SYD-LOCK(1) General Commands Manual SYD-LOCK(1)

syd-lock - Run a command under Landlock

syd-lock [-hvAV] [-r path]... [-w path]... [-b port]... [-c port]... {command [args...]}

The syd-lock utility runs a command under Landlock. Read-only and read-write paths should be specified using the -r and -w parameters. Path arguments must be fully-qualified, relative paths are not permitted. bind(2) and connect(2) ports may be specified using the -b and -c parameters. Argument is either a single port or a closed range in format port1-port2. Use -V option to check for Landlock support. The specific support level may be determined by the exit code. Use -A option to check for Landlock ABI version.

-h Display help.
-v Be verbose. Print Landlock status to standard error before running the specified command.
-A Print ABI version on standard output and exit with ABI version as exit code, rather than running a command. Use for scripting.
-V Check if Landlock is supported and print ABI version, rather than running a command.
-r path Specify a read-only path, may be repeated. In this context, read-only includes execute operations.
-w path Specify a read-write path, may be repeated. In this context, read-write includes execute and ioctl(2) operations.
-b port Specify a port for bind(2), may be repeated. Argument is either a single port or a closed range in format port1-port2.
-c port Specify a port for connect(2), may be repeated. Argument is either a single port or a closed range in format port1-port2.

When running a command, syd-lock exits with the same exit code as the command.

When running in check mode with -A, syd exits with ABI version as exit code.

When running in check mode with -V, syd may exit with the following exit codes:

0 Fully enforced
1 Partially enforced
2 Not enforced
127 Not supported

Landlock ABI versioning makes it possible to adjust the security policy according to the kernel capabilities.

1.
First Landlock ABI, introduced with Linux 5.13: https://git.kernel.org/stable/c/17ae69aba89dbfa2139b7f8024b757ab3cc42f59
2.
Second Landlock ABI, introduced with Linux 5.19: https://git.kernel.org/stable/c/cb44e4f061e16be65b8a16505e121490c66d30d0
3.
Third Landlock ABI, introduced with Linux 6.2: https://git.kernel.org/stable/c/299e2b1967578b1442128ba8b3e86ed3427d3651
4.
Fourth Landlock ABI, introduced with Linux 6.7: https://git.kernel.org/stable/c/136cc1e1f5be75f57f1e0404b94ee1c8792cb07d
5.
Fifth Landlock ABI, introduced with Linux 6.10: https://git.kernel.org/stable/c/2fc0e7892c10734c1b7c613ef04836d57d4676d5
6.
Sixth Landlock ABI, introduced with Linux 6.12.

alip@syd:~|⇒  syd-lock wget -O/dev/null chesswob.org
alip@syd:~|⇒  syd-lock -r/ wget -O/dev/null chesswob.org
/dev/null: Permission denied
alip@syd:~|⇒  syd-lock -r/ -w/dev/null wget -O/dev/null chesswob.org
--2024-11-30 16:52:51--  http://chesswob.org/
Resolving chesswob.org... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to chesswob.org|95.216.39.164|:80... failed: Permission denied.
Connecting to chesswob.org|fe80::468a:5bff:fe88:2141|:80... failed: Permission denied.
Retrying.
^C
alip@syd:~|⇒  syd-lock -r/ -w/dev/null -c80 -c443 wget -O/dev/null chesswob.org
--2024-11-30 16:53:00--  http://chesswob.org/
Resolving chesswob.org... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to chesswob.org|95.216.39.164|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://www.chesswob.org/ [following]
--2024-11-30 16:53:00--  https://www.chesswob.org/
Resolving www.chesswob.org... 95.216.39.164, fe80::468a:5bff:fe88:2141
Connecting to www.chesswob.org|95.216.39.164|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 148827 (145K) [text/html]
Saving to: ‘/dev/null’
/dev/null 100%[========================================================================================>] 145.34K  --.-KB/s    in 0.1s
2024-11-30 16:53:00 (1.04 MB/s) - ‘/dev/null’ saved [148827/148827]
alip@syd:~|⇒

syd(1), syd(2), syd(5), syd-pds(1)

syd homepage: https://sydbox.exherbolinux.org/

LandLock homepage: https://landlock.io/

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat.

2025-02-14