.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-TOR" "1" "2026\-07\-12"
.PP
.SH NAME
.PP
\fBsyd\-tor\fR \- SOCKS Proxy Forwarder
.PP
.SH SYNOPSIS
.PP
\fBsyd\-tor\fR \fI[\-dh]\fR \fI\-i <socket\-fd>\fR \fI[\-o addr:port]\fR \fI[\-u unix\-sock]\fR
.PP
.SH DESCRIPTION
.PP
Receives listening socket from fd and forwards traffic to addr:port or
UNIX socket.\&
.PP
External address must either be an IPv4, or an IPv6 address or path to a
UNIX domain socket, defaults to \fB127.\&0.\&0.\&1:9050\fR.\&
.PP
.SH OPTIONS
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB\-h\fR
T}	T{
Display help.\&
T}
T{
\fB\-d\fR
T}	T{
Run in debug mode without confinement.\&
T}
T{
\fB\-i\fR \fBsocket\-fd\fR
T}	T{
Socket file descriptor to receive listening socket from.\&
T}
T{
\fB\-o\fR \fBext\-addr\fR
T}	T{
Specify external address to forward traffic to.\&
T}
T{

T}	T{
Address may be an IPv4/IPv6 address in format "addr:port".\&
T}
T{

T}	T{
Defaults to "127.\&0.\&0.\&1:9050".\&
T}
T{
\fB\-u\fR \fBunix\-sock\fR
T}	T{
Specify UNIX domain socket to forward traffic to.\&
T}
T{

T}	T{
This option has precedence over \fB\-o\fR.\&
T}
.TE
.sp 1
.SH USAGE
.PP
\fIsyd\-tor\fR(1) is not meant to be used as a standalone tool.\& Syd invokes
\fIsyd\-tor\fR(1) at startup when Proxy sandboxing is set to on with
"sandbox/proxy:on".\& See PROXY SANDBOXING section in \fIsyd\fR(7) manual page
for more information.\& If you want to use \fIsyd\-tor\fR(1) in your own
project, create a UNIX socket\-pair, enter a network namespace, bring up
loopback device, \fIbind\fR(2) a socket to a port on it and then send this
socket file descriptor through write end of socket\-pair with
\fIsendmsg\fR(2) \fBSCM_RIGHTS\fR option.\& Finally pass read end of the
socket\-pair to \fIsyd\-tor\fR(1) with "\-i <socket\-fd>" argument.\&
.PP
.SH IMPLEMENTATION
.PP
\fIsyd\-tor\fR(1) is designed for performance, security, and privacy, using
edge\-triggered \fIepoll\fR(7) for event notification and fully asynchronous
operations to handle multiple connections without blocking.\& It transfers data
with zero\-copy \fIsplice\fR(2), moving bytes directly between file descriptors
within kernel without exposing plaintext in user space.\& Two pairs of pipes
carry bidirectional traffic between client and external address.\&
Execution environment is confined with \fIseccomp\fR(2) and \fIlandlock\fR(7),
restricting system calls and file access to minimum required.\& Compared to
socksns, which uses Tokio runtime for asynchronous I/O, \fIsyd\-tor\fR(1) relies
on kernel\-level primitives for efficiency and confinement.\&
.PP
.SH SECURITY
.PP
\fIsyd\-tor\fR(1) applies multiple confinement layers to mitigate risks
associated with running outside Syd sandbox, preventing potential
Meddler\-in\-the\-Middle (MITM) attacks against containers.\& Linux
\fIcapabilities\fR(7) are dropped early and no\-new\-privs attribute is set so
no unwanted capability leaks into the process.\& Resource limits
\fBRLIMIT_FSIZE\fR, \fBRLIMIT_NPROC\fR, \fBRLIMIT_LOCKS\fR, \fBRLIMIT_MEMLOCK\fR, and
\fBRLIMIT_MSGQUEUE\fR are set to zero to prevent file/process/lock/msgqueue
creation inside main loop.\& \fIseccomp\fR(2) filters are carefully configured
to allow only required syscalls.\& \fIsocket\fR(2) syscall is limited to a
single domain, type, and protocol, while \fIconnect\fR(2) is restricted to a
single memory address, preventing unauthorized network connections.\&
\fIsigaction\fR(2), and \fIrt_sigaction\fR(2) system calls are not permitted to
install new signal handlers.\& \fIpipe2\fR(2), \fIsocket\fR(2), \fIconnect\fR(2),
\fIaccept4\fR(2), and \fIshutdown\fR(2) system calls are protected by syscall
argument cookies determined randomly using \fIgetrandom\fR(2) with
GRND_RANDOM at startup.\& Refer to \fBSyscall Argument Cookies\fR section of
\fIsyd\fR(7) manual page for more information on argument cookies.\& These
mitigations are most effective on 64\-bit architectures, but on 32\-bit
systems \fIsocketcall\fR(2) interface may be exploited.\& Therefore,
additional protective measures are implemented.\& On Linux 6.\&10 and later,
memory area containing external network address is sealed using
\fImseal\fR(2) and surrounding memory is protected with guard pages to
prevent overflow or adjacent corruption.\& Executable memory is also
disallowed to prevent code injection attacks.\& If available,
\fIlandlock\fR(7) and \fInamespaces\fR(7) impose further restrictions by
disallowing all filesystem access, thereby providing an extra layer of
security.\& Binary is also re\-executed from a sealed \fImemfd_create\fR(2)
file descriptor to guard against CVE\-2019\-5736.\& Together, these
techniques ensure that even if \fIsyd\-tor\fR(1) is compromised, scope of
malicious actions is significantly limited, maintaining overall
integrity and security of the system.\&
.PP
.SH ENVIRONMENT
.PP
.TS
l lx
l lx
l lx.
T{
\fBSYD_TOR_DEBUG\fR
T}	T{
Run in debug mode without confinement, equivalent to "\-d" option.\&
T}
T{

T}	T{
This is ignored unless Syd is built with \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_TOR_RULES\fR
T}	T{
Print seccomp rules in human\-readable format to standard error at startup.\&
T}
.TE
.sp 1
.SH CAVEATS
.PP
\fIsyd\-tor\fR(1) process runs as a single process and can potentially hit
file descriptor (FD) limits due to number of FDs it opens per
connection.\& Each client connection involves six FDs: one for client
socket, one for external socket, and four for pipes used for
bidirectional data transfer (two pipes with an input and output FD
each).\& To mitigate this, \fIsyd\-tor\fR(1) sets file\-max limit to the hard
limit by overriding the soft limit at startup.\& However, in some cases,
this may not be sufficient, and manual adjustment of FD limits may be
necessary.\&
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(7)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&