.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-SEC" "1" "2026\-07\-12"
.PP
.SH NAME
.PP
\fBsyd\-sec\fR \- Print secure bits or run command with secure bits set
.PP
.SH SYNOPSIS
.PP
\fBsyd\-sec\fR \fI[\-ahikprsxAIKPRSX]\fR \fI{command [args.\&.\&.\&]}\fR
.PP
.SH DESCRIPTION
.PP
Given no arguments, print information on process secure bits in compact JSON.\&
.PP
Given no command, one or more of the secure bit options \fI[\-aikprsx]\fR may
be given to test for secure bits.\& Use capital letter options,
\fI[\-AIKPRSX]\fR, to test for locked versions of respective secure bits.\&
.PP
Given a command and arguments, with at least one of the secure bit
options \fI[\-aikprsxAIKRSX]\fR set the specified securebits, execute the
command and exit with the same status.\&
.PP
.SH OPTIONS
.PP
.TS
l lx.
T{
\fB\-h\fR
T}	T{
Display help and exit.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-p, \-P\fR
T}	T{
Set/test process no_new_privs attribute.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-r, \-R\fR
T}	T{
Set/test secure bit SECBIT_NOROOT.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-s, \-S\fR
T}	T{
Set/test secure bit SECBIT_NO_SETUID_FIXUP.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-k, \-K\fR
T}	T{
Set/test secure bit SECBIT_KEEP_CAPS.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-a, \-A\fR
T}	T{
Set/test secure bit SECBIT_NO_CAP_AMBIENT_RAISE.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-x, \-X\fR
T}	T{
Set/test secure bit SECBIT_EXEC_RESTRICT_FILE.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fB\-i, \-I\fR
T}	T{
Set/test secure bit SECBIT_EXEC_DENY_INTERACTIVE.\&
T}
.TE
.sp 1
.SH SECURE BITS
.PP
.TS
allbox;lx lx lx
lx lx lx
lx lx lx
lx lx lx
lx lx lx
lx lx lx
lx lx lx
lx lx lx.
T{
\fBSecurebit\fR
T}	T{
\fBDescription\fR
T}	T{
\fBCAP_SETPCAP required?\&\fR
T}
T{
NO_NEW_PRIVS
T}	T{
When set, \fIexecve\fR(2) will not grant new privileges (e.\&g.\&, set\-user\-ID/set\-group\-ID mode bits and file capabilities are ignored).\& Inherited across \fIfork\fR(2), \fIclone\fR(2), and \fIexecve\fR(2); once set, cannot be unset.\&
T}	T{
No
T}
T{
NOROOT
T}	T{
Disable special handling of UID 0 for gaining capabilities on exec/setuid.\& NOROOT_LOCKED is lock for NOROOT (prevents further changes; irreversible).\&
T}	T{
Yes
T}
T{
NO_SETUID_FIXUP
T}	T{
Stop kernel adjustments to permitted/effective/ambient capability sets when effective/filesystem UIDs toggle between 0 and nonzero.\& NO_SETUID_FIXUP_LOCKED is lock for NO_SETUID_FIXUP (prevents further changes; irreversible).\&
T}	T{
Yes
T}
T{
KEEP_CAPS
T}	T{
Allow retaining permitted capabilities when switching all UIDs from 0 to nonzero; always cleared on \fIexecve\fR(2).\& KEEP_CAPS_LOCKED is lock for KEEP_CAPS (prevents further changes; irreversible).\&
T}	T{
Yes
T}
T{
NO_CAP_AMBIENT_RAISE
T}	T{
Disallow raising ambient capabilities via \fIprctl(PR_CAP_AMBIENT_RAISE)\fR.\& NO_CAP_AMBIENT_RAISE_LOCKED is lock for NO_CAP_AMBIENT_RAISE (prevents further changes; irreversible).\&
T}	T{
Yes
T}
T{
EXEC_RESTRICT_FILE
T}	T{
Interpreter/dynamic linker should execute a file only if \fIexecveat\fR(2) with AT_EXECVE_CHECK on the related file descriptor succeeds.\& EXEC_RESTRICT_FILE_LOCKED is lock for EXEC_RESTRICT_FILE (prevents further changes; irreversible).\&
T}	T{
No
T}
T{
EXEC_DENY_INTERACTIVE
T}	T{
Interpreter should not accept interactive user commands; content via a file descriptor is allowed only if \fIexecveat\fR(2) with AT_EXECVE_CHECK succeeds.\& EXEC_DENY_INTERACTIVE_LOCKED is lock for EXEC_DENY_INTERACTIVE (prevents further changes; irreversible).\&
T}	T{
No
T}
.TE
.sp 1
.SH EXIT STATUS
.PP
When querying secure bits, \fBsyd\-sec\fR exits with success if all the
specified secure bits are set in process secure bits.\& When running a
command, \fBsyd\-sec\fR exits with the same code as the child process.\& If
\fIPR_SET_SECUREBITS\fR(2const) \fIprctl\fR(2) operation fails prior to command
execution, \fBsyd\-sec\fR exits with \fIerrno\fR(3).\&
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\-lock\fR(1), \fIsyd\-mdwe\fR(1),
\fIsyd\-ofd\fR(1), \fIsyd\-pds\fR(1), \fIsyd\-tsc\fR(1), \fIPR_GET_SECUREBITS\fR(2const),
\fIPR_SET_SECUREBITS\fR(2const)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&