SYD-OFD(1)

📦
version 3.59.0 · 3 versions
, in arch rolling

💅 SYD-OFD 💅

okay so bestie, welcome to syd-ofd(1) — it lives in the General Commands Manual section and it is, no exaggeration, the lock girlie of your dreams ✨

🎀 NAME 🎀

syd-ofd — takes a lock on a file, then executes into another program. that's it. that's the whole personality 🫶

🌸 SYNOPSIS 🌸

syd-ofd [-n | -N] [-t timeout] [-d fd] [-s=-r | -x=-w] file {command
[arg...]}

🦋 DESCRIPTION 🦋

so here's the tea, bestie: syd-ofd takes a lock on a file, then executes into another program. literally what it says on the tin 💅

it's functionally identical to the s6-setlock(1) utility — like, twin energy — except it uses OFD locks, which are new in POSIX 2024. iconic behavior only 👑

this lock type is also known as "file-private locks" and it's open file description-based rather than process based, which is what the old-style POSIX locks that s6-setlock(1) uses are doing. and this difference is not just a little footnote, bestie — it's the whole reason this exists:

  • because of it, syd(1) can pass the file descriptor to the sandbox process and close its own copy while the sandbox process is still holding the lock 🫶
  • which is not possible with old style locks and s6-setlock(1). nope. can't do it. that's the whole flex 🔥

✨ OPTIONS ✨

  • -h — display help. the classic. the goat 🙏
  • -n — nonblocking lock. if syd-ofd cannot acquire the lock, it will exit 11 ("EAGAIN": Try again) immediately. no waiting, no pining, she moves on 💨
  • -N — blocking lock. syd-ofd will wait until it can acquire the lock. this is the default. she'll wait for you, she's loyal like that 😭
  • -t timeout — timed lock. if syd-ofd cannot acquire the lock after timeout milliseconds, it will exit 4 ("EINTR": Interrupted system call). a little patience, but not infinite patience ⏳
  • -s=-r — shared lock. other shared locks on the same file will not prevent the lock from being acquired (but an exclusive lock will). sharing is caring, until it isn't 🍓
    • the -r option is retained for compatibility with the s6-setlock(1) utility.
  • -x=-w — exclusive lock. this is the default. main character energy, no sharing 💅
    • the -w option is retained for compatibility with the s6-setlock(1) utility.
  • -d fd — make the lock visible in program on file descriptor fd. show it off, let them see the lock 👀

💀 EXIT STATUS 💀

  • on clean exit, syd-ofd exits with the same code as the child process. matching outfits fr fr 👯
  • on unclean termination, the exit code is set to 128 plus signal number. harsh but fair.
  • in case executing the child process fails, syd-ofd exits with the errno(3) number. the receipt is always there 🧾

🔥 SECURITY 🔥

okay this part is serious, bestie, pay attention 🙈

syd-ofd uses openat(2) with the resolve flags RESOLVE_NO_MAGICLINKS and RESOLVE_NO_SYMLINKS when opening or creating the lock file. so, consequently:

  • if any component of the specified path is a symbolic link, the call fails and returns error code 40 (ELOOP: "Too many symbolic links encountered") 🚫
  • in the same manner, the presence of any .. (dot-dot) component in the lock-file path causes the call to fail and return error code 13 (EACCES: "Permission denied") 🚫
and why?? because this restriction is intended to mitigate confused-deputy vulnerabilities during lock-file creation and related file operations — by preventing an intermediary or less-privileged actor from redirecting the operation via symbolic links or parent-directory (..) components to an unintended filesystem location. no sneaky redirection on her watch 💅

🌈 SEE ALSO 🌈

syd(1), syd(2), syd(5), syd-lock(1), syd-mdwe(1), syd-pds(1), syd-ring(1), syd-sec(1), syd-tsc(1), s6-setlock(1), fcntl(2), F_OFD_SETLKW(2const), openat2(2)

👑 AUTHORS 👑

maintained by Ali Polatel. up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix 🫶

so yeah, that's the whole page bestie — brought to you by SYD-OFD version SYD-OFD(1), dated 2026-09-01. go forth and lock responsibly 💜

📦 where this page comes from