.\" Generated by scdoc 1.11.4
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD" "1" "2026-06-14"
.PP
.SH NAME
.PP
\fBsyd\fR - Rock solid application kernel
.PP
.SH SYNOPSIS
.PP
\fBsyd\fR [-acefhlmpqtxEPV] [--] {command [arg.\&.\&.\&]}
.PP
\fBsyd\fR --api
.PP
\fBsyd\fR --check
.PP
\fBsyd\fR --el
.PP
\fBsyd\fR --sh
.PP
argv[0]=\fBsyd-pty\fR \fIsyd-pty\fR(1)
.PP
argv[0]=\fBsyd-tor\fR \fIsyd-tor\fR(1)
.PP
.SH DESCRIPTION
.PP
Syd is a utility that uses the \fIseccomp\fR(2) system call to sandbox
processes on Linux systems version 5.\&19 or later.\& It enables per-syscall
control over a process'\&s filesystem and network access \fIwithout
requiring root privileges\fR.\& Syd is designed for ease of use across a
wide array of architectures, including \fBx86\fR, \fBx86_64\fR, \fBx32\fR, \fBarmv7\fR,
\fBaarch64\fR, \fBloongarch64\fR, \fBmips\fR, \fBmips64\fR, \fBmips64el\fR, \fBppc\fR, \fBppc64\fR,
\fBppc64le\fR, \fBriscv64\fR, and \fBs390x\fR embodying the principle of providing
simple, flexible, and reliable access control to Linux users.\&
.PP
The core functionality of Syd revolves around restricting a process'\&s
resource access through several mechanisms:
.PP
.PD 0
.IP \(bu 4
\fBBind Mounts\fR: Utilized within a mount namespace to enforce restrictions at 
the \fBVirtual File System (VFS)\fR level, such as \fBread-only\fR, \fBnodev\fR, \fBnoexec\fR, 
\fBnosuid\fR, and \fBnosymfollow\fR.\&
.IP \(bu 4
\fBLandlock\fR: Employs read-only and read-write path restrictions at the kernel level.\&
.IP \(bu 4
\fBseccomp-bpf\fR: Applies Secure Computing user filters for kernel-space sandboxing.\&
.IP \(bu 4
\fBseccomp-notify\fR: Enables sandboxing in kernel space with user space 
fallback for dereferencing pointer arguments in system calls, 
including pathnames and network addresses.\& Access checks use 
UNIX shell-style patterns and CIDR notation, defaulting to denying 
system calls with \fBEACCES\fR while attempting to emulate successful 
calls to mitigate \fBTime-of-Check to Time-of-Use (TOCTOU)\fR 
attack vectors.\&
.PD
.PP
Prerequisites for Syd include a Linux kernel supporting \fIpidfd_getfd\fR(2) and
\fIpidfd_send_signal\fR(2) system calls, \fBSECCOMP_USER_NOTIF_FLAG_CONTINUE\fR
operation in the Secure Computing facility, and preferably the
\fBCONFIG_CROSS_MEMORY_ATTACH\fR kernel option.\& For syscall emulation, Syd uses the
seccomp operation \fBSECCOMP_IOCTL_NOTIF_ADDFD\fR.\& Syd also sets the
\fBSECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV\fR flag to correctly handle interrupts
during tracing.\& While \fILinux version 5.\&19 or later is required\fR, for Landlock
support Syd requires a kernel configured with the option \fBCONFIG_LSM_LANDLOCK\fR
supporting \fILandlock ABI version 3\fR, with \fIsyd-lock\fR(1) available as a helper
program to verify kernel support.\& Linux kernel options \fBCONFIG_KCMP\fR and
\fBCONFIG_UNIX_DIAG\fR are recommended.\&
.PP
By default, Syd restricts the resource space accessible to sandboxed
processes as tightly as possible.\& The \fBSECURITY\fR section of the \fIsyd\fR(7)
manual page lists all hardening measures and the
\fItrace/allow_unsafe_*\fR options to relax specific restrictions when
needed.\&
.PP
.SH OPTIONS
.PP
The following options are understood:
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB-h\fR, \fB--help\fR
T}	T{
Show usage and exit.\&
T}
T{
\fB-V\fR, \fB--version\fR
T}	T{
Show version and exit.\&
T}
T{
\fB-C\fR, \fB--check\fR
T}	T{
Print sandboxing support information about the current system and exit.\&
T}
T{
\fB-v\fR, \fB--verbose\fR
T}	T{
Increase verbosity, equivalent to incrementing \fBlog/verbose\fR by one.\&
T}
T{
\fB-c\fR
T}	T{
Login shell compatibility
T}
T{

T}	T{
Causes command to be executed under a shell with the \fBuser\fR profile.\&
T}
T{

T}	T{
The shell to execute is \fI/bin/sh\fR by default.\&
T}
T{

T}	T{
Use the environment variable \fBSYD_SHELL\fR to override.\&
T}
T{
\fB-f\fR
T}	T{
Login shell compatibility.\&
T}
T{

T}	T{
Causes Syd to parse the \fBuser\fR profile on startup.\&
T}
T{
\fB-l\fR, \fB--login\fR
T}	T{
Login shell compatibility
T}
T{

T}	T{
Causes Syd to parse the \fBuser\fR profile on startup.\&
T}
T{
\fB-q\fR
T}	T{
Enable quick boot mode for faster startup times.\&
T}
T{

T}	T{
This must be passed as the first option or it will be ignored.\&
T}
T{

T}	T{
See the explanation of the environment variable \fBSYD_QUICK_BOOT\fR for the safety of this option.\&
T}
T{
\fB-x\fR
T}	T{
Enable \fBtrace\fR aka "dry run" mode.\&
T}
T{

T}	T{
In this mode Syd will allow system calls even if they raise access violations.\&
T}
T{

T}	T{
This mode with extended logging can be used to build sandboxing profiles in an automated way.\&
T}
T{

T}	T{
See \fIpandora\fR(1) which is a tool that uses Syd'\&s trace mode to automatically generate sandbox profiles.\&
T}
T{
\fB-m config\fR
T}	T{
Configure sandbox during init, may be repeated.\&
T}
T{
\fB-p name\fR
T}	T{
Use a sandbox profile during init, may be repeated.\&
T}
T{
\fB-P path\fR
T}	T{
Run a configuration file during init, may be repeated.\&
T}
T{
\fB-a alias\fR
T}	T{
Set alias of the command.\& Passed as \fBargv[0]\fR to the program.\&
T}
T{
\fB-e\fR
T}	T{
Use \fB-e var=val\fR to put var=val in the environment for command, may be repeated.\&
T}
T{

T}	T{
Use \fB-e var\fR to remove var from the environment for command, may be repeated.\&
T}
T{

T}	T{
Use \fB-e var=\fR to pass-through an unsafe environment variable, may be repeated.\&
T}
T{
\fB-t timeout\fR
T}	T{
Specify sandbox timeout in human readable format.\&
T}
T{

T}	T{
Equivalent to \fBtimeout\fR option, refer to \fIsyd\fR(2) for more information.\&
T}
T{
\fB-E mode\fR
T}	T{
Export secure computing rules with the given format to standard output and exit.\&
T}
T{

T}	T{
Mode must be one of \fBbpf\fR or \fBpfc\fR:
T}
T{

T}	T{
\fBbpf\fR, aka \fBBerkeley Packet Filter\fR is a binary, machine readable format, whereas
T}
T{

T}	T{
\fBpfc\fR, aka \fBPseudo Filter Code\fR is a textual, human readable format.\&
T}
T{
\fB--api\fR
T}	T{
Output \fIsyd\fR(2) API specification in JSON format.\&
T}
T{

T}	T{
This specification is intended to ease generation of language bindings.\&
T}
T{

T}	T{
This specification is also available via the magic path \fB/dev/syd\fR.\&
T}
T{
\fB--el\fR
T}	T{
Output \fBsyd.\&el\fR which is the Emacs Lisp implementation of Syd \fIstat\fR(2) interface.\&
T}
T{

T}	T{
This file is also available via the magic path \fB/dev/syd.\&el\fR.\&
T}
T{
\fB--sh\fR
T}	T{
Output a shell script which defines the \fBesyd\fR helper function.\&
T}
T{

T}	T{
This file is also available via the magic path \fB/dev/syd.\&sh\fR.\&
T}
T{

T}	T{
Works with POSIX sh, bash and zsh.\&
T}
T{

T}	T{
You may use \fBeval "$(syd --sh)"\fR in your shell init file.\&
T}
.TE
.sp 1
.SH INVOCATION
.PP
Syd executes a command with the specified arguments under a sandbox and
exits with the same status.\& The sandbox may be constructed by
command-line arguments and configuration files.\& \fIsyd\fR(2) API is
available for dynamic configuration if the sandbox lock allows it.\& An
IPC socket may be configured with the \fIipc\fR command to configure Syd
through a UNIX socket.\& Refer to the \fIsyd\fR(2) manual page for more
information.\&
.PP
.SH ENVIRONMENT
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fBSYD_IPC\fR
T}	T{
Specify UNIX socket address for runtime configuration.\&
T}
T{

T}	T{
Equivalent to the \fBipc\fR command, see the \fIsyd\fR(2) manual page.\&
T}
T{

T}	T{
\fBipc\fR command has precedence over this environment variable.\&
T}
T{
\fBSYD_LOG\fR
T}	T{
Set log level to \fBemerg\fR, \fBalert\fR, \fBcrit\fR, \fBerror\fR, \fBwarn\fR, \fBnotice\fR, \fBinfo\fR or \fBdebug\fR.\&
T}
T{
\fBSYD_LOG_BUF_LEN\fR
T}	T{
Set \fIsyslog\fR(2) ring buffer capacity.\&
T}
T{

T}	T{
By default, the ring buffer is allocated on the stack with an architecture-dependent size.\&
T}
T{

T}	T{
Setting this variable makes Syd allocate the ring buffer on the heap with the user-specified size.\&
T}
T{

T}	T{
The value is parsed using the \fBparse-size\fR crate.\&
T}
T{

T}	T{
Refer to their documentation for information on formatting.\&
T}
T{
\fBSYD_LOG_FD\fR
T}	T{
Set log file descriptor, defaults to \fIstderr\fR(3).\&
T}
T{

T}	T{
Negative values are permitted as a shorthand to disable logging.\&
T}
T{

T}	T{
Positive values must be valid FDs or Syd will exit with \fBEBADF\fR.\&
T}
T{
\fBSYD_PDS\fR
T}	T{
Set parent-death signal using signal name or number.\&
T}
T{
\fBSYD_PID_FN\fR
T}	T{
Set pid filename, makes Syd write its process ID to this file at startup.\&
T}
T{

T}	T{
The file must not exist and is going to be created with user-only read permissions.\&
T}
T{
\fBSYD_NPROC\fR
T}	T{
Set the number of core syscall handler threads, defaults to the number of CPUs.\&
T}
T{

T}	T{
The number must be at least 1.\&
T}
T{
\fBSYD_NPROC_MAX\fR
T}	T{
Set the number of maximum syscall handler threads, defaults to usize::MAX.\&
T}
T{

T}	T{
The number must be greater than \fBSYD_NPROC\fR.\&
T}
T{
\fBSYD_CHDIR\fR
T}	T{
Change current working directory to a safe directory at startup.\&
T}
T{

T}	T{
This is implied if no optional arguments are given.\&
T}
T{
\fBSYD_SHELL\fR
T}	T{
Pick the shell to spawn when invoked as a login shell.\&
T}
T{

T}	T{
Defaults to \fB/usr/bin/bash --login --noprofile --norc --restricted\fR.\&
T}
T{
\fBSYD_DUMP_SCMP\fR
T}	T{
Export secure computing rules with the given format, equivalent to the \fB-E\fR option.\&
T}
T{
\fBSYD_SKIP_SCMP\fR
T}	T{
Skip \fIseccomp\fR(2) confinement of per-Syd threads.\&
T}
T{

T}	T{
This is \fBunsafe\fR and should only used for profiling.\&
T}
T{

T}	T{
Syd honours \fBRUST_BACKTRACE\fR environment variable when this is set.\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_SKIP_NAME\fR
T}	T{
Skip randomizing Syd thread names which is useful for debugging.\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_FORCE_NO_SYMLINKS\fR
T}	T{
Force \fBRESOLVE_NO_SYMLINKS\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_symlinks:1\fR.\&
T}
T{
\fBSYD_FORCE_NO_MAGICLINKS\fR
T}	T{
Force \fBRESOLVE_NO_MAGICLINKS\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_magiclinks:1\fR.\&
T}
T{
\fBSYD_FORCE_NO_XDEV\fR
T}	T{
Force \fBRESOLVE_NO_XDEV\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_xdev:1\fR.\&
T}
T{
\fBSYD_FORCE_CLOEXEC\fR
T}	T{
Force close-on-exec for file descriptors.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_cloexec:1\fR.\&
T}
T{
\fBSYD_FORCE_RAND_FD\fR
T}	T{
Use randomized file descriptors to harden against fd reuse.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_rand_fd:1\fR.\&
T}
T{
\fBSYD_FORCE_RO_OPEN\fR
T}	T{
Reject creating and writing \fIopen\fR(2) calls.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_ro_open:1\fR.\&
T}
T{
\fBSYD_FORCE_WX_OPEN\fR
T}	T{
Reject creating and writing \fIopen\fR(2) calls for executables.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_wx_open:1\fR.\&
T}
T{
\fBSYD_FORCE_LOCAL_NET\fR
T}	T{
Force local networking, rewrites all addresses to loopback for bind/connect.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_local_net:1\fR.\&
T}
T{
\fBSYD_FORCE_TTY\fR
T}	T{
Force TTY output which is pretty-printed JSON.\&
T}
T{
\fBSYD_QUIET_TTY\fR
T}	T{
Force quiet TTY output which is line-oriented JSON.\&
T}
T{
\fBSYD_PROXY_HOST\fR
T}	T{
Override the default value of \fBproxy/ext/host\fR,
T}
T{

T}	T{
If the value is a hostname and not an IP address,
T}
T{

T}	T{
Syd resolves this hostname at startup and selects a response IP randomly.\&
T}
T{
\fBSYD_PROXY_PORT\fR
T}	T{
Override the default value of \fBproxy/ext/port\fR.\&
T}
T{
\fBSYD_PROXY_UNIX\fR
T}	T{
Set the default value for \fBproxy/ext/unix\fR which overrides \fBproxy/ext/host\fR.\&
T}
T{
\fBSYD_QUICK_BOOT\fR
T}	T{
Enable quick boot mode, this makes Syd startup noticeably faster:
T}
T{

T}	T{
However, quick boot removes a layer of defense against some container breaks!\&
T}
T{

T}	T{
Use this if you frequently re-execute \fIsyd\fR(1) or \fIsyd-oci\fR(1),
T}
T{

T}	T{
as Exherbo Linux does during \fIcave-generate-metadata\fR(1).\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_RLIMIT_AS\fR
T}	T{
Set the default value for \fBrlimit/as\fR.\&
T}
T{
\fBSYD_RLIMIT_CORE\fR
T}	T{
Set the default value for \fBrlimit/core\fR.\&
T}
T{
\fBSYD_RLIMIT_DATA\fR
T}	T{
Set the default value for \fBrlimit/data\fR.\&
T}
T{
\fBSYD_RLIMIT_FSIZE\fR
T}	T{
Set the default value for \fBrlimit/fsize\fR.\&
T}
T{
\fBSYD_RLIMIT_MEMLOCK\fR
T}	T{
Set the default value for \fBrlimit/memlock\fR.\&
T}
T{
\fBSYD_RLIMIT_NICE\fR
T}	T{
Set the default value for \fBrlimit/nice\fR.\&
T}
T{
\fBSYD_RLIMIT_NOFILE\fR
T}	T{
Set the default value for \fBrlimit/nofile\fR.\&
T}
T{
\fBSYD_RLIMIT_NPROC\fR
T}	T{
Set the default value for \fBrlimit/nproc\fR.\&
T}
T{
\fBSYD_RLIMIT_RTPRIO\fR
T}	T{
Set the default value for \fBrlimit/rtprio\fR.\&
T}
T{
\fBSYD_RLIMIT_RTTIME\fR
T}	T{
Set the default value for \fBrlimit/rttime\fR.\&
T}
T{
\fBSYD_RLIMIT_SIGPENDING\fR
T}	T{
Set the default value for \fBrlimit/sigpending\fR.\&
T}
T{
\fBSYD_RLIMIT_STACK\fR
T}	T{
Set the default value for \fBrlimit/stack\fR.\&
T}
T{
\fBSYD_TMOUT\fR
T}	T{
Set the default value for \fBtimeout\fR.\&
T}
T{
\fBSYD_NO_CROSS_MEMORY_ATTACH\fR
T}	T{
Disable cross memory attach and use \fIproc_pid_mem\fR(5) unconditionally.\&
T}
T{
\fBSYD_PROC_PID_MEM_FALLBACK\fR
T}	T{
By default, Syd uses cross memory attach unconditionally.\&
T}
T{

T}	T{
Setting this variable causes Syd to fall back to \fIproc_pid_mem\fR(5) automatically,
T}
T{

T}	T{
if \fIprocess_vm_readv\fR(2) or \fIprocess_vm_writev\fR(2) fails with \fBENOSYS\fR,
T}
T{

T}	T{
which indicates kernel support is missing for these system calls.\&
T}
T{

T}	T{
The variable \fBSYD_NO_CROSS_MEMORY_ATTACH\fR has precedence over this variable.\&
T}
T{
\fBSYD_ASSUME_KERNEL\fR
T}	T{
Override \fIuname\fR(2) to get host Linux kernel version used for feature detection.\&
T}
T{

T}	T{
Syd reports the major and minor kernel version at \fIuname\fR(2) boundary within the sandbox.\&
T}
T{

T}	T{
The micro version is randomized per-Syd run to prevent information leaks.\&
T}
T{

T}	T{
This environment variable is ignored unless Syd is built with the "trusted" feature.\&
T}
T{
\fBSYD_PALUDIS_LPATH\fR
T}	T{
Override \fIsandbox/lpath\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_IOCTL\fR
T}	T{
Override \fIsandbox/ioctl\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_USER_LPATH\fR
T}	T{
Override \fIsandbox/lpath\fR option for the \fIuser\fR profile, defaults to on.\&
T}
.TE
.sp 1
.SH LOGGING
.PP
There'\&re eight log levels: emerg, alert, crit, error, warn, notice,
info, and debug.\& Log level may be set with the \fBSYD_LOG\fR environment
variable.\& Logs go to standard error unless a file descriptor is
specified with the environment variable \fBSYD_LOG_FD\fR.\& The messages of
severity warn and above are also sent to \fIsyslog\fR(3) unless the
environment variable \fBSYD_NO_SYSLOG\fR is set.\&
.PP
Syd logs in JSON lines.\& Below is a list of some of the commonly used
keys and their meanings:
.PP
.TS
allbox;l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l.
T{
\fBKEY\fR
T}	T{
\fBDESCRIPTION\fR
T}
T{
\fBid\fR
T}	T{
Sandbox ID as 128 lowercase hexadecimal characters.\&
T}
T{
\fBctx\fR
T}	T{
Context of the log entry, e.\&g.\& \fBaccess\fR, \fBsafesetid\fR, \fBsegvguard\fR etc.\&
T}
T{
\fBcap\fR
T}	T{
Sandbox capability
T}
T{
\fBact\fR
T}	T{
Sandbox action: \fBAllow\fR, \fBWarn\fR, \fBDeny\fR, \fBPanic\fR, \fBStop\fR, \fBAbort\fR, \fBKill\fR or \fBExit\fR
T}
T{
\fBpid\fR
T}	T{
Process ID
T}
T{
\fBpath\fR
T}	T{
Path argument of the syscall
T}
T{
\fBaddr\fR
T}	T{
Network address argument of the syscall, e.\&g.\& \fB127.\&0.\&0.\&1!\&22\fR
T}
T{
\fBunix\fR
T}	T{
UNIX socket address argument of the syscall
T}
T{
\fBipv\fR
T}	T{
IP version of the network address in the \fBaddr\fR field (4 or 6)
T}
T{
\fBabs\fR
T}	T{
True if the socket address in the \fBunix\fR field is an abstract UNIX socket
T}
T{
\fBsys\fR
T}	T{
Name of the syscall
T}
T{
\fBarch\fR
T}	T{
Architecture of the syscall
T}
T{
\fBargs\fR
T}	T{
Arguments of the syscalll
T}
T{
\fBcmd\fR
T}	T{
Process name, or command line if log output is a TTY or \fBlog\fR feature is enabled
T}
T{
\fBcwd\fR
T}	T{
Current working directory of the process
T}
T{
\fBuid\fR
T}	T{
User ID
T}
T{
\fBtime\fR
T}	T{
Timestamp in ISO8601-compatible format, currently \fBYYYYMMDDThhmmssZ\fR
T}
T{

T}	T{
Time format may change but it will always remain ISO8601-compatible.\&
T}
T{

T}	T{
Formatting errors fallback to printing the timestamp as an integer.\&
T}
T{
\fBerr\fR
T}	T{
Error information
T}
T{
\fBmsg\fR
T}	T{
Miscellaneous informational messages, mostly used with the \fBinfo\fR log level
T}
T{
\fBtip\fR
T}	T{
Informational messages on how to configure the sandbox
T}
.TE
.sp 1
.SH EXIT CODES
.PP
Syd exits with the same exit code as the sandbox process itself.\& If the
sandbox process exits with a signal, Syd exits with 128 plus the value of the
signal.\& In case there was an error in spawning or waiting for the sandbox
process, Syd exits with \fBerrno\fR indicating the error condition.\& E.\&g.\& \fBsyd
true\fR returns \fB0\fR, \fBsyd false\fR returns \fB1\fR, and \fBsyd -- syd true\fR returns \fB16\fR
which stands for \fBEBUSY\fR which means \fBDevice or resource busy\fR indicating there
is already a secure computing filter loaded.\& Syd exits with 124 if sandbox
timeout is exceeded.\&
.PP
.SH BENCHMARKS
.PP
The table below lists the benchmark runs we ran for Syd:
.PP
.TS
allbox;l l c
l l c
l l c
l l c
l l c
l l c
l l c.
T{
1: compile kernel
T}	T{
sydbox-{1,3}
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2534
T}
T{
2: compile kernel
T}	T{
sydbox-{1,3}
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2536
T}
T{
3: unpack compressed tarball
T}	T{
sydbox-{1,3}, Gentoo sandbox
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2537
T}
T{
4: compile kernel
T}	T{
sydbox-{1,3}, Gentoo sandbox
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2594
T}
T{
5: compile kernel in a Podman container
T}	T{
syd-oci, crun, runc, youki, gvisor
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2613
T}
T{
6: compile kernel in a Podman container
T}	T{
syd-oci, crun, runc, youki, gvisor
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2622
T}
T{
7: run sqlite-bench
T}	T{
no-syd, syd, syd+crypt
T}	T{
https://gitlab.\&exherbo.\&org/-/snippets/2758
T}
.TE
.sp 1
.SH SEE ALSO
.PP
\fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\fR(7), \fIsyd-lock\fR(1), \fIsyd-ls\fR(1)
.PP
.PD 0
.IP \(bu 4
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.IP \(bu 4
\fBlibsyd\fR homepage: https://libsyd.\&exherbo.\&org/
.IP \(bu 4
\fBpandora\fR homepage: https://lib.\&rs/pandora_box
.IP \(bu 4
\fBpaludis\fR homepage: http://paludis.\&exherbo.\&org/
.IP \(bu 4
\fBLandlock\fR homepage: https://landlock.\&io
.IP \(bu 4
\fBPath\fR wiki: https://en.\&wikipedia.\&org/wiki/Path_(computing)
.IP \(bu 4
\fBUnix domain socket\fR wiki: https://en.\&wikipedia.\&org/wiki/Unix_domain_socket
.IP \(bu 4
\fBIPv4\fR wiki: https://en.\&wikipedia.\&org/wiki/IPv4
.IP \(bu 4
\fBIPv6\fR wiki: https://en.\&wikipedia.\&org/wiki/IPv6
.IP \(bu 4
\fBTOCTOU\fR wiki: https://en.\&wikipedia.\&org/wiki/Time-of-check_to_time-of-use
.IP \(bu 4
\fBVFS\fR wiki: https://en.\&wikipedia.\&org/wiki/Virtual_file_system
.IP \(bu 4
\fBipnetwork\fR documentation: https://docs.\&rs/ipnetwork
.IP \(bu 4
\fBEnabling Logging\fR: https://docs.\&rs/env_logger/latest/env_logger/#enabling-logging
.PD
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up-to-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/-/issues.\& Discuss in #sydbox on
Libera Chat or in #sydbox:mailstation.\&de on Matrix.\&