list of denied fcntl(2) operations. Refer to the "Restricting fcntl operations and trace/allow_unsafe_fcntl" section of the syd(7) manual page for more information.

  trace/allow_unsafe_filename

type | boolean
drop | yes, off only

A boolean specifying whether the restrictions on file names should be lifted. By default, file names with control characters, forbidden characters or invalid UTF-8 are denied with EINVAL as necessary. Read Enhanced Path Integrity Measures of the syd(7) manual page for more information.

  trace/allow_unsafe_futex

type | boolean
static | yes

A boolean specifying whether priority-inheritance futex(2) operations should be allowed. When disabled (default), Syd denies the FUTEX_LOCK_PI, FUTEX_LOCK_PI2, FUTEX_TRYLOCK_PI, FUTEX_UNLOCK_PI, FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI commands, which is every operation gated by CONFIG_FUTEX_PI configuration option in the Linux kernel, with ENOSYS ("Function not implemented").

  trace/allow_unsafe_hardlinks

type | boolean
drop | yes, off only

A boolean specifying whether to allow unsafe hardlink targets. Refer to the "Trusted Hardlinks" section of the syd(7) manual page for more information.

  trace/allow_unsafe_machine_id

type | boolean
drop | yes, off only

Specify whether the sandbox substitutes machine-id(5) with a synthetic, per-Syd random identifier or exposes the host value. The substitution is done at open(2) boundary after the access checks grants access to this file. The files /etc/hostid and /var/adm/hostid which are part of the gethostid(3) interface of POSIX.1-2008 as well as /sys/class/dmi/id/product_uuid are also substituted as part of this mitigation. When false (default), at startup Syd computes a SHA3-512 digest using AT_RANDOM bytes and formats the result as a 128-character lowercase hexadecimal sandbox ID; the first 32 characters of this string (which must not be all zeroes) are presented in place of machine-id(5), /etc/hostid, /var/adm/hostid, and /sys/class/dmi/id/product_uuid to limit information leakage. Users may override the sandbox ID by setting SYD_ID environment variable to a 128-character lowercase hexadecimal string that satisfies the same non-all-zero 32-character prefix constraint. When true, no substitution is performed and the real system machine-id(5), /etc/hostid, /var/adm/hostid, and /sys/class/dmi/id/product_uuid files are made visible to the sandbox process (i.e., the mitigation is disabled). Refer to the following links for more information:

•   https://man7.org/linux/man-pages/man5/machine-id.5.html
•   https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostid.html

  trace/allow_unsafe_proc_dumpable

type | boolean
static | yes

Specifies whether PR_SET_DUMPABLE prctl(2) operation with dumpable argument set to SUID_DUMP_DISABLE should be turned into noop for compatibility. This may be necessary to sandbox programs such as sftp(1) which use this operation to make their per-process proc(5) directory inaccessible to other programs including Syd.

  trace/allow_unsafe_proc_files

type | boolean
static | yes

Specifies whether internal procfs(5) should NOT be mounted with the option subset=pid. This option is a no-op unless unshare/pid:true is also set.

  trace/allow_unsafe_proc_name

type | boolean
static | yes

Specifies whether PR_SET_NAME prctl(2) operation to change process name should be allowed. By default, this operation is logged and denied with a success return, so from the perspective of the sandbox process the call succeeds but no process name change takes place.

  trace/allow_unsafe_proc_pid_status

type | boolean
drop | yes, off only

A boolean specifying whether masking security-sensitive fields in proc_pid_status(5) files should be disabled. Refer to the "Hardening proc_pid_status(5)" section of the syd(7) manual page for more information.

  trace/allow_unsafe_magiclinks

type | boolean
static | yes

A boolean specifying whether /proc magic links should be followed even when per-process directory id differs from the caller process id. Magic links are symbolic link-like objects that are most notably found in proc(5); examples include /proc/pid/exe and /proc/pid/fd/*. Refer to symlink(7) manual page for more details. Unknowingly opening magic links can be risky for some applications. Examples of such risks include the following:

•   If the process opening a pathname is a controlling process that currently has no controlling terminal (see credentials(7)), then opening a magic link inside /proc/pid/fd that happens to refer to a terminal would cause the process to acquire a controlling terminal.
•   In a containerized environment, a magic link inside /proc may refer to an object outside the container, and thus may provide a means to escape from the container.

Because of such risks, Syd denies access to magic links which do not belong to the current process by default.

  trace/allow_unsafe_symlinks

type | boolean
drop | yes, off only

A boolean specifying whether to allow following symlinks in untrusted directories. Untrusted directories are either group-writable, world-writable, or have the sticky-bit set. Refer to the "Trusted Symbolic Links" section of the syd(7) manual page for more information.

  trace/allow_unsafe_sticky

type | boolean
drop | yes, off only

A boolean specifying whether immutable setgid/sticky bits enforcement for directories should be disabled. By default, Syd preserves both the setgid and sticky bits on directories at chmod(2) boundary: if a directory already has setgid bit or sticky bit set, any chmod(2) call that would remove either bit is corrected to retain the bit(s) with a warning. Setting this option to true disables this enforcement, allowing both bits to be freely toggled. Refer to the "Immutable Sticky Bit" section of the syd(7) manual page for more information.

  trace/allow_unsafe_namespace

type | string-vec
static | yes

A list of namespaces to allow creation under the sandbox. Must be a comma-separated list of mount, uts, ipc, user, pid, net, cgroup and time. The special value all is supported as a placeholder to specify all namespaces. The special values none and off are supported to reset to no namespaces. An invocation of this command overrides all previous invocations, ie only the list of subnamespaces in the last invocation of this command will be allowed. By default, subnamespace creation is not allowed. As of version 3.35.2, the system calls sethostname(2) and setdomainname(2) are only allowed in the sandbox if uts subnamespace is allowed. This is similar to the mount family system calls which are only allowed if mount subnamespace is allowed.

  trace/allow_unsafe_netlink

type | boolean
drop | yes, off only

A boolean specifying whether the sandbox process may receive asynchronous kernel notifications on netlink(7) sockets. When disabled (default) Syd attaches a locked socket filter at the socket(2) boundary which discards received messages bearing a zero nlmsg_pid. Such messages originate from the kernel and report host network state changes and audit(8) records. Their delivery to a confined process serves no purpose and exposes host activity useful for reconnaissance. Requests, replies and dumps are retained, so the process may still query the kernel. Applications which monitor netlink(7) events require this option.

  trace/allow_unsafe_nice

type | boolean
static | yes

A boolean specifying whether process and I/O priority changes are allowed for the sandbox. Refer to the "Process Priority and Resource Management" section of the syd(7) manual page for more information.

  trace/allow_unsafe_nocookie

type | boolean
static | yes

A boolean specifying whether enforcement of syscall argument cookies should be disabled. Refer to the "Syscall Argument Cookies" section of the syd(7) manual page for more information.

  trace/allow_unsafe_nomseal

type | boolean
static | yes

A boolean specifying whether read-only sealing critical regions of the Syd sandbox policy using mseal(2) when sandbox is locked should be disabled. Refer to the "Memory Sealing of Sandbox Policy Regions on Lock" section of the syd(7) manual page for more information.

  trace/allow_unsafe_noxom

type | boolean
static | yes

A boolean specifying whether the hardening to enforce immutability and Execute-Only Memory (XOM) protections on Syd's own executable mappings during initialization should be disabled. Refer to the "Hardening executable mappings" section of the syd(7) manual page for more information.

  trace/allow_unsafe_recvmsg

type | boolean
static | yes

A boolean specifying whether hooking the system calls recvmsg(2) and recvmmsg(2) should be disabled. Syd handles these system calls only to perform credentials management for SCM_CREDENTIALS, no sandboxing is done for these system calls. Disabling these hooks is necessary to receive O_PATH file descriptors with SCM_RIGHTS.

  trace/allow_unsafe_chown

type | boolean
static | yes

Makes Syd keep the capability CAP_CHOWN and allows sandbox process to chown(2) files to arbitrary uid/gid. Without this option, chown(2) family calls are confined to caller's own effective UID and GID. Attempts to change ownership to a different uid or gid are denied with EPERM ("Operation not permitted").

  trace/allow_unsafe_chroot

type | boolean
static | yes

Disable Chroot sandboxing and turn chroot(2) system call into a no-op. Refer to the explanation of chroot sandbox category in the "SANDBOXING" section of the syd(7) manual page for more information.

  trace/allow_unsafe_pivot_root

type | boolean
static | yes

Turn pivot_root(2) system call into a no-op rather than unconditionally denying it with the errno(3) EPERM. Refer to the explanation of chroot sandbox category in the "SANDBOXING" section of the syd(7) manual page for more information.

  trace/allow_unsafe_copy

type | boolean
static | yes

Allow the MSG_COPY flag for msgrcv(2).

  trace/allow_unsafe_oob

type | boolean
static | yes

Allow the MSG_OOB flag for send(2), sendto(2), sendmsg(2), sendmmsg(2), recv(2), recvfrom(2), recvmsg(2), and recvmmsg(2) system calls to send and receive out-of-band data, and allow the setsockopt(2) option SO_OOBINLINE which selects the inline urgent data delivery path. Refer to the "Denying MSG_OOB Flag in send/recv System Calls" section of the syd(7) manual page for more information.

  trace/allow_unsafe_open_kfd

type | boolean
drop | yes, off only

A boolean specifying whether open(2) calls to AMD KFD character devices should be continued in the sandbox process rather than opening them in the Syd emulator thread and sending the file descriptor. The /dev/kfd character device requires per-application access to the GPU device, therefore opening the device in the Syd emulator thread and then continuing the subsequent ioctl(2) system calls in the sandbox process is going to return EBADF ("Bad file number"). Until Syd has a way to fully emulate the ioctl(2) request space and is able to call the ioctl(2) system call directly from Syd emulator threads, this option may be used to access such character devices. Setting this option opens a TOCTOU attack vector, whereby the sandbox process can open an arbitrary file instead of the character device in question! Syd applies the following mitigations to limit the scope of the attack vector:

•   Syd continues the system call if and only if O_RDWR is set in the flags argument.
•   Syd does not continue the system call if at least one of the flags O_CREAT, O_TRUNC or O_TMPFILE is set in the flags argument.
•   Syd returns ENOSYS ("Function not implemented") for the openat2(2) system call rather than continuing it in the sandbox process to prevent the struct open_how pointer indirection to bypass the restrictions applied to the flags argument. Refer to the openat2(2) manual page for more information.
•   This option may be changed at runtime, and it is highly recommended to unset this option using the syd(2) virtual system call API right after the character device is opened.

  trace/allow_unsafe_open_path

type | boolean
drop | yes, off only

A boolean specifying whether the mitigation to turn O_PATH file descriptors into O_RDONLY file descriptors for safe emulation should be disabled. With this option, Syd continues the open(2) system calls with the O_PATH in the sandbox process which opens a TOCTOU vector.

  trace/allow_unsafe_open_suid

type | boolean
drop | yes, off only

A boolean specifying whether the mitigation to prevent opening files with set-user-ID or set-group-ID mode bits should be disabled. With this option, Syd allows opening SUID/SGID files regardless of mode. When disabled, opening SUID/SGID files with write modes returns EACCES ("Permission denied") errno(3).

  trace/allow_unsafe_mkbdev

type | boolean
static | yes

Specify whether unsafe block device access should be allowed. When set, Syd does not drop the capability CAP_MKNOD on startup for itself, but it is still dropped for the sandbox process. This allows:

•   block device creation with mknod(2).
•   open block devices with open(2).
•   list block devices with getdents64(2).

  trace/allow_unsafe_mkcdev

type | boolean
static | yes

Specify whether unsafe character device creation should be allowed. When set, Syd does not drop the capability CAP_MKNOD on startup for itself, but it is still dropped for the sandbox process. This allows creation of character devices with mknod(2).

  trace/allow_unsafe_stat_bdev

type | boolean
drop | yes, off only
static | yes

Specify whether stat(2) family calls on block devices should return last access and modification times as-is. Refer to the "Device Sidechannel Mitigations" section of the syd(7) manual page for more information.

  trace/allow_unsafe_stat_cdev

type | boolean
drop | yes, off only
static | yes

Specify whether stat(2) family calls on character devices should return last access and modification times as-is. Refer to the "Device Sidechannel Mitigations" section of the syd(7) manual page for more information.

  trace/allow_unsafe_notify_bdev

type | boolean
drop | yes, off only
static | yes

Specify whether unsafe event generation for fanotify_mark(2) and inotify_add_watch(2) system calls should be allowed for block devices. Refer to the "Device Sidechannel Mitigations" section of the syd(7) manual page for more information.

  trace/allow_unsafe_notify_cdev

type | boolean
drop | yes, off only
static | yes

Specify whether unsafe event generation for fanotify_mark(2) and inotify_add_watch(2) system calls should be allowed for character devices. Refer to the "Device Sidechannel Mitigations" section of the syd(7) manual page for more information.

  trace/allow_unsafe_cpu

type | boolean
static | yes

Specify whether CPU emulation system calls should be allowed. By default, as of version 3.22.1, Syd denies the modify_ldt(2), subpage_prot(2), switch_endian(2), vm86(2), and vm86old(2) system calls, which are associated with CPU emulation functionalities. Enabling this option (trace/allow_unsafe_cpu:1) permits these calls, thus relaxing the restriction. This option should be used with caution, as allowing these system calls can introduce potential vulnerabilities by enabling processes to modify CPU state or memory protections. Use this setting only in trusted environments where the execution of these system calls is necessary.

  trace/allow_unsafe_deprecated

type | boolean
static | yes

Specify whether deprecated system calls such as remap_file_pages(2), stime(2), and uselib(2) should be allowed. Refer to the output of the command "syd-ls deprecated" for the full list of deprecated system calls for your installation.

  trace/allow_unsafe_kcapi

type | boolean
static | yes

Specify whether access to the Linux kernel cryptography API (aka: "KCAPI") should be allowed when network sandboxing is on. This option has no effect when network sandboxing is off.

As most things in life, cryptography has good and evil uses: KCAPI is convenient as it may be used to implement cryptography without depending on user-space libraries such as OpenSSL but it may also enable malicious code to efficiently turn itself into ransomware. KCAPI is also vulnerable to attacks such as CVE-2026-31431 aka copy.fail. Adhering to the goal to be secure by default Syd disallows this access by default.

Syd does not hook into setsockopt(2) and the ALG_SET_KEY operation to set the encryption key is directly handled by the host kernel therefore the encryption key is not copied into Syd's address space.

Syd hooks into bind(2), sendto(2), sendmsg(2), and sendmmsg(2) but not read(2), write(2), recv(2), or splice(2). To reduce syscall overhead, user is recommended to use the unhooked system calls when they can to interact with KCAPI.

  trace/allow_unsafe_kcmp

type | boolean
static | yes

A boolean specifying whether the kcmp(2) system call should be allowed inside the sandbox. This call may be unsafe if it's directed to a process which sandbox process does not own.

  trace/allow_unsafe_keyring

type | boolean
static | yes

Specify whether the add_key(2), keyctl(2), and request_key(2) system calls should be allowed. Enabling this setting permits key management within the sandbox, which can introduce security risks by allowing keyring manipulations. Use only in trusted environments.

  trace/allow_unsafe_pipe

type | boolean
static | yes

Allow creating notification pipes using the O_NOTIFICATION_PIPE flag to the pipe2(2) system call. When disabled, such calls fail with ENOPKG ("Package not installed") as on a Linux kernel built without CONFIG_WATCH_QUEUE. Refer to the "Denying O_NOTIFICATION_PIPE Flag in pipe2" section of the syd(7) manual page for more information. This option was added as of version 3.58.0.

  trace/allow_unsafe_pkey

type | boolean
static | yes

Specifies whether the pkey_alloc(2), pkey_free(2), and pkey_mprotect(2) system calls should be allowed. By default, these calls are denied to enhance security. Setting this option to true enables these system calls, allowing the use of memory protection keys. This option should be used with caution and only in trusted environments where the use of these system calls is necessary.

  trace/allow_unsafe_madvise

type | boolean
static | yes

Specifies whether madvise(2) system call should NOT be hardened. By default, only a subset of advice are permitted, see syd-ls madvise. Refer to the "madvise(2) Hardening" section of the syd(7) manual page for more information.

  trace/allow_unsafe_numa

type | boolean
static | yes

Specifies whether the NUMA memory-policy and page-migration system calls should be allowed. Refer to the output of "syd-ls numa" for the list of NUMA system calls. By default these system calls are denied.

  trace/allow_unsafe_page_cache

type | boolean
static | yes

Specifies whether the system calls cachestat(2) and mincore(2) should be allowed. By default, these calls are denied to enhance security as it has been documented that they can be misused to perform page-cache attacks. Refer to the "Mitigation against Page Cache Attacks" section of the syd(7) manual page for more information.

  trace/allow_unsafe_setsockopt

type | boolean
static | yes

Specifies whether setsockopt(2) hardening should be disabled. Refer to the "setsockopt(2) Hardening" section of the syd(7) manual page for more information.

  trace/allow_unsafe_socketcall

type | boolean
static | yes

Specifies whether socketcall(2) multiplexer system call should be allowed. Enabling this option gives the sandbox process a way to bypass "setsockopt(2) Hardening" on architectures x86, m68k, mips, mipsel, ppc, ppc64, ppc64le, s390, s390x, sheb, and sh. This is only necessary for compatibility with libcs which don't yet support the newer non-multiplexed system calls available as of Linux-4.3. GNU Libc added support for new system calls as of version 2.23 and removed support for the old socketcall(2) fallback as version 2.37. musl added support for new system calls as of version 1.2.2.

  trace/allow_unsafe_tcp_devmem

type | boolean
static | yes

Specify whether devmem TCP should be allowed. This covers SO_DEVMEM_* socket(2) options and MSG_SOCK_DEVMEM recv(2) flag, both of which Syd denies with EOPNOTSUPP ("Operation not supported") by default.

  trace/allow_unsafe_tcp_fastopen

type | boolean
static | yes

Specify whether TCP Fast Open should be allowed. This covers TCP_FASTOPEN socket(2) options and MSG_FASTOPEN send(2) flag, both of which Syd denies with EOPNOTSUPP ("Operation not supported") by default.

  trace/allow_unsafe_time

type | boolean
static | yes

A boolean specifying whether system calls which adjust the system time are allowed. This also causes Syd to keep the CAP_SYS_TIME capability. Use syd-ls time to see the list of system calls allowed by this setting.

  trace/allow_unsafe_xattr

type | boolean
drop | yes, off only
static | yes

A boolean specifying whether the extended attributes restrictions on security, system, and trusted namespaces should be lifted. If this option is not set only sandbox processes with access to the sandbox lock can view or change these extended attribute namespaces.

  trace/allow_unsafe_caps

type | boolean
static | yes
trusted | yes

A boolean specifying whether Syd should skip dropping Linux capabilities(7) at startup. This setting can be used to construct privileged containers and should be used with extreme care.

As of version 3.50.0, this option requires the trusted Cargo feature to take effect. Without the feature, setting this option to true is ignored with a warning.

As of version 3.57.0, the following capabilities(7) are dropped regardless of the value this option: CAP_AUDIT_CONTROL, CAP_BLOCK_SUSPEND, CAP_BPF, CAP_CHECKPOINT_RESTORE, CAP_IPC_OWNER, CAP_KILL, CAP_MAC_ADMIN, CAP_MAC_OVERRIDE, CAP_NET_ADMIN, CAP_SYS_ADMIN, CAP_SYS_BOOT, CAP_SYS_MODULE, CAP_SYS_PACCT, CAP_SYS_RAWIO, CAP_SYS_RESOURCE, CAP_SYS_TTY_CONFIG, and CAP_WAKE_ALARM.

  trace/allow_unsafe_cap_fixup

type | boolean
static | yes

Opt out of hardened UID/capability transitions. When off (default), Syd clears SECBIT_KEEP_CAPS and SECBIT_NO_SETUID_FIXUP and applies their lock bits at startup so capabilities are dropped when all UIDs become nonzero. When on, Syd leaves SECBIT_KEEP_CAPS and SECBIT_NO_SETUID_FIXUP (and their locks) as inherited from the parent, preserving the Linux' traditional "setuid fixup" behavior and any PR_SET_KEEPCAPS use by the application (legacy behavior). This option is a no-op on kernels that do not support securebits. Refer to the "Securebits and Kernel-Assisted Executability" section of the syd(7) manual page for more information.

  trace/allow_unsafe_env

type | boolean
static | yes

Specify whether unsafe environment variables should be allowed into the environment of the sandbox process. Refer to the output of "syd-ls env" for the list of unsafe environment variables.

  trace/allow_safe_syslog

type | boolean
static | yes

Specify whether unprivileged sandbox processes can access Syd's syslog(2) emulation using dmesg(8). Unprivileged processes include the set of all sandbox processes with the sandbox lock "off", and all but the initial sandbox process with the sandbox lock set to "exec". This option has nothing to do with access to the host syslog which is never allowed.

  trace/allow_safe_bind

type | boolean
static | yes

Specify whether the socket address arguments of successful bind(2) calls should be allowed for connect(2), sendto(2), sendmsg(2), and sendmmsg(2) system calls.

Note, these addresses are allowed globally and not per-process for usability reasons. Thus, for example, a process which forks to call bind(2) will have its address allowed for their parent as well.

  trace/allow_unsafe_bind

type | boolean
static | yes

Specify whether the Linux capability CAP_NET_BIND_SERVICE, which allows a process to bind(2) to ports lower than 1024, should be retained. When this option is set, Syd keeps the capability on startup for itself, but it is still dropped for the sandbox process.

  trace/allow_unsafe_any_addr

type | boolean
drop | yes, off only

Specify whether connections to wildcard "any" addresses are allowed to cross bind(2), connect(2), sendto(2), sendmsg(2), and sendmmsg(2) boundaries unchanged. When unset (default), Syd rewrites IPv4 0.0.0.0 to 127.0.0.1 and IPv6 :: to ::1 at bind(2) to prevent unintended exposure on all interfaces, and denies connect(2), sendto(2), sendmsg(2), and sendmmsg(2) to wildcard addresses with the errno(3) ENETUNREACH ("Network is unreachable"), consistent with FreeBSD's net.inet.ip.connect_inaddr_wild sysctl. When set, both the rewrite and the rejection are disabled.

  trace/allow_unsafe_ipv6_rthdr

type | boolean
drop | yes, off only

Specify whether IPV6_RTHDR ancillary data on sendmsg(2) and sendmmsg(2) is allowed to cross the network sandbox unchanged, including RFC 2292 alias IPV6_2292RTHDR. When unset (default), Syd strips any such control message from message header before forwarding the call to Linux and logs the event. IPV6_RTHDR installs an IPv6 routing header on the outgoing packet. Type-2 routing header defined for Mobile IPv6 (RFC 6275) is unprivileged on Linux and doesn't require CAP_NET_RAW unlike IPV6_HOPOPTS, IPV6_DSTOPTS, and IPV6_RTHDRDSTOPTS. Linux rewrites the outgoing packet's destination address to the first segment of routing header, bypassing the address only access check that Syd performs on the syscall destination argument.

  trace/allow_unsafe_ipv6_scope

type | boolean
drop | yes, off only

Specify whether a non-zero sin6_scope_id (RFC 4007 zone identifier) in the IPv6 socket address of bind(2), connect(2), sendto(2), sendmsg(2), and sendmmsg(2) is allowed to cross the network sandbox unchanged. When unset (default), Syd zeroes out sin6_scope_id before forwarding the call to Linux and logs the event. The address-only access check cannot match the egress interface encoded in sin6_scope_id, which Linux honours for link-scoped destinations (fe80::/10, ff02::/16).

  trace/allow_unsafe_ip_pktinfo

type | boolean
drop | yes, off only
static | yes

Specify whether IP_PKTINFO, IPV6_PKTINFO, and the RFC 2292 alias IPV6_2292PKTINFO ancillary data on sendmsg(2) and sendmmsg(2) are allowed to cross the network sandbox unchanged. When unset (default), Syd strips any such control message from message header before forwarding the call to Linux and logs the event. These control messages override the per-packet egress interface and source address, bypassing the address-only access check. When set, this option also allows the setsockopt(2) options IP_PKTINFO, IPV6_PKTINFO, IPV6_RECVPKTINFO, and IPV6_2292PKTINFO regardless of the value of the option trace/allow_unsafe_setsockopt.

  trace/allow_unsafe_ip_retopts

type | boolean
drop | yes, off only

Specify whether IP_RETOPTS ancillary data on sendmsg(2) and sendmmsg(2) is allowed to cross the network sandbox unchanged. When unset (default), Syd strips any such control message from message header before forwarding the call to Linux and logs the event. IP_RETOPTS installs IPv4 options for the outgoing packet, including the Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) source routing options. Linux kernel rewrites the packet's destination address to the first hop encoded in the LSRR or SSRR option, bypassing the address only access check that Syd performs on the syscall destination argument.

  trace/allow_unsafe_socket

type | boolean
static | yes

Specify whether unsafe socket families should be allowed. When set, Syd does not drop the capability CAP_NET_RAW on startup for itself, but it is still dropped for the sandbox process. This allows:

•   use of RAW and PACKET sockets.
•   bind to any address for transparent proxying.
•   make use of the ping(1) command.

  trace/allow_unsupp_socket

type | boolean
drop | yes, off only
static | yes

Specify whether unsupported socket families such as netlink sockets should be allowed access when network sandboxing is on. By default Syd allows sandboxed access to unix, ipv4 and ipv6 sockets. This option has no effect when network sandboxing is off.

As of version 3.52.0 Syd allows access to algorithm sockets with the trace/allow_unsafe_kcapi option rather than with this option. Algorithm sockets are used to interact with the Linux kernel cryptography API.

As of version 3.42.0, Transparent Inter-Process Communication (AF_TIPC) sockets at socketpair(2) boundary are only permitted if this option is set to true.

  trace/allow_unsupp_cmsg

type | boolean
drop | yes, off only

Specify whether unsupported control messages for sendmsg(2) and sendmmsg(2) are allowed to cross the network sandbox unchanged. When unset (default), Syd strips any such control message from message header before forwarding the call to Linux and logs the event.

  trace/allow_unsafe_personality

type | boolean
static | yes

Specify whether personality(2) restrictions should be lifted. Refer to the output of "syd-ls personality" for the list of allowlisted personality(2) personas. Refer to the "Personality Syscall Restrictions" section of the syd(7) manual page for more information.

  trace/allow_unsafe_arch_prctl

type | boolean
static | yes

Specify whether arch_prctl(2) shadow stack restrictions should be lifted. When disabled (default), Syd permits enabling the shadow stack but denies disabling it, unlocking it, and enabling the writable ARCH_SHSTK_WRSS feature.

  trace/allow_unsafe_prctl

type | boolean
static | yes

Specify whether prctl(2) restrictions should be lifted. Refer to the output of "syd-ls prctl" for the list of allowed prctl requests.

  trace/allow_unsafe_prlimit

type | boolean
static | yes

Specify whether prlimit(2) restrictions should be lifted.

  trace/allow_unsafe_shm

type | boolean
static | yes

Specify whether sysvipc(7) system calls should be allowed. Refer to the "Shared Memory Hardening" section of the syd(7) manual page for more information. Use syd-ls shm to see the list of system calls allowed by this setting.

  trace/allow_unsafe_perm_shm

type | boolean
static | yes

Specify whether unsafe permissions in mode arguments of shmget(2), msgget(2), and semget(2) system calls and the IPC_SET operation of shmctl(2), msgctl(2), and semctl(2) system calls should be permitted. Refer to the "Shared Memory Permissions Hardening" section of the syd(7) manual page for more information.

  trace/allow_unsafe_msgqueue

type | boolean
static | yes

Specify whether mq_overview(7) system calls should be allowed. Refer to the Shared Memory Hardening section of the syd(7) manual page for more information. Use syd-ls msgqueue to see the list of system calls allowed by this setting.

  trace/allow_unsafe_perm_msgqueue

type | boolean
static | yes

Specify whether unsafe permissions in mode argument of mq_open(2) system call should be permitted. Refer to the "Shared Memory Permissions Hardening" section of the syd(7) manual page for more information.

  trace/allow_unsafe_rseq

type | boolean
static | yes

Specify whether unsafe Restartable Sequences with the rseq(2) system call should be permitted. Refer to the "Denying Restartable Sequences" section of the syd(7) manual page for more information.

  trace/allow_unsafe_sud

type | boolean
static | yes

A boolean specifying whether the PR_SET_SYSCALL_USER_DISPATCH prctl(2) operation should be permitted within the sandbox. By default it is denied with errno(3) EINVAL ("Invalid argument"). This operation is only used by compatibility layers such as Wine.

  trace/allow_unsafe_sysinfo

type | boolean
static | yes

Specify whether the sysinfo(2) randomizer should be disabled at startup. If this option is set at startup the sysinfo(2) system call becomes allowed and provides identical info to the files /proc/loadavg and /proc/meminfo which are disabled by default by common profiles such as the linux and user profiles. Notably this mitigation is unset for the paludis profile because leaking this side-channel is irrelevant for package builds.

  trace/allow_unsafe_syslog

type | boolean
static | yes

Specify whether the Linux capability CAP_SYSLOG should be retained. This allows the process to perform privileged syslog(2) operations. This is useful when sandboxing a service such as syslogd.

  trace/allow_unsafe_memfd

type | boolean
drop | yes, off only
static | yes

A boolean specifying whether executable memory file descriptors should be enabled. By default Syd strips the MFD_EXEC and adds the MFD_NOEXEC_SEAL flag to memfd_create(2) flags argument. This ensures the memory file descriptor can never be made executable. The MFD_NOEXEC_SEAL flag requires Linux-6.3 or newer therefore on older kernels this option must be enabled to make memory file descriptors work. However, the user should be aware that allowing encrypted memory file descriptors does allow an attacker to bypass Exec, Force and TPE sandboxing and execute denylisted code.

  trace/allow_unsafe_uname

type | boolean
static | yes

A boolean specifying whether uname(2) hardening should be disabled. Refer to the "Hardened uname(2)" section of the syd(7) manual page for more information.

  trace/allow_unsafe_vmsplice

type | boolean
static | yes

Specify whether the vmsplice(2) system call should be allowed inside the sandbox. By default this system call is not permitted. Refer to the "Restricting vmsplice System Call" section of the syd(7) manual page for more information.

  trace/deny_dotdot

type | boolean
drop | yes, on only

Specify whether .. components should be denied during path resolution for chdir(2) and open(2) family system calls. This is useful in mitigating path traversal attacks. Refer to the "Path Resolution Restriction For Chdir and Open Calls" section of the syd(7) manual page for more information.

  trace/deny_exec_elf32

type | boolean
static | yes

Deny the execution of 32-bit ELF binaries.

  trace/deny_exec_elf_dynamic

type | boolean
static | yes

Deny the execution of dynamically linked ELF binaries.

  trace/deny_exec_elf_norelro

type | boolean
static | yes

Deny the execution of ELF binaries without full RELRO, that is binaries lacking a PT_GNU_RELRO segment with immediate binding. Note binaries without a dynamic section are denied as well.

  trace/deny_exec_elf_static

type | boolean
static | yes

Deny the execution of statically linked ELF binaries.

  trace/deny_exec_script

type | boolean
static | yes

Deny the execution of scripts (files with #!<interpreter> on first line).

The execve(2) TOCTOU mitigations do not cover this option which means the functionality is vulnerable to TOCTOU. This allows an attacker to execute a script whose path is denylisted. This TOCTOU is limited to scripts and requires the interpreter binary to be allowlisted for exec. Hence this vulnerability does not allow an attacker to execute denylisted binaries. This is why the user is recommended to deny the respective interpreter binaries for execution instead for a safe and secure approach.

On Linux-6.14 and newer, kernel-assisted executability provides a safe way to deny execution of scripts in cooperation with enlightened interpreters. Refer to the "Securebits and Kernel-Assisted Executability" section of the syd(7) manual page for more information.

  trace/deny_passrights

type | boolean
static | yes

Specify whether receiving file descriptors via SCM_RIGHTS should be denied. When enabled, Syd disables the SO_PASSRIGHTS socket option on unix(7) sockets created at socket(2), socketpair(2), accept(2), and accept4(2) boundaries. Thereafter the kernel denies sendmsg(2) of SCM_RIGHTS messages to these sockets with EPERM ("Operation not permitted").

•   This requires Linux-6.16 or newer. Setting this option on older kernels fails with ENOSYS ("Function not implemented").
•   Check is performed at sendmsg(2) time against the receiving socket, hence the error is observed by the sender.
•   setsockopt(2) with SO_PASSRIGHTS is denied with EPERM ("Operation not permitted") at seccomp-bpf level, hence the sandbox process cannot re-enable fd reception.
•   This option denies reception outright in the kernel, whereas the RecvFd sandboxing category restricts reception by file descriptor name.
•   This breaks programs which rely on file descriptor passing, such as Wayland, D-Bus, and PipeWire clients.
•   Refer to the link https://lwn.net/Articles/1023085/ for the motivation behind the SO_PASSRIGHTS socket option.

  trace/deny_tsc

type | boolean
static | yes

Specify whether reading the timestamp counter should be denied. Without an accurate timer, many timing attacks are going to be harder to perform.

•   This works on aarch64, x32, x86, and x86_64 only.
•   This breaks time related calls in the vDSO, which can be trivially worked around by writing a LD_PRELOAD library to call the respective system calls directly. Refer to "libsydtime", https://lib.rs/libsydtime, for a reference implementation.
•   This has a negative performance impact on programs that rely on gettimeofday(2) being a vDSO call.

  trace/deny_vdso

type | boolean
drop | yes, on only

Specify whether access to vDSO should be prevented by overwriting the auxiliary vector members AT_SYSINFO and AT_SYSINFO_EHDR at exec(3) boundary. This option becomes a no-op if trace/allow_unsafe_exec_libc is set to true.

  trace/exit_wait_all

type | boolean
static | yes

Specify whether Syd should wait for all processes to exit before exiting. By default, Syd exits with the eldest process and any leftover processes in the background are automatically killed.

  trace/force_cloexec

type | boolean
drop | yes, on only

Specify whether the "O_CLOEXEC" flag should be enforced for all creat(2), open(2), openat(2), openat2(2), memfd_create(2), socket(2), accept(2), and accept4(2) system calls made by the sandbox process. When this feature is enabled, Syd ensures that every file descriptor opened by the sandbox process is automatically set with the "O_CLOEXEC" flag, which prevents these file descriptors from being inherited by newly executed programs. This measure enhances security by closing file descriptors during exec(3) calls, preventing risk of file descriptor leakage which could lead to unauthorized access to sensitive files or resources. The feature can be toggled at runtime using Syd's virtual stat(2) API, providing flexible control over the confinement level of sandboxed processes.

  trace/force_rand_fd

type | boolean
drop | yes, on only

Specify whether file descriptors returned by all creat(2), open(2), openat(2), openat2(2), memfd_create(2), socket(2), accept(2), and accept4(2) system calls made by the sandbox process should be randomized. When this feature is enabled, Syd specifies a random available slot (rather than the lowest-numbered one) to the SECCOMP_IOCTL_NOTIF_ADDFD operation which is used to install a file descriptor to the sandbox process. Randomizing file descriptor numbers makes it significantly harder for an attacker to predict or deliberately reuse critical descriptors, thereby raising the bar against file-descriptor reuse and collision attacks. Note that enabling this may break programs which rely on the POSIX guarantee that open(2) returns the lowest available descriptor. This behavior can be toggled at runtime via Syd's virtual stat(2) API, allowing operators to enable or disable descriptor randomization without restarting or recompiling the sandboxed process. We're also cooperating with the HardenedBSD project to implement a similar feature in the BSD kernel. Refer to the following link for more information: https://git.hardenedbsd.org/hardenedbsd/HardenedBSD/-/issues/117

This feature uses the kcmp(2) system call and requires a Linux kernel configured with the CONFIG_KCMP option. On a kernel without this option, all system calls that are part of this feature will return ENOSYS (Function not implemented).

As of version 3.38.0, this option is enabled for the user profile.

  trace/force_ro_open

type | boolean
drop | yes, on only

Specify whether creating and writing open(2) family system calls should be denied regardless of the path argument. This option is restricted to creat(2), open(2), openat(2), and openat2(2) system calls and provided for convenience. To stop all write-like access completely, including e.g. mkdir(2), truncate(2) etc., use the readonly profile instead which uses the rule "deny/wrset/***" to prevent all write-like access. Refer to the "PROFILES" section of the syd(5) manual page for more information.

  trace/force_wx_open

type | boolean
drop | yes, on only

Specify whether creating and writing open(2) family system calls for executable files should be denied regardless of the path argument. This option is restricted to creat(2), open(2), openat(2), and openat2(2) system calls. This option may be combined with "trace/force_umask" option to confine the filesystem as W^X (Write XOR Execute). Refer to the "user" profile for an example. Refer to the "PROFILES" section of the syd(5) manual page for more information.

  trace/force_local_net

type | boolean
drop | yes, on only

Force local networking, rewrites all addresses to loopback for bind/connect.

In addition, AF_INET and AF_INET6 sockets created at socket(2) boundary get a loopback-only classic BPF socket filter attached with SO_ATTACH_FILTER and locked with SO_LOCK_FILTER. The filter drops incoming packets whose originating network interface is not the loopback interface. It is inherited by accept(2)ed sockets together with the lock. It can neither be detached, nor replaced, nor unlocked for the lifetime of the socket, even if the file descriptor leaks out of the sandbox. Sockets created before this option was enabled do not have the filter attached.

  trace/force_no_symlinks

type | boolean
drop | yes, on only

Specify whether path resolution for the open(2) family is forced to use the RESOLVE_NO_SYMLINKS resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the open(2) family. When enabled, traversal of symbolic links is disallowed during lookup; all pathname components must be non-symlink entries. This affects only the pathname resolution step and does not modify other flags or access checks.

  trace/force_no_magiclinks

type | boolean
drop | yes, on only

Specify whether path resolution for the open(2) family is forced to use the RESOLVE_NO_MAGICLINKS resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the open(2) family. When enabled, traversal of magic links (such as special proc(5) links that do not behave like regular symbolic links) is disallowed during lookup; all pathname components must be non-magiclink entries. This affects only the pathname resolution step and does not modify other flags or access checks. As of version 3.49.0, Syd honours this option when listing files under proc(5) filesystem thereby hiding magic links when this option is enabled.

  trace/force_no_xdev

type | boolean
drop | yes, on only

Specify whether path resolution for the open(2) family is forced to use the RESOLVE_NO_XDEV resolve flag. This flag is forced during path canonicalization, therefore this mitigation applies to all hooked path system calls, not just the open(2) family. When enabled, traversal of mount points, including bind mounts, is disallowed during lookup; the path must reside on the same mount as the directory referenced by dirfd (or the current working directory when dirfd == AT_FDCWD). This affects only the pathname resolution step and does not modify other flags or access checks.

  trace/force_umask

type | octal
default | 7000
drop | yes, raise only

Specify an umask mode to force for regular files. To unset a previously configured force umask use -1 or off as the value. As of version 3.15.6, chmod(2) family system calls also honour force umask for added hardening. As of version 3.22.1, this setting does not apply to directory creation for mkdir(2) and mkdirat(2) system calls. As of version 3.26.2, this setting does not apply to UNIX domain socket creation for bind(2) system calls, and non-regular file creation for mknod(2) and mknodat(2) system calls. As of version 3.54.0, default value is 7000 which ignores setuid/setgid/sticky bits for chmod(2) family system calls. This is in consistency with OpenBSD pledge(2).

  trace/memory_access

type | integer
default | 2
static | yes

Set mode on cross memory attach and proc_pid_mem(5) usage. Cross memory attach is done using the system calls process_vm_readv(2) and process_vm_writev(2) which requires a Linux kernel configured with the CONFIG_CROSS_MEMORY_ATTACH option enabled. Supported modes are:

•   0: Use cross memory attach if available, use proc_pid_mem(5) otherwise.
•   1: Use /proc/pid/mem(5) unconditionally.
•   2: Use cross memory attach unconditionally.

From a security point of view, these two modes of access have an important distinction where cross memory attach honours page protections of the target process, however using /proc/pid/mem(5) does not. This makes direct proc_pid_mem(5) access dangerous in that a Syd deputy process may be confused into corrupting or even controlling memory regions the sandbox process otherwise does not have direct access to. This is the main reason why mode 2 has been added as of version 3.32.6 as a secure default alternative to the previous default mode 0 whose fallback behaviour can be unpredictable and is against the idea of secure defaults. Therefore as of version 3.32.6, the user is asked to change the memory access mode explicitly if their Linux kernel is not configured with the CONFIG_CROSS_MEMORY_ATTACH option. You may also use the environment variables SYD_NO_CROSS_MEMORY_ATTACH and SYD_PROC_PID_MEM_FALLBACK, refer to the ENVIRONMENT section of the syd(1) manual page for more information. For further information about the security impact of proc_pid_mem(5) writes refer to the following links:

•   https://lore.kernel.org/lkml/202403011451.C236A38@keescook/T/
•   https://lwn.net/Articles/476947/
•   https://issues.chromium.org/issues/40089045

    ; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:0 true
    % time     seconds  usecs/call     calls    errors syscall
    ------ ----------- ----------- --------- --------- -----------------
    100.00    0.000031          10         3           process_vm_readv
    ------ ----------- ----------- --------- --------- -----------------
    100.00    0.000031          10         3           total
    ; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:1 true
    ; strace -q -eprocess_vm_readv -fc -- syd -poff -pD -mtrace/memory_access:2 true
    % time     seconds  usecs/call     calls    errors syscall
    ------ ----------- ----------- --------- --------- -----------------
    100.00    0.000008           2         3           process_vm_readv
    ------ ----------- ----------- --------- --------- -----------------
    100.00    0.000008           2         3           total

  trace/sync_seccomp

type | boolean
static | yes

Use synchronous mode for seccomp_unotify(2) so each Syd syscall handler thread wakes up on the same CPU as the respective sandbox thread that executed the system call. This option makes no functional difference and may or may not help with performance. Syd typically performs better with this option off, therefore it defaults to off.

PATTERN MATCHING

Syd uses shell-style pattern matching for path-based allowlists and filters, and for UNIX socket address patterns. The matcher is a derivative of the wildmatch matcher of rsync(1) with Syd-specific extensions, refer to the PATTERN MATCHING RULES section of the rsync(1) manual for background. Matching operates on raw bytes rather than characters: the matcher is 8-bit clean, case-sensitive, and independent of the locale, performing no Unicode normalization or code point interpretation. A pattern is a sequence of bytes in which the following constructs carry special meaning, any other byte matches itself:

* | Matches any sequence of bytes, never matching the directory separator /.
** | Matches any sequence of bytes, including the directory separator /.
? | Matches exactly one byte, never matching the directory separator /.
[...] | Matches exactly one byte out of the given class, see below.
\ | Escapes the next byte, stripping it of any special meaning.

Consistent with the filter rules of rsync(1), a trailing triple star matches the path itself in addition to everything below it: a pattern of the form P/*** is exactly equivalent to the pair of patterns P and P/**. For instance, /dev/*** matches both /dev and any file recursively under /dev, whereas /dev/** matches strictly below /dev. The triple star is only meaningful as a trailing component. In addition, Syd applies one extension to rsync(1) semantics, component elision: a ** between two separators also matches zero path components, e.g. /usr/**/bin/bash matches both /usr/bin/bash and /usr/local/bin/bash. A character class matches a single byte against a set:

[abc] | Matches one of the given bytes. The byte ] may be included by placing it first in the class, e.g. []a].
[!abc], [^abc] | Negated class, matches any byte not in the given class, e.g. [^0-9] matches any byte which is not an ASCII digit.
[a-f] | Range, matches any byte between the given bounds inclusive. A - placed first or last is literal.
[\x] | Escapes the next byte inside a class.
[[:name:]] | POSIX character class, where name is one of alnum, alpha, blank, cntrl, digit, graph, lower, print, punct, space, upper, or xdigit. Consistent with byte-wise matching, classes apply to ASCII range only.

Patterns are matched against canonicalized, absolute pathnames: symbolic links are resolved, and neither . (dot), nor .. (dotdot), nor consecutive separators occur in the matched text, hence patterns should be written in canonical form as well. A valid pattern starts with one of the characters / for pathnames, @ for abstract UNIX socket addresses, or ! for special addresses such as !unnamed (see ADDRESS MATCHING), or memory file descriptor names such as !memfd:*. Patterns may include environment variables which are expanded once at configure time. Finally, a pattern may be given hex-encoded, e.g. as produced by syd-hex(1), to express bytes which cannot be written in a configuration file, such as newlines: a pattern which is in its entirety a valid hexadecimal encoding is decoded before use. Decoding is unambiguous since canonical patterns start with one of /, @, or !, none of which is a hexadecimal digit. For efficient evaluation, Syd classifies each pattern at configure time into one of three match methods. This classification is an internal optimization with no semantic effect:

Literal | A pattern including none of *, ?, or [ is matched by plain byte equality.
Prefix | A pattern of the form LITERAL/** or LITERAL/*** is matched by a prefix comparison which honours component boundaries, e.g. /dev/*** matches /dev/null but not /devices.
Wildcard | Any other pattern is matched with the full matcher, an iterative algorithm with constant additional memory based on Kirk Krauss's FastWildCompare, extended with dual backup points for the * and ** wildcards, and SIMD-accelerated literal scanning.

Syd gets patterns from multiple sources: a configuration file, a profile, the -m command line switch (see syd(1) and syd(5)), or a stat(2) call with the /dev/syd prefix. There is no precedence between different sources: all rules accumulate in order into a single list per sandboxing capability, and pattern matching during access control happens in a single step where the last matching pattern decides the outcome. In particular, precedence is positional rather than structural: a later, more general pattern overrides an earlier, more specific one. If no pattern matches, the default action of the respective sandboxing capability applies (see the default/ family of commands).

ADDRESS MATCHING

Syd has a simple address scheme to match network addresses. Addresses can either be glob(3p) patterns to match UNIX and abstract UNIX socket addresses, or IP CIDR followed by a port specification to match IPv4 and IPv6 addresses. Port specification can be a single port, a closed range in format port1-port2, or a comma-separated list of ports and/or ranges such as 80,443,8000-9000. The address and the port specification must be split by the character !. The precedence logic is same as PATTERN MATCHING where the last matching pattern decides the outcome. UNIX socket addresses are matched against glob(3p) patterns as follows:

•   /path: UNIX domain sockets are matched by their canonicalized socket path, hence the patterns always start with the character /, e.g. /run/foo.sock, or /run/user/*/bus
•   @name: Abstract UNIX sockets are prefixed with the character @ before the access check, hence the patterns must start with the character @, e.g. @dbus-* matches abstract sockets whose name starts with dbus-. Abstract socket names are kernel-side identifiers, they're not filesystem paths and they're not canonicalized
•   !unnamed: Unnamed UNIX sockets are matched with the dummy address !unnamed. This is used for the socketpair(2) system call, and for socket operations on UNIX sockets without a pathname or an abstract name

Some examples are given below:

allow/net/bind+/run/foo.sock | Allow bind(2) to the UNIX socket /run/foo.sock.
allow/net/connect+/run/user/*/bus | Allow connect(2) to user D-Bus sockets.
allow/net/bind+@dbus-* | Allow bind(2) to abstract sockets with name prefix dbus-.
allow/net/bind,net/connect+!unnamed | Allow socketpair(2) and operations on unnamed UNIX sockets.

As of version 3.56.0, Syd supports dial(3) strings in the style of Plan9 and go, which extend the address scheme with protocol filtering. A dial(3) string has the form network!netaddr!service:

•   network: One of the predefined network names tcp, tcp4, tcp6, mptcp, mptcp4, mptcp6, udp, udp4, udp6, udplite, udplite4, udplite6, sctp, sctp4, sctp6, dccp, dccp4, dccp6, icmp, icmp4, icmp6, net, net4, net6, unix, unixgram, or unixpacket. Network names are case-insensitive. The tcp names match TCP sockets, the mptcp names match Multipath TCP sockets, the udp names match UDP sockets, the udplite names match UDP-Lite sockets, the sctp names match SCTP sockets, the dccp names match DCCP sockets, the icmp names match ping sockets, and the net names match any protocol. Each protocol-qualified name matches only its own protocol. To cover a host across every protocol use a net name or the legacy format. The 4 and 6 suffixes constrain the address family of netaddr. icmp4 and icmp6 are distinct protocols. icmp unifies them by address family. Service field of an icmp name is the ICMP identifier.
•   netaddr: An IP address, an IP CIDR network, a network alias such as loopback (see below), or the wildcard * which is an alias for any. Hostnames are not supported.
•   service: A port specification as described above, or the wildcard * which matches all ports. Named services are not supported, the service must be numeric.

Protocol of a socket is determined at system call time using the SO_PROTOCOL socket option. The network names form a predefined set, there's no ndb(8) lookup. Every field of a dial(3) string may be set with environment variables which are expanded at configure time, e.g. tcp!${ADDR}!${PORT}, or ${PROTO}!127.0.0.1!80. For network names unix, unixgram, and unixpacket, the service field is omitted and netaddr is a glob(3p) pattern matching UNIX and abstract UNIX socket addresses with the conventions described above: unix!/run/foo.sock is equivalent to /run/foo.sock, unix!@dbus-* is equivalent to @dbus-*, and unix!!unnamed is equivalent to !unnamed. The three UNIX network names are equivalent, the socket type is not used in matching. Some examples are given below:

tcp!127.0.0.1!80 | TCP to 127.0.0.1 port 80
udp!9.9.9.9!53 | UDP to 9.9.9.9 port 53
tcp!10.0.0.0/8!22,80,443 | TCP to the 10.0.0.0/8 network on ports 22, 80, and 443
tcp6!*!443 | TCP over IPv6 to any address on port 443
sctp!10.0.0.7!9899 | SCTP to 10.0.0.7 port 9899
udp!loopback!* | UDP to the loopback addresses on any port
net!::1!8080 | Any protocol to ::1 port 8080
unix!/run/*** | UNIX sockets under /run
unix!@dbus-* | Abstract UNIX sockets with the name prefix dbus-
unix!!unnamed | Unnamed UNIX sockets

dial(3) strings expanding to multiple networks add one rule per network, e.g. allow/net/connect+tcp!loopback!80 is equivalent to allow/net/connect+tcp!127.0.0.0/8!80 followed by allow/net/connect+tcp!::1/128!80. Addresses in the legacy format match any protocol, hence the legacy format is equivalent to the net network name, and existing configuration retains its behaviour, e.g. allow/net/connect+::1!8080 is equivalent to allow/net/connect+net!::1!8080. In addition there are some aliases, which may be used instead of specifying an address:

any | any4 + any6
any4 | Whole IPv4 address space: 0.0.0.0/0
any6 | Whole IPv6 address space: ::/0
loopback | loopback4 + loopback6
loopback4 | 127.0.0.0/8
loopback6 | ::1/128
linklocal | linklocal4 + linklocal6
linklocal4 | 169.254.0.0/16
linklocal6 | fe80::/10
local | local4 + local6
local4 | Loopback network and RFC1918 private networks: 127.0.0.0/8 + 10.0.0.0/8 + 172.16.0.0/12 + 192.168.0.0/16
local6 | ::1/128 + fe80::/10 + fc00::/7 + fec0::/10
multicast | multicast4 + multicast6
multicast4 | IPv4 multicast address space: 224.0.0.0/4
multicast6 | IPv6 multicast address space: ff00::/8

SECURITY

The interface is only available if the sandbox lock is not set for the calling process. Similarly, command-line option parsing and configuration file parsing stops once a lock:on clause is executed.

RETURN VALUE

For stat(2) calls, on success, zero is returned. On error, -1 is returned, and errno(3) is set to indicate the error.

For open(2) calls, on success the new file descriptor (a nonnegative integer) is returned. The file descriptor is randomized. On error, -1 is returned and errno(3) is set to indicate the error.

On a successful call the stat(2) buffer has the following fields masked, other fields are equivalent to the character device /dev/null:

•   Inode is zero.
•   Mode field represents the file type (character device) and permissions, with special bits set as follows: sticky bit for unshare/mount:1, SUID bit for unshare/user:1, SGID bit for unshare/net:1, user read/write/exec bits for Read, Write and Exec sandboxing, group read bit for Stat sandboxing, group write bit for Proxy sandboxing, group exec bit for TPE sandboxing, world read bit for Lock sandboxing, world write bit for Uring sandboxing, and world exec bit for Force sandboxing.
•   Nlink field represents the lower 32 bits of sandboxing capabilities, encoded as: lock, walk, list, stat, read, write, exec, ioctl, create, delete, rename, readlink, symlink, truncate, chdir, readdir, mkdir, rmdir, chown, chgrp, chmod, chattr, chroot, notify, utime, mkbdev, mkcdev, mkfifo, mktemp, net/bind, net/connect, and sendfd.
•   Device type represents syd(2) API version (major, minor)
•   Access, creation, and modification times are non-zero constants.

ERRORS

EINVAL | Sandbox command is syntactically incorrect.

ENOENT | Result of the given sandbox query is false (e.g. test -c /dev/syd/sandbox/stat?).

ENOENT | Sandbox lock is on, no commands are allowed.

EPERM | Attempted to raise privileges in lock:drop mode.

EBUSY | Attempted to edit a setting at runtime that must be configured at startup.

EEXIST | Overwriting rule is not permitted in lock:drop mode.

EEXIST | Attempted to add an UID/GID transition for SafeSetID but a transition with the same source UID/GID exists.

ENODATA | SafeSetID is on but no UID/GID transits were defined for the current user/group.

ENOSYS | Attempt to enable Randomized File Descriptors on a system without kcmp(2) support.

ENOSYS | Attempt to enable Force sandboxing which was disabled at build time.

EOPNOTSUPP | Hash algorithm is not supported for Force sandboxing.

EOPNOTSUPP | Ioctl operation is not supported for Ioctl sandboxing.

EOPNOTSUPP | Sandbox command is not supported for syd-oci(1).

SEE ALSO

syd(1), syd(5), syd(7), syd-ls(1), open(2), stat(2), perf(1), pledge(2), ptrace(2), seccomp(2), strace(1), glob(3p), io_uring(7), gdb(1), valgrind(1)

•   syd homepage: https://sydbox.exherbo.org
•   libsyd homepage: https://libsyd.exherbo.org
•   gosyd homepage: https://gosyd.exherbo.org
•   plsyd homepage: https://plsyd.exherbo.org
•   pysyd homepage: https://pysyd.exherbo.org
•   rbsyd homepage: https://rbsyd.exherbo.org
•   syd.el homepage: https://sydel.exherbo.org
•   libsydtime homepage: https://lib.rs/libsydtime
•   LandLock homepage: https://landlock.io/
•   vDSO wiki: https://en.wikipedia.org/wiki/VDSO
•   parse-size documentation: https://docs.rs/parse-size/1.0.0/parse_size/
•   ipnetwork documentation: https://docs.rs/ipnetwork

AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.