.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-RING" "1" "2026\-08\-10"
.PP
.SH NAME
.PP
\fBsyd\-ring\fR \- Run a program under \fIio_uring\fR(7) restrictions
.PP
.SH SYNOPSIS
.PP
\fBsyd\-ring\fR \fI[\-hvV]\fR \fI[\-o op[,op.\&.\&.\&]].\&.\&.\&\fR \fI[\-f flag[,flag.\&.\&.\&]].\&.\&.\&\fR \fI{command [args.\&.\&.\&]}\fR
.PP
.SH DESCRIPTION
.PP
\fBsyd\-ring\fR runs a program under \fIio_uring\fR(7) task\-level restrictions,
which require Linux\-7.\&0 or newer.\& Without such a restriction,
\fIio_uring\fR(7) can bypass path and network sandboxing because it performs
operations from kernel worker threads that \fIseccomp\fR(2) cannot observe.\&
The restriction is an allowlist enforced by Linux.\& Only the submission
queue operations and entry flags that are explicitly permitted may be
issued, and it applies to calling task and any program it executes into.\&
.PP
Operations are allowed with \fI\-o\fR and submission flags with \fI\-f\fR, each
taking a comma separated list of names and repeatable.\& With no \fI\-o\fR or
\fI\-f\fR option allowlist defaults to operations \fIepoll_ctl\fR, \fIread\fR,
\fIreadv\fR, \fIwrite\fR, and \fIwritev\fR and the flag \fIasync\fR.\& Once an operation
is given with \fI\-o\fR the allowlist is built from an empty set instead.\&
Names may be enumerated with \fI\-o list\fR and \fI\-f list\fR.\& Refer to \fBUring
Sandboxing\fR section of \fIsyd\fR(7) manual page for more information.\&
.PP
.SH OPTIONS
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB\-h\fR
T}	T{
Display help.\&
T}
T{
\fB\-v\fR
T}	T{
Be verbose.\& Print \fIio_uring\fR(7) restriction status to \fIstderr\fR(3) before running the program.\&
T}
T{
\fB\-V\fR
T}	T{
Check for \fIio_uring\fR(7) task\-level restriction support in Linux.\&
T}
T{
\fB\-o\fR \fIop[,op.\&.\&.\&]\fR
T}	T{
Allow submission queue operations, may be repeated.\&
T}
T{

T}	T{
Use \fI\-o list\fR to print the list of known operations.\&
T}
T{
\fB\-f\fR \fIflag[,flag.\&.\&.\&]\fR
T}	T{
Allow submission queue entry flags, may be repeated.\&
T}
T{

T}	T{
Use \fI\-f list\fR to print the list of known flags.\&
T}
.TE
.sp 1
.SH HISTORY
.PP
.PD 0
.IP \(bu 4
Task\-level \fIio_uring\fR(7) restrictions were introduced with Linux\-7.\&0.\&
.PD
.PP
Refer to following links for more information:
.PP
.PD 0
.IP \(bu 4
https://git.\&kernel.\&org/stable/c/ed82f35b926b2e505c14b7006473614b8f58b4f4
.PD
.PP
.SH EXIT STATUS
.PP
.PD 0
.IP \(bu 4
\fBsyd\-ring\fR exits with the same code as the child process.\&
.IP \(bu 4
\fBsyd\-ring\fR exits with \fB22\fR (EINVAL: "Invalid argument") for invalid CLI arguments.\&
.PD
.PP
\fBsyd\-ring \-V\fR exits with one of the following exit codes based on
support for task\-level \fIio_uring\fR(7) restrictions:
.PP
.TS
l lx
l lx.
T{
\fB0\fR
T}	T{
Supported.\&
T}
T{
\fB127\fR
T}	T{
Not supported.\&
T}
.TE
.sp 1
.SH SEE ALSO
.PP
\fIio_uring\fR(7), \fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\fR(7), \fIsyd\-lock\fR(1),
\fIsyd\-mdwe\fR(1), \fIsyd\-ofd\fR(1), \fIsyd\-pds\fR(1), \fIsyd\-sec\fR(1), \fIsyd\-tsc\fR(1)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&