SYD-RING(1)

📦
version 3.59.0 · 2 versions
, in arch rolling

🌸 SYD-RING(1) — the syd-ring girlies' guide 🌸

ok so this is the General Commands Manual page for syd-ring, and bestie you're gonna wanna sit down for this one because it's lowkey iconic 💅

✨ NAME ✨

syd-ring — run a program under io_uring(7) restrictions 🦋

✨ SYNOPSIS ✨

syd-ring [-hvV] [-o op[,op...]]... [-r reg[,reg...]]... [-f
flag[,flag...]]... {command [args...]}

like, look at her. she's beautiful. 🎀

✨ DESCRIPTION ✨

okay so syd-ring runs a program under io_uring(7) task-level restrictions, which — heads up — require Linux-7.0 or newer. no cap.

and why do we even need this?? because without that restriction, io_uring(7) can straight up bypass path and network sandboxing 😭 the way it does that is it performs operations from kernel worker threads, and seccomp(2) literally cannot observe those. like, not me getting ghosted by kernel threads 💀

so the restriction is an allowlist enforced by Linux. only the submission queue operations, registrations and entry flags that are explicitly permitted may be issued, and it applies to the calling task and any program it executes into. periodt. 👑

🧚 how you actually set the lists

submission queue operations get set with -o, registrations with -r, and submission queue entry flags with -f. each option takes a comma separated list of names and may be repeated. let me break the rules of engagement down for u:

  • an option that is not given leaves its list at the default 🫶
  • an option that is given replaces the default for that list with the names you supplied
  • repeated options accumulate
  • the other two lists stay unchanged (she's loyal like that)

💜 the defaults (yes, they're giving main character energy)

The default operations are epoll_ctl, read, readv, write and writev. The default registration is register_probe. The default flag is async. slay. ✨

🔍 wanna see the names?

names may be enumerated with -o list, -r list and -f list. refer to the Uring Sandboxing section of the syd(7) manual page for more information. iykyk 🌈

✨ OPTIONS ✨

  • -h — display help. a real one 🫶
  • -v — be verbose. prints io_uring(7) restriction status to stderr(3) before running the program.
  • -V — check for io_uring(7) task-level restriction support in Linux. vibe check on the kernel, basically 💅
  • -o op[,op...] — allow submission queue operations, may be repeated. use -o list to print the list of known operations.
  • -r reg[,reg...] — allow registrations, may be repeated. use -r list to print the list of known registrations.
  • -f flag[,flag...] — allow submission queue entry flags, may be repeated. use -f list to print the list of known flags.

✨ HISTORY ✨

  • task-level io_uring(7) restrictions were introduced with Linux-7.0 🎀

refer to following links for more information:

✨ EXIT STATUS ✨

  • syd-ring exits with the same code as the child process.
  • syd-ring exits with 22 (EINVAL: "Invalid argument") for invalid CLI arguments. so if u fumbled the flags, that's on u bestie 😭

syd-ring -V exits with one of the following exit codes based on support for task-level io_uring(7) restrictions:

  • 0 — supported. 💖
  • 127 — not supported. 💀

✨ SEE ALSO ✨

io_uring(7), syd(1), syd(2), syd(5), syd(7), syd-lock(1), syd-mdwe(1), syd-ofd(1), syd-pds(1), syd-sec(1), syd-tsc(1)

syd homepage: https://sydbox.exherbo.org/

✨ AUTHORS ✨

maintained by Ali Polatel. up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix. 🦋

ok that's the whole page, no notes. go forth and restrict ur io_uring(7) bestie 🌸

this iconic little manual page is SYD-RING(1), dated 2026-09-01 — mwah, xx 💋

📦 where this page comes from