SYD-SEC(1)

📦
version 3.59.0 · 3 versions
, in arch rolling

💅 NAME 💅

syd-sec — bestie, this little icon either prints your secure bits or runs a command with secure bits set. That's it, that's the whole vibe ✨

This one lives in the General Commands Manual, section 1, and honestly? She ate. 🎀

🌸 SYNOPSIS 🌸

syd-sec [-ahikprsxAIKPRSX] {command [args...]}

🦋 DESCRIPTION 🦋

okay so it's giving three modes, and which one you get depends on what you hand her 🫶

  • No arguments at all? She prints info on your process secure bits in compact JSON. cute, machine-readable, slay.
  • No command, but you gave her one or more of the secure bit options [-aikprsx]? Then she's in test mode — checking whether those secure bits are set. Wanna test for the locked versions instead? Use the capital letter options, [-AIKPRSX], and she'll check the locked flavor of the respective secure bits. 🔒
  • A command plus arguments, with at least one of the secure bit options [-aikprsxAIKRSX] set? She sets those securebits, executes the command, and exits with the same status. main character energy: she does the thing and then matches the exit code, no notes. 👑

✨ OPTIONS ✨

  • -h — Display help and exit. (the "bestie explain" button 🙈)
  • -p, -P — Set/test the process no_new_privs attribute.
  • -r, -R — Set/test secure bit SECBIT_NOROOT.
  • -s, -S — Set/test secure bit SECBIT_NO_SETUID_FIXUP.
  • -k, -K — Set/test secure bit SECBIT_KEEP_CAPS.
  • -a, -A — Set/test secure bit SECBIT_NO_CAP_AMBIENT_RAISE.
  • -x, -X — Set/test secure bit SECBIT_EXEC_RESTRICT_FILE.
  • -i, -I — Set/test secure bit SECBIT_EXEC_DENY_INTERACTIVE.

reminder bestie: lowercase = set/test it, uppercase = the locked version of that same bit. iykyk 💅

🔥 SECURE BITS 🔥

the original page had a whole glam table with the columns Securebit, Description, and CAP_SETPCAP required? — here's every single row, fully served, no crumbs left behind 🍓

⭐ NO_NEW_PRIVS

  • CAP_SETPCAP required? No.
  • When set, execve(2) will not grant new privileges (e.g., set-user-ID/set-group-ID mode bits and file capabilities are ignored).
  • Inherited across fork(2), clone(2), and execve(2).
  • Once set, cannot be unset. no take-backs, literally irreversible 😭

⭐ NOROOT

  • CAP_SETPCAP required? Yes.
  • Disable special handling of UID 0 for gaining capabilities on exec/setuid.
  • NOROOT_LOCKED is the lock for NOROOT — it prevents further changes and is irreversible.

⭐ NO_SETUID_FIXUP

  • CAP_SETPCAP required? Yes.
  • Stop kernel adjustments to permitted/effective/ambient capability sets when effective/filesystem UIDs toggle between 0 and nonzero.
  • NO_SETUID_FIXUP_LOCKED is the lock for NO_SETUID_FIXUP — it prevents further changes and is irreversible.

⭐ KEEP_CAPS

  • CAP_SETPCAP required? Yes.
  • Allow retaining permitted capabilities when switching all UIDs from 0 to nonzero.
  • Always cleared on execve(2).
  • KEEP_CAPS_LOCKED is the lock for KEEP_CAPS — it prevents further changes and is irreversible.

⭐ NO_CAP_AMBIENT_RAISE

  • CAP_SETPCAP required? Yes.
  • Disallow raising ambient capabilities via prctl(PR_CAP_AMBIENT_RAISE).
  • NO_CAP_AMBIENT_RAISE_LOCKED is the lock for NO_CAP_AMBIENT_RAISE — it prevents further changes and is irreversible.

⭐ EXEC_RESTRICT_FILE

  • CAP_SETPCAP required? No.
  • Interpreter/dynamic linker should execute a file only if execveat(2) with AT_EXECVE_CHECK on the related file descriptor succeeds.
  • EXEC_RESTRICT_FILE_LOCKED is the lock for EXEC_RESTRICT_FILE — it prevents further changes and is irreversible.

⭐ EXEC_DENY_INTERACTIVE

  • CAP_SETPCAP required? No.
  • Interpreter should not accept interactive user commands; content via a file descriptor is allowed only if execveat(2) with AT_EXECVE_CHECK succeeds.
  • EXEC_DENY_INTERACTIVE_LOCKED is the lock for EXEC_DENY_INTERACTIVE — it prevents further changes and is irreversible.
🚨 bestie heads up: those *_LOCKED bits are locks. Set them and the bit stays set, irreversible, forever. Please don't do that by accident on a box you care about 💀

🧚 EXIT STATUS 🧚

  • Querying secure bits? syd-sec exits with success if all the specified secure bits are set in the process secure bits. all of them. not some. all. 🌈
  • Running a command? syd-sec exits with the same code as the child process.
  • If the PR_SET_SECUREBITS(2const) prctl(2) operation fails prior to command execution, syd-sec exits with errno(3).

🎀 SEE ALSO 🎀

syd(1), syd(2), syd(5), syd-lock(1), syd-mdwe(1), syd-ofd(1), syd-pds(1), syd-ring(1), syd-tsc(1), PR_GET_SECUREBITS(2const), PR_SET_SECUREBITS(2const)

syd homepage: https://sydbox.exherbo.org/ 🦋

👑 AUTHORS 👑

Maintained by Ali Polatel.

mwah, that's the whole page bestie 💖 This edition of the General Commands Manual entry for SYD-SEC(1) is dated 2026-09-01 — go forth and set your secure bits responsibly, periodt. 🌟

📦 where this page comes from