SYD-RING(1)                 General Commands Manual                SYD-RING(1)

NAME
       syd-ring - Run a program under io_uring(7) restrictions

SYNOPSIS
       syd-ring [-hvV] [-o op[,op...]]... [-f flag[,flag...]]... {command
       [args...]}

DESCRIPTION
       syd-ring runs a program under io_uring(7) task-level restrictions,
       which require Linux-7.0 or newer. Without such a restriction,
       io_uring(7) can bypass path and network sandboxing because it performs
       operations from kernel worker threads that seccomp(2) cannot observe.
       The restriction is an allowlist enforced by Linux. Only the submission
       queue operations and entry flags that are explicitly permitted may be
       issued, and it applies to calling task and any program it executes
       into.

       Operations are allowed with -o and submission flags with -f, each
       taking a comma separated list of names and repeatable. With no -o or -f
       option allowlist defaults to operations epoll_ctl, read, readv, write,
       and writev and the flag async. Once an operation is given with -o the
       allowlist is built from an empty set instead. Names may be enumerated
       with -o list and -f list. Refer to Uring Sandboxing section of syd(7)
       manual page for more information.

OPTIONS

       -h                  Display help.
       -v                  Be verbose. Print io_uring(7) restriction status to
                           stderr(3) before running the program.
       -V                  Check for io_uring(7) task-level restriction
                           support in Linux.
       -o op[,op...]       Allow submission queue operations, may be repeated.
                           Use -o list to print the list of known operations.
       -f flag[,flag...]   Allow submission queue entry flags, may be
                           repeated.
                           Use -f list to print the list of known flags.


HISTORY
       o   Task-level io_uring(7) restrictions were introduced with Linux-7.0.

       Refer to following links for more information:

       o   https://git.kernel.org/stable/c/ed82f35b926b2e505c14b7006473614b8f58b4f4

EXIT STATUS
       o   syd-ring exits with the same code as the child process.
       o   syd-ring exits with 22 (EINVAL: "Invalid argument") for invalid CLI
           arguments.

       syd-ring -V exits with one of the following exit codes based on support
       for task-level io_uring(7) restrictions:

       0     Supported.
       127   Not supported.


SEE ALSO
       io_uring(7), syd(1), syd(2), syd(5), syd(7), syd-lock(1), syd-mdwe(1),
       syd-ofd(1), syd-pds(1), syd-sec(1), syd-tsc(1)

       syd homepage: https://sydbox.exherbo.org/

AUTHORS
       Maintained by Ali Polatel. Up-to-date sources can be found at
       https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at
       rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to
       https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox
       on Libera Chat or in #sydbox:mailstation.de on Matrix.

                                  2026-08-10                       SYD-RING(1)