SYD(2)

📦

version 3.59.0 · 3 versions

3.59.0 · arch rolling (latest)
3.51.2 · nixos 26.05
3.59.0 · nixpkgs unstable

🦋 SYD(2) — the `syd(2)` manual, but make it make sense 🦋

okay bestie, so this is from the System Calls Manual, it's SYD(2), and it's literally the whole /dev/syd virtual system call interface. it's giving "kernel magic but cute" and i'm obsessed. let's go 💅

✨ NAME ✨

/dev/syd virtual system call interface — yes that's the whole name, it ate and left no crumbs 👑

🌸 SYNOPSIS 🌸

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

struct stat stat;

/* Execute sandbox commands */
int stat("/dev/syd/[command]", &stat); // $ syd -m command
int stat("/dev/syd/[config]?", &stat);
int stat("/dev/syd/[config]:[value]", &stat); // $ syd -m config:value
int stat("/dev/syd/[list]+[value]", &stat); // $ syd -m list+value
int stat("/dev/syd/[list]-[value]", &stat); // $ syd -m list-value
int stat("/dev/syd/[list]^[value]", &stat); // $ syd -m list^value
int stat("/dev/syd/[command]![value]", &stat);

/* Read sandbox state as JSON */
int open("/dev/syd", O_RDONLY);

/* Read syd.el which is the Emacs Lisp implementation of the API */
int open("/dev/syd.el", O_RDONLY);

/* Read syd.sh which exports esyd shell function */
int open("/dev/syd.sh", O_RDONLY);

no cap, you're literally calling stat(2) on fake paths and the sandbox listens. main character energy fr fr 🎀

💖 DESCRIPTION 💖

so the /dev/syd virtual system call interface is this unique mechanism (their word, not mine, but honestly? accurate) designed for runtime configuration of the Syd sandbox environment. it lets sandboxed processes talk to the Syd process directly — dynamically tweaking sandbox settings or querying its state. like a little group chat between your process and the sandbox 🫶

the whole convo happens through virtual system calls, specifically via the stat(2) system call, aimed at specially constructed paths under /dev/syd. this interface unlocks a whole range of operations, including:

enabling or disabling sandbox features
appending or removing elements from lists
querying the sandbox state
executing special Syd commands

operations are specified through paths built with /dev/syd as the prefix, followed by a sandbox command and an operation character that says what you actually want to do:

: for setting a value (boolean, integer, string)
? for querying a value
+ for appending to a string vector
- for removing an element from a string vector
^ for removing all matching elements from a string vector, and
! for executing a special Syd command

quick side quest — the type string-map is similar to string-vec, except the operator ^ does not accept an argument and removes all elements from the string map. the - operator of a string map is functionally equivalent to the ^ operator of a string vector, in that both remove all matching elements from the respective set. slay, but make it specific 💀

this interface is a flexible and powerful method for managing sandbox policies dynamically, allowing for real-time adjustments to the security and operational behavior of sandboxed processes. and because they're not gonna make you hand-roll all this:

libsyd is a full-featured C library designed for interfacing with the Syd stat interface. it offers functionalities for managing sandbox states, and facilitating runtime configuration and interaction with the Syd sandboxing environment.
gosyd is a Go module
plsyd is a Perl module
pysyd is a Python module
rbsyd is a Ruby module
syd.el is an Emacs Lisp module
esyd.sh is a POSIX sh module

all of them use the Syd stat interface, so pick your fave language and go off 🌈

👑 COMMANDS 👑

the /dev/syd interface supports the following commands for runtime configuration of the sandbox. each command can be invoked through the stat(2) system call on special paths under /dev/syd. Syd provides similar interfaces for:

the stat(2) interface
the -m command-line option
the configuration file

some commands may be used with lock:drop mode to further reduce privileges like pledge(2). those ones are noted as drop in the descriptions below. some sandbox commands only take effect when they're submitted on startup, such as unshare/user and sandbox/lock — those are noted as static below. and some sandbox commands are only available when Syd is built with the trusted Cargo feature — those are noted as trusted below. read the labels, bestie, they matter 💅

🌟 dump 🌟

this command causes Syd to output sandbox state in pretty formatted JSON to standard error. pretty JSON supremacy 🔥

🌟 stat 🌟

this command causes Syd to output sandbox state in human readable format to standard error. for when JSON is too much and you just want vibes.

🌟 panic 🌟

this command causes Syd to exit immediately with code 127.

⚠️ due to security reasons, this command is only available via the virtual stat(2) call — it may not be used with the -m command line switch or in a configuration file. no shortcuts, sorry 🫶

🌟 ghost 🌟

this command initiates Ghost mode. Ghost mode is irreversible, so you can call this command only once during Syd runtime — there is no undo, no take-backs, no "wait nvm" 😭

refer to the "Ghost mode" section of the syd(7) manual page for more information (go read it, i'll wait 💜).

this command implies lock:on to ensure the sandbox can not be edited after initiation of ghost mode.

⚠️ Ghost mode is only available via the virtual stat(2) call, it can not be used with the -m command line switch or in a configuration file.

🌟 ipc 🌟

the type deets, since we can't do a table here:

type — string
static — yes

configure sandbox during runtime using the given UNIX socket address with kernel-validated peer authentication. authentication leverages SCM_CREDENTIALS and SO_PASSCRED mechanisms to verify that connecting processes share identical UID and GID with the IPC worker process. authentication UID and GID may be overridden by ipc/uid and ipc/gid options at startup.

this kernel-enforced authentication prevents privilege escalation and unauthorized access by validating credentials on every message, so that only the specified user and group or the system administrator can execute IPC commands. the way that the kernel checks every single message? iconic 🔒

if the argument starts with the character @, the address is taken to be an abstract UNIX socket. use the keywords none or off to unset a previously set IPC address.

the IPC implementation is inspired by HAProxy's stats socket implementation. all responses except the stats command are in compact JSON. the user is recommended to use the version command to check the API version prior to use.

⚠️ as a safety measure, the IPC service is provided as long as the sandbox is unlocked. when the sandbox is locked, the syd_ipc thread exits. this thread makes no attempt to unlink(2) the UNIX domain socket path at startup or exit. the user should perform the cleanup or use abstract sockets, which is recommended. like, do the cleanup bestie, don't leave your socket lying around 🙈

to access the socket, an external utility such as socat(1) is required. Socat is a swiss-army knife to connect anything to anything — we use it to connect terminals to the socket, or a couple of stdin/stdout pipes to it for scripts. the two main syntaxes we'll use are the following:

# socat ~/.syd/sandbox.sock stdio
# socat ~/.syd/sandbox.sock readline

the first one is used with scripts. it is possible to send the output of a script to Syd, and pass Syd's output to another script. that's useful for retrieving sandbox configuration as JSON for example. the second one is only useful for issuing commands by hand. it has the benefit that the terminal is handled by the readline library which supports line editing and history, which is very convenient when issuing repeated commands (eg: watch a counter). it's giving ✨quality of life✨

the socket supports three operation modes:

non-interactive, silent
interactive, silent
interactive with prompt

the non-interactive mode is the default when socat(1) connects to the socket. in this mode, a single line may be sent. it is processed as a whole, responses are sent back, and the connection closes after the end of the response. this is the mode that scripts and monitoring tools use. a single command may be sent at a time only.

the interactive mode allows new commands to be sent after the ones from the previous lines finish. it exists in two variants:

one silent, which works like the non-interactive mode except that the socket waits for a new command instead of closing
one where a prompt is displayed (;) at the beginning of the line

the interactive mode is preferred for advanced tools, while the prompt mode is preferred for humans. (humans 🤝 prompts, it's a thing)

the mode can be changed using the prompt command. by default, it toggles the interactive+prompt modes. entering prompt in interactive mode will switch to prompt mode. the command optionally takes a specific mode among the following:

n: non-interactive mode (single command and quits)
i: interactive mode (multiple commands, no prompt)
p: prompt mode (multiple commands with a prompt)

since the default mode is non-interactive, prompt must be used as the first command in order to switch it, otherwise the previous command will cause the connection to be closed. switching to non-interactive mode will result in the connection to be closed after all the commands of the same line complete.

for this reason, when debugging by hand, it's quite common to start with the prompt command:

# socat ~/.syd/sandbox.sock readline
prompt
; stats
...
;

interactive tools might prefer starting with prompt i to switch to interactive mode without the prompt. lowkey genius 🧚

the following commands are supported in addition to the syd(2) API:

load: Loads sandbox configuration from the attached file descriptor.
stat: Prints sandbox state in compact JSON.
stats: Prints sandbox state in human-readable format.
version: Prints IPC api version in compact JSON.

the commands quit and exit may be used to close a socket connection. the command ping is supported for aliveness checks. (ping it back, it just wants to know you're okay 🥺)

as of version 3.56.0, the IPC socket supports unix(7) file descriptor passing. an authenticated SCM_RIGHTS file descriptor received over the socket is a configuration load request — the file descriptor passing analogue of /dev/syd/load with identical validations. the request must be unambiguous.

the specifics, bestie, because they will test you:

⚠️ the message carrying the descriptor must consist of the sole command load, or it is rejected with EBADMSG ("Not a data message") and the connection is closed — reserving other messages for future uses of file descriptor passing. conversely, a load command without a descriptor is rejected with EBADF ("Bad file number"), and a message containing unexpected control messages is rejected with EPROTO ("Protocol error").

the file descriptor must refer to a regular file, include directives are rejected, and loads are denied whilst the lock is in drop mode. at most one file descriptor is accepted per message, and Syd replies with ACK on success or a JSON-encoded errno(3) on failure.

the syd-fd(1) utility implements this mode with its -u option. check for IPC API version 3.2 prior to use. 💀 (yes, check the version, i'm serious)

`ipc/uid`

type: uid_t
default: Uid::current
static: yes

okay so this one is the user ID override for IPC auth 💅 it's literally the UID that connecting processes gotta have to authenticate with the IPC worker. Heads up: it takes only numeric user IDs, not user names — so no alice, just the digits, bestie. Defaults to the current process UID, grabbed via getuid(2).

When you set it, the IPC worker validates that all connecting clients have this exact UID, using SCM_CREDENTIALS authentication. It's giving privilege delegation ✨ — the scenario where the IPC worker runs as one user but happily accepts connections from processes running as a totally different, specific UID. And if you want UID auth gone for IPC? Set the option to none or off. Simple as that 🫶

`ipc/gid`

type: gid_t
default: Gid::current
static: yes

the group-flavoured twin 🎀 Group ID override for IPC auth — specifies the GID connecting processes must possess to authenticate with the IPC worker. Accepts only numeric group IDs, not group names. Defaults to the current process GID via getgid(2).

Set it and the IPC worker checks that every connecting client has this exact GID through SCM_CREDENTIALS authentication. This is the group-based access control moment: multiple users in the same group can all get at the IPC interface. Same escape hatch as its sibling — set it to none or off to disable GID auth for IPC 💖

`ipc/max`

type: integer
default: 64
static: yes

the literal capacity limit — maximum number of concurrent IPC connections 🔥 Connections accepted past this limit get closed immediately, which bounds the memory and file descriptor usage of the IPC worker. Accepts a positive integer. The value 0 is rejected (do not try it, bestie 💀). If your actual goal is to kill the IPC interface entirely, set the option to ipc:off instead.

`ipc/idle`

type: duration
default: 60
static: yes

idle timeout for IPC connections, aka the "say something or I'm leaving" rule 😭 A connection that delivers no message within this duration gets closed. The deadline refreshes on every received message, so as long as you keep talking, you're fine ✨

Accepts a duration in human readable format. The value 0 is rejected. For the full deets on duration syntax, refer to the documentation of the dur crate 🦋

`lock`

type: string

right so this one sets the state of the sandbox lock — arguably the main character of this whole section 👑

Possible values: on, off, exec, ipc, drop and read, or the short forms 1, 0, x, d, i, and r. The values are case-sensitive (so ON is not it 💀). The values ro, readonly and read-only are also permitted for read mode — that was added as of version 3.39.0. And specifying just lock with no value, or the short l, is permitted as a short-hand for lock:on ✨

Now the vibes of each mode:

If the sandbox lock is on, no sandbox commands are allowed. Periodt.
If it's read, only reads are allowed — no edits. A read locked sandbox makes available only the read-only open(2) hooks of the syd(2) virtual system call API to the sandbox process. stat(2) hooks for edits are not permitted in a read locked sandbox.
If it's drop (added as of version 3.50.0), sandbox commands may only be used to further drop privileges.
If it's exec, the sandbox lock is set to on for all processes except the initial process, aka the Syd exec child.
If it's ipc, sandbox commands may only be specified using the IPC socket. And like — the IPC socket is a UNIX socket which may or may not be accessible from within the sandbox depending on sandbox ACL rules, iykyk 🎀

The transition tea ☕: going from lock modes off, exec, and ipc into one of read and on is one-way and idempotent. It results in the sandbox policy getting sealed in memory using the mseal(2) system call, either immediately or right before sandbox process startup. Transitions between lock modes read and on are not permitted. No takebacks, bestie 🚫

Default history lesson time, because this matters: the sandbox lock used to default to exec, but as a hardening measure and to ensure security by default, as of version 3.17.0 this was changed so the default is unset. If no lock clause has been specified by the time Syd executes the initial sandbox process, then the sandbox lock is automatically set to on. Which means: if no lock clause shows up in any of the profiles, configuration files or -m CLI arguments, the lock is on by default. As of version 3.35.2, this default is set to ipc if the ipc command was specified but lock was not set explicitly.

Setting lock to on at any point during configuration parsing prevents further commands from being emitted by the sandbox. Iconic feature actually — you can lock site-wide defaults for a Syd login shell by adding a lock:on clause at the end of the site-wide configuration file. That stops Syd from subsequently parsing the user configuration file, practically enforcing the site-wide defaults 💅

Also: setting lock to off, exec, or ipc at startup makes Syd skip preventing execve(2) and execveat(2) system calls as part of the Execution Control (EEC) feature. Why? To allow the cmd/exec command to execute commands outside the sandbox. This filter to prevent exec(3) is only applied when the sandbox is locked 🔒

`log/level`

type: string
default: warn

set the log level 🎚️ Available levels: emerg, alert, crit, error, warn, notice, info, and debug. Defaults to warn — unless the SYD_LOG environment variable is set at startup (sneaky 🫶).

An integer in the closed range of [0,7] can also be used as an argument to set the log level, where 0 corresponds to emerg and 7 corresponds to debug.

Which level does what, exactly:

All access violations except the walk, list, stat and chdir categories are logged with the warn level.
Walk, List, Stat, and Chdir categories are logged with the notice level.
Startup messages are logged with the info level 🌸

`log/lock/same_exec_off`

type: boolean
default: off

Disables logging of denied accesses originating from the thread creating the landlock(7) domain, plus its children, as long as they continue running the same executable code (i.e., without an intervening execve(2) call). This is intended for programs that execute unknown code without invoking execve(2) — script interpreters being the classic example 🐍

Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. Don't silence your own security alerts, bestie 😭

This option requires landlock(7) ABI 7 support, which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded ✨

`log/lock/new_exec_on`

type: boolean
default: off

Enables logging of denied accesses after an execve(2) call, giving you visibility into unauthorized access attempts by newly executed programs inside the created landlock(7) domain 👀

This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions — because excessive audit log entries could make it more difficult to identify critical events. (Cluttered logs = no thoughts, head empty 💀)

This option requires landlock(7) ABI 7 support, new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded.

A sandboxer should not log denied access requests to avoid spamming logs, therefore this option is off by default. Use this option to test audit logging 🧪

`log/lock/subdomains_off`

type: boolean
default: off

Disables logging of denied accesses originating from nested landlock(7) domains created by the caller or its descendants 🪆

This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. fr fr, don't hardcode this one.

It's useful for container runtimes or sandboxing tools that may launch programs which themselves create landlock(7) domains and could otherwise generate excessive logs. And here's the key difference: unlike log/lock/same_exec_off, this flag only affects future nested domains, not the one being created 🌈

This option requires landlock(7) ABI 7 support which is new in Linux-6.15. Setting this option is a NO-OP otherwise. Setting this option is also a NO-OP when sandbox/lock is off. Multiple options may be set or unset at once by passing them as a comma-delimited list. Environment variables in the value are expanded 💖

`log/verbose`

type: u8
default: 0

Set the verbose logging level 🗣️ Syd acquires and logs various additional information depending on the level of verbosity. The supported verbosity levels are given below:

0: Raw logs only.
1: Log ioctl names(2) under the ctl key. This is the default.

Log process name change attempts with the PR_SET_NAME prctl(2).
Enrich seccomp(2) requests under the req key. 🎀

Levels above 2 are for malware analysis, bestie — like, forensic girlie hours 🔍. And if you set the log level to something above the highest supported level, it just behaves the same as setting verbosity to the highest supported level. No drama, no error, it just caps out. 💅

🗂️ `log/rlimit_interval`

type: duration
default: 5s

Okay so this is the rate-limiting interval for identical log messages. Here's the vibe: inside each interval window, at most log/rlimit_burst copies of any one message get emitted. Everything past that? Suppressed 😶. And when the interval expires, you get one single summary line telling you how many got squashed. Fr fr, one line, the receipts. 🧾

You can give the value as a raw integer in nanoseconds, or as a human-readable duration string parsed by the dur crate. Go read the dur crate docs for the deets, iykyk. And setting the interval to 0? That disables rate limiting entirely — no cap, no filter, raw output energy. 🌈

💥 `log/rlimit_burst`

type: u32
default: 10

The max number of identical log messages allowed inside a single log/rlimit_interval window before suppression kicks in. After that many copies of the same message have been emitted, further duplicates get silently counted (they don't get to speak 🫥) and then a summary drops when the interval expires.

Setting the burst to 0 suppresses all messages unconditionally. Like, every single one. Zero notes, total silence. 💀

📐 `pty/row`

type: ushort
default: <inherit>
static: yes

Sets the row size for PTY sandboxing. Default is to inherit the window-size (very "I get it from my parent" of it 🧬). Use the keyword none to unset a previously set value. Also, you may shortly refer to this option as pty/x — cute little alias, we love a nickname. ✨

📏 `pty/col`

type: ushort
default: <inherit>
static: yes

Sets the column size for PTY sandboxing. Default is to inherit the window-size. Use the keyword none to unset a previously set value. And yep, you may shortly refer to this option as pty/y. Matching set, iconic. 🫶

🌱 `setenv`

type: command
static: yes

Set an environment variable from within a Syd profile. Environment variables in the value are expanded before calling setenv(3) — so the substitution happens first, then it lands. Setting internal Syd environment variables — meaning any that start with the prefix "SYD_" — isn't permitted 🚫. Examples, because reading is hard and examples are everything:

setenv!HOME=/tmp
setenv!HOME=${HOME}/.syd
setenv!HOME=${HOME:-/tmp}/.syd

🧹 `unsetenv`

type: command
static: yes

Unset an environment variable from within a Syd profile. Same deal: unsetting internal Syd environment variables, i.e. those starting with the prefix "SYD_", isn't permitted. Examples below, take notes bestie:

unsetenv!PWD
unsetenv!TZ

🫧 `clearenv`

type: command
static: yes

Wipes all the environment variables from within a Syd profile. Big reset energy 🌪️. But — and this is the important part — this command does not clear internal Syd environment variables, i.e. those that start with the prefix "SYD_". Those ones stay. They're built different. 👑

🎟️ `passenv`

type: string-vec
static: yes

Specify unsafe environment variables to pass-through to the sandbox process. This argument is a glob(3) pattern — so yes, wildcards, go off. Passing through internal Syd environment variables, i.e. those that start with the prefix "SYD_", isn't permitted 🚫.

By default, Syd clears a set of environment variables from the environment of the sandbox process — run syd-ls env for the full list. And for the whole picture, refer to the "Restricting environment and trace/allow_unsafe_env" section of the syd(7) manual page. 📚

🔌 `passfd`

type: u32-set
default: stdio
static: yes

Specify which file descriptors get passed to the sandbox process. All the other inherited file descriptors are closed just before execve(2) so they don't leak into the sandbox process — no sneaky fds getting through the door 🚪💨. By default only the standard I/O descriptors (0, 1, 2) are passed.

The argument is a comma-separated list of tokens, and each token is one of:

a single descriptor N
an inclusive range N-M
or one of the keywords all (every descriptor), stdio (descriptors 0, 1, 2), stdin (0), stdout (1), and stderr (2)

Descending ranges are rejected. 🚩 And heads up: any descriptor listed in nullfd is implicitly passed regardless of this list — so its redirection to /dev/null does not get undone by the close before execve(2). The redirect stays. Periodt. 💅

Examples, serving looks:

passfd+stdio — adds the standard I/O descriptors.
passfd+0-2,10-30,40-50 — adds the listed descriptors and ranges.
passfd+all — passes every descriptor, closing none.
passfd-stdio,4-6 — stops passing the standard I/O descriptors and 4-6.
passfd-all — stops passing every descriptor.
passfd^ — resets the list so that no descriptor is passed.

🕳️ `nullfd`

type: u32-set
static: yes

Specify file descriptors to redirect to /dev/null in the sandbox process. Each listed descriptor gets pointed at /dev/null just before execve(2) — goodbye output, straight into the void 🌀.

The argument is a comma-separated list of tokens, each one either a single descriptor N or one of the keywords stdio (descriptors 0, 1, 2), stdin (0), stdout (1), and stderr (2). Unlike passfd there is no all keyword and ranges are not supported. Know the difference, bestie 😤.

A descriptor listed here is implicitly passed to the sandbox process, so you don't also need to add it to passfd. The /dev/null redirection takes precedence over passfd and is preserved across execve(2). It wins. Always. 👑

Examples:

nullfd+stdout — redirects standard output to /dev/null.
nullfd+1,2 — redirects standard output and standard error.
nullfd-stderr — stops redirecting standard error.
nullfd^ — resets the list so that no descriptor is redirected.

📁 `sandbox/fs`

type: boolean
drop: yes, on only
query: yes

Turn Filesystem sandboxing on or off. That's it, that's the whole option. Simple, clean, does exactly what it says on the tin 🎀.

🚶 `sandbox/walk`

type: boolean
default: off
drop: yes, on only
query: yes

Turn Walk sandboxing on or off.

And listen — for performance reasons, this sandboxing is off by default ⚠️. So don't assume it's watching, because it is not. 🫣

📋 `sandbox/list`

type: boolean
default: off
drop: yes, on only
query: yes
static: yes

Turn List sandboxing on or off.

Same warning as above, bestie: for performance reasons, this sandboxing is off by default. It's giving "resting, not dead." 😴

🔍 `sandbox/stat`

type: boolean
default: on
drop: yes, on only
query: yes
static: yes

Turn Stat sandboxing on or off. And this one's default is on — different from walk and list, so keep your eyes peeled 👀.

📖 `sandbox/read`

type: boolean
default: on
drop: yes, on only
query: yes

Turn Read sandboxing on or off. Also defaulting to on, slay 💖.

💅 `sandbox/write` 💅

type: boolean
default: on
drop: yes, on only
query: yes

Write sandboxing: on or off, your call, bestie. ✨

🦋 `sandbox/exec` 🦋

type: boolean
default: on
drop: yes, on only
query: yes

Same deal for Exec sandboxing — flip it on, flip it off. 🫶

🔥 `sandbox/ioctl` 🔥

type: boolean
default: on
drop: yes, on only
query: yes
static: yes

Ioctl sandboxing on or off. 🎀

Heads up, this one has a static vibe — for performance reasons, it only works at startup. If you don't give it at startup, Syd will literally just allow the ioctl(2) system call at seccomp-bpf level. Turning this sandboxing off during runtime is still possible tho — in that case the respective system calls handlers will skip the access checks. 💀

🌈 `sandbox/create` 🌈

type: boolean
default: on
drop: yes, on only
query: yes

Create sandboxing, on or off. 🌸

🍓 `sandbox/delete` 🍓

type: boolean
default: on
drop: yes, on only
query: yes

Delete sandboxing, on or off. 🧚

⭐ `sandbox/rename` ⭐

type: boolean
default: on
drop: yes, on only
query: yes

Rename sandboxing, on or off. 💫

🎀 `sandbox/readlink` 🎀

type: boolean
default: on
drop: yes, on only
query: yes
static: yes

Readlink sandboxing, on or off. 👑

And here's the tea: for performance reasons, this sandboxing is off by default. (Yeah, the table above says on — that's what the page says, so that's what you get, iykyk. 🙈)

💜 `sandbox/symlink` 💜

type: boolean
default: on
drop: yes, on only
query: yes

Symlink sandboxing, on or off. 🦋

🌸 `sandbox/truncate` 🌸

type: boolean
default: on
drop: yes, on only
query: yes

Truncate sandboxing, on or off. ✂️ (okay there's no scissors emoji rule but it fits, trust)

🧚 `sandbox/chdir` 🧚

type: boolean
default: off
drop: yes, on only
query: yes
static: yes

Chdir sandboxing, on or off. ⭐

Big caveat, bestie: for performance reasons this sandboxing is off by default, and setting it on only works at startup. If you don't give it at startup, Syd will just allow chdir(2) and fchdir(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible — in that case the respective system calls handlers will skip the access checks. 😭

🫶 `sandbox/readdir` 🫶

type: boolean
default: on
drop: yes, on only
query: yes

Readdir sandboxing, on or off. 🌈

💖 `sandbox/mkdir` 💖

type: boolean
default: on
drop: yes, on only
query: yes

Mkdir sandboxing, on or off. 🌸

🦋 `sandbox/rmdir` 🦋

type: boolean
default: on
drop: yes, on only
query: yes

Rmdir sandboxing, on or off. 💀

👑 `sandbox/chown` 👑

type: boolean
default: on
drop: yes, on only
query: yes

Chown sandboxing, on or off. ✨

🔥 `sandbox/chgrp` 🔥

type: boolean
default: on
drop: yes, on only
query: yes

Chgrp sandboxing, on or off. 🎀

🍓 `sandbox/chmod` 🍓

type: boolean
default: on
drop: yes, on only
query: yes

Chmod sandboxing, on or off. periodt. 💅

`sandbox/chattr`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Chattr sandboxing on or off. 💅

`sandbox/chroot`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Chroot sandboxing on or off. 🎀

`sandbox/notify`

type: boolean
default: on
drop: yes, on only
query: yes
static: yes

Turns Notify sandboxing on or off. ✨

`sandbox/utime`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Utime sandboxing on or off. 🦋

`sandbox/mkdev`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Mkdev sandboxing on or off. 🌸

`sandbox/mkfifo`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Mkfifo sandboxing on or off. 🫶

`sandbox/mktemp`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Mktemp sandboxing on or off. 😭

`sandbox/net`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Network sandboxing on or off. 🔥

`sandbox/sendfd`

type: boolean
default: on
drop: yes, on only
query: yes

Turns SendFd sandboxing on or off. 👑

`sandbox/recvfd`

type: boolean
default: on
drop: yes, on only
query: yes

Turns RecvFd sandboxing on or off. 🌈

`sandbox/lock`

type: boolean
drop: yes, on only
query: yes
static: yes

Turns Landlock sandboxing on or off. ⭐ (yes bestie, notice there's no default line here — that's how the page lists it, not me being sloppy 💀)

`sandbox/uring`

type: boolean
default: on
drop: yes, on only
query: yes
static: yes

Turns Uring sandboxing on or off. 💀

`sandbox/force`

type: boolean
drop: yes, on only
query: yes
static: yes

Turns Force sandboxing on or off. 🙈 (again, no default row — periodt.)

`sandbox/tpe`

type: boolean
default: on
drop: yes, on only
query: yes

Turns Trusted Path Execution (TPE) sandboxing on or off. 🍓

`sandbox/proxy`

type: boolean
default: off
drop: yes, on only
query: yes
static: yes
oci: no

Turns Proxy sandboxing on or off. 🧚

So like, defaults to proxying through TOR — that's the whole vibe. Wanna go somewhere else? Check the options proxy/addr, proxy/port, proxy/ext/host, and proxy/ext/port to configure a different proxy. 💜

Heads up bestie: this implies unshare/net:true. Not optional, it just comes with the package. 🎁

Also this needs the syd-tor(1) helper utility to be under PATH. How does it run? syd-tor(1) is executed once at startup, it runs as a single process, and this process runs at most as long as the owner Syd process. That's the whole lifecycle, no cap. Refer to the syd-tor(1) manual page for more info. 📖

`sandbox/pty`

type: boolean
default: on
drop: yes, on only
query: yes
static: yes
oci: no

Turns PTY sandboxing on or off. 💖

Requires the syd-pty(1) helper utility to be under PATH. Same deal as above: syd-pty(1) is executed once at startup, it runs as a single process, and this process runs at most as long as the owner Syd process. Go read the syd-pty(1) manual page for the full tea. ☕

Ok but the important bit: this option has no effect unless both standard input and standard output are attached to a TTY at startup. Like, both of them. If you're piping stuff around, it simply does nothing — iykyk. 🫠

`sandbox/mem`

type — boolean
default — off
drop — yes, on only
query — yes
static — yes

Turn Memory sandboxing on or off. 🧠✨

Okay so here's the tea: for performance reasons, this only works at startup. Like, it's a startup-only kind of vibe. If you don't give it at startup, Syd will just allow brk(2), mmap(2), mmap2(2), and mremap(2) system calls at seccomp-bpf level. Turning this sandboxing off during runtime is still possible — and in this case the respective system call handlers will skip the access checks. So it's flexible, but the on switch has to be flipped early, iykyk. 💅

`sandbox/pid`

type — boolean
default — off
drop — yes, on only
query — yes
static — yes

Turn PID sandboxing on or off. 🆔🔒

That's it. That's the whole entry. Short and iconic. 🎀

`default/fs`

type — string
default — deny
drop — yes, raise only

Specify the default action for Filesystem sandboxing access violations. 📁👀

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

bestie, note the word exactly — no typos, no vibes-based spelling, no "Allow" with a capital A. The parser is not feeling generous. 😭

`default/walk`

type — string
default — deny
drop — yes, raise only

Specify the default action for Walk sandboxing access violations. 🚶‍♀️🌸

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/list`

type — string
default — deny
drop — yes, raise only

Specify the default action for List sandboxing access violations. 📋✨

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/stat`

type — string
default — deny
drop — yes, raise only

Specify the default action for Stat sandboxing access violations. 📊🔍

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/read`

type — string
default — deny
drop — yes, raise only

Specify the default action for Read sandboxing access violations. 📖💖

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/write`

type — string
default — deny
drop — yes, raise only

Specify the default action for Write sandboxing access violations. ✍️🔥

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/exec`

type — string
default — deny
drop — yes, raise only

Specify the default action for Exec sandboxing access violations. ⚡👑

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/ioctl`

type — string
default — deny
drop — yes, raise only

Specify the default action for Ioctl sandboxing access violations. 🎛️💀

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/create`

type — string
default — deny
drop — yes, raise only

Specify the default action for Create sandboxing access violations. 🆕🦋

The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

`default/delete`

type — string
default — deny
drop — yes, raise only

Specify the default action for Delete sandboxing access violations. 🗑️😭

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

⚠️ lowkey important: see how "panic" is hanging out after "kill" here instead of before "stop"? Yeah. This entry's list is in a different order than the others. Same nine values, different lineup. Don't come for me, I'm just the messenger — copy the order as written. 💀

`default/rename`

type — string
default — deny
drop — yes, raise only

Specify the default action for Rename sandboxing access violations. 🏷️✨

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

same deal as default/delete — "panic" sits after "kill" in this list. Respect the order, bestie. 🙈

`default/readlink`

type — string
default — deny
drop — yes, raise only

Specify the default action for Readlink sandboxing access violations. 🔗👀

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

`default/symlink`

type — string
default — deny
drop — yes, raise only

Specify the default action for Symlink sandboxing access violations. 🪢💜

The value must be exactly one of "allow", "warn", "filter", "deny", "stop", "abort", "kill", "panic", or "exit", where the default is "deny".

`default/truncate`

type: string
default: deny
drop: yes, raise only

So this one's the default action for Truncate sandboxing access violations. Bestie, the value has to be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit" — no freestyling, no vibes-based spelling — and the default is "deny". 💅

`default/chdir`

type: string
default: deny
drop: yes, raise only

Sets the default action for Chdir sandboxing access violations. Value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". 🎀

`default/readdir`

type: string
default: deny
drop: yes, raise only

Default action for Readdir sandboxing access violations. Again: exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", and the default is "deny". ✨

`default/mkdir`

type: string
default: deny
drop: yes, raise only

This is the default action for Mkdir sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit" — default "deny". 🦋

`default/rmdir`

type: string
default: deny
drop: yes, raise only

Default action for Rmdir sandboxing access violations. Same deal, bestie: the value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". 🌸

`default/chown`

type: string
default: deny
drop: yes, raise only

Specifies the default action for Chown sandboxing access violations. Value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". 🫶

`default/chgrp`

type: string
default: deny
drop: yes, raise only

The default action for Chgrp sandboxing access violations lives here. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", and the default is "deny". 💖

`default/chmod`

type: string
default: deny
drop: yes, raise only

Default action for Chmod sandboxing access violations. Must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit"; default is "deny". 🔥

`default/chattr`

type: string
default: deny
drop: yes, raise only

This is the default action for Chattr sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". 🌈

`default/chroot`

type: string
default: deny
drop: yes, raise only

Default action for Chroot sandboxing access violations — and ngl this one's kind of main character energy, so get it right. Value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", default "deny". 👑

`default/notify`

type: string
default: deny
drop: yes, raise only

Specifies the default action for Notify sandboxing access violations. Must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". ⭐

`default/utime`

type: string
default: deny
drop: yes, raise only

The default action for Utime sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", and the default is "deny". 🍓

`default/mkdev`

type: string
default: deny
drop: yes, raise only

Default action for Mkdev sandboxing access violations. Exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit" — default "deny". 🧚

`default/mkfifo`

type: string
default: deny
drop: yes, raise only

Sets the default action for Mkfifo sandboxing access violations. Value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". 💜

`default/mktemp`

type: string
default: deny
drop: yes, raise only

Last one in this lil' family: the default action for Mktemp sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", and the default is "deny". 😭

Quick vibe check before you speed-run the next section: every single one of these is "deny" out of the box, so if you want your sandbox to be chill instead of locked-down, you're gonna have to say so explicitly. No cap. 💀

💅 `default/net`

type — string
default — deny
drop — yes, raise only

Bestie, this sets the default action for Network sandboxing access violations. The value has to be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit" — and yeah, the default is "deny". 💅

🫶 `default/sendfd`

type — string
default — deny
drop — yes, raise only

Default action for SendFd sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

🎀 `default/recvfd`

type — string
default — deny
drop — yes, raise only

Default action for RecvFd sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

🌸 `default/block`

type — string
default — deny
drop — yes, raise only

This one's the action for IP blocklist violations. Value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny". Notice allow isn't on the menu here — it's giving "girl, you are not getting through" energy. 🙈

💜 `default/force`

type — string
default — deny
drop — yes, raise only

For force sandboxing, this is where you define the default action to take when the path of a binary is not in the Integrity Force map. The value must be either one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", "exit", where the default is "deny".

🦋 `default/segvguard`

type — string
default — deny
drop — yes, raise only

Action for SegvGuard access violations. The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

⭐ `default/tpe`

type — string
default — deny
drop — yes, raise only

Action for TPE sandboxing access violations. The value must be exactly one of "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

🌈 `default/mem`

type — string
default — deny
drop — yes, raise only

Action for Memory sandboxing access violations. The value must be exactly one of "allow", "warn", "filter", "deny", "panic", "stop", "abort", "kill", or "exit", where the default is "deny".

🔥 `default/pid`

type — string
default — kill
drop — yes, raise only

Action for PID sandboxing access violations. Heads up, the default here is not deny — it's "kill" 😭. The value must be either one of "warn", "filter", "stop", "abort", "kill", "exit", where the default is "kill".

👑 `default/lock`

type — string
default — kill
drop — yes, raise only
static — yes

Specify the compatibility level for Lock sandboxing. The value must be either one of kill, deny, warn. So what do those actually mean, bestie?

kill stands for the Landlock compatibility level hard-requirement
deny stands for soft-requirement
warn stands for best-effort

As of version 3.35.0, the default level has been promoted from warn to kill to adhere to the principle of secure defaults. Again, as of this version ENOENT ("No such file or directory") errors are fatal unless compatibility level is set to best-effort at startup using default/lock:warn. ⚠️

For more information on Landlock compatibility levels, see: https://landlock.io/rust-landlock/landlock/trait.Compatible.html

🧚 `unshare/mount`

type — boolean
drop — yes, on only
query — yes
static — yes
oci — no

Create Mount namespace on startup — and lowkey it implies unshare/pid:true too. ✨

🍓 `unshare/uts`

type — boolean
drop — yes, on only
query — yes
static — yes
oci — no

Create UTS namespace on startup.

💀 `unshare/ipc`

type — boolean
drop — yes, on only
query — yes
static — yes
oci — no

Create IPC namespace on startup.

🌸 `unshare/user`

type — boolean
drop — yes, on only
query — yes
static — yes
oci — no

Create User namespace on startup.

💖 `unshare/pid`

type — boolean
drop — yes, on only
query — yes
static — yes
oci — no

Create Pid namespace on startup — and plot twist, it implies unshare/mount:true. 🌀

Syd mounts a private procfs(5) in this mode.

As of version 3.37.2 procfs(5) is mounted with hidepid=4 option which is Linux>=5.8.

As of version 3.39.0 procfs(5) is mounted with subset=pid option which is Linux>=5.8, unless trace/allow_unsafe_proc_files:true is set at startup.

🕸️ unshare/net

type: boolean
drop: yes, on only
query: yes
static: yes
oci: no

Create a Net namespace on startup. network vibes fully quarantined, slay 💅

🧺 unshare/cgroup

type: boolean
drop: yes, on only
query: yes
static: yes
oci: no

Create a CGroup namespace on startup.

⏰ unshare/time

type: boolean
drop: yes, on only
query: yes
static: yes
oci: no

Create a Time namespace on startup. Syd resets the boot-time clock so that uptime(1) reports container uptime instead of host uptime — no cap, your sandbox gets its own little clock and it's kind of iconic 🎀 Use the time command to override the default and set an alternative time.

🌱 root

type: string
static: yes
oci: no

Change the root mount to the given new root directory at startup using pivot_root(2). Destination path arguments of bind commands are interpreted relative to this directory. The directories $root/dev and $root/proc must exist to mount private filesystems. On top of that, target paths of the bind commands must also be manually created by the user — Syd is not gonna do your homework for you bestie 😭

This option does nothing without unshare/mount:1.

As of version 3.23.14, symbolic links are not followed in any part of the root directory, and path traversal using ".." is not permitted. Also: the root directory must be an absolute path — relative paths are not permitted, periodt.

As of version 3.35.0, the special keyword tmpfs, or shortly tmp, or just t, is supported to make Syd mount a private tmpfs(5) filesystem as the root directory. In this mode, Syd is going to attempt to create target paths inside the private temporary filesystem. Similarly, as of version 3.45.0, the special keyword ramfs, or shortly ram, or just r, is supported to make Syd mount a private ramfs(5) filesystem as the root directory. Heads up though 🫶 ramfs(5) is limited compared to tmpfs(5) and should only be preferred when the host Linux kernel isn't configured with the CONFIG_TMPFS option. The private root directory is mounted with the options nodev, noexec, nosuid, nosymfollow, noatime, and mode=700.

As of version 3.35.2, the special keywords none and off may be used to unset a previously set root directory. very demure, very mindful 💜

🗺️ root/map

type: boolean
static: yes
oci: no

Map the current user to root in the sandbox on startup.

This option does nothing without "unshare/user:1".

🎭 root/fake

type: boolean
static: yes

In fakeroot mode, the system will return a user/group id of 0, mimicking the root user. This allows users to execute commands with apparent root privileges, without actual superuser rights — it's giving main character energy without the actual crown 👑 It's useful for tasks like package building where a root-like environment is needed, but not actual root permissions.

ngl this is fake root, not real root. The permissions are cosmetic. Don't go thinking you're actually root fr fr 💀

🕰️ time

type: i64
static: yes
oci: no

Set clock boottime and monotonic offset (seconds) in the Time Namespace. To set boottime and monotonic offsets separately, use the options time/boot and time/mono. This option is a shorthand to set both at the same time to the same offset. Use the keywords none or off to unset a previously set offset.

🌅 time/boot

type: i64
static: yes
oci: no

Set the clock boottime offset (seconds) in the Time Namespace. Use the keywords none or off to unset a previously set offset.

📈 time/mono

type: i64
static: yes
oci: no

Set the clock monotonic offset (seconds) in the Time Namespace. Use the keywords none or off to unset a previously set offset.

⏳ timeout

type: duration
default: none

Set a sandbox timeout, after which Syd will exit with code 124 and all sandbox processes running under it will exit with Syd. Use none or off to disable it — that's the default, no pressure ✨ Duration may be specified in human readable format. Refer to the documentation of the dur crate for more information, iykyk.

🏷️ uts/host

type: string
default: localhost

Set the UTS host name in the sandbox. The name is limited to 64 characters. The name may be empty. The name may not have nul bytes. Default is localhost. Use the keywords none or off to unset it, and then Syd will pass-through the original hostname to the sandbox process.

Useful when combined with unshare/uts:true. As of version 3.40.0, the value of this option is returned at the uname(2) boundary in the nodename field of the utsname structure regardless of the unshare/uts option.

As of version 3.39.3, this value may be changed at runtime.

As of version 3.49.0, this value must NOT be empty and must be a safe filename. Refer to the "Enhanced Path Integrity Measures" section of the syd(7) manual page for information on safe filenames.

🌐 uts/domain

type: string
default: (none)

Set the NIS/YP domain name in the sandbox. The name is limited to 64 characters. The name may be empty. The name may not have nul bytes. The default is (none). Use the keywords none or off to unset it, and then Syd will pass-through the original domainname to the sandbox process.

Useful when combined with unshare/uts:true. As of version 3.40.0, the value of this option is returned at the uname(2) boundary in the domainname field of the utsname structure regardless of the unshare/uts option.

As of version 3.39.3, this value may be changed at runtime.

📦 uts/version

type: string
default: <random>

Set the version level of the operating system as returned in the version field of the utsname structure at the uname(2) boundary. The name is limited to 64 characters. The name may be empty. The name may not have nul bytes. The default is determined randomly at startup — cute little surprise every time 🎀 Use the keywords none or off to unset it, and then Syd will pass-through the original version to the sandbox process.

As of version 3.56.0, this value must NOT be empty and must be a safe filename. Refer to the "Enhanced Path Integrity Measures" section of the syd(7) manual page for information on safe filenames.

🎛️ allow/ioctl

type: integer or string
default: [...]
drop: yes, remove only

So basically: prefix with 0x for hexadecimal and 0o for octal, bestie — and use allow/ioctl+<request> to add stuff to the allowlist, allow/ioctl-<request> to yeet it back out. ✨ As of version 3.38.0, you can also name ioctl(2) requests by case-insensitive name, and you can add or remove a whole bunch at once by comma-delimiting them. Naming your requests is strongly recommended because request numbers can vary by architecture, and naming them handles that transparently for you. 🫶 As of version 3.38.6, you can prepend the name with an optional exclamation mark, !, to tell Syd not to return EINVAL ("Invalid argument") errno(3) when the name isn't defined for any of the currently supported architectures — iconic for writing rules that stay generic across multiple incompatible architectures. 💅 As of version 3.50.0, shell-style glob(3) patterns work for ioctl(2) names: the glob(3) characters *, ?, and [...] match multiple ioctl(2) names at once, like allow/ioctl+DRM_IOCTL_I915_* to allow every Intel GPU ioctl, or allow/ioctl+FIO* to allow all the generic file ioctls. Glob matching is case-insensitive and combines with comma-separated literals, e.g. allow/ioctl+FIO*,FIBMAP. The ! applies per element, no cap.

By default the allowlist contains these ioctl(2) requests: FIOCLEX, FIONCLEX, FIONBIO, FIONREAD, FIOASYNC, FIOQSIZE, FIDEDUPERANGE, PIDFD_GET_INFO, and RNDGETENTCNT. 📋

For rules added at startup, deny rules have precedence over allow rules because the denylist gets checked at kernel-space while the allowlist gets checked at user-space. For rules added after startup, the last matching rule wins. 🏁

👑 `deny/ioctl`

Alright so the vibe check on this one:

type — integer or string
default — [...] (there's a whole list, hang on)
drop — yes, add only
static — add is dynamic, remove is partly static

Add to or remove a request from the ioctl(2) request denylist. Accepts an unsigned 64-bit integer as argument. Prefix with 0x for hexadecimal and 0o for octal input. Use deny/ioctl+<request> to add to, and deny/ioctl-<request> to remove from the allowlist — and yeah, the page does say "allowlist" right there in the deny section, that's just how it's written, we move. 💀

As of version 3.38.0, ioctl(2) requests can also be specified by case-insensitive name, and you can add or remove multiple by comma-delimiting. Naming is strongly recommended since request numbers vary by architecture and that's handled transparently when you use a name. ✨ As of version 3.38.6, the ioctl(2) name can be prepended with an optional exclamation mark, !, meaning Syd shouldn't return EINVAL ("Invalid argument") errno(3) if the name isn't defined for any of the currently supported architectures — perfect for generic rules across incompatible architectures. As of version 3.50.0, shell-style glob(3) patterns are accepted for ioctl(2) names: *, ?, and [...] match multiple names at once, e.g. deny/ioctl+SECCOMP_IOCTL_* to deny all the seccomp(2) ioctls. Glob matching is case-insensitive and combines with comma-separated literals. The ! applies per element. 🎀

As of version 3.58.0, ioctl(2) names corresponding to variable-sized ioctl(2) requests — also known as extensible-argument ioctls, e.g. SPI_IOC_MESSAGE, EVIOCGNAME, SECCOMP_IOCTL_NOTIF_ADDFD or PIDFD_GET_INFO — are supported on the denylist and matched with the size field wildcarded, so the request is denied for every payload size. 🔥 Parameterized ioctl(2) requests whose command number varies with an argument, e.g. EVIOCGABS, EVIOCSABS and EVIOCGBIT, are likewise matched with the varying command-number bits — and, where applicable, size bits — wildcarded, so a whole request family is covered by a single rule. Slay.

By default the denylisted ioctl(2) requests are FIFREEZE, FITHAW, FS_IOC_FIEMAP, FIGETBSZ, FICLONE, FICLONERANGE, FS_IOC_GETFSUUID, FS_IOC_GETFSSYSFSPATH, FIBMAP, FS_IOC_FSGETXATTR, FS_IOC_FSSETXATTR, FS_IOC_SETFLAGS, FS_IOC32_SETFLAGS, KDSETKEYCODE, KDSIGACCEPT, RNDADDTOENTCNT, RNDGETPOOL, RNDADDENTROPY, RNDZAPENTCNT, RNDCLEARPOOL, SECCOMP_IOCTL_NOTIF_RECV, SECCOMP_IOCTL_NOTIF_SEND, SECCOMP_IOCTL_NOTIF_ID_VALID, SECCOMP_IOCTL_NOTIF_ADDFD, SECCOMP_IOCTL_NOTIF_SET_FLAGS, TIOCCONS, TIOCLINUX, TIOCSETD, TIOCSTI, TIOCSSERIAL, KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_RESET_TRACE, KCOV_REMOTE_ENABLE, and DRM_IOCTL_GEM_CHANGE_HANDLE. 👀

For security reasons, the ioctl(2) denylist is applied at the parent seccomp-bpf filter at startup. That means the Syd process is included in this restriction too. It also means removing elements from this list after startup has no effect. But — if Ioctl sandboxing was enabled at startup, adding new elements to the ioctl(2) denylist will further restrict the ioctl(2) request space. 😭

For rules added at startup, deny rules have precedence over allow rules, because the denylist is checked at kernel-space and the allowlist is checked at user-space. For rules added after startup, the last matching rule wins. 🏁

Further reading about denylisted ioctl(2) requests, if you're in your research era:

🍓 `mem/max`

type — positive integer (u64)
default — 0
drop — yes, reduce only

This one sets the limit on per-process memory usage. Setting it to 0 disables testing for this type of memory usage. The value is parsed using the parse-size crate — go check their docs for how to format it. 📏 Setting a non-zero value here implies sandbox/mem:on.

As of version 3.58.1, when this setting is non-zero, the sysinfo(2) handler honours the limit. Check the "Cryptographically Randomized Sysinfo" section of the syd(7) manual page for more. 🔍

🦋 `mem/vm_max`

type — positive integer (u64)
default — 0
drop — yes, reduce only

Same energy but for virtual memory: this sets the limit on per-process virtual memory usage. 0 disables testing for this type of memory usage. Value is parsed using the parse-size crate (docs, bestie, docs). Setting a non-zero value with this option implies sandbox/mem:on. 💖

🌸 `pid/max`

type — positive integer (u64)
default — 0
drop — yes, reduce only

This setting specifies the limit on the number of running tasks for pid sandboxing. Setting it to 0 is functionally equivalent to setting sandbox/pid to off. Setting a non-zero value here implies sandbox/pid:on. 🔢

As of version 3.40.0, when unshare/pid:true is set, PID sandboxing counts and enforces the limit in the current PID namespace; on Linux 6.14 and newer, to account for the kernel's 300 reserved PIDs, the namespaced kernel.pid_max is set to max(pid/max, 301) (or 512 on s390x), while on older kernels the kernel.pid_max sysctl(8) is left unchanged. No cap, well — actually, cap. 😌

🧚 `pipe/max`

type — positive integer (i32)
default — ${SYD_PAGE_SIZE}
drop — yes, reduce only
static — reduce is dynamic, raise is static

This setting is the max pipe(2) buffer size in bytes, bestie 💅 and the value has got to be at least the system page size — which, fun fact, is also the Syd default. Smaller limits literally cannot be enforced. You can reduce it after startup but you cannot raise it, because Syd installs a seccomp(2) filter at startup that confines the F_SETPIPE_SZ(2const) fcntl(2) operation. And when pipe(2) creation is confined by Create sandboxing? Every single created pipe(2) gets its buffer size set to this value. no cap. 🫶

🎀 `xattr/max` 🎀

type — positive integer (size_t)
default — 512
drop — yes, reduce only

This one sets the maximum extended attribute value size in bytes for the setxattr(2), lsetxattr(2), fsetxattr(2) and setxattrat(2) system calls. Default is 512 bytes. Minimum permitted value is 0. Maximum permitted value is 65536. A write whose value exceeds this limit gets denied with E2BIG ("Argument list too long") 😭 and honestly that's the point — it mitigates kernel heap spraying via attacker-sized, attacker-controlled extended attribute allocations. icon behavior fr fr 💜

🌸 `rlimit/as` 🌸

type — positive integer (rlim_t)
static — yes

Limits the maximum size of the sandbox process's virtual memory (address space) using rlimit(2). The limit is specified in bytes and is rounded down to the system page size. The value is parsed using the parse-size crate — go read their documentation for the formatting tea ☕. Use the keywords none or off to unset a previously set value. The keyword inf denotes no limit on the resource. slay.

🦋 `rlimit/core` 🦋

type — positive integer (rlim_t)
default — 0
static — yes

Limits the maximum size of a core(5) file in bytes using rlimit(2). When it's 0 (the default) no core dump files are created. When it's nonzero, larger dumps get truncated to this size. The value is parsed using the parse-size crate — check their docs for formatting. Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource. 💀

⭐ `rlimit/cpu` ⭐

type — positive integer (rlim_t)
static — yes

Limits the amount of CPU time in seconds using rlimit(2). The value is parsed using the dur crate — yes, a different crate, refer to their documentation for formatting info 🙈. Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

🍓 `rlimit/data` 🍓

type — positive integer (rlim_t)
static — yes

Limits the maximum size of the sandbox process's data segment — that's initialized data, uninitialized data, and heap, all of it 😌 — using rlimit(2). The limit is in bytes and is rounded down to the system page size. Parsed with the parse-size crate, docs are right there bestie. Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

💖 `rlimit/fsize` 💖

type — positive integer (rlim_t)
static — yes

Limits the maximum size in bytes of files that the sandbox process may create, using rlimit(2). Parsed with the parse-size crate (their docs, go look 💅). Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

Heads up bestie: this limit is applied to the Syd process as well, so that system calls like truncate(2) and fallocate(2) are correctly limited. Care should be taken, because setting this limit to a value lower than what Syd's internal file handling requires may result in unexpected errors 😭 — don't do it, or at least don't say I didn't warn you.

🧚 `rlimit/memlock` 🧚

type — positive integer (rlim_t)
default — 0
static — yes

Limits the maximum number of bytes of memory that may be locked into RAM using rlimit(2). This limit is in effect rounded down to the nearest multiple of the system page size. Default is zero. Parsed via the parse-size crate — docs, formatting, you know the drill ✨. Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

🌈 `rlimit/msgqueue` 🌈

type — positive integer (rlim_t)
default — 0
static — yes

Limits the number of bytes that can be allocated for POSIX message queues for the real user ID of the sandbox process, using rlimit(2). The limit is enforced for mq_open(3). Default is zero. The value is parsed using the parse-size crate — refer to their documentation for formatting info 🫶. Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

👑 `rlimit/nice` 👑

type — integer (-20..=20)
default — 20
static — yes

Specifies a ceiling to which the sandbox process's nice value can be raised, using setpriority(2) or nice(2) via rlimit(2). The accepted range for this limit is from -20 to 20 (the default). Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource.

Default is 20. And btw — the option trace/allow_unsafe_nice must also be set to permit the sandbox process to change its nice value. iykyk 😌

🔥 `rlimit/nofile` 🔥

type — positive integer (rlim_t)
static — yes

Limits the maximum file descriptor number that can be opened, using resource limits via rlimit(2). Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource. periodt 💅

💜 `rlimit/nproc` 💜

type — positive integer (rlim_t)
static — yes

Limits the number of extant process (or, more precisely on Linux, threads) for the real user ID of the sandbox process, using rlimit(2). Use none or off to unset a previously set value. The keyword inf denotes no limit on the resource. literally the thread-counting one 🧵✨

🌸 rlimit/rtprio 🌸

type — positive integer (rlim_t)
default — 0
static — yes

Okay so this one lets you put a literal ceiling on the real-time priority that the sandbox process is allowed to set for itself, via sched_setscheduler(2) and sched_setparam(2), all enforced through rlimit(2). Default is zero. Wanna unset something you set earlier? Use the keywords none or off. And the keyword inf means "no limit on this resource" — infinite vibes, no cap, literally. ✨

🦋 rlimit/rttime 🦋

type — positive integer (rlim_t)
default — 0
static — yes

This caps (in microseconds) how much CPU time a sandbox process can burn while running under a real-time scheduling policy without making a blocking system call — enforced through rlimit(2). Default is zero. The value gets parsed using the dur crate, so go read their docs for the formatting tea 🫖. Same keywords as always: none or off to unset a previously set value, inf for no limit on the resource.

🎀 rlimit/sigpending 🎀

type — positive integer (rlim_t)
static — yes

(and no, bestie, there is genuinely no default row in this table — I'm not gatekeeping it from you 💀)

This one limits how many signals can be queued for the real user ID of the sandbox process, using rlimit(2). Both standard and real-time signals count toward this limit, so nothing sneaks past. Use none or off to unset a previously set value, inf for no limit on the resource.

🌈 rlimit/stack 🌈

type — positive integer (rlim_t)
static — yes

(again, no default row on this one either — the table just doesn't have one 🙈)

Caps the maximum size of the sandbox process stack, in bytes, via rlimit(2). The value is parsed using the parse-size crate — their docs have the formatting deets. Use none or off to unset a previously set value, and inf means no limit on the resource. Periodt.

💅 bind 💅

type — string-vec
static — yes
oci — no

This command makes Syd bind mount a directory on startup. The format is source-dir:target-dir:mount-options,... — and yes, the source and target directories are allowed to be equal, no drama.

As of version 3.55.0, bind mounts are secure by default. And I mean regardless of whether the source is an absolute path or a filesystem type, every single bind gets mounted with nodev, noexec, nosuid, and nosymfollow applied. So if you want the relaxed behaviour, you have to explicitly opt back in upfront with the options below. Each option weakens exactly one of the secure defaults:

dev — to interpret character and block special devices on the filesystem. By default with nodev, device nodes are not interpreted.
exec — to permit direct execution of binaries on the mounted filesystem. By default with noexec, execution is not permitted.
suid — to honour set-user-ID and set-group-ID bits and file capabilities when executing programs from this filesystem. By default with nosuid they are ignored. In addition, SELinux domain transitions require permission nosuid_transition, which in turn needs also policy capability nnp_nosuid_transition.
symfollow — to follow symbolic links when resolving paths. By default with nosymfollow, symbolic links are not followed. They can still be created, and readlink(1), readlink(2), realpath(1), and realpath(3) all still work properly. In addition, ro mounts the filesystem read-only. rw resets a previous ro option, and is a no-op otherwise.

Access time of a bind mount is not part of the secure defaults, because changing it is privileged in unprivileged user_namespaces(7). The access time options that stay available as opt-in flags are:

noatime — to not update inode access times on this filesystem (e.g. for faster access on the news spool to speed up news servers). This works for all inode types (directories too), so it implies nodiratime.
nodiratime — to not update directory inode access times on this filesystem. (This option is implied when noatime is set.)
relatime — to update inode access times relative to modify or change time. This is the default.
strictatime — to always update inode access times on every access. This may increase I/O and is rarely needed.

The legacy restrictive options nodev, noexec, nosuid, and nosymfollow are now the default and are accepted only as no-ops for backwards compatibility. The access time options (noatime, relatime, strictatime) are mutually exclusive — specifying conflicting options is an error, so don't even try it 🙅

Mount options may be omitted entirely. If the source directory isn't an absolute path, it's interpreted as the filesystem type rather than the source directory. That's how you mount special filesystems like cgroupfs, overlayfs or tmpfs(5) into the mount namespace. In that case, any mount options supported by that filesystem type can go in the options argument — not just the ones listed above. Some iconic examples:

bind+/:/:ro
bind+tmpfs:/tmp:size=16M
bind+tmpfs:/run:exec,size=16M
bind+/dev:/dev:dev
bind+overlay:/tmp/target:exec,lowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work
bind+devpts:/dev/pts:dev,newinstance,ptmxmode=0600,mode=600
bind+ramfs:/tmp
bind+sysfs:/sys
bind+mqueue:/dev/mqueue

You can use this command to create immutable containers 👑. For example, bind+/:/:ro is functionally equivalent to deny/write+/***, except the restriction happens at the kernel VFS layer rather than at user level using seccomp(2) notify. Alternatively you can achieve the same thing at the kernel level using landlock(7).

As of version 3.23.14, symbolic links are not followed in any part of the source or target directory paths, and path traversal using .. is not permitted. Also the target directory must be an absolute path — relative paths are simply not permitted, no exceptions.

As of version 3.23.14, mounting the special proc(5) filesystem under a custom path is not permitted. Syd handles that mount itself, specially, after all bind mounts are processed. Main character behaviour, honestly.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This command does nothing without unshare/mount:true. Like, nothing at all. Don't come for me.

🧚 bind-try 🧚

type — string-vec
static — yes
oci — no

Behaves identically to bind except for one lil thing: it warns and continues on the ENOENT ("No such file or directory") errno(3) on the source directory. All other errors stay fatal, no mercy. This is the one for portable profiles that reference optional paths which might not exist on every system 🫶. Format is the same as bind: source-dir:target-dir:mount-options,...

Take "bind-try+/opt/custom:/opt/custom:ro" as an example. If /opt/custom doesn't exist, the mount is skipped with a warning and execution continues on its merry way. But if the source does exist and just can't be opened for any other reason (e.g. EACCES, ELOOP), Syd reports the error and terminates as usual. So it's forgiving, not reckless 💅

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option does nothing without unshare/mount:true.

⭐ mkdir ⭐

type — string-vec
static — yes
oci — no

This command has Syd create a directory node in the mount namespace on startup using mkdirat(2). Format is path or path:mode, where path is an absolute path and mode is an optional octal permission mode. No mode? It defaults to 0700, cute and private by default 🎀

mkdir+/dev/shm
mkdir+/dev/shm:0755
mkdir+/tmp/work:0700

The path must be absolute. Relative paths and any path components containing .. get rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories are created automatically using mkdirat(2) with safe fd-based traversal. The node itself is created using mkdirat(2), which does not follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup, which strips group and other permission bits from the requested mode. In addition, setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit survive in the final mode — everything else gets left on read 💀✨

...and the escape thing? yeah it works in path args across all of these: "\:" drops a literal colon, "\\" drops a literal backslash. Very "trust me bestie" of them but it's real. 💅

🚨 heads up: every single one of these needs root:ramfs or root:tmpfs. No ramfs(5)/tmpfs(5) root? Then the operation is silently ignored — like, not an error, just nothing, which is the most annoying kind of nothing, ngl. And they all do absolutely zero without unshare/mount:true. Periodt.

🎀 `mkdir-try` 🎀

type — string-vec
static — yes
oci — no

Basically mkdir's chill twin 😌 — it does the exact same thing, except it warns and keeps going when it hits EEXIST ("File exists") errno(3). Every other error stays fatal, no exceptions. Super useful for making directories that might already be there, like the classic standard paths in a tmpfs root. Same format as mkdir: path or path:mode.

Take "mkdir-try+/dev/shm:0755" as an example. If /dev/shm already exists, creation gets skipped with a warning and execution just carries on. If the path can't be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual. 😭

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkdir-try operations are silently ignored. This option does nothing without unshare/mount:true.

🦋 `mkfile` 🦋

type — string-vec
static — yes
oci — no

Makes Syd create a regular file node in the mount namespace on startup using mknodat(2). Format is path or path:mode where path is an absolute path and mode is an optional octal permission mode. Skip the mode? Defaults to 0400. 🎀

mkfile+/dev/null
mkfile+/dev/null:0666
mkfile+/tmp/placeholder:0600

The path must be absolute. Relative paths and path components containing .. get rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path — none, not one. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories are created automatically using mkdirat(2) with safe fd-based traversal. The node itself is created using mknodat(2), which doesn't follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup, which strips group and other permission bits from the requested mode. On top of that, setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit survive in the final mode. Iconic security behaviour, honestly. 👑

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfile operations are silently ignored. This option does nothing without unshare/mount:true.

🌸 `mkfile-try` 🌸

type — string-vec
static — yes
oci — no

Same energy as mkfile, except it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. Great for file nodes that may already exist, like device nodes in a tmpfs root. Format's identical to mkfile: path or path:mode.

Take "mkfile-try+/dev/null:0666" as an example. If /dev/null already exists, the creation is skipped with a warning and execution continues. If the path can't be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfile-try operations are silently ignored. This option does nothing without unshare/mount:true.

🍓 `mkfifo` 🍓

type — string-vec
static — yes
oci — no

Creates a named pipe (FIFO) node in the mount namespace on startup using mknodat(2) with S_IFIFO. Format: path or path:mode, path absolute, mode an optional octal permission mode. Omit the mode and it defaults to 0600.

mkfifo+/tmp/myfifo
mkfifo+/tmp/myfifo:0644
mkfifo+/run/syd/ctl:0600

Path must be absolute. Relative paths and path components containing .. → rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of the path. Parent directories are opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories get created automatically using mkdirat(2) with safe fd-based traversal. The node is created using mknodat(2), which doesn't follow symbolic links in the final component. A secure umask(2) of 0077 is applied during mount namespace setup, stripping group and other permission bits from the requested mode. Plus setuid and setgid bits are stripped explicitly. Only user permission bits and the sticky bit are preserved in the final mode. 💅

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfifo operations are silently ignored. This option does nothing without unshare/mount:true.

💜 `mkfifo-try` 💜

type — string-vec
static — yes
oci — no

mkfifo but it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. Perfect for FIFO nodes that may already exist in a tmpfs root. Same format as mkfifo: path or path:mode.

Take "mkfifo-try+/tmp/myfifo:0644" as an example. If /tmp/myfifo already exists, the creation is skipped with a warning and execution continues. If the path can't be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, mkfifo-try operations are silently ignored. This option does nothing without unshare/mount:true.

🔥 `link` 🔥

type — string-vec
static — yes
oci — no

Makes Syd create a hard link in the mount namespace on startup using linkat(2). Format is dst:src where dst is the absolute path of the new link and src is the absolute path of the existing file you're linking to.

link+/lib/libfoo.so:/usr/lib/libfoo.so
link+/opt/bin/tool:/usr/bin/tool

Both dst and src must be absolute paths. Relative paths and path components containing .. get rejected with EINVAL ("Invalid argument"). Symbolic links are not followed in any component of either path. The source file is opened with openat2(2) using RESOLVE_NO_XDEV to prevent cross-device path traversal. Parent directories of dst are created automatically using mkdirat(2) with safe fd-based traversal.

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, link operations are silently ignored. This option does nothing without unshare/mount:true.

🧚 `link-try` 🧚

type — string-vec
static — yes
oci — no

Identical to link except it warns and continues on EEXIST ("File exists") errno(3). All other errors remain fatal. Handy for hard links that may already exist in a tmpfs root. Format is the same as link: dst:src.

Take "link-try+/lib/libfoo.so:/usr/lib/libfoo.so" as an example. If /lib/libfoo.so already exists, the creation is skipped with a warning and execution continues. If the link can't be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates as usual. 😭

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, link-try operations are silently ignored. This option does nothing without unshare/mount:true.

🌈 `symlink` 🌈

type — string-vec
static — yes
oci — no

So basically this command makes Syd create a symbolic link inside the mount namespace at startup, using symlinkat(2). The format is dst:src — dst is the absolute path of the shiny new symlink, and src is whatever it points at. 🎀

symlink+/lib/libfoo.so:/usr/lib/libfoo.so
symlink+/usr/lib/libfoo.so.1:libfoo.so

The dst path has to be absolute, no exceptions bestie. Relative dst paths and any path components containing .. in either dst or src get rejected with EINVAL ("Invalid argument"). But unlike link, the src path can be relative — that gives you a relative symbolic link, which is resolved when the link is accessed, not when it's created. Symbolic links are not followed in the final component of dst. Parent directories of dst get created automatically using mkdirat(2) with safe fd-based traversal. ✨

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, symlink operations are silently ignored 👀. This option does nothing without unshare/mount:true.

symlink-try

type: string-vec
static: yes
oci: no

This one behaves identically to symlink except that it warns and continues on EEXIST ("File exists") errno(3). Every other error stays fatal. Super useful for symbolic links that might already exist in a tmpfs root. Format is the same as symlink: dst:src

Take "symlink-try+/lib/libfoo.so:/usr/lib/libfoo.so" as an example. If /lib/libfoo.so already exists, creation is skipped with a warning and execution keeps going. If the symbolic link can't be created for any other reason (e.g. EACCES, ENOENT), Syd reports the error and terminates like usual. 💅

Escape sequences are supported in the path arguments: "\:" inserts a literal colon and "\\" inserts a literal backslash.

This option requires root:ramfs or root:tmpfs. Without a ramfs(5) or tmpfs(5) root, symlink-try operations are silently ignored. This option does nothing without unshare/mount:true.

workdir

type: string
static: yes
oci: no

Sets the current working directory inside the mount namespace on startup. The working directory gets changed after all bind, link, symlink, mkdir, mkfile, and mkfifo commands have been applied. Use the keywords none or off to unset a previously set value. 🦋

workdir:/tmp
workdir:/opt/build
workdir:none

The path must be absolute. Relative paths and path traversal using ".." are not permitted. Symbolic links are not followed. This command may be combined with mkdir to first create the target directory and then change into it — iconic combo honestly. ✨

This option does nothing without the root command. This option does nothing without unshare/mount:true.

force

type: string-vec
drop: yes, add only

Add or remove an integrity force rule for Force Sandboxing. The format is force+/path:algorithm:hashhex:action for adding and force-/path for removing. Use force^ to clear the Integrity Force map. Available actions are "warn", "filter", "deny", "panic", "stop", "abort", "kill" and "exit", and the default is "deny". Algorithm is any supported hash algorithm (see syd-sum(1) -a list), e.g. sha256, sha3-512, blake2b-256, crc32c. hashhex is the hexadecimal digest. 🔥

As of version 3.57.0, escape sequences are supported in the path: "\:" inserts a literal colon and "\\" inserts a literal backslash.

syd-sum(1) is a helper tool to calculate checksums of files.
syd-path(1) is a helper tool to write integrity force rules for binaries under PATH.

proxy/addr

type: IP address
default: 127.0.0.1
static: yes
oci: no

Set the internal address for Proxy sandboxing. This must be an IPv4 or an IPv6 address. Defaults to 127.0.0.1.

proxy/port

type: integer
default: 9050
static: yes
oci: no

Set the internal port for Proxy sandboxing. Defaults to 9050. 🧚

proxy/ext/host

type: IP
default: 127.0.0.1
static: yes
oci: no

Set the external address for Proxy sandboxing. This must be either an IPv4 address or an IPv6 address.

Defaults to "127.0.0.1", which may be overridden with the environment variable SYD_PROXY_HOST at startup. 💜

proxy/ext/port

type: integer
default: 9050
static: yes
oci: no

Set the external port for Proxy sandboxing.

Defaults to 9050, which may be overridden with the environment variable SYD_PROXY_PORT at startup.

proxy/ext/unix

type: string
static: yes
oci: no

Set the external UNIX domain socket for Proxy sandboxing. 🐚

The argument may also be set using the environment variable SYD_PROXY_UNIX at startup.

This option has precedence over the option "proxy/ext/host", ie. when both are given Syd will connect to the UNIX domain socket.

segvguard/expiry

type: duration
default: 120
drop: yes, raise only

Specify the SegvGuard expiry timeout in seconds. Set to 0 to disable SegvGuard.

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the dur crate for more information. ⏳

segvguard/suspension

type: duration
default: 600
drop: yes, raise only

Specify the SegvGuard suspension timeout in seconds. 0 is an invalid value. 🙅‍♀️

As of version 3.47.0, duration may be passed in human readable format. Refer to the documentation of the dur crate for more information.

segvguard/maxcrashes

type: integer (u8)
default: 5
drop: yes, reduce only

Specify SegvGuard max crashes. 0 is an invalid value. 💀

tpe/gid

type: integer (gid_t)

Specify untrusted GID for Trusted Path Execution (TPE). By default, TPE is applied to users of all groups including root, and this setting can be used to limit it to a certain group. To unset a previously set GID and return to the default state, set "none" as the value. 🫶

tpe/negate

type: boolean

Negate GID logic for Trusted Path Execution (TPE). This flips "tpe/gid" from untrusted into trusted, so users belonging to this group are exempt from TPE. ✨

tpe/root_owned

type: boolean
drop: yes, on only

Ensure the file and parent directory are root-owned for Trusted Path Execution (TPE).

Heads up bestie — this option will misbehave with "unshare/user:1" if the real root user is not mapped inside the container. 😭

🫶 `tpe/user_owned`

type — boolean

Okay so this one is the Trusted Path Execution (TPE) bestie: it makes sure the file and its parent directory are either user-owned or root-owned. No weird third-party owner sneaking into your exec path, ty 💅

Heads up though — this option may misbehave with unshare/user:1 if the real root user is not mapped inside the container. Not a vibe, just a fact 😭

🌸 `tpe/root_mount`

type — boolean

Same TPE energy, different check: file and parent directory both have to live on the root filesystem. Use this if you wanna pin all your executions to a single safe mountpoint — one mount to rule them all 👑

🦋 `allow/fs`

type — string-vec
drop — yes, remove only

This is your guest list for Filesystem sandboxing: which filesystem types are allowed in. Literally a list of types, that's it ✨

It accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input — yes bestie, you can get your hex girl on 🔥

⭐ `allow/walk`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Walk sandboxing. Walking through the filesystem like it's a runway 🚶‍♀️💅

🎀 `allow/list`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for List sandboxing. Peeking at the directory listing? Only if you're on the list, babe 📋

💜 `allow/stat`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Stat sandboxing — as in, who gets to ask about file metadata. Nosy behavior, but make it consensual 🔍

🌈 `allow/read`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Read sandboxing. Reading is fundamental, but like, only where permitted 📖

🍓 `allow/write`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Write sandboxing. Put the pen down unless the pattern says otherwise ✍️

💀 `allow/exec`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Exec sandboxing. This is the main-character permission honestly, guard it 👑

🧚 `allow/create`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Create sandboxing. New file who dis 🐣

🦋 `allow/delete`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Delete sandboxing. The trash can stays locked unless the pattern says slay 💅

🔥 `allow/rename`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Rename sandboxing. Glow-up name changes only for approved paths ✨

🎀 `allow/readlink`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Readlink sandboxing. Following the crumbs, but make it permissioned 🍪

💜 `allow/symlink`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Symlink sandboxing. Making little shortcuts to other files, iykyk 🔗

🌸 `allow/truncate`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Truncate sandboxing. Chopping a file down to size, respectfully ✂️

⭐ `allow/chdir`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chdir sandboxing. Where you're allowed to wander to — stay in your lane, gorgeous 🚪

🫶 `allow/readdir`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Readdir sandboxing. Reading the contents of a directory, which is different from List, don't ask me why, that's just how it is 😌

🐣 `allow/mkdir`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Mkdir sandboxing. Building new little homes for your files 🏠

💀 `allow/rmdir`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Rmdir sandboxing. Demolition requires paperwork, fr fr 📄

👑 `allow/chown`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chown sandboxing. Changing who owns what — that's a whole power move, so obviously it's gated 🫡

🍓 `allow/chgrp`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chgrp sandboxing. Group project energy, but with permissions 👯

🌈 `allow/chmod`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chmod sandboxing. Changing the mode bits, aka the file's whole aesthetic 💅

🔥 `allow/chattr`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chattr sandboxing. Toggling those extra-special file attributes, the deep lore ones 📚

🦋 `allow/chroot`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Chroot sandboxing. Changing your whole root directory?? Massive. Gated, obviously 🌍

🎀 `allow/notify`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Notify sandboxing. Keeping an eye on things — surveillance but make it sandboxed 👀

🧚 `allow/utime`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Utime sandboxing. Touching timestamps, the ultimate "time is a construct" permission ⏰

💜 `allow/mkdev`

type — string-vec
drop — yes, remove only

List of glob(3p) patterns allowed for Mkdev sandboxing — creating device nodes…

Specifies a list of glob(3p) patterns to allow for Mkdev sandboxing. 💅

allow/mkfifo 🎀

type — string-vec
drop — yes, remove only

This one's the allowlist for Mkfifo sandboxing: it takes a list of glob(3p) patterns and that's the whole vibe. ✨

allow/mktemp 🦋

type — string-vec
drop — yes, remove only

Same energy for Mktemp sandboxing — a list of glob(3p) patterns, no cap. 💖

allow/net/bind 🌸

type — string-vec
drop — yes, remove only

This is the network address pattern allowlist for Bind network sandboxing. Lowkey crucial if you're locking down who gets to bind. 🔥

allow/net/accept 💫

type — string-vec
drop — yes, remove only

The network address pattern allowlist for Accept network sandboxing — yes bestie, accepting connections has its own little guest list. 🫶

allow/net/connect 🌈

type — string-vec
drop — yes, remove only

And here's the network address pattern allowlist for Connect network sandboxing. Outbound connections stay picky. 💅

allow/sendfd 👑

type — string-vec
drop — yes, remove only

Specifies a list of file descriptor names to allow for SendFd sandboxing. 💖

Real talk: the file descriptor being sent is matched, not the peer it is sent to. That distinction is doing main character energy. ✨

Accepts a file descriptor name, which begins with the character !:

!file — regular file
!dir — directory
!symlink — symbolic link
!magiclink — proc(5) magic symbolic link
!magicdir — proc(5) magic symbolic link to a directory
!bdev — block device
!cdev — character device
!socket — socket
!fifo — filesystem FIFO
!pipe — anonymous pipe
!notification_pipe — notification pipe
!nsfs — namespace file descriptor
!pidfd — process file descriptor
!secretmem — secret memory file descriptor
!memfd:NAME — memory file descriptor named NAME
!memfd-hugetlb:NAME — hugetlb memory file descriptor named NAME
!unknown — file descriptor with no name
!all — every file descriptor (wildcard)

allow/recvfd 💜

type — string-vec
drop — yes, remove only

Specifies a list of file descriptor names to allow for RecvFd sandboxing. 🌟

The file descriptor being received is matched, not the peer it is received from. Fr fr, that's the detail that matters. 😭

Accepts a file descriptor name, which begins with the character !:

!file — regular file, the classic
!dir — directory
!symlink — symbolic link
!magiclink — proc(5) magic symbolic link
!magicdir — proc(5) magic symbolic link to a directory
!bdev — block device
!cdev — character device
!socket — socket
!fifo — filesystem FIFO
!pipe — anonymous pipe
!notification_pipe — notification pipe
!nsfs — namespace file descriptor
!pidfd — process file descriptor
!secretmem — secret memory file descriptor
!memfd:NAME — memory file descriptor named NAME
!memfd-hugetlb:NAME — hugetlb memory file descriptor named NAME
!unknown — file descriptor with no name
!all — every file descriptor (wildcard, the "all of the above" of fds)

Other kernel objects take the name the kernel gives the object, e.g. !eventpoll for an epoll(7) file descriptor, !inotify, or !io_uring. This set is open. A name a newer kernel introduces may be used before Syd knows of it. (iconic "we'll figure it out when it happens" energy — Syd isn't gonna gatekeep your brand new fd type.)

allow/net/link

the little type table, but make it a list:

type — string-vec
drop — yes, remove only
static — yes

Specifies a list of netlink families to allow for Link network sandboxing. (not the Zelda guy. the network sandbox feature.)

Accepts a comma-delimited list of the following items: route, usersock, firewall, sock_diag, nflog, xfrm, selinux, iscsi, audit, fib_lookup, connector, netfilter, ip6_fw, dnrtmsg, kobject_uevent, generic, scsitransport, ecryptfs, rdma, crypto, and smc. Use all to specify all families. yup, the whole menu, no substitutions.

allow/uring/op

type — string-vec
drop — yes, remove only
static — yes
default — epoll_ctl, read, readv, write, writev

Specifies list of io_uring(7) submission queue operations to allow for the sandbox process using task-level io_uring(7) restrictions new in Linux-7.0. future tech era fr Any operation not in the list is denied, so by default the io_uring(7) interface cannot be used to bypass path and network sandboxing. None of the default operations can reference a path or network address, so they cannot bypass path or network sandboxing. An empty list, e.g. after allow/uring/op^, denies the io_uring(7) interface altogether. like, fully off. gone. not invited to the function.

Accepts a comma-delimited list of the following items: nop, readv, writev, fsync, read_fixed, write_fixed, poll_add, poll_remove, sync_file_range, sendmsg, recvmsg, timeout, timeout_remove, accept, async_cancel, link_timeout, connect, fallocate, openat, close, files_update, statx, read, write, fadvise, madvise, send, recv, openat2, epoll_ctl, splice, provide_buffers, remove_buffers, tee, shutdown, renameat, unlinkat, mkdirat, symlinkat, linkat, msg_ring, fsetxattr, setxattr, fgetxattr, getxattr, socket, uring_cmd, send_zc, sendmsg_zc, read_multishot, waitid, futex_wait, futex_wake, futex_waitv, fixed_fd_install, ftruncate, bind, listen, recv_zc, epoll_wait, readv_fixed, writev_fixed, pipe, nop128 and uring_cmd128. Use all to specify all operations.

Note that io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock. don't forget the linked page bestie, it's a whole thing 💅

allow/uring/reg

type — string-vec
drop — yes, remove only
static — yes
default — register_probe

Specifies list of io_uring(7) registrations to allow for the sandbox process using task-level io_uring(7) restrictions new in Linux-7.0. Any registration not in the list is denied. Registrations configure a ring rather than submit work, so on their own they cannot be used to bypass path or network sandboxing. they're setup girlies, not doers. The default allows only register_probe, a read-only capability query, because the kernel enforces register restrictions only when at least one registration is allowlisted. so we gotta name at least one, that's the trick. Four further registrations are issued without reference to a ring and thus cannot be restricted: register_send_msg_ring, register_query, register_restrictions and register_bpf_filter. They are always permitted and are not accepted here. read that twice — "always permitted" and "not accepted here", both. don't try to list 'em, they're not on the menu.

Accepts a comma-delimited list of the following items: register_buffers, unregister_buffers, register_files, unregister_files, register_eventfd, unregister_eventfd, register_files_update, register_eventfd_async, register_probe, register_personality, unregister_personality, register_enable_rings, register_files2, register_files_update2, register_buffers2, register_buffers_update, register_iowq_aff, unregister_iowq_aff, register_iowq_max_workers, register_ring_fds, unregister_ring_fds, register_pbuf_ring, unregister_pbuf_ring, register_sync_cancel, register_file_alloc_range, register_pbuf_status, register_napi, unregister_napi, register_clock, register_clone_buffers, register_zcrx_ifq, register_resize_rings, register_mem_region and register_zcrx_ctrl. Use all to specify all registrations.

Note that io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock. same warning, same page, same vibe check 🫶

allow/uring/flag

type — string-vec
drop — yes, remove only
static — yes
default — async

okay so this setting is literally the list of io_uring(7) submission queue entry flags that the sandbox process is allowed to use with the task-level io_uring(7) restrictions that are new in Linux-7.0 ✨. If a submission sets a flag that is not in this list, it gets rejected — no cap 🫶. The defaults are the set required to make PostgreSQL work under Syd, and they may change in the future 👀. These flags govern how a submission is sequenced and dispatched, not which operation it runs, so on their own they cannot be used to bypass path or network sandboxing 💅.

Accepts a comma-delimited list of the following items:

fixed_file
io_drain
io_link
io_hardlink
async
buffer_select
cqe_skip_success

Use all to specify all flags.

Also ngl: io_uring(7) may also require a nonzero RLIMIT_MEMLOCK, see rlimit/memlock.

`allow/lock/read` 🦋

type: string-set
static: yes
default: ("/dev/null", "/proc")

Specifies a set of beneath paths to grant file read access for Lock sandboxing 🔐. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_READ_FILE and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the paths "/dev/null" and "/proc" by default as Syd is included in the Landlock sandbox and Syd requires read access to these paths to function correctly 🫶.

As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

`allow/lock/write` 🌸

type: string-set
static: yes
default: ("/dev/null")

Specifies a set of beneath paths to grant file write access for Lock sandboxing ✍️. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_WRITE_FILE and only applies to the content of the directory not the directory itself. As of version 3.21.0, this set includes the path "/dev/null" by default as Syd is included in the Landlock sandbox and Syd requires write access to this file to function correctly 💖.

`allow/lock/exec` 🎀

type: string-set
static: yes

Specifies a set of beneath paths to grant file execute access for Lock sandboxing 🏃‍♀️. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_EXECUTE and only applies to the content of the directory not the directory itself.

`allow/lock/ioctl` ⚡

type: string-set
static: yes

Specifies a set of beneath paths to grant ioctl(2) access for Lock sandboxing 🎛️. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_IOCTL_DEV and only applies to the content of the directory not the directory itself. Landlock ioctl(2) support requires ABI 5 or later. Fifth Landlock ABI was introduced with Linux 6.10. On older kernels, this command is a no-op and is not going to confine ioctl(2) operations 😭.

`allow/lock/create` 🌱

type: string-set
static: yes

Specifies a set of beneath paths to grant file creation, rename and link access for Lock sandboxing 🛠️. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_REG and only applies to the content of the directory not the directory itself.

`allow/lock/delete` 💀

type: string-set
static: yes

Specifies a set of beneath paths to grant file unlink, rename and link access for Lock sandboxing 🗑️. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REMOVE_FILE and only applies to the content of the directory not the directory itself.

`allow/lock/rename` 🔁

type: string-set
static: yes

Specifies a set of beneath paths to grant access to link or rename a file from or to a different directory (i.e. reparent a file hierarchy) for Lock sandboxing 🧳. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REFER and only applies to the content of the directory not the directory itself. Landlock rename support requires ABI 2 or later. Second Landlock ABI was introduced with Linux 5.19. On older kernels, this type of access is always denied with Landlock 😤.

`allow/lock/symlink` 🪢

type: string-set
static: yes

Specifies a set of beneath paths to grant symbolic link creation, rename and link access for Lock sandboxing 🎀. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_SYM and only applies to the content of the directory not the directory itself.

`allow/lock/truncate` ✂️

type: string-set
static: yes
default: ("/dev/null")

Landlock's LANDLOCK_ACCESS_FS_TRUNCATE right is what's behind this one, and it only applies to the content of the directory — not the directory itself, bestie, read that again 💅

Landlock file truncation support needs ABI 3 or later, and the third Landlock ABI showed up with Linux 6.2. On older kernels this command is a literal no-op and it is not going to confine file truncation operations — so don't be out here thinking you're protected when you're not 😭

As of version 3.21.0, this set includes the path "/dev/null" by default, because Syd is itself included in the Landlock sandbox and Syd requires truncation access to this file to function correctly. Yes, she sandboxes herself too, iconic 👑

As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symbolic symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative, in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

🌸 `allow/lock/readdir` 🌸

type: string-set
static: yes
default: ("/proc")

Specifies a set of beneath paths to grant directory list access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_READ_DIR and — heads up, this one's different from the truncate vibe — it applies to the directory and the directories beneath it 👀

As of version 3.21.0, this set includes the directory "/proc" by default, since Syd is included in the Landlock sandbox and Syd requires readdir access to this directory to function correctly. Self-care, fr fr 🫶

🎀 `allow/lock/mkdir` 🎀

type: string-set
static: yes

Specifies a set of beneath paths to grant directory creation and rename access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_DIR and only applies to the content of the directory, not the directory itself ✨

🦋 `allow/lock/rmdir` 🦋

type: string-set
static: yes

Specifies a set of beneath paths to grant directory deletion and rename access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_REMOVE_DIR and only applies to the content of the directory, not the directory itself.

💜 `allow/lock/mkbdev` 💜

type: string-set
static: yes

Specifies a set of beneath paths to grant block device creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_BLOCK and only applies to the content of the directory, not the directory itself. Block devices, in this economy? okay 😭

🍓 `allow/lock/mkcdev` 🍓

type: string-set
static: yes

Specifies a set of beneath paths to grant character device creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_CHAR and only applies to the content of the directory, not the directory itself.

As of version 3.46.0, path must not contain magic symbolic links or parent ("..") components. Path is permitted to contain regular symbolic links. These regular symlinks are permitted to resolve to targets with parent ("..") components in them. Path may be relative, in which case it is resolved relative to the directory where Syd was executed. Noop without sandbox/lock:on.

🧚 `allow/lock/mkfifo` 🧚

type: string-set
static: yes

Specifies a set of beneath paths to grant named pipe (FIFO) creation access for Lock sandboxing. This category corresponds to the Landlock access right LANDLOCK_ACCESS_FS_MAKE_FIFO and only applies to the content of the directory, not the directory itself.

🔥 `allow/lock/bind` 🔥

type: (u16-set, string-set)
static: yes

Specifies a list of allowed bind(2) ports and UNIX domain socket paths for Lock sandboxing. This category corresponds to the landlock(7) access rights LANDLOCK_ACCESS_NET_BIND_TCP, LANDLOCK_ACCESS_NET_BIND_UDP, and LANDLOCK_ACCESS_FS_MAKE_SOCK — and that last one only applies to the content of the directory, not the directory itself, iykyk 💅

The argument is either:

a single port,
a closed range in format port1-port2,
a comma-separated list of ports and/or ranges such as 80,443,8000-9000,
or an absolute UNIX domain socket path.

landlock(7) network support requires ABI 4 or later, and the fourth landlock(7) ABI was introduced with Linux 6.7. UDP port support requires ABI 10 or later, and the tenth landlock(7) ABI was introduced with Linux 7.2 🚀

On older kernels, this command is a no-op when specified with the unsupported argument kind and does not do any network confinement. So like, check your kernel first bestie 🫶

🌈 `allow/lock/connect` 🌈

type: (u16-set, string-set)
static: yes

Specifies a list of allowed connect(2) ports and pathname UNIX domain socket paths for Lock sandboxing. This category corresponds to the landlock(7) access rights LANDLOCK_ACCESS_NET_CONNECT_TCP, LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, and LANDLOCK_ACCESS_FS_RESOLVE_UNIX — and that last one restricts both connect(2) and sendmsg(2) with an explicit recipient address to UNIX domain sockets created outside the landlock(7) domain 👀✨

The argument is either:

a single port,
a closed range in format port1-port2,
a comma-separated list of ports and/or ranges such as 80,443,8000-9000,
or an absolute UNIX domain socket path.

landlock(7) network support requires ABI 4 or later, and the fourth landlock(7) ABI was introduced with Linux 6.7. UNIX domain socket support requires ABI 9 or later, and the ninth landlock(7) ABI was introduced with Linux 7.1. UDP port support requires ABI 10 or later, and the tenth landlock(7) ABI was introduced with Linux 7.2 🌟

On older kernels, this command is a no-op when specified with the unsupported argument kind and does not do any confinement. Not her being quietly useless on your ancient kernel 💀

⭐ `warn/fs` ⭐

type: string-vec

Specifies a list of filesystem types to warn for Filesystem sandboxing. Like, a little heads-up instead of a whole lockdown, very "I'm not mad, I'm just disappointed" energy 🙈

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input — no decimal ambiguity allowed, periodt.

🎀 `warn/walk` 🎀

type: string-vec

Specifies a list of glob(3p) patterns to warn for Walk sandboxing. Patterns, bestie — so you can be as fancy with the matching as you like ✨

`warn/list`

type: string-vec

bestie this one's your little lookout list — a list of glob(3p) patterns to warn for List sandboxing 👀 nothing gets blocked, it just goes "hey girl, eyes up" ✨

`warn/stat`

type: string-vec

a list of glob(3p) patterns to warn for Stat sandboxing 🎀 so when something goes poking at file metadata, you hear about it, no cap 💅

`warn/read`

type: string-vec

a list of glob(3p) patterns to warn for Read sandboxing 📖 lowkey the "why is this thing reading my diary" alarm 🫶

`warn/write`

type: string-vec

a list of glob(3p) patterns to warn for Write sandboxing ✍️ somebody's about to touch your files? not me finding out from the group chat — you'll get a warning 🌸

`warn/exec`

type: string-vec

a list of glob(3p) patterns to warn for Exec sandboxing 🔥 your "who tf just ran that" list, but make it a heads-up instead of a block 😭

`warn/create`

type: string-vec

a list of glob(3p) patterns to warn for Create sandboxing 🎀 new files appearing out of nowhere? iconic, but you're gonna hear about it first ✨

`warn/delete`

type: string-vec

a list of glob(3p) patterns to warn for Delete sandboxing 💀 the "bestie something is about to be GONE" list, honestly terrifying, love that for us 🙈

`warn/rename`

type: string-vec

a list of glob(3p) patterns to warn for Rename sandboxing 🦋 moving things around? sure, but don't think you're doing it in silence 👑

`warn/readlink`

type: string-vec

a list of glob(3p) patterns to warn for Readlink sandboxing 🔗 for when someone's following the symlink breadcrumbs and you'd like a lil notification 🌸

`warn/symlink`

type: string-vec

a list of glob(3p) patterns to warn for Symlink sandboxing 🧚 pointing one thing at another — cute! — but you're gonna know ✨

`warn/truncate`

type: string-vec

a list of glob(3p) patterns to warn for Truncate sandboxing ✂️ file's about to get chopped, and you get a warning BEFORE the yassification of your data into nothing 😭

`warn/chdir`

type: string-vec

a list of glob(3p) patterns to warn for Chdir sandboxing 🚪 someone's walking through directories — main character energy, but you get the play-by-play 🫶

`warn/readdir`

type: string-vec

a list of glob(3p) patterns to warn for Readdir sandboxing 📂 they're scrolling through your directory like it's a feed, and you get told 💅

`warn/mkdir`

type: string-vec

a list of glob(3p) patterns to warn for Mkdir sandboxing 🎀 new folder, who dis — and yes you get a warning for it, periodt ⭐

`warn/rmdir`

type: string-vec

a list of glob(3p) patterns to warn for Rmdir sandboxing 🗑️ folder's about to vanish into the void and you're getting the heads-up fr fr 😭

`warn/chown`

type: string-vec

a list of glob(3p) patterns to warn for Chown sandboxing 👑 ownership changes are a big deal, so yeah, you're on the notify list 💜

`warn/chgrp`

type: string-vec

a list of glob(3p) patterns to warn for Chgrp sandboxing 🫶 group changes get a warning too — everybody eats, everybody knows 🌈

`warn/chmod`

type: string-vec

a list of glob(3p) patterns to warn for Chmod sandboxing 🔐 permissions getting flipped around? bestie you're getting a warning, that's the whole vibe ✨

`warn/chattr`

type: string-vec

a list of glob(3p) patterns to warn for Chattr sandboxing 🦋 attribute changes are sneaky little things, so this one keeps you in the loop 💅

`warn/chroot`

type: string-vec

a list of glob(3p) patterns to warn for Chroot sandboxing 🧚 somebody's changing their whole root reality — very main character of them, and you get to watch 👀

`warn/notify`

type: string-vec

a list of glob(3p) patterns to warn for Notify sandboxing 🔔 warnings about warnings, we love a meta queen ✨

`warn/utime`

type: string-vec

a list of glob(3p) patterns to warn for Utime sandboxing ⏰ timestamps being rewritten? that's literally editing history, so yes, it's on the warn list 💀

`warn/mkdev`

type: string-vec

a list of glob(3p) patterns to warn for Mkdev sandboxing 🎀 device nodes popping into existence is a whole moment, and you're getting a warning for it 🌸

`warn/mkfifo`

type: string-vec

a list of glob(3p) patterns to warn for Mkfifo sandboxing 🥤 a named pipe got made — communication era — and you get a warning, iykyk 🫶

`warn/mktemp`

type: string-vec

a list of glob(3p) patterns to warn for Mktemp sandboxing 🍓 temp files are supposed to be lowkey! but you're still getting a warning about them, no cap ✨

`warn/net/bind`

type: string-vec

a list of network address patterns to warn for Bind network sandboxing 🌐 this isn't globs, bestie, it's addresses — someone's grabbing a port, and you hear about it 📡

`warn/net/accept`

type: string-vec

a list of network address patterns to warn for Accept network sandboxing 🫶 incoming connections get the warning treatment — you're not being left on read 💅

`warn/net/connect`

type: string-vec

a list of network address patterns to warn for Connect network sandboxing 🔥 outbound connections, warned. it's giving "I know where you're going" 👀

`warn/sendfd`

type: string-vec

a list of file descriptor names to warn for SendFd sandboxing 📤 note the vibe shift: these are file descriptor names, not globs, not addresses — descriptors, bestie 🎀

`warn/recvfd`

type: string-vec

a list of file descriptor names to warn for RecvFd sandboxing 📥 same deal, receiving side — file descriptor names get the warning treatment ✨

okay now we flip the whole energy 😌 these next ones aren't warnings, they're denies — actual "no ma'am" energy. and heads up: every single one of them is tagged:

drop: yes, add only

which means it drops stuff, and it's add-only, so this is a one-way street, bestie 💅

`deny/fs`

type: string-vec
drop: yes, add only

a list of filesystem types to deny for Filesystem sandboxing 🚫🗂️

and this one's got extra rules, so pay attention: it accepts a comma-delimited list of strings and unsigned 64-bit integers as argument 🧮 prefix with 0x for hexadecimal and 0o for octal input, periodt ✨

`deny/walk`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Walk sandboxing 🚶♀️🚫 no strolling through there, thank you 💅

`deny/list`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for List sandboxing 📂🚫 the window shopping is cancelled 😭

`deny/stat`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Stat sandboxing 🚫 nobody's checking that metadata on your watch, no cap 🎀

`deny/read`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Read sandboxing 📖🚫 eyes off, bestie, this one's off-limits 🫶

`deny/write`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Write sandboxing ✍️🚫 not a single pen touch, absolutely not 🔥

`deny/exec`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Exec sandboxing 🚫⚡ these do not run. full stop. periodt 💀

`deny/create`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Create sandboxing 🎀🚫 no new files here, the vibes are closed for business 🌸

`deny/delete`

type: string-vec
drop: yes, add only

a list of glob(3p) patterns to deny for Delete sandboxing 🗑️🚫 nothing gets yeeted from these paths, not on your watch 👑

`deny/rename`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Rename sandboxing. bestie said no renaming and honestly? she meant it 💅

`deny/readlink`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Readlink sandboxing. no peeking behind the curtain, the curtain said no ✨

`deny/symlink`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Symlink sandboxing. no making new little shortcuts to places, periodt 🎀

`deny/truncate`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Truncate sandboxing. not the file getting chopped down to nothing, we're not doing that today 😭

`deny/chdir`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chdir sandboxing. you're not walking into that directory, the vibes are off in there 🚪

`deny/readdir`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Readdir sandboxing. no listing, no scrolling the folder like it's a feed, we stay ignorant 🙈

`deny/mkdir`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Mkdir sandboxing. no new little folders being born in there, we are not hosting a gender reveal 💀

`deny/rmdir`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Rmdir sandboxing. nobody's deleting anybody's home directory on my watch 🫶

`deny/chown`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chown sandboxing. hands off, that file belongs to who it belongs to 👑

`deny/chgrp`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chgrp sandboxing. same energy as deny/chown but for the group chat membership, and the group chat is not accepting new members 🌸

`deny/chmod`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chmod sandboxing. nobody is out here changing permissions, that's giving chaos and we're giving peace ✌️

`deny/chattr`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chattr sandboxing. no little attribute tweaks, no sneaky glue, no notes in the margins 🦋

`deny/chroot`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Chroot sandboxing. you're not redefining what "root" means today, that's main character energy and it's not your turn 🔥

`deny/notify`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Notify sandboxing. no watch parties, no notifs, we left that on read ⭐

`deny/utime`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Utime sandboxing. timestamps stay exactly as they are, stop trying to make it look freshly posted 💜

`deny/mkdev`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Mkdev sandboxing. no new device nodes, we have device nodes at home 🌈

`deny/mkfifo`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Mkfifo sandboxing. no pipes, no passing messages through the wall, the wall said not today 🧚

`deny/mktemp`

type: string-vec
drop: yes, add only

Specifies a list of glob(3p) patterns to deny for Mktemp sandboxing. no spontaneous temp file situations, we are not doing that much admin 💅

`deny/net/bind`

type: string-vec
drop: yes, add only

Specifies a list of network address patterns to deny for Bind network sandboxing. note the glow-up: these are network address patterns, not glob(3p) ones — read the spec right bestie, iykyk 📡

`deny/net/accept`

type: string-vec
drop: yes, add only

Specifies a list of network address patterns to deny for Accept network sandboxing. she's not accepting new connections, her DMs are closed 🎀

`deny/net/connect`

type: string-vec
drop: yes, add only

Specifies a list of network address patterns to deny for Connect network sandboxing. no reaching out, no "hey stranger", the connection dies in the drafts 💀

`deny/sendfd`

type: string-vec
drop: yes, add only

Specifies a list of file descriptor names to deny for SendFd sandboxing. this one's file descriptor names, not patterns, okay? don't mix the two up 👀

`deny/recvfd`

type: string-vec
drop: yes, add only

Specifies a list of file descriptor names to deny for RecvFd sandboxing. you're not receiving that package, no tracking number for you 📦

`filter/fs`

type: string-vec

Specifies a list of filesystem types to filter for Filesystem sandboxing.

Accepts a comma-delimited list of strings and unsigned 64-bit integers as argument. Prefix with 0x for hexadecimal and 0o for octal input. yes the different prefixes are real and yes they matter, type them exactly 🙏

quick note: this one's table has no drop row — only type is listed for filter/fs. lowkey important, don't assume 💖

`filter/walk`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Walk sandboxing. she's walking but she's filtering, it's giving curated stroll 🌸

`filter/list`

type: string-vec

Specifies a list of glob(3p) patterns to filter for List sandboxing. not a full list, a filtered list, the difference is the whole point bestie ✨

`filter/stat`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Stat sandboxing. you get stats for what you're allowed to get stats for, that's the deal 🦋

`filter/read`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Read sandboxing. some pages are available, the rest are simply not, and that's the plot 🍓

`filter/write`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Write sandboxing. yes you can write, no you can't write everywhere, read the room 🫶

`filter/exec`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Exec sandboxing. not every binary gets to be the main character today 🎬

`filter/create`

type: string-vec

Specifies a list of glob(3p) patterns to filter for Create sandboxing. creation is allowed, but it's an invite-only kind of creation, no cap 👑

`filter/delete` 🗑️

type: string-vec

Specifies a list of glob(3p) patterns to filter for Delete sandboxing.

`filter/rename` ✏️

type: string-vec

Specifies a list of glob(3p) patterns to filter for Rename sandboxing.

`filter/readlink` 🔗

type: string-vec

Specifies a list of glob(3p) patterns to filter for Readlink sandboxing.

`filter/symlink` 🪢

type: string-vec

Specifies a list of glob(3p) patterns to filter for Symlink sandboxing.

`filter/truncate` ✂️

type: string-vec

Specifies a list of glob(3p) patterns to filter for Truncate sandboxing.

`filter/chdir` 📂

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chdir sandboxing.

`filter/readdir` 📖

type: string-vec

Specifies a list of glob(3p) patterns to filter for Readdir sandboxing.

`filter/mkdir` 🆕

type: string-vec

Specifies a list of glob(3p) patterns to filter for Mkdir sandboxing.

`filter/rmdir` 🧹

type: string-vec

Specifies a list of glob(3p) patterns to filter for Rmdir sandboxing.

`filter/chown` 👑

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chown sandboxing.

`filter/chgrp` 👥

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chgrp sandboxing.

`filter/chmod` 🔐

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chmod sandboxing.

`filter/chattr` 🏷️

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chattr sandboxing.

`filter/chroot` 🏰

type: string-vec

Specifies a list of glob(3p) patterns to filter for Chroot sandboxing.

`filter/notify` 🔔

type: string-vec

Specifies a list of glob(3p) patterns to filter for Notify sandboxing.

`filter/utime` ⏰

type: string-vec

Specifies a list of glob(3p) patterns to filter for Utime sandboxing.

`filter/mkdev` 🎛️

type: string-vec

Specifies a list of glob(3p) patterns to filter for Mkdev sandboxing.

`filter/mkfifo` 🥤

type: string-vec

Specifies a list of glob(3p) patterns to filter for Mkfifo sandboxing.

`filter/mktemp` 🎲

type: string-vec

Specifies a list of glob(3p) patterns to filter for Mktemp sandboxing.

`filter/net/bind` 🪢

type: string-vec

Specifies a list of network address patterns to filter for Bind network sandboxing.

`filter/net/accept` 📥

type: string-vec

Specifies a list of network address patterns to filter for Accept network sandboxing.

`filter/net/connect` 📤

type: string-vec

Specifies a list of network address patterns to filter for Connect network sandboxing.

`filter/sendfd` 🫱

type: string-vec

Specifies a list of file descriptor names to filter for SendFd sandboxing.

`filter/recvfd` 🫲

type: string-vec

Specifies a list of file descriptor names to filter for RecvFd sandboxing.

okay and now the panic list 💀🔥 — same energy, but these are the "actually no, abort" ones, and heads up: they all have a drop of literally yes, add only, meaning it's add-only vibes.