SYD-MDWE(1)

📦
version 3.59.0 · 3 versions
, in arch rolling

💅 SYD-MDWE(1) — the syd-mdwe girlies' guide ✨

okay so real talk, this is a page from the General Commands Manual, and the star of the show is syd-mdwe — she's giving security-tool main character energy and honestly? obsessed. 🫶

🌸 NAME 🌸

syd-mdwe — run a program under Memory-Deny-Write-Execute protections 💖

✨ SYNOPSIS ✨

syd-mdwe [-hms] {command [args...]}

🦋 DESCRIPTION 🦋

so syd-mdwe is this utility that runs a program under Memory-Deny-Write-Execute (MDWE) protections. no cap. 🔥

the protections can be applied using prctl(2) and seccomp(2), and bestie, they're literally identical to what Syd applies by default. iykyk. 💅

🎀 OPTIONS 🎀

  • -h — display help. she's helpful, she's iconic. 🙈
  • -m — enable MDWE protections using prctl(2) PR_SET_MDWE (default: both). 👑
  • -s — enable MDWE protections using seccomp(2) (default: both). ⭐

🌈 EXAMPLES 🌈

okay so the flex here is running pax-test once standalone and once under syd-mdwe(1) on a 6.8 kernel, and the differences are literally the whole point:

the ones that get Killed either way (standalone: Killed, mdwe: Killed) — no change, she was already slaying:

  • Executable anonymous mapping
  • Executable bss
  • Executable data
  • Executable heap
  • Executable stack
  • Executable shared library bss
  • Executable shared library data

and the ones where syd-mdwe really ate (standalone: Vulnerable, mdwe: Killed) — this is the glow-up right here, not me crying 😭:

  • Executable anonymous mapping (mprotect)
  • Executable bss (mprotect)
  • Executable data (mprotect)
  • Executable heap (mprotect)
  • Executable stack (mprotect)
  • Executable shared library bss (mprotect)
  • Executable shared library data (mprotect):
  • Writable text segments
fr fr the Vulnerable → Killed pipeline is the most satisfying glow-up in this whole page 💀✨

the test was performed with paxtest-0.9.15, and here's the receipts verbatim 🧾:

PaXtest - Copyright(c) 2003-2016 by Peter Busser <peter@adamantix.org> and Brad Spengler <spender@grsecurity.net>
Released under the GNU Public Licence version 2 or later

Mode: 1
Blackhat
Kernel:
Linux syd 6.8.0-syd-13213-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux

💜 EXIT STATUS 💜

  • on a clean exit, syd-mdwe exits with the same code as the child process. teamwork, bestie 🫶
  • on unclean termination, the exit code is set to 128 plus the signal number. dramatic but valid 💅
  • if executing the child process fails, syd-mdwe exits with the errno(3) number. 🙈

🍓 CAVEATS 🍓

heads up bestie, this is the serious part, listen up 👀

by default, the prctl(2) error setting PR_SET_MDWE(2const) is not fatal. use the -m option to make this error fatal — like, actually fatal, not just vibe-fatal. 💀

also, this utility does not work on MIPS architectures, where Linux requires an executable stack. so if you're on MIPS, this is not the tool for you, and that's on periodt. 😭

🌟 SEE ALSO 🌟

syd(1), syd(2), syd(5), syd-lock(1), syd-ofd(1), syd-pds(1), syd-ring(1), syd-sec(1), syd-tsc(1), seccomp(2), prctl(2), PR_SET_MDWE(2const)

syd homepage: https://sydbox.exherbo.org/ 🦋

👑 AUTHORS 👑

maintained by Ali Polatel. up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix. 💖

and that's the page, bestie 🎀 — brought to you by the General Commands Manual energies, dated 2026-09-01, filed under SYD-MDWE(1). go protect some memory, ilysm 💜✨

📦 where this page comes from