.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD" "2" "2026\-07\-12"
.PP
.SH NAME
.PP
\fB/dev/syd\fR virtual system call interface
.PP
.SH SYNOPSIS
.PP
.nf
.RS 4
#include <sys/types\&.h>
#include <sys/stat\&.h>
#include <fcntl\&.h>

struct stat stat;

/* Execute sandbox commands */
int stat("/dev/syd/[command]", &stat); // $ syd \-m command
int stat("/dev/syd/[config]?", &stat);
int stat("/dev/syd/[config]:[value]", &stat); // $ syd \-m config:value
int stat("/dev/syd/[list]+[value]", &stat); // $ syd \-m list+value
int stat("/dev/syd/[list]\-[value]", &stat); // $ syd \-m list\-value
int stat("/dev/syd/[list]^[value]", &stat); // $ syd \-m list^value
int stat("/dev/syd/[command]![value]", &stat);

/* Read sandbox state as JSON */
int open("/dev/syd", O_RDONLY);

/* Read syd\&.el which is the Emacs Lisp implementation of the API */
int open("/dev/syd\&.el", O_RDONLY);

/* Read syd\&.sh which exports esyd shell function */
int open("/dev/syd\&.sh", O_RDONLY);
.fi
.RE
.PP
.SH DESCRIPTION
.PP
The \fB/dev/syd\fR virtual system call interface is a unique mechanism
designed for runtime configuration of the Syd sandbox environment.\& It
enables sandboxed processes to interact with the Syd process to
dynamically adjust sandbox settings or query its state.\& This interaction
is facilitated through the use of virtual system calls, specifically via
the \fIstat\fR(2) system call, applied to specially constructed paths under
\fB/dev/syd\fR.\& This interface allows for a range of operations, including
enabling or disabling sandbox features, appending or removing elements
from lists, querying the sandbox state, and executing special Syd
commands.\& Operations are specified through paths constructed with
\fB/dev/syd\fR as the prefix, followed by a sandbox command and an operation
character that denotes the desired action:
.PP
.PD 0
.IP \(bu 4
\fB:\fR for setting a value (boolean, integer, string),
.IP \(bu 4
\fB?\&\fR for querying a value,
.IP \(bu 4
\fB+\fR for appending to a string vector,
.IP \(bu 4
\fB\-\fR for removing an element from a string vector,
.IP \(bu 4
\fB\(ha\fR for removing all matching elements from a string vector, and
.IP \(bu 4
\fB!\&\fR for executing a special Syd command.\&
.PD
.PP
The type \fBstring\-map\fR is similar to \fBstring\-vec\fR, except the operator
\fB\(ha\fR does not accept an argument and removes all elements from the string
map.\& The \fB\-\fR operator of a string map is functionally equivalent to the
\fB\(ha\fR operator of a string vector in that both remove all matching elements
from the respective set.\&
.PP
This interface supports a flexible and powerful method for managing sandbox
policies dynamically, allowing for real\-time adjustments to the security and
operational behavior of sandboxed processes.\& \fBlibsyd\fR is a full\-featured C
library designed for interfacing with the Syd stat interface.\& It offers
functionalities for managing sandbox states, and facilitating runtime
configuration and interaction with the Syd sandboxing environment.\& \fBgosyd\fR is
a Go module that uses \fIcgo\fR to use \fBlibsyd\fR.\& \fBplsyd\fR is a Perl module that uses
\fIFFI::Platypus\fR to use \fBlibsyd\fR.\& \fBpysyd\fR is a Python module that uses \fIctypes\fR
to use \fBlibsyd\fR.\& \fBrbsyd\fR is a Ruby module that uses \fIffi\fR gem to use \fBlibsyd\fR.\&
\fBsyd.\&el\fR is an \fIEmacs Lisp\fR implementation of the Syd stat interface.\&
.PP
.SH COMMANDS
.PP
The \fB/dev/syd\fR interface supports the following commands for runtime
configuration of the sandbox.\& Each command can be invoked through the
\fIstat\fR(2) system call on special paths under \fB/dev/syd\fR.\& Syd provides
similar interfaces for the \fIstat\fR(2) interface, \fB\-m\fR command\-line option
and the configuration file.\& Some commands may be used with \fBlock:drop\fR
mode to further reduce privileges like \fIpledge\fR(2).\& Such commands are
noted as \fBdrop\fR in the descriptions below.\& Some sandbox commands only
take affect when they'\&re submitted on startup, such as \fBunshare/user\fR,
and \fBsandbox/lock\fR.\& Such commands are noted as \fBstatic\fR in the
descriptions below.\& Some sandbox commands are only available when Syd is
built with the trusted Cargo feature.\& Such commands are noted as
\fBtrusted\fR in the descriptions below.\&
.PP
.SS dump
.PP
This command causes Syd to output sandbox state in pretty formatted JSON
to standard error.\&
.PP
.SS stat
.PP
This command causes Syd to output sandbox state in human readable format
to standard error.\&
.PP
.SS panic
.PP
This command causes Syd to exit immediately with code 127.\&
.PP
Due to security reasons, this command is only available via the virtual
\fIstat\fR(2) call, it may not be used with the \fB\-m\fR command line switch or
in a configuration file.\&
.PP
Due to safety reasons, panic may not be called when Crypt sandboxing is
on.\& In this case the virtual \fIstat\fR(2) returns \-1 and sets \fIerrno\fR(3) to
\fBEBUSY\fR.\& This ensures concurrent or near\-concurrent encryption
operations continue uninterrupted.\&
.PP
.SS ghost
.PP
This command initiates Ghost mode.\& Ghost mode is irreversible so you can
call this command only once during Syd runtime.\& Refer to the \fBGhost
mode\fR section of the \fIsyd\fR(7) manual page for more information.\& This
command implies \fBlock:on\fR to ensure sandbox can not be edited after
initiation of ghost mode.\& Ghost mode is only available via the virtual
\fIstat\fR(2) call, it can not be used with the \fB\-m\fR command line switch or
in a configuration file.\&
.PP
.SS config/expand
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
drop
T}	T{
\fByes, 0 only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Given zero as timeout in seconds, which is the default, enables
environment variable and tilde expansion using the \fBshellexpand\fR crate.\&
This runs much faster as it does not require confinement, however it
does not support command substitution and recursive environment variable
expansion like \fIwordexp\fR(3) does.\& Unset environment variables are not
expanded to empty strings.\& On environment variable lookup errors and
UTF\-8 decoding errors Syd stops parsing and exits with error.\& This is
done for safety as an unintended empty\-string expansion can potentially
cause the resulting sandboxing rule to allowlist unintended paths
without the user easily noticing it.\& The user is recommended to set
default values for environment variables using the familiar
\fB${HOME:\-/var/empty}\fR notation.\& Empty\-string expansion on unset
environment variables can still be done using the notation \fB${HOME:\-}\fR
but this is not recommended and should be used with care.\&
.PP
Given a positive integer as timeout in seconds, enables environment
variable expansion and command substitutiton for configuration using
\fIwordexp\fR(3).\& The fork process which calls \fB/bin/sh\fR for expansion is
executed in a confined environment and it is terminated if its runtime
exceeds the given timeout.\& This is intended for pure computation.\&
References to undefined shell variables are rejected with error to
prevent unintended empty\-string expansions from widening sandbox rules.\&
This is not yet supported by musl libc where undefined variables still
expand using shell defaults.\& Confinement is done using \fIlandlock\fR(7),
\fInamespaces\fR(7) and \fIseccomp\fR(2).\& All Linux \fIcapabilities\fR(7) are
dropped and the no\-new\-privileges attribute is set to ensure no unwanted
capabilities leak into the this subprocess.\&
.PP
This is a startup\-only setting.\& For safety reasons, no expansion is
performed for runtime configuration.\&
.PP
As of version 3.\&47.\&0, duration may be passed in human readable format.\&
Refer to the documentation of the \fBdur\fR crate for more information.\&
.PP
As of version 3.\&57.\&0, setting duration to non\-zero is not permitted for
\fIsyd\-oci\fR(1) as it may be running with an untrusted /bin/sh.\&
.PP
As of version 3.\&57.\&0, \fBPOSIXLY_CORRECT\fR environment variable is set for
the \fIwordexp\fR(3) subprocess.\&
.PP
.SS ipc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Configure sandbox during runtime using the given UNIX socket address
with kernel\-validated peer authentication.\& Authentication leverages
\fBSCM_CREDENTIALS\fR and \fBSO_PASSCRED\fR mechanisms to verify that connecting
processes share identical UID and GID with the IPC worker process.\&
Authentication UID and GID may be overridden by \fBipc/uid\fR and \fBipc/gid\fR
options at startup.\& This kernel\-enforced authentication prevents
privilege escalation and unauthorized access by validating credentials
on every message, so that only the specified user and group or the
system administrator can execute IPC commands.\&
.PP
If the argument starts with the character \fB@\fR, the address is taken to
be an \fIabstract\fR UNIX socket.\& Use the keywords \fBnone\fR or \fBoff\fR to unset
a previously set IPC address.\& The IPC implementation is inspired by
HAProxy'\&s stats socket implementation.\& All responses except the \fBstats\fR
command are in compact JSON.\& User is recommended to use the \fBversion\fR
command to check the API version prior to use.\& As a safety measure, the
IPC service is provided as long as the sandbox is unlocked.\& When the
sandbox is locked, the \fIsyd_ipc\fR thread exits.\& This thread makes no
attempt to \fIunlink\fR(2) the UNIX domain socket path at startup or exit.\&
The user should perform the cleanup or use abstract sockets which is
recommended.\& To access the socket, an external utility such as
\fIsocat\fR(1) is required.\& Socat is a swiss\-army knife to connect anything
to anything.\& We use it to connect terminals to the socket, or a couple
of stdin/stdout pipes to it for scripts.\& The two main syntaxes we'\&ll use
are the following:
.PP
.nf
.RS 4
# socat ~/\&.syd/sandbox\&.sock stdio
# socat ~/\&.syd/sandbox\&.sock readline
.fi
.RE
.PP
The first one is used with scripts.\& It is possible to send the output of
a script to Syd, and pass Syd'\&s output to another script.\& That'\&s useful
for retrieving sandbox configuration as JSON for example.\& The second one
is only useful for issuing commands by hand.\& It has the benefit that the
terminal is handled by the readline library which supports line editing
and history, which is very convenient when issuing repeated commands
(eg: watch a counter).\&
.PP
The socket supports three operation modes:
.PD 0
.IP \(bu 4
non\-interactive, silent
.IP \(bu 4
interactive, silent
.IP \(bu 4
interactive with prompt
.PD
.PP
The non\-interactive mode is the default when \fIsocat\fR(1) connects to the
socket.\& In this mode, a single line may be sent.\& It is processed as a
whole, responses are sent back, and the connection closes after the end
of the response.\& This is the mode that scripts and monitoring tools use.\&
A single command may be sent at a time only.\& The interactive mode allows
new commands to be sent after the ones from the previous lines finish.\&
It exists in two variants, one silent, which works like the
non\-interactive mode except that the socket waits for a new command
instead of closing, and one where a prompt is displayed ('\&;'\&) at the
beginning of the line.\& The interactive mode is preferred for advanced
tools while the prompt mode is preferred for humans.\&
.PP
The mode can be changed using the \fBprompt\fR command.\& By default, it
toggles the interactive+prompt modes.\& Entering \fBprompt\fR in interactive
mode will switch to prompt mode.\& The command optionally takes a specific
mode among the following:
.PP
.PD 0
.IP \(bu 4
\fBn\fR: non\-interactive mode (single command and quits)
.IP \(bu 4
\fBi\fR: interactive mode (multiple commands, no prompt)
.IP \(bu 4
\fBp\fR: prompt mode (multiple commands with a prompt)
.PD
.PP
Since the default mode is non\-interactive, \fBprompt\fR must be used as the
first command in order to switch it, otherwise the previous command will
cause the connection to be closed.\& Switching to non\-interactive mode
will result in the connection to be closed after all the commands of the
same line complete.\&
.PP
For this reason, when debugging by hand, it'\&s quite common to start with
the \fBprompt\fR command:
.PP
.nf
.RS 4
# socat ~/\&.syd/sandbox\&.sock readline
prompt
; stats
\&.\&.\&.
; 
.fi
.RE
.PP
Interactive tools might prefer starting with \fBprompt i\fR to switch to
interactive mode without the prompt.\&
.PP
The following commands are supported in addition to the \fIsyd\fR(2) API:
.PP
.PD 0
.IP \(bu 4
load: Loads sandbox configuration from the attached file descriptor.\&
.IP \(bu 4
stat: Prints sandbox state in compact JSON.\&
.IP \(bu 4
stats: Prints sandbox state in human\-readable format.\&
.IP \(bu 4
version: Prints IPC api version in compact JSON.\&
.PD
.PP
The commands \fIquit\fR and \fIexit\fR may be used to close a socket connection.\&
The command \fIping\fR is supported for aliveness checks.\&
.PP
As of version 3.\&56.\&0, IPC socket supports \fIunix\fR(7) file descriptor
passing.\& An authenticated \fBSCM_RIGHTS\fR file descriptor received over the
socket is a configuration load request, the file descriptor passing
analogue of \fI/dev/syd/load\fR with identical validations.\& The request must
be unambiguous.\& Message carrying the descriptor must consist of the sole
command \fIload\fR, or it is rejected with \fBEBADMSG\fR ("Not a data message")
and the connection is closed, reserving other messages for future uses
of file descriptor passing.\& Conversely, a \fIload\fR command without a
descriptor is rejected with \fBEBADF\fR ("Bad file number"), and a message
containing unexpected control messages is rejected with \fBEPROTO\fR
("Protocol error").\& The file descriptor must refer to a regular file,
include directives are rejected, and loads are denied whilst the lock is
in \fIdrop\fR mode.\& At most one file descriptor is accepted per message, and
Syd replies with \fBACK\fR on success or a JSON\-encoded \fIerrno\fR(3) on
failure.\& \fIsyd\-fd\fR(1) utility implements this mode with its \fI\-u\fR option.\&
Check for IPC API version 3.\&2 prior to use.\&
.PP
.SS ipc/uid
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBuid_t\fR
T}
T{
default
T}	T{
\fBUid::current\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
User ID override for IPC authentication.\& Specifies the UID that
connecting processes must possess to authenticate with the IPC worker.\&
Accepts only numeric user IDs, not user names.\& Defaults to the current
process UID obtained via \fIgetuid\fR(2).\& When set, the IPC worker validates
that all connecting clients have this exact UID via \fBSCM_CREDENTIALS\fR
authentication.\& This setting allows privilege delegation scenarios where
the IPC worker runs as one user but accepts connections from processes
running as a different specific UID.\& Set the option to \fBnone\fR or \fBoff\fR
to disable UID authentication for IPC.\&
.PP
.SS ipc/gid
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBgid_t\fR
T}
T{
default
T}	T{
\fBGid::current\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Group ID override for IPC authentication.\& Specifies the GID that
connecting processes must possess to authenticate with the IPC worker.\&
Accepts only numeric group IDs or not group names.\& Defaults to the
current process GID obtained via \fIgetgid\fR(2).\& When set, the IPC worker
validates that all connecting clients have this exact GID via
\fBSCM_CREDENTIALS\fR authentication.\& This setting enables group\-based
access control where multiple users belonging to the same group can
access the IPC interface.\& Set the option to \fBnone\fR or \fBoff\fR to disable
GID authentication for IPC.\&
.PP
.SS ipc/max
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBinteger\fR
T}
T{
default
T}	T{
\fB64\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Maximum number of concurrent IPC connections.\& Connections accepted
beyond this limit are closed immediately, bounding the memory and file
descriptor usage of the IPC worker.\& Accepts a positive integer.\& The
value \fB0\fR is rejected.\& Set the option to \fBipc:off\fR to disable the IPC
interface instead.\&
.PP
.SS ipc/idle
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
\fB60\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Idle timeout for IPC connections.\& A connection that delivers no message
within this duration is closed.\& The deadline is refreshed on every
received message.\& Accepts a duration in human readable format.\& The value
\fB0\fR is rejected.\& Refer to the documentation of the \fBdur\fR crate for more
information.\&
.PP
.SS lock
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\fR
T}
.TE
.sp 1
Set the state of the sandbox lock.\& Possible values are \fBon\fR, \fBoff\fR,
\fBexec\fR, \fBipc\fR, \fBdrop\fR and \fBread\fR or shortly just \fB1\fR, \fB0\fR, \fBx\fR, \fBd\fR,
\fBi\fR, and \fBr\fR.\& The values are case\-sensitive.\& The values \fBro\fR,
\fBreadonly\fR and \fBread\-only\fR are also permitted for \fBread\fR mode which was
added as of version 3.\&39.\&0.\& Specifying just \fBlock\fR without value or
shortly \fBl\fR is permitted as a short\-hand for \fBlock:on\fR.\&
.PP
If the sandbox lock is \fBon\fR no sandbox commands are allowed.\& If sandbox
lock is \fBread\fR, only reads are allowed but not edits.\& A read locked
sandbox makes available only the read\-only \fIopen\fR(2) hooks of the
\fIsyd\fR(2) virtual system call API to the sandbox process.\& \fIstat\fR(2) hooks
for edits are not permitted in a read locked sandbox.\&
.PP
If \fBdrop\fR is specified, which was added as of version 3.\&50.\&0, sandbox
commands may only be used to further drop privileges.\&
.PP
If \fBexec\fR is specified, the sandbox lock is set to \fBon\fR for all
processes except the initial process, aka Syd exec child.\& If the sandbox
lock is \fBipc\fR, sandbox commands may only be specified using the IPC
socket.\& The IPC socket is a UNIX socket which may or may not be
accessible from within the sandbox depending on sandbox ACL rules.\&
.PP
Transition from lock modes \fBoff\fR, \fBexec\fR, and \fBipc\fR into one of \fBread\fR
and \fBon\fR is one\-way and idempotent: It results in the sandbox policy
getting sealed in memory using the \fImseal\fR(2) system call either
immediately or right before sandbox process startup.\& Transitions between
lock modes \fBread\fR and \fBon\fR are not permitted.\&
.PP
The sandbox lock used to default to \fBexec\fR but as a hardening measure
and to ensure security by default, as of version 3.\&17.\&0, this has been
changed such that the default is \fBunset\fR and if no lock clause has been
specified by the time Syd executes the initial sandbox process, then the
sandbox lock is automatically set to \fBon\fR.\& This means if no \fBlock\fR
clause is specified in any of the profiles, configuration files or \fB\-m\fR
CLI arguments, the lock will be \fBon\fR by default.\& As of version 3.\&35.\&2,
this default is set to \fBipc\fR if the \fBipc\fR command was specified but lock
was not set explicitly.\& Setting lock to \fBon\fR at any point during
configuration parsing prevents further commands from being emitted by
the sandbox.\& This feature may be used to lock site\-wide defaults for a
Syd login shell by adding a \fBlock:on\fR clause at the end of the site\-wide
configuration file which prevents Syd from subsequently parsing the user
configuration file, practically enforcing the site\-wide defaults.\&
.PP
Setting lock to \fBoff\fR, \fBexec\fR, or \fBipc\fR at startup makes Syd skip
preventing \fIexecve\fR(2) and \fIexecveat\fR(2) system calls as part of the
\fBExecution Control (EEC)\fR feature.\& This is done to allow \fBcmd/exec\fR
command to execute commands outside the sandbox.\& This filter to prevent
\fIexec\fR(3) is only applied when the sandbox is locked.\&
.PP
.SS log/level
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBwarn\fR
T}
.TE
.sp 1
Set the log level.\& Available log levels are \fBemerg\fR, \fBalert\fR, \fBcrit\fR,
\fBerror\fR, \fBwarn\fR, \fBnotice\fR, \fBinfo\fR, and \fBdebug\fR.\& Defaults to \fBwarn\fR
unless \fBSYD_LOG\fR environment variable is set at startup.\& An integer in
the closed range of \fB[0,7]\fR can also be used as an argument to set the
log level, where \fB0\fR corresponds to \fBemerg\fR and \fB7\fR corresponds to
\fBdebug\fR.\& All access violations except the \fBwalk\fR, \fBlist\fR, \fBstat\fR and
\fBchdir\fR categories are logged with the \fBwarn\fR level.\& Walk, List, Stat,
and Chdir categories are logged with the \fBnotice\fR level.\& Startup
messages are logged with the \fBinfo\fR level.\&
.PP
.SS log/lock/same_exec_off
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
.TE
.sp 1
Disables logging of denied accesses originating from the thread creating
the \fIlandlock\fR(7) domain, as well as its children, as long as they
continue running the same executable code (i.\&e.\&, without an intervening
\fIexecve\fR(2) call).\& This is intended for programs that execute unknown
code without invoking \fIexecve\fR(2), such as script interpreters.\& Programs
that only sandbox themselves should not set this flag, so users can be
notified of unauthorized access attempts via system logs.\&
.PP
This option requires \fIlandlock\fR(7) ABI 7 support which is new in
Linux\-6.\&15.\& Setting this option is a NO\-OP otherwise.\& Setting this
option is also a NO\-OP when \fBsandbox/lock\fR is off.\& Multiple options may
be set or unset at once by passing them as a comma\-delimited list.\&
Environment variables in the value are expanded.\&
.PP
.SS log/lock/new_exec_on
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
.TE
.sp 1
Enables logging of denied accesses after an \fIexecve\fR(2) call, providing
visibility into unauthorized access attempts by newly executed programs
within the created \fIlandlock\fR(7) domain.\& This flag is recommended only
when all potential executables in the domain are expected to comply with
the access restrictions, as excessive audit log entries could make it
more difficult to identify critical events.\&
.PP
This option requires \fIlandlock\fR(7) ABI 7 support which is new in
Linux\-6.\&15.\& Setting this option is a NO\-OP otherwise.\& Setting this
option is also a NO\-OP when \fBsandbox/lock\fR is off.\& Multiple options may
be set or unset at once by passing them as a comma\-delimited list.\&
Environment variables in the value are expanded.\& A sandboxer should not
log denied access requests to avoid spamming logs, therefore this option
is off by default.\& Use this option to test audit logging.\&
.PP
.SS log/lock/subdomains_off
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
.TE
.sp 1
Disables logging of denied accesses originating from nested
\fIlandlock\fR(7) domains created by the caller or its descendants.\& This
flag should be set according to runtime configuration, not hardcoded, to
avoid suppressing important security events.\& It is useful for container
runtimes or sandboxing tools that may launch programs which themselves
create \fIlandlock\fR(7) domains and could otherwise generate excessive
logs.\& Unlike \fBlog/lock/same_exec_off\fR, this flag only affects future
nested domains, not the one being created.\&
.PP
This option requires \fIlandlock\fR(7) ABI 7 support which is new in
Linux\-6.\&15.\& Setting this option is a NO\-OP otherwise.\& Setting this
option is also a NO\-OP when \fBsandbox/lock\fR is off.\& Multiple options may
be set or unset at once by passing them as a comma\-delimited list.\&
Environment variables in the value are expanded.\&
.PP
.SS log/verbose
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBu8\fR
T}
T{
default
T}	T{
\fB0\fR
T}
.TE
.sp 1
Set verbose logging level.\& Syd acquires and logs various additional
information depending on the level of verbosity.\& Supported verbosity
levels are given below:
.PP
0: Raw logs only.\&
.PP
1: Log \fIioctl\fR names(2) under the \fIctl\fR key.\& This is the default.\&
.PP
2: Log process name change attempts with the \fBPR_SET_NAME\fR \fIprctl\fR(2).\&
.PP
3: Enrich \fIseccomp\fR(2) requests under the \fIreq\fR key.\&
.PP
Levels above 2 are intended for malware analysis.\& Setting the log level
to a value above the highest supported level is equivalent to setting
verbosity to the highest supported level.\&
.PP
.SS log/rlimit_interval
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
\fB5s\fR
T}
.TE
.sp 1
Set rate\-limiting interval for identical log messages.\& Within each
interval window, at most \fBlog/rlimit_burst\fR copies of any given message
are emitted, further duplicates are suppressed and a single summary line
recording the suppressed count is emitted when the interval expires.\&
.PP
The value may be specified as a raw integer in nanoseconds or as a
human\-readable duration string parsed by the \fBdur\fR crate.\& Refer to the
documentation of the \fBdur\fR crate for more information.\& Setting the
interval to \fB0\fR disables rate limiting entirely.\&
.PP
.SS log/rlimit_burst
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBu32\fR
T}
T{
default
T}	T{
\fB10\fR
T}
.TE
.sp 1
Set the maximum number of identical log messages permitted within a
single \fBlog/rlimit_interval\fR window before suppression begins.\& After
this many copies of the same message have been emitted, subsequent
duplicates are silently counted and a summary is emitted when the
interval expires.\& Setting the burst to \fB0\fR suppresses all messages
unconditionally.\&
.PP
.SS pty/row
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBushort\fR
T}
T{
default
T}	T{
\fB<inherit>\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Set row size for PTY sandboxing.\& Default is to inherit the window\-size.\&
Use the keyword \fBnone\fR to unset a previously set value.\& You may shortly
refer to this option as \fBpty/x\fR.\&
.PP
.SS pty/col
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBushort\fR
T}
T{
default
T}	T{
\fB<inherit>\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Set column size for PTY sandboxing.\& Default is to inherit the
window\-size.\& Use the keyword \fBnone\fR to unset a previously set value.\&
You may shortly refer to this option as \fBpty/y\fR.\&
.PP
.SS setenv
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBcommand\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Set an environment variable from within a Syd profile.\& Environment
variables in the value are expanded before calling \fIsetenv\fR(3).\& Setting
internal Syd environment variables, i.\&e those that start with the prefix
"SYD_", isn'\&t permitted.\& Illustrative examples are given below:
.PP
.nf
.RS 4
setenv!HOME=/tmp
setenv!HOME=${HOME}/\&.syd
setenv!HOME=${HOME:\-/tmp}/\&.syd
.fi
.RE
.PP
.SS unsetenv
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBcommand\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Unset an environment variable from within a Syd profile.\& Unsetting
internal Syd environment variables, i.\&e those that start with the prefix
"SYD_", isn'\&t permitted.\& Illustrative examples are given below:
.PP
.nf
.RS 4
unsetenv!PWD
unsetenv!TZ
.fi
.RE
.PP
.SS clearenv
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBcommand\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Clear all environment variables from within a Syd profile.\& This command
does not clear internal Syd environment variables, i.\&e those that start
with the prefix "SYD_".\&
.PP
.SS passenv
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify unsafe environment variables to pass\-through to the sandbox
process.\& This argument is a \fIglob\fR(3) pattern.\& Passing through internal
Syd environment variables, i.\&e those that start with the prefix "SYD_",
isn'\&t permitted.\& By default, Syd clears a set of environment variables
from the environment of the sandbox process, see \fBsyd\-ls env\fR for the
list.\& Refer to the \fBRestricting environment and trace/allow_unsafe_env\fR
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS passfd
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBu32\-set\fR
T}
T{
default
T}	T{
\fBstdio\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify the file descriptors to pass to the sandbox process.\& All other
inherited file descriptors are closed just before \fIexecve\fR(2) so they do
not leak into the sandbox process.\& By default only the standard I/O
descriptors (0, 1, 2) are passed.\& The argument is a comma\-separated list
of tokens, each of which is a single descriptor \fIN\fR, an inclusive range
\fIN\-M\fR, or one of the keywords \fIall\fR (every descriptor), \fIstdio\fR
(descriptors 0, 1, 2), \fIstdin\fR (0), \fIstdout\fR (1), and \fIstderr\fR (2).\&
Descending ranges are rejected.\& Any descriptor listed in \fInullfd\fR is
implicitly passed regardless of this list, so its redirection to
\fI/dev/null\fR is not undone by the close before \fIexecve\fR(2).\& Examples:
.PP
.PD 0
.IP \(bu 4
\fIpassfd+stdio\fR adds the standard I/O descriptors.\&
.IP \(bu 4
\fIpassfd+0\-2,10\-30,40\-50\fR adds the listed descriptors and ranges.\&
.IP \(bu 4
\fIpassfd+all\fR passes every descriptor, closing none.\&
.IP \(bu 4
\fIpassfd\-stdio,4\-6\fR stops passing the standard I/O descriptors and \fI4\-6\fR.\&
.IP \(bu 4
\fIpassfd\-all\fR stops passing every descriptor.\&
.IP \(bu 4
\fIpassfd\(ha\fR resets the list so that no descriptor is passed.\&
.PD
.PP
.SS nullfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBu32\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify the file descriptors to redirect to \fI/dev/null\fR in the sandbox
process.\& Each listed descriptor is pointed at \fI/dev/null\fR just before
\fIexecve\fR(2).\& The argument is a comma\-separated list of tokens, each of
which is a single descriptor \fIN\fR or one of the keywords \fIstdio\fR
(descriptors 0, 1, 2), \fIstdin\fR (0), \fIstdout\fR (1), and \fIstderr\fR (2).\&
Unlike \fIpassfd\fR there is no \fIall\fR keyword and ranges are not supported.\&
A descriptor listed here is implicitly passed to the sandbox process, so
it need not also be added to \fIpassfd\fR.\& The \fI/dev/null\fR redirection takes
precedence over \fIpassfd\fR and is preserved across \fIexecve\fR(2).\& Examples:
.PP
.PD 0
.IP \(bu 4
\fInullfd+stdout\fR redirects standard output to \fI/dev/null\fR.\&
.IP \(bu 4
\fInullfd+1,2\fR redirects standard output and standard error.\&
.IP \(bu 4
\fInullfd\-stderr\fR stops redirecting standard error.\&
.IP \(bu 4
\fInullfd\(ha\fR resets the list so that no descriptor is redirected.\&
.PD
.PP
.SS sandbox/fs
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Filesystem sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/walk
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Walk sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default.\&
.PP
.SS sandbox/list
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn List sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default.\&
.PP
.SS sandbox/stat
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Stat sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default and setting
it on only works at startup.\& If not given at startup, Syd will just
allow \fIaccess\fR(2), \fIfaccessat\fR(2), \fIfaccessat2\fR(2), \fIgetdents64\fR(2),
\fIreadlink\fR(2), \fIreadlinkat\fR(2), \fIstat\fR(2), \fIstat64\fR(2), \fIstatx\fR(2),
\fIlstat\fR(2), \fIlstat64\fR(2), \fIfstatat64\fR(2), \fInewfstatat\fR(2), \fIfstat\fR(2),
\fIfstat64\fR(2), \fIstatfs\fR(2), \fIstatfs64\fR(2), \fIfstatfs\fR(2), \fIfstatfs64\fR(2),
\fIgetxattr\fR(2), \fIfgetxattr\fR(2), \fIlgetxattr\fR(2), \fIgetxattrat\fR(2),
\fIlistxattr\fR(2), \fIflistxattr\fR(2), \fIllistxattr\fR(2), \fIllistxattrat\fR(2),
\fIfanotify_mark\fR(2), and \fIinotify_add_watch\fR(2) system calls at
seccomp\-bpf level.\& Turning this sandboxing off during runtime is still
possible, in this case the respective system calls handlers will skip
the access checks.\& As an exception, if Stat sandboxing is off but
sandbox lock is one of \fIoff\fR or \fIexec\fR, the system calls \fIstat\fR(2),
\fIstat64\fR(2), \fIstatx\fR(2), \fIlstat\fR(2), \fIlstat64\fR(2), \fIfstatat64\fR(2), and
\fInewfstatat\fR(2) are handled at userspace to support the \fIsyd\fR(2) API.\&
.PP
.SS sandbox/read
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Read sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/write
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Write sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/exec
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Exec sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/ioctl
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Ioctl sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this only works at startup.\& If not given at
startup, Syd will just allow the \fIioctl\fR(2) system call at seccomp\-bpf
level.\& Turning this sandboxing off during runtime is still possible, in
this case the respective system calls handlers will skip the access
checks.\&
.PP
.SS sandbox/create
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Create sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/delete
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Delete sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/rename
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Rename sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/readlink
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Readlink sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default.\&
.PP
.SS sandbox/symlink
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Symlink sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/truncate
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Truncate sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chdir
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chdir sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default and setting
it on only works at startup.\& If not given at startup, Syd will just
allow \fIchdir\fR(2) and \fIfchdir\fR(2) system calls at seccomp\-bpf level.\&
Turning this sandboxing off during runtime is still possible, in this
case the respective system calls handlers will skip the access checks.\&
.PP
.SS sandbox/readdir
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Readdir sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/mkdir
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Mkdir sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/rmdir
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Rmdir sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chown
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chown sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chgrp
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chgrp sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chmod
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chmod sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chattr
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chattr sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/chroot
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Chroot sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/notify
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Notify sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this sandboxing is off by default.\&
.PP
.SS sandbox/utime
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Utime sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/mkdev
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Mkdev sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/mkfifo
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Mkfifo sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/mktemp
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Mktemp sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/net
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Network sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/lock
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Landlock sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/force
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Force sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/tpe
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Trusted Path Execution (TPE) sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS sandbox/crypt
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Crypt sandboxing \fBon\fR or \fBoff\fR.\&
.PP
To set this option \fBon\fR, a key must have already been specified with
\fBcrypt/key\fR or Syd will exit with the \fIerrno\fR(3) \fBENOKEY\fR.\&
.PP
Setting this sandboxing type to \fBon\fR implies \fBtrace/exit_wait_all:true\fR so as
not to leave any ongoing encryption processes behind on sandbox process exit.\&
.PP
.SS sandbox/proxy
.PP
.TS
allbox;l l
l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Turn Proxy sandboxing \fBon\fR or \fBoff\fR.\&
.PP
Defaults to proxying through TOR.\& Refer to the options \fIproxy/addr\fR,
\fIproxy/port\fR, \fIproxy/ext/host\fR, and \fIproxy/ext/port\fR to configure a
different proxy.\&
.PP
Implies \fBunshare/net:true\fR.\&
.PP
Requires \fIsyd\-tor\fR(1) helper utility to be under PATH.\& \fIsyd\-tor\fR(1) is
executed once at startup, it runs as a single process and this process
runs at most as long as the owner Syd process.\& Refer to the \fIsyd\-tor\fR(1)
manual page for more information.\&
.PP
.SS sandbox/pty
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBon\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn PTY sandboxing \fBon\fR or \fBoff\fR.\&
.PP
Requires \fIsyd\-pty\fR(1) helper utility to be under PATH.\& \fIsyd\-pty\fR(1) is
executed once at startup, it runs as a single process and this process
runs at most as long as the owner Syd process.\& Refer to the \fIsyd\-pty\fR(1)
manual page for more information.\& This option has no effect unless both
standard input and standard output are attached to a TTY at startup.\&
.PP
.SS sandbox/mem
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn Memory sandboxing \fBon\fR or \fBoff\fR.\&
.PP
For performance reasons, this only works at startup.\& If not given at startup,
Syd will just allow \fIbrk\fR(2), \fImmap\fR(2), \fImmap2\fR(2), and \fImremap\fR(2) system
calls at seccomp\-bpf level.\& Turning this sandboxing off during runtime is still
possible, in this case the respective system calls handlers will skip the access
checks.\&
.PP
.SS sandbox/pid
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBoff\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn PID sandboxing \fBon\fR or \fBoff\fR.\&
.PP
.SS default/fs
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Filesystem sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/walk
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Walk sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/list
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for List sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/stat
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Stat sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/read
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Read sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/write
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Write sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/exec
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Exec sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/ioctl
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Ioctl sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/create
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Create sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/delete
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Delete sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"stop", "abort", "kill", "panic", or "exit", where the default is "deny".\&
.PP
.SS default/rename
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Rename sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"stop", "abort", "kill", "panic", or "exit", where the default is "deny".\&
.PP
.SS default/readlink
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Readlink sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"stop", "abort", "kill", "panic", or "exit", where the default is "deny".\&
.PP
.SS default/symlink
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Symlink sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"stop", "abort", "kill", "panic", or "exit", where the default is "deny".\&
.PP
.SS default/truncate
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Truncate sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chdir sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/readdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Readdir sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/mkdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Mkdir sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/rmdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Rmdir sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chown
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chown sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chgrp
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chgrp sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chmod
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chmod sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chattr
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chattr sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/chroot
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Chroot sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/notify
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Notify sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/utime
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Utime sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/mkdev
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Mkdev sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/mkfifo
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Mkfifo sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/mktemp
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Mktemp sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/net
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the default action for Network sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/block
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the action for IP blocklist violations.\&
.PP
The value must be exactly one of "warn", "filter", "deny", "panic",
"stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/force
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
For force sandboxing, define the default action to take when the path of
a binary is not in the Integrity Force map.\&
.PP
The value must be either one of "warn", "filter", "deny", "panic",
"stop", "abort", "kill", "exit", where the default is "deny".\&
.PP
.SS default/segvguard
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the action for SegvGuard access violations.\&
.PP
The value must be exactly one of "warn", "filter", "deny", "panic",
"stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/tpe
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the action for TPE sandboxing access violations.\&
.PP
The value must be exactly one of "warn", "filter", "deny", "panic",
"stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/mem
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBdeny\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the action for Memory sandboxing access violations.\&
.PP
The value must be exactly one of "allow", "warn", "filter", "deny",
"panic", "stop", "abort", "kill", or "exit", where the default is "deny".\&
.PP
.SS default/pid
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBkill\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify the action for PID sandboxing access violations.\&
.PP
The value must be either one of "warn", "filter", "stop", "abort",
"kill", "exit", where the default is "kill".\&
.PP
.SS default/lock
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
 \fBstring\fR
T}
T{
default
T}	T{
\fBkill\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify the compatibility level for Lock sandboxing.\&
.PP
The value must be either one of \fBkill\fR, \fBdeny\fR, \fBwarn\fR.\& \fBkill\fR
stands for the Landlock compatibility level \fBhard\-requirement\fR,
whereas \fBdeny\fR stands for \fBsoft\-requirement\fR and \fBwarn\fR stands
for \fBbest\-effort\fR.\&
.PP
As of version 3.\&35.\&0, the default level has been promoted from \fBwarn\fR to
\fBkill\fR to adhere to the principle of secure defaults.\& Again, as of this
version \fBENOENT\fR ("No such file or directory") errors are fatal unless
compatibility level is set to \fBbest\-effort\fR at startup using
\fBdefault/lock:warn\fR.\&
.PP
For more information on Landlock compatibility levels, see:
https://landlock.\&io/rust\-landlock/landlock/trait.\&Compatible.\&html
.PP
.SS unshare/mount
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create Mount namespace on startup, implies \fBunshare/pid:true\fR.\&
.PP
.SS unshare/uts
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create UTS namespace on startup.\&
.PP
.SS unshare/ipc
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create IPC namespace on startup.\&
.PP
.SS unshare/user
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create User namespace on startup.\&
.PP
.SS unshare/pid
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create Pid namespace on startup, implies \fBunshare/mount:true\fR.\&
.PP
Syd mounts private \fIprocfs\fR(5) in this mode.\&
.PP
As of version 3.\&37.\&2 \fIprocfs\fR(5) is mounted with \fBhidepid=4\fR option which is Linux>=5.\&8.\&
.PP
As of version 3.\&39.\&0 \fIprocfs\fR(5) is mounted with \fBsubset=pid\fR option which is
Linux>=5.\&8, unless \fBtrace/allow_unsafe_proc_files:true\fR is set at startup.\&
.PP
.SS unshare/net
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create Net namespace on startup.\&
.PP
.SS unshare/cgroup
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create CGroup namespace on startup.\&
.PP
.SS unshare/time
.PP
.TS
allbox;l l
l l
l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
T{
query
T}	T{
\fByes\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Create Time namespace on startup.\& Syd resets the boot\-time clock
such that \fIuptime\fR(1) will report container uptime rather than
host uptime.\& Use \fItime\fR command to override default and set
alternative time.\&
.PP
.SS root
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Change the root mount to the given new root directory at startup using
\fIpivot_root\fR(2).\& Destination path arguments of \fIbind\fR commands are
interpreted relative to this directory.\& The directories \fI$root/dev\fR, and
\fI$root/proc\fR must exist to mount private filesystems.\& In addition,
target paths of the \fIbind\fR commands must also be manually created by
the user.\&
.PP
This option does nothing without \fIunshare/mount:1\fR.\&
.PP
As of version 3.\&23.\&14, symbolic links are not followed in any part of
the root directory and path traversal using ".\&.\&" is not permitted.\& In
addition, root directory must be an absolute path, relative paths are
not permitted.\&
.PP
As of version 3.\&35.\&0, the special keyword \fItmpfs\fR, or shortly \fItmp\fR or
just \fIt\fR, is supported to make Syd mount a private \fItmpfs\fR(5) filesystem
as the root directory.\& In this mode, Syd is going to attempt to create
target paths inside the private temporary filesystem.\& Similarly, as of
version 3.\&45.\&0, the special keyword \fIramfs\fR, or shortly \fIram\fR or just
\fIr\fR, is supported to make Syd mount a private \fIramfs\fR(5) filesystem as
the root directory.\& \fIramfs\fR(5) is limited compared to \fItmpfs\fR(5) and
should only be preferred when the host Linux kernel isn'\&t configured
with the \fBCONFIG_TMPFS\fR option.\& The private root directory is mounted
with the options \fInodev\fR, \fInoexec\fR, \fInosuid\fR, \fInosymfollow\fR, \fInoatime\fR,
and \fImode=700\fR.\&
.PP
As of version 3.\&35.\&2, the special keywords \fInone\fR and \fIoff\fR may be used
to unset a previously set \fIroot\fR directory.\&
.PP
.SS root/map
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Map current user to root in the sandbox on startup.\&
.PP
This option does nothing without "unshare/user:1".\&
.PP
.SS root/fake
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
In \fBfakeroot\fR mode, the system will return a user/group id of \fB0\fR,
mimicking the \fBroot\fR user.\& This allows users to execute commands with
apparent root privileges, without actual superuser rights.\& It'\&s useful
for tasks like package building where root\-like environment is needed,
but not actual root permissions.\&
.PP
.SS time
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBi64\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set clock boottime and monotonic offset (seconds) in Time Namespace.\& To
set boottime and monotonic offsets separately, use the options
\fBtime/boot\fR, and \fBtime/mono\fR.\& This option is a shorthand to set both at
the same time to the same offset.\& Use the keywords \fBnone\fR or \fBoff\fR to
unset a previously set offset.\&
.PP
.SS time/boot
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBi64\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set clock boottime offset (seconds) in Time Namespace.\& Use the keywords
\fBnone\fR or \fBoff\fR to unset a previously set offset.\&
.PP
.SS time/mono
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBi64\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set clock monotonic offset (seconds) in Time Namespace.\& Use the
keywords \fBnone\fR or \fBoff\fR to unset a previously set offset.\&
.PP
.SS timeout
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
\fBnone\fR
T}
.TE
.sp 1
Set sandbox timeout after which Syd will exit with code 124 and all
sandbox processes running under it will exit with Syd.\& Use \fBnone\fR or
\fBoff\fR to disable which is the default.\& Duration may be specified in
human readable format.\& Refer to the documentation of the \fBdur\fR crate for
more information.\&
.PP
.SS uts/host
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fBlocalhost\fR
T}
.TE
.sp 1
Set UTS host name in the sandbox.\& Name is limited to 64 characters.\&
Name may be empty.\& Name may not have nul bytes.\& Default is \fBlocalhost\fR.\&
Use the keywords \fBnone\fR or \fBoff\fR to unset when Syd will pass\-through the
original hostname to the sandbox process.\&
.PP
Useful when combined with \fBunshare/uts:true\fR.\& As of version 3.\&40.\&0, the
value of this option is returned at \fIuname\fR(2) boundary in \fBnodename\fR
field of the \fButsname\fR structure regardless of the \fBunshare/uts\fR option.\&
.PP
As of version 3.\&39.\&3, this value may be changed at runtime.\&
.PP
As of version 3.\&49.\&0, this value must NOT be empty and must be a safe
filename.\& Refer to the \fBEnhanced Path Integrity Measures\fR section of the
\fIsyd\fR(7) manual page for information on safe filenames.\&
.PP
.SS uts/domain
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fB(none)\fR
T}
.TE
.sp 1
Set NIS/YP domain name in the sandbox.\& Name is limited to 64 characters.\&
Name may be empty.\& Name may not have nul bytes.\& Default is \fB(none)\fR.\&
Use the keywords \fBnone\fR or \fBoff\fR to unset when Syd will pass\-through the
original domainname to the sandbox process.\&
.PP
Useful when combined with \fBunshare/uts:true\fR.\& As of version 3.\&40.\&0, the
value of this option is returned at \fIuname\fR(2) boundary in \fBdomainname\fR
field of the \fButsname\fR structure regardless of the \fBunshare/uts\fR option.\&
.PP
As of version 3.\&39.\&3, this value may be changed at runtime.\&
.PP
As of version 3.\&49.\&0, this value must NOT be empty and must be a safe
filename.\& Refer to the \fBEnhanced Path Integrity Measures\fR section of the
\fIsyd\fR(7) manual page for information on safe filenames.\&
.PP
.SS uts/version
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
\fB<random>\fR
T}
.TE
.sp 1
Set version level of the operating system as returned in \fBversion\fR field
of the \fButsname\fR structure at \fIuname\fR(2) boundary.\& Name is limited to 64
characters.\& Name may be empty.\& Name may not have nul bytes.\& Default is
determined randomly at startup.\& Use the keywords \fBnone\fR or \fBoff\fR to
unset when Syd will pass\-through the original version to the sandbox
process.\&
.PP
As of version 3.\&56.\&0, this value must NOT be empty and must be a safe
filename.\& Refer to the \fBEnhanced Path Integrity Measures\fR section of the
\fIsyd\fR(7) manual page for information on safe filenames.\&
.PP
.SS allow/ioctl
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBinteger or string\fR
T}
T{
default
T}	T{
\fB[.\&.\&.\&]\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Add to or remove a request from the \fIioctl\fR(2) request allowlist.\&
Accepts an unsigned 32\-bit integer as argument.\& Prefix with \fB0x\fR for
hexadecimal and \fB0o\fR for octal input.\& Use \fBallow/ioctl+<request>\fR to add
to, and \fBallow/ioctl\-<request>\fR to remove from the allowlist.\& As of
version 3.\&38.\&0, ioctl(2) requests may also be specified by
case\-insensitive name and multiple requests may be added or removed by
separating them as a comma\-delimited list.\& Specifying ioctl(2) requests
by name is strongly recommended because request numbers may vary by
architecture which is handled transparently when the request is
specified as a name.\& As of version 3.\&38.\&6, the \fIioctl\fR(2) name may be
prepended with an optional exclamation mark, i.\&e.\& \fB!\&\fR, to denote Syd
should not return EINVAL ("Invalid argument") \fIerrno\fR(3) in case the
name is not defined for any of the current supported architectures.\& This
allows for writing rules generic across multiple incompatible
architectures.\& As of version 3.\&50.\&0, shell\-style \fIglob\fR(3) patterns are
accepted for \fIioctl\fR(2) names.\& The \fIglob\fR(3) characters \fB*\fR, \fB?\&\fR, and
\fB[.\&.\&.\&]\fR may be used to match multiple \fIioctl\fR(2) names at once, e.\&g.\&
\fBallow/ioctl+DRM_IOCTL_I915_*\fR to allow all Intel GPU ioctls, or
\fBallow/ioctl+FIO*\fR to allow all generic file ioctls.\& Glob matching is
case\-insensitive and may be combined with comma\-separated literals, e.\&g.\&
\fBallow/ioctl+FIO*,FIBMAP\fR.\& The \fB!\&\fR suffix applies per element.\&
.PP
By default the allowlist contains the \fIioctl\fR(2) requests \fBFIOCLEX\fR,
\fBFIONCLEX\fR, \fBFIONBIO\fR, \fBFIONREAD\fR, \fBFIOASYNC\fR, \fBFIOQSIZE\fR,
\fBFIDEDUPERANGE\fR, \fBPIDFD_GET_INFO\fR, and \fBRNDGETENTCNT\fR.\&
.PP
For rules added at startup deny rules have precedence over allow rules
because the denylist is checked at kernel\-space, whereas the allowlist
is checked at user\-space.\& For rules added after startup, the last
matching rule wins.\&
.PP
.SS deny/ioctl
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBinteger or string\fR
T}
T{
default
T}	T{
\fB[.\&.\&.\&]\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
T{
static
T}	T{
\fBadd is dynamic, remove is partly static\fR
T}
.TE
.sp 1
Add to or remove a request from the \fIioctl\fR(2) request denylist.\& Accepts
an unsigned 64\-bit integer as argument.\& Prefix with \fB0x\fR for hexadecimal
and \fB0o\fR for octal input.\& Use \fBdeny/ioctl+<request>\fR to add to, and
\fBdeny/ioctl\-<request>\fR to remove from the allowlist.\& As of version
3.\&38.\&0, ioctl(2) requests may also be specified by case\-insensitive name
and multiple requests may be added or removed by separating them as a
comma\-delimited list.\& Specifying ioctl(2) requests by name is strongly
recommended because request numbers may vary by architecture which is
handled transparently when the request is specified as a name.\& As of
version 3.\&38.\&6, the \fIioctl\fR(2) name may be prepended with an optional
exclamation mark, i.\&e.\& \fB!\&\fR, to denote Syd should not return \fBEINVAL\fR
("Invalid argument") \fIerrno\fR(3) in case the name is not defined for any
of the current supported architectures.\& This allows for writing rules
generic across multiple incompatible architectures.\& As of version
3.\&50.\&0, shell\-style \fIglob\fR(3) patterns are accepted for \fIioctl\fR(2)
names.\& The \fIglob\fR(3) characters \fB*\fR, \fB?\&\fR, and \fB[.\&.\&.\&]\fR may be used to
match multiple \fIioctl\fR(2) names at once, e.\&g.\&
\fBdeny/ioctl+SECCOMP_IOCTL_*\fR to deny all \fIseccomp\fR(2) ioctls.\& Glob
matching is case\-insensitive and may be combined with comma\-separated
literals.\& The \fB!\&\fR suffix applies per element.\& As of version 3.\&55.\&0,
\fIioctl\fR(2) names corresponding to variable\-sized \fIioctl\fR(2) requests are
rejected with \fBEOPNOTSUPP\fR ("Operation not supported") because the
\fIseccomp\fR(2) BPF filter cannot match them by a single numeric value.\&
.PP
By default the list of denylisted \fIioctl\fR(2) requests are \fBFIFREEZE\fR,
\fBFITHAW\fR, \fBFS_IOC_FIEMAP\fR, \fBFIGETBSZ\fR, \fBFICLONE\fR, \fBFICLONERANGE\fR,
\fBFS_IOC_GETFSUUID\fR, \fBFS_IOC_GETFSSYSFSPATH\fR, \fBFIBMAP\fR,
\fBFS_IOC_FSGETXATTR\fR, \fBFS_IOC_FSSETXATTR\fR, \fBFS_IOC_SETFLAGS\fR,
\fBFS_IOC32_SETFLAGS\fR, \fBKDSETKEYCODE\fR, \fBKDSIGACCEPT\fR, \fBRNDADDTOENTCNT\fR,
\fBRNDGETPOOL\fR, \fBRNDADDENTROPY\fR, \fBRNDZAPENTCNT\fR, \fBRNDCLEARPOOL\fR,
\fBSECCOMP_IOCTL_NOTIF_RECV\fR, \fBSECCOMP_IOCTL_NOTIF_SEND\fR,
\fBSECCOMP_IOCTL_NOTIF_ID_VALID\fR, \fBSECCOMP_IOCTL_NOTIF_ADDFD\fR,
\fBSECCOMP_IOCTL_NOTIF_SET_FLAGS\fR, \fBTIOCCONS\fR, \fBTIOCLINUX\fR, \fBTIOCSETD\fR,
\fBTIOCSTI\fR, \fBTIOCSSERIAL\fR, \fBKCOV_INIT_TRACE\fR, \fBKCOV_ENABLE\fR,
\fBKCOV_DISABLE\fR, \fBKCOV_RESET_TRACE\fR, and \fBKCOV_REMOTE_ENABLE\fR.\&
.PP
For security reasons, the \fIioctl\fR(2) denylist is applied at the parent
seccomp\-bpf filter at startup.\& This means the Syd process is included in
this restriction as well.\& This also means, removing elements from this
list after startup has no effect.\& However, if Ioctl sandboxing was
enabled at startup, adding new elements to the \fIioctl\fR(2) denylist will
further restrict the \fIioctl\fR(2) request space.\&
.PP
For rules added at startup, deny rules have precedence over allow rules
because the denylist is checked at kernel\-space, whereas the allowlist
is checked at user\-space.\& For rules added after startup, the last
matching rule wins.\&
.PP
Further reading about denylisted \fIioctl\fR(2) requests:
.PP
.PD 0
.IP \(bu 4
https://cve.\&mitre.\&org/cgi\-bin/cvename.\&cgi?\&name=CVE\-2023\-1523
.IP \(bu 4
https://a13xp0p0v.\&github.\&io/2017/03/24/CVE\-2017\-2636.\&html
.IP \(bu 4
http://phrack.\&org/issues/52/6.\&html#article
.IP \(bu 4
https://git.\&kernel.\&org/pub/scm/linux/kernel/git/torvalds/linux.\&git/commit/?\&id=83efeeeb3d04b22aaed1df99bc70a48fe9d22c4d
.IP \(bu 4
https://git.\&kernel.\&org/pub/scm/linux/kernel/git/torvalds/linux.\&git/commit/?\&id=8d1b43f6a6df7bcea20982ad376a000d90906b42
.IP \(bu 4
https://seclists.\&org/oss\-sec/2024/q1/13
.IP \(bu 4
https://seclists.\&org/oss\-sec/2024/q1/14
.IP \(bu 4
https://forums.\&grsecurity.\&net/viewtopic.\&php?\&f=7&t=2522
.IP \(bu 4
http://lkml.\&indiana.\&edu/hypermail/linux/kernel/9907.\&0/0132.\&html
.IP \(bu 4
http://linux.\&derkeiler.\&com/Mailing\-Lists/Kernel/2007\-11/msg07723.\&html
.PD
.PP
.SS mem/max
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (u64)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
drop
T}	T{
\fByes, reduce only\fR
T}
.TE
.sp 1
This setting specifies the limit on per\-process memory usage.\& Setting this value
to \fB0\fR disables testing for this type of memory usage.\& The value is
parsed using the \fBparse\-size\fR crate.\& Refer to their documentation for
information on formatting.\& Setting an non\-zero value with this option
implies \fIsandbox/mem:on\fR.\&
.PP
.SS mem/vm_max
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (u64)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
drop
T}	T{
\fByes, reduce only\fR
T}
.TE
.sp 1
This setting specifies the limit on per\-process virtual memory usage.\& Setting
this value to \fB0\fR disables testing for this type of memory usage.\&  The
value is parsed using the \fBparse\-size\fR crate.\& Refer to their
documentation for information on formatting.\& Setting an non\-zero value
with this option implies \fIsandbox/mem:on\fR.\&
.PP
.SS pid/max
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (u64)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
drop
T}	T{
\fByes, reduce only\fR
T}
.TE
.sp 1
This setting specifies the limit on the number of running tasks for pid
sandboxing.\& Setting this value to \fI0\fR is functionally equivalent to
setting \fIsandbox/pid\fR to \fIoff\fR.\& Setting an non\-zero value with this
option implies \fIsandbox/pid:on\fR.\&
.PP
As of version 3.\&40.\&0, when \fIunshare/pid:true\fR is set, PID sandboxing
counts and enforces the limit in the current PID namespace; on Linux
6.\&14 and newer, to account for the kernel'\&s 300 reserved PIDs the
namespaced kernel.\&pid_max is set to \fBmax(pid/max, 301)\fR (or 512 on
s390x), while on older kernels \fIkernel.\&pid_max\fR \fIsysctl\fR(8) is left
unchanged.\&
.PP
.SS rlimit/as
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum size of the sandbox process'\&s virtual memory (address
space) using \fIrlimit\fR(2).\& The limit is specified in bytes, and is
rounded down to the system page size.\& The value is parsed using the
\fBparse\-size\fR crate.\& Refer to their documentation for information on
formatting.\& Use the keywords \fBnone\fR or \fBoff\fR to unset a previously set
value.\& The keyword \fBinf\fR denotes no limit on the resource.\&
.PP
.SS rlimit/core
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum size of a \fIcore\fR(5) file in bytes using \fIrlimit\fR(2).\&
When 0 (default) no core dump files are created.\& When nonzero, larger
dumps are truncated to this size.\& The value is parsed using the
\fBparse\-size\fR crate.\& Refer to their documentation for information on
formatting.\& Use the keywords \fBnone\fR or \fBoff\fR to unset a previously set
value.\& The keyword \fBinf\fR denotes no limit on the resource.\&
.PP
.SS rlimit/cpu
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the amount of CPU time in seconds using \fIrlimit\fR(2).\& The
value is parsed using the \fBdur\fR crate.\& Refer to their documentation for
information on formatting.\& Use the keywords \fBnone\fR or \fBoff\fR to unset a
previously set value.\& The keyword \fBinf\fR denotes no limit on the
resource.\&
.PP
.SS rlimit/data
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum size of the sandbox process'\&s data segment
(initialized data, uninitialized data, and heap) using \fIrlimit\fR(2).\& The
limit is specified in bytes, and is rounded down to the system page
size.\& The value is parsed using the \fBparse\-size\fR crate.\& Refer to their
documentation for information on formatting.\& Use the keywords \fBnone\fR or
\fBoff\fR to unset a previously set value.\& The keyword \fBinf\fR denotes no
limit on the resource.\&
.PP
.SS rlimit/fsize
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum size in bytes of files that the sandbox process may
create using \fIrlimit\fR(2).\& The value is parsed using the \fBparse\-size\fR
crate.\& Refer to their documentation for information on formatting.\& Use
the keywords \fBnone\fR or \fBoff\fR to unset a previously set value.\& The
keyword \fBinf\fR denotes no limit on the resource.\& This limit is applied to
the Syd process as well to ensure system calls such as \fItruncate\fR(2),
and \fIfallocate\fR(2) are correctly limited.\& Care should be taken, because
setting this limit to a value lower than what Syd'\&s internal file
handling requires may result in unexpected errors.\&
.PP
.SS rlimit/memlock
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum number of bytes of memory that may be locked into RAM
using \fIrlimit\fR(2).\& This limit is in effect rounded down to the nearest
multiple of the system page size.\& Default is zero.\& The value is parsed
using the \fBparse\-size\fR crate.\& Refer to their documentation for
information on formatting.\& Use the keywords \fBnone\fR or \fBoff\fR to unset a
previously set value.\& The keyword \fBinf\fR denotes no limit on the
resource.\&
.PP
.SS rlimit/msgqueue
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the number of bytes that can be allocated for POSIX message queues
for the real user ID of the sandbox process using \fIrlimit\fR(2).\& The limit
is enforced for \fImq_open\fR(3).\& Default is zero.\& The value is parsed using
the \fBparse\-size\fR crate.\& Refer to their documentation for information on
formatting.\& Use the keywords \fBnone\fR or \fBoff\fR to unset a previously set
value.\& The keyword \fBinf\fR denotes no limit on the resource.\&
.PP
.SS rlimit/nice
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBinteger (\-20.\&.\&=20)\fR
T}
T{
default
T}	T{
\fB20\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify a ceiling to which sandbox process'\&s nice value can be raised
using \fIsetpriority\fR(2) or \fInice\fR(2) using \fIrlimit\fR(2).\& The accepted
range for this limit is from \-20 to 20 (default).\& Use the keywords
\fBnone\fR or \fBoff\fR to unset a previously set value.\& The keyword \fBinf\fR
denotes no limit on the resource.\&
.PP
Default is 20.\& The option \fItrace/allow_unsafe_nice\fR must also be set to
permit the sandbox process to change its nice value.\&
.PP
.SS rlimit/nofile
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum file descriptor number that can be opened using
resource limits using \fIrlimit\fR(2).\& Use the keywords \fBnone\fR or \fBoff\fR to
unset a previously set value.\& The keyword \fBinf\fR denotes no limit on the
resource.\&
.PP
.SS rlimit/nproc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the number of extant process (or, more precisely on Linux,
threads) for the real user ID of the sandbox process using \fIrlimit\fR(2).\&
Use the keywords \fBnone\fR or \fBoff\fR to unset a previously set value.\& The
keyword \fBinf\fR denotes no limit on the resource.\&
.PP
.SS rlimit/rtprio
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify a ceiling on the real\-time priority that may be set for the
sandbox process using \fIsched_setscheduler\fR(2) and \fIsched_setparam\fR(2)
using \fIrlimit\fR(2).\& Default is zero.\& Use the keywords \fBnone\fR or \fBoff\fR to
unset a previously set value.\& The keyword \fBinf\fR denotes no limit on the
resource.\&
.PP
.SS rlimit/rttime
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
default
T}	T{
\fB0\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit (in microseconds) on the amount of CPU time that a sandbox process
scheduled under a real\-time scheduling policy may consume without making
a blocking system call using \fIrlimit\fR(2).\& Default is zero.\& The value is
parsed using the \fBdur\fR crate.\& Refer to their documentation for
information on formatting.\&  Use the keywords \fBnone\fR or \fBoff\fR to unset a
previously set value.\& The keyword \fBinf\fR denotes no limit on the
resource.\&
.PP
.SS rlimit/sigpending
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the number of signals that may be queued for the real user ID of
the sandbox process using \fIrlimit\fR(2).\& Both standard and real\-time
signals are counted for the purpose of checking this limit.\& Use the
keywords \fBnone\fR or \fBoff\fR to unset a previously set value.\& The keyword
\fBinf\fR denotes no limit on the resource.\&
.PP
.SS rlimit/stack
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBpositive integer (rlim_t)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Limit the maximum size of the sandbox process stack, in bytes using
\fIrlimit\fR(2).\& The value is parsed using the \fBparse\-size\fR crate.\& Refer to
their documentation for information on formatting.\& Use the keywords
\fBnone\fR or \fBoff\fR to unset a previously set value.\& The keyword \fBinf\fR
denotes no limit on the resource.\&
.PP
.SS bind
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to bind mount a directory on startup.\& The format
is \fBsource\-dir:target\-dir:mount\-options,.\&.\&.\&\fR where \fIthe source and
target directories may be equal\fR.\& As of version 3.\&55.\&0, bind mounts are
secure by default.\& Regardless of whether the source is an absolute path
or a filesystem type, every bind is mounted with \fBnodev\fR, \fBnoexec\fR,
\fBnosuid\fR, and \fBnosymfollow\fR options applied.\& User must therefore
explicitly opt back into the relaxed behaviour upfront using the options
below.\& Each option weakens exactly one of the secure defaults:
.PP
.PD 0
.IP \(bu 4
\fBdev\fR to interpret character and block special devices on the 
filesystem.\& By default with \fBnodev\fR, device nodes are not interpreted.\&
.IP \(bu 4
\fBexec\fR to permit direct execution of binaries on the mounted 
filesystem.\& By default with \fBnoexec\fR, execution is not permitted.\&
.IP \(bu 4
\fBsuid\fR to honour set\-user\-ID and set\-group\-ID bits and file 
capabilities when executing programs from this filesystem.\& By default 
with \fBnosuid\fR they are ignored.\& In addition, SELinux domain transitions 
require permission \fBnosuid_transition\fR, which in turn needs also policy 
capability \fBnnp_nosuid_transition\fR.\&
.IP \(bu 4
\fBsymfollow\fR to follow symbolic links when resolving paths.\& By default 
with \fBnosymfollow\fR, symbolic links are not followed.\& They can still be 
created, and \fIreadlink\fR(1), \fIreadlink\fR(2), \fIrealpath\fR(1), and 
\fIrealpath\fR(3) all still work properly.\&
.PD
In addition, \fBro\fR mounts the filesystem read\-only.\& \fBrw\fR resets a
previous \fBro\fR option, and is a no\-op otherwise.\&
.PP
Access time of a bind mount is not part of the secure defaults because
changing it is privileged in unprivileged \fIuser_namespaces\fR(7).\& The
following access time options remain available as opt\-in flags:
.PP
.PD 0
.IP \(bu 4
\fBnoatime\fR to not update inode access times on this filesystem (e.\&g.\& for 
faster access on the news spool to speed up news servers).\& This works for all 
inode types (directories too), so it implies \fBnodiratime\fR.\&
.IP \(bu 4
\fBnodiratime\fR to not update directory inode access times on this filesystem.\& 
(This option is implied when \fBnoatime\fR is set.\&)
.IP \(bu 4
\fBrelatime\fR to update inode access times relative to modify or change 
time.\& This is the default.\&
.IP \(bu 4
\fBstrictatime\fR to always update inode access times on every access.\& This 
may increase I/O and is rarely needed.\&
.PD
.PP
The legacy restrictive options \fBnodev\fR, \fBnoexec\fR, \fBnosuid\fR, and
\fBnosymfollow\fR are now the default and are accepted only as no\-ops for
backwards compatibility.\& Access time options (\fBnoatime\fR, \fBrelatime\fR,
\fBstrictatime\fR) are mutually exclusive.\& Specifying conflicting options is
an error.\&
.PP
Mount options may be omitted.\& If the source directory is not an absolute
path, it is interpreted as the filesystem type rather than the source
directory.\& This may be used to mount special filesystems such as
cgroupfs, overlayfs or \fItmpfs\fR(5) into the mount namespace.\& In this
case, any mount options supported by this filesystem type may be
submitted in options argument not just the ones listed above.\& You may
find some examples below:
.PP
.PD 0
.IP \(bu 4
bind+/:/:ro
.IP \(bu 4
bind+tmpfs:/tmp:size=16M
.IP \(bu 4
bind+tmpfs:/run:exec,size=16M
.IP \(bu 4
bind+/dev:/dev:dev
.IP \(bu 4
bind+overlay:/tmp/target:exec,lowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work
.IP \(bu 4
bind+devpts:/dev/pts:dev,newinstance,ptmxmode=0600,mode=600
.IP \(bu 4
bind+ramfs:/tmp
.IP \(bu 4
bind+sysfs:/sys
.IP \(bu 4
bind+mqueue:/dev/mqueue
.PD
.PP
This command may be used to create immutable containers.\& For example,
the command \fBbind+/:/:ro\fR is functionally equivalent to
\fBdeny/write+/***\fR except the restriction happens at kernel VFS layer
rather than at user level using \fIseccomp\fR(2) notify.\& Alternatively this
can also be achieved at the kernel level using \fIlandlock\fR(7).\&
.PP
As of version 3.\&23.\&14, symbolic links are not followed in any part of
the source or target directory paths and path traversal using \fB.\&.\&\fR is
not permitted.\& In addition, target directory must be an absolute path,
relative paths are not permitted.\&
.PP
As of version 3.\&23.\&14, mounting the special \fIproc\fR(5) filesystem under a
custom path is not permitted.\& Syd handles this mount itself specially
after all bind mounts are processed.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This command does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS bind\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fIbind\fR except that it warns and
continues on \fBENOENT\fR ("No such file or directory") \fIerrno\fR(3) on the
source directory.\& All other errors remain fatal.\& This is useful for
portable profiles that reference optional paths which may not exist on
every system.\& The format is the same as \fIbind\fR:
\fBsource\-dir:target\-dir:mount\-options,.\&.\&.\&\fR
.PP
Take "bind\-try+/opt/custom:/opt/custom:ro" as an example.\& If
\fI/opt/custom\fR does not exist, the mount is skipped with a warning and
execution continues.\& If the source exists but cannot be opened for any
other reason (e.\&g.\& \fBEACCES\fR, \fBELOOP\fR), Syd reports the error and
terminates as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to create a directory node in the mount
namespace on startup using \fImkdirat\fR(2).\& The format is \fBpath\fR or
\fBpath:mode\fR where \fIpath\fR is an absolute path and \fImode\fR is an optional
octal permission mode.\& If mode is omitted, it defaults to \fB0700\fR.\&
.PP
.PD 0
.IP \(bu 4
mkdir+/dev/shm
.IP \(bu 4
mkdir+/dev/shm:0755
.IP \(bu 4
mkdir+/tmp/work:0700
.PD
.PP
The path must be absolute.\& Relative paths and path components containing
\fB.\&.\&\fR are rejected with \fBEINVAL\fR ("Invalid argument").\& Symbolic links are
not followed in any component of the path.\& Parent directories are opened
with \fIopenat2\fR(2) using \fBRESOLVE_NO_XDEV\fR to prevent cross\-device path
traversal.\& Parent directories are created automatically using
\fImkdirat\fR(2) with safe fd\-based traversal.\& The node is created using
\fImkdirat\fR(2) which does not follow symbolic links in the final
component.\& A secure \fIumask\fR(2) of \fB0077\fR is applied during mount
namespace setup which strips group and other permission bits from the
requested mode.\& In addition, \fIsetuid\fR and \fIsetgid\fR bits are stripped
explicitly.\& Only user permission bits and the sticky bit are preserved
in the final mode.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkdir operations are silently ignored.\& This option
does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkdir\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fImkdir\fR except that it warns and
continues on \fBEEXIST\fR ("File exists") \fIerrno\fR(3).\& All other errors
remain fatal.\& This is useful for creating directories that may already
exist, such as standard paths in a tmpfs root.\& The format is the same as
\fImkdir\fR: \fBpath\fR or \fBpath:mode\fR
.PP
Take "mkdir\-try+/dev/shm:0755" as an example.\& If \fI/dev/shm\fR already
exists, the creation is skipped with a warning and execution continues.\&
If the path cannot be created for any other reason (e.\&g.\& \fBEACCES\fR,
\fBENOENT\fR), Syd reports the error and terminates as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkdir\-try operations are silently ignored.\& This
option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkfile
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to create a regular file node in the mount
namespace on startup using \fImknodat\fR(2).\& The format is \fBpath\fR or
\fBpath:mode\fR where \fIpath\fR is an absolute path and \fImode\fR is an optional
octal permission mode.\& If mode is omitted, it defaults to \fB0400\fR.\&
.PP
.PD 0
.IP \(bu 4
mkfile+/dev/null
.IP \(bu 4
mkfile+/dev/null:0666
.IP \(bu 4
mkfile+/tmp/placeholder:0600
.PD
.PP
The path must be absolute.\& Relative paths and path components containing
\fB.\&.\&\fR are rejected with \fBEINVAL\fR ("Invalid argument").\& Symbolic links are
not followed in any component of the path.\& Parent directories are opened
with \fIopenat2\fR(2) using \fBRESOLVE_NO_XDEV\fR to prevent cross\-device path
traversal.\& Parent directories are created automatically using
\fImkdirat\fR(2) with safe fd\-based traversal.\& The node is created using
\fImknodat\fR(2) which does not follow symbolic links in the final
component.\& A secure \fIumask\fR(2) of \fB0077\fR is applied during mount
namespace setup which strips group and other permission bits from the
requested mode.\& In addition, \fIsetuid\fR and \fIsetgid\fR bits are stripped
explicitly.\& Only user permission bits and the sticky bit are preserved
in the final mode.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkfile operations are silently ignored.\& This option
does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkfile\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fImkfile\fR except that it warns and
continues on \fBEEXIST\fR ("File exists") \fIerrno\fR(3).\& All other errors
remain fatal.\& This is useful for creating file nodes that may already
exist, such as device nodes in a tmpfs root.\& The format is the same as
\fImkfile\fR: \fBpath\fR or \fBpath:mode\fR
.PP
Take "mkfile\-try+/dev/null:0666" as an example.\& If \fI/dev/null\fR already
exists, the creation is skipped with a warning and execution continues.\&
If the path cannot be created for any other reason (e.\&g.\& \fBEACCES\fR,
\fBENOENT\fR), Syd reports the error and terminates as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkfile\-try operations are silently ignored.\& This
option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkfifo
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to create a named pipe (FIFO) node in the mount
namespace on startup using \fImknodat\fR(2) with \fBS_IFIFO\fR.\& The format is
\fBpath\fR or \fBpath:mode\fR where \fIpath\fR is an absolute path and \fImode\fR is an
optional octal permission mode.\& If mode is omitted, it defaults to
\fB0600\fR.\&
.PP
.PD 0
.IP \(bu 4
mkfifo+/tmp/myfifo
.IP \(bu 4
mkfifo+/tmp/myfifo:0644
.IP \(bu 4
mkfifo+/run/syd/ctl:0600
.PD
.PP
The path must be absolute.\& Relative paths and path components containing
\fB.\&.\&\fR are rejected with \fBEINVAL\fR ("Invalid argument").\& Symbolic links are
not followed in any component of the path.\& Parent directories are opened
with \fIopenat2\fR(2) using \fBRESOLVE_NO_XDEV\fR to prevent cross\-device path
traversal.\& Parent directories are created automatically using
\fImkdirat\fR(2) with safe fd\-based traversal.\& The node is created using
\fImknodat\fR(2) which does not follow symbolic links in the final
component.\& A secure \fIumask\fR(2) of \fB0077\fR is applied during mount
namespace setup which strips group and other permission bits from the
requested mode.\& In addition, \fIsetuid\fR and \fIsetgid\fR bits are stripped
explicitly.\& Only user permission bits and the sticky bit are preserved
in the final mode.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkfifo operations are silently ignored.\& This option
does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS mkfifo\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fImkfifo\fR except that it warns and
continues on \fBEEXIST\fR ("File exists") \fIerrno\fR(3).\& All other errors
remain fatal.\& This is useful for creating FIFO nodes that may already
exist in a tmpfs root.\& The format is the same as \fImkfifo\fR: \fBpath\fR or
\fBpath:mode\fR
.PP
Take "mkfifo\-try+/tmp/myfifo:0644" as an example.\& If \fI/tmp/myfifo\fR
already exists, the creation is skipped with a warning and execution
continues.\& If the path cannot be created for any other reason (e.\&g.\&
\fBEACCES\fR, \fBENOENT\fR), Syd reports the error and terminates as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, mkfifo\-try operations are silently ignored.\& This
option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS link
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to create a hard link in the mount namespace on
startup using \fIlinkat\fR(2).\& The format is \fBdst:src\fR where \fIdst\fR is the
absolute path of the new link and \fIsrc\fR is the absolute path of the
existing file to link to.\&
.PP
.PD 0
.IP \(bu 4
link+/lib/libfoo.\&so:/usr/lib/libfoo.\&so
.IP \(bu 4
link+/opt/bin/tool:/usr/bin/tool
.PD
.PP
Both \fIdst\fR and \fIsrc\fR must be absolute paths.\& Relative paths and path
components containing \fB.\&.\&\fR are rejected with \fBEINVAL\fR ("Invalid
argument").\& Symbolic links are not followed in any component of either
path.\& The source file is opened with \fIopenat2\fR(2) using
\fBRESOLVE_NO_XDEV\fR to prevent cross\-device path traversal.\& Parent
directories of \fIdst\fR are created automatically using \fImkdirat\fR(2) with
safe fd\-based traversal.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, link operations are silently ignored.\& This option
does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS link\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fIlink\fR except that it warns and
continues on \fBEEXIST\fR ("File exists") \fIerrno\fR(3).\& All other errors
remain fatal.\& This is useful for creating hard links that may already
exist in a tmpfs root.\& The format is the same as \fIlink\fR: \fBdst:src\fR
.PP
Take "link\-try+/lib/libfoo.\&so:/usr/lib/libfoo.\&so" as an example.\& If
\fI/lib/libfoo.\&so\fR already exists, the creation is skipped with a warning
and execution continues.\& If the link cannot be created for any other
reason (e.\&g.\& \fBEACCES\fR, \fBENOENT\fR), Syd reports the error and terminates
as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, link\-try operations are silently ignored.\& This
option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS symlink
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command causes Syd to create a symbolic link in the mount namespace
on startup using \fIsymlinkat\fR(2).\& The format is \fBdst:src\fR where \fIdst\fR is
the absolute path of the new symbolic link and \fIsrc\fR is the target the
symbolic link points to.\&
.PP
.PD 0
.IP \(bu 4
symlink+/lib/libfoo.\&so:/usr/lib/libfoo.\&so
.IP \(bu 4
symlink+/usr/lib/libfoo.\&so.\&1:libfoo.\&so
.PD
.PP
The \fIdst\fR path must be absolute.\& Relative \fIdst\fR paths and path
components containing \fB.\&.\&\fR in either \fIdst\fR or \fIsrc\fR are rejected with
\fBEINVAL\fR ("Invalid argument").\& Unlike \fIlink\fR, the \fIsrc\fR path may be
relative; this creates a relative symbolic link which is resolved at the
time the link is accessed rather than at creation time.\& Symbolic links
are not followed in the final component of \fIdst\fR.\& Parent directories of
\fIdst\fR are created automatically using \fImkdirat\fR(2) with safe fd\-based
traversal.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, symlink operations are silently ignored.\& This option
does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS symlink\-try
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
This command behaves identically to \fIsymlink\fR except that it warns and
continues on \fBEEXIST\fR ("File exists") \fIerrno\fR(3).\& All other errors
remain fatal.\& This is useful for creating symbolic links that may already
exist in a tmpfs root.\& The format is the same as \fIsymlink\fR: \fBdst:src\fR
.PP
Take "symlink\-try+/lib/libfoo.\&so:/usr/lib/libfoo.\&so" as an example.\& If
\fI/lib/libfoo.\&so\fR already exists, the creation is skipped with a warning
and execution continues.\& If the symbolic link cannot be created for any
other reason (e.\&g.\& \fBEACCES\fR, \fBENOENT\fR), Syd reports the error and
terminates as usual.\&
.PP
Escape sequences are supported in the path arguments: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\&
.PP
This option requires \fBroot:ramfs\fR or \fBroot:tmpfs\fR.\& Without a \fIramfs\fR(5)
or \fItmpfs\fR(5) root, symlink\-try operations are silently ignored.\& This
option does nothing without \fBunshare/mount:true\fR.\&
.PP
.SS workdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set the current working directory inside the mount namespace on startup.\&
The working directory is changed after all \fIbind\fR, \fIlink\fR, \fIsymlink\fR,
\fImkdir\fR, \fImkfile\fR, and \fImkfifo\fR commands have been applied.\& Use the
keywords \fBnone\fR or \fBoff\fR to unset a previously set value.\&
.PP
.PD 0
.IP \(bu 4
workdir:/tmp
.IP \(bu 4
workdir:/opt/build
.IP \(bu 4
workdir:none
.PD
.PP
The path must be absolute.\& Relative paths and path traversal using
".\&.\&" are not permitted.\& Symbolic links are not followed.\& This command
may be combined with \fImkdir\fR to first create the target directory and
then change into it.\&
.PP
This option does nothing without the \fBroot\fR command.\& This option does
nothing without \fBunshare/mount:true\fR.\&
.PP
.SS crypt
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to encrypt for \fBCrypt sandboxing\fR.\&
.PP
.SS crypt/key
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBi32\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify \fIkeyrings\fR(7) IDs of the 256\-bit AES\-CTR encryption key and
HMAC\-SHA256 authentication key for \fBCrypt sandboxing\fR.\& The ID must be a
32\-bit integer.\& To set encryption and authentication keys separately,
use the options \fBcrypt/key/enc\fR, and \fBcrypt/key/mac\fR.\& This option is a
shorthand to set both at the same time to the same key serial ID.\&
.PP
Setting an encryption key with this option implies \fBsandbox/crypt:on\fR.\&
.PP
Session keyring must be attached to the user keyring or this will fail
at startup with the EKEYREVOKED ("Key has been revoked") \fIerrno\fR(3).\&
Use the \fIsyd\-key\fR(1) utility to safely generate a key and save to
\fIkeyrings\fR(7) interface.\&
.PP
.SS crypt/key/enc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBi32\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify \fIkeyrings\fR(7) ID of the 256\-bit AES\-CTR encryption key for
\fBCrypt sandboxing\fR.\& The ID must be a 32\-bit integer.\&
.PP
Setting an encryption key with this option implies \fBsandbox/crypt:on\fR.\&
.PP
Session keyring must be attached to the user keyring or this will fail
at startup with the EKEYREVOKED ("Key has been revoked") \fIerrno\fR(3).\&
Use the \fIsyd\-key\fR(1) utility to safely generate a key and save to
\fIkeyrings\fR(7) interface.\&
.PP
.SS crypt/key/mac
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBi32\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify \fIkeyrings\fR(7) ID of the 256\-bit HMAC\-SHA256 authentication key
for \fBCrypt sandboxing\fR.\& The ID must be a 32\-bit integer.\&
.PP
Setting an encryption key with this option implies \fBsandbox/crypt:on\fR.\&
.PP
Session keyring must be attached to the user keyring or this will fail
at startup with the EKEYREVOKED ("Key has been revoked") \fIerrno\fR(3).\&
Use the \fIsyd\-key\fR(1) utility to safely generate a key and save to
\fIkeyrings\fR(7) interface.\&
.PP
.SS crypt/tmp
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
default
T}	T{
mem
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify temporary backing directory for transparent file decryption.\& The
argument must be an absolute path or the special value \fBmem\fR.\& The user
must ensure this directory is secure as decrypted contents will be
written to temporary files under this directory.\& Specify the special
value \fBmem\fR to use anonymous files which live in RAM with a volatile
backing storage created with \fImemfd_create\fR(2).\& This is the default.\& The
user is encouraged to specify this option for efficient handling of
large files for \fBCrypt sandboxing\fR.\&
.PP
Setting this option implies \fBsandbox/crypt:on\fR.\&
.PP
.SS force
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Add or remove an integrity force rule for Force Sandboxing.\& The format
is \fIforce+/path:algorithm:hashhex:action\fR for addition and \fIforce\-/path\fR
for removal.\& Use \fIforce\(ha\fR to clear the Integrity Force map.\& Available
actions are "warn", "filter", "deny", "panic", "stop", "abort", "kill"
and "exit" where the default is "deny".\& Algorithm is any supported hash
algorithm (see \fIsyd\-sum\fR(1) \fB\-a list\fR), e.\&g.\& sha256, sha3\-512,
blake2b\-256, crc32c.\& \fIhashhex\fR is the hexadecimal digest.\&
.PP
As of version 3.\&57.\&0, escape sequences are supported in the path: "\e:"
inserts a literal colon and "\e\e" inserts a literal backslash.\&
.PP
.PD 0
.IP \(bu 4
\fIsyd\-sum\fR(1) is a helper tool to calculate checksums of files.\&
.IP \(bu 4
\fIsyd\-path\fR(1) is a helper tool to write integrity force rules for binaries under PATH.\&
.PD
.PP
.SS proxy/addr
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBIP address\fR
T}
T{
default
T}	T{
\fB127.\&0.\&0.\&1\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set internal address for Proxy sandboxing.\& This must be an IPv4 or an
IPv6 address.\& Defaults to 127.\&0.\&0.\&1.\&
.PP
.SS proxy/port
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBinteger\fR
T}
T{
default
T}	T{
\fB9050\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set internal port for Proxy sandboxing.\& Defaults to 9050.\&
.PP
.SS proxy/ext/host
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBHostname or IP\fR
T}
T{
default
T}	T{
\fB127.\&0.\&0.\&1\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set external address for Proxy sandboxing.\& This must either be an IPv4
address or an IPv6 address or a hostname.\& If the argument does not parse
as an IP address, Syd resolves the name using the system DNS resolver
and selects a response IP randomly.\&
.PP
Defaults to "127.\&0.\&0.\&1", which may be be overridden with the environment variable
\fBSYD_PROXY_HOST\fR at startup.\&
.PP
.SS proxy/ext/port
.PP
.TS
allbox;l l
l l
l l
l l.
T{
type
T}	T{
\fBinteger\fR
T}
T{
default
T}	T{
\fB9050\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set external port for Proxy sandboxing.\&
.PP
Defaults to 9050, which may be overridden with the environment variable
\fBSYD_PROXY_PORT\fR at startup.\&
.PP
.SS proxy/ext/unix
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
oci
T}	T{
\fBno\fR
T}
.TE
.sp 1
Set external UNIX domain socket for Proxy sandboxing.\&
.PP
The argument may also be set using the environment variable
\fBSYD_PROXY_UNIX\fR at startup.\&
.PP
This option has precedence over the option "proxy/ext/host", ie.\& when
both are given Syd will connect to the UNIX domain socket.\&
.PP
.SS segvguard/expiry
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
120
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify SegvGuard expiry timeout in seconds.\& Set to 0 to disable SegvGuard.\&
.PP
As of version 3.\&47.\&0, duration may be passed in human readable format.\&
Refer to the documentation of the \fBdur\fR crate for more information.\&
.PP
.SS segvguard/suspension
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBduration\fR
T}
T{
default
T}	T{
600
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify SegvGuard suspension timeout in seconds.\& 0 is an invalid value.\&
.PP
As of version 3.\&47.\&0, duration may be passed in human readable format.\&
Refer to the documentation of the \fBdur\fR crate for more information.\&
.PP
.SS segvguard/maxcrashes
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBinteger (u8)\fR
T}
T{
default
T}	T{
5
T}
T{
drop
T}	T{
\fByes, reduce only\fR
T}
.TE
.sp 1
Specify SegvGuard max crashes.\& 0 is an invalid value.\&
.PP
.SS tpe/gid
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBinteger (gid_t)\fR
T}
.TE
.sp 1
Specify untrusted GID for Trusted Path Execution (TPE).\& By default, TPE
is applied to users of all groups including root and this setting can be
used to limit it to a certain group.\& To unset a previously set GID and
return to the default state set "none" as the value.\&
.PP
.SS tpe/negate
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBboolean\fR
T}
.TE
.sp 1
Negate GID logic for Trusted Path Execution (TPE).\& This turns "tpe/gid"
from untrusted into trusted such that users belonging to this group will
be exempt from TPE.\&
.PP
.SS tpe/root_owned
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Ensure file and parent directory are root\-owned for Trusted Path
Execution (TPE).\&
.PP
This option will misbehave with "unshare/user:1" if the real root user
is not mapped inside the container.\&
.PP
.SS tpe/user_owned
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBboolean\fR
T}
.TE
.sp 1
Ensure file and parent directory are user\-owned or root\-owned for
Trusted Path Execution (TPE).\&
.PP
This option may misbehave with "unshare/user:1" if the real root user is
not mapped inside the container.\&
.PP
.SS tpe/root_mount
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBboolean\fR
T}
.TE
.sp 1
Ensure file and parent directory are on root filesystem for Trusted Path
Execution (TPE).\&
.PP
This option may be used to pin all executions to a single safe mountpoint.\&
.PP
.SS allow/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to allow for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS allow/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBWalk sandboxing\fR.\&
.PP
.SS allow/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBList sandboxing\fR.\&
.PP
.SS allow/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBStat sandboxing\fR.\&
.PP
.SS allow/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBRead sandboxing\fR.\&
.PP
.SS allow/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBWrite sandboxing\fR.\&
.PP
.SS allow/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBExec sandboxing\fR.\&
.PP
.SS allow/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBCreate sandboxing\fR.\&
.PP
.SS allow/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBDelete sandboxing\fR.\&
.PP
.SS allow/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBRename sandboxing\fR.\&
.PP
.SS allow/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBReadlink sandboxing\fR.\&
.PP
.SS allow/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBSymlink sandboxing\fR.\&
.PP
.SS allow/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBTruncate sandboxing\fR.\&
.PP
.SS allow/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChdir sandboxing\fR.\&
.PP
.SS allow/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBReaddir sandboxing\fR.\&
.PP
.SS allow/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBMkdir sandboxing\fR.\&
.PP
.SS allow/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBRmdir sandboxing\fR.\&
.PP
.SS allow/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChown sandboxing\fR.\&
.PP
.SS allow/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChgrp sandboxing\fR.\&
.PP
.SS allow/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChmod sandboxing\fR.\&
.PP
.SS allow/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChattr sandboxing\fR.\&
.PP
.SS allow/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBChroot sandboxing\fR.\&
.PP
.SS allow/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBNotify sandboxing\fR.\&
.PP
.SS allow/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBUtime sandboxing\fR.\&
.PP
.SS allow/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBMkdev sandboxing\fR.\&
.PP
.SS allow/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBMkfifo sandboxing\fR.\&
.PP
.SS allow/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to allow for \fBMktemp sandboxing\fR.\&
.PP
.SS allow/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to allow for \fBBind network sandboxing\fR.\&
.PP
.SS allow/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to allow for \fBAccept network sandboxing\fR.\&
.PP
.SS allow/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to allow for \fBConnect network sandboxing\fR.\&
.PP
.SS allow/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to allow for \fBSendFd network sandboxing\fR.\&
.PP
.SS allow/net/link
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a list of netlink families to allow for \fBLink network sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of the following items: \fBroute\fR,
\fBusersock\fR, \fBfirewall\fR, \fBsock_diag\fR, \fBnflog\fR, \fBxfrm\fR, \fBselinux\fR,
\fBiscsi\fR, \fBaudit\fR, \fBfib_lookup\fR, \fBconnector\fR, \fBnetfilter\fR, \fBip6_fw\fR,
\fBdnrtmsg\fR, \fBkobject_uevent\fR, \fBgeneric\fR, \fBscsitransport\fR, \fBecryptfs\fR,
\fBrdma\fR, \fBcrypto\fR, and \fBsmc\fR.\& Use \fBall\fR to specify all families.\&
.PP
.SS allow/lock/read
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
default
T}	T{
\fI("/dev/null", "/proc")\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file read access for \fBLock
sandboxing\fR.\& This category corresponds to the Landlock access right
\fBLANDLOCK_ACCESS_FS_READ_FILE\fR and only applies to the content of the
directory not the directory itself.\& As of version 3.\&21.\&0, this set
includes the paths "/dev/null" and "/proc" by default as Syd is included
in the Landlock sandbox and Syd requires read access to these paths to
function correctly.\& As of version 3.\&46.\&0, path must not contain magic
symbolic links or parent (".\&.\&") components.\& Path is permitted to contain
regular symbolic links.\& These regular symbolic symlinks are permitted to
resolve to targets with parent (".\&.\&") components in them.\& Path may be
relative in which case it is resolved relative to the directory where
Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/write
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
default
T}	T{
\fI("/dev/null")\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file write access for \fBLock
sandboxing\fR.\& This category corresponds to the Landlock access right
\fBLANDLOCK_ACCESS_FS_WRITE_FILE\fR and only applies to the content of the
directory not the directory itself.\& As of version 3.\&21.\&0, this set
includes the path "/dev/null" by default as Syd is included in the
Landlock sandbox and Syd requires write access to this file to function
correctly.\& As of version 3.\&46.\&0, path must not contain magic symbolic
links or parent (".\&.\&") components.\& Path is permitted to contain regular
symbolic links.\& These regular symbolic symlinks are permitted to resolve
to targets with parent (".\&.\&") components in them.\& Path may be relative
in which case it is resolved relative to the directory where Syd was
executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file execute access for \fBLock
sandboxing\fR.\& This category corresponds to the Landlock access right
\fBLANDLOCK_ACCESS_FS_EXECUTE\fR and only applies to the content of the
directory not the directory itself.\& As of version 3.\&46.\&0, path must not
contain magic symbolic links or parent (".\&.\&") components.\& Path is
permitted to contain regular symbolic links.\& These regular symbolic
symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/ioctl
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant \fIioctl\fR(2) access for \fBLock
sandboxing\fR.\& This category corresponds to the Landlock access right
\fBLANDLOCK_ACCESS_FS_IOCTL_DEV\fR and only applies to the content of the
directory not the directory itself.\& Landlock \fIioctl\fR(2) support requires
ABI 5 or later.\& Fifth Landlock ABI was introduced with Linux 6.\&10.\& On
older kernels, this command is a no\-op and is not going to confine
\fIioctl\fR(2) operations.\& As of version 3.\&46.\&0, path must not contain magic
symbolic links or parent (".\&.\&") components.\& Path is permitted to contain
regular symbolic links.\& These regular symbolic symlinks are permitted to
resolve to targets with parent (".\&.\&") components in them.\& Path may be
relative in which case it is resolved relative to the directory where
Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file creation, rename and link
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_MAKE_REG\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file unlink, rename and link
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_REMOVE_FILE\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant access to link or rename a
file from or to a different directory (i.\&e.\& reparent a file hierarchy)
for \fBLock sandboxing\fR.\& This category corresponds to the Landlock access
right \fBLANDLOCK_ACCESS_FS_REFER\fR and only applies to the content of the
directory not the directory itself.\& Landlock rename support requires ABI
2 or later.\& Second Landlock ABI was introduced with Linux 5.\&19.\& On older
kernels, this type of access is always denied with Landlock.\& As of
version 3.\&46.\&0, path must not contain magic symbolic links or parent
(".\&.\&") components.\& Path is permitted to contain regular symbolic links.\&
These regular symbolic symlinks are permitted to resolve to targets with
parent (".\&.\&") components in them.\& Path may be relative in which case it
is resolved relative to the directory where Syd was executed.\& Noop without
\fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant symbolic link creation, rename
and link access for \fBLock sandboxing\fR.\& This category corresponds to the
Landlock access right \fBLANDLOCK_ACCESS_FS_MAKE_SYM\fR and only applies
to the content of the directory not the directory itself.\& As of version
3.\&46.\&0, path must not contain magic symbolic links or parent (".\&.\&")
components.\& Path is permitted to contain regular symbolic links.\& These
regular symbolic symlinks are permitted to resolve to targets with
parent (".\&.\&") components in them.\& Path may be relative in which case it
is resolved relative to the directory where Syd was executed.\& Noop without
\fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/truncate
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
default
T}	T{
\fI("/dev/null")\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant file truncation access for
\fBLock sandboxing\fR.\& This category corresponds to the Landlock access
right \fBLANDLOCK_ACCESS_FS_TRUNCATE\fR and only applies to the content of
the directory not the directory itself.\& Landlock file truncation support
requires ABI 3 or later.\& Third Landlock ABI was introduced with Linux
6.\&2.\& On older kernels, this command is a no\-op and is not going to
confine file truncation operations.\& As of version 3.\&21.\&0, this set
includes the path "/dev/null" by default as Syd is included in the
Landlock sandbox and Syd requires truncation access to this file to
function correctly.\& As of version 3.\&46.\&0, path must not contain magic
symbolic links or parent (".\&.\&") components.\& Path is permitted to
contain regular symbolic links.\& These regular symbolic symlinks are
permitted to resolve to targets with parent (".\&.\&") components in them.\&
Path may be relative in which case it is resolved relative to the
directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/readdir
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
default
T}	T{
\fI("/proc")\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant directory list access for
\fBLock sandboxing\fR.\& This category corresponds to the Landlock access
right \fBLANDLOCK_ACCESS_FS_READ_DIR\fR and applies to the directory
and the directories beneath it.\& As of version 3.\&21.\&0, this set includes
the directory "/proc" by default as Syd is included in the Landlock
sandbox and Syd requires readdir access to this directory to function
correctly.\& As of version 3.\&46.\&0, path must not contain magic symbolic
links or parent (".\&.\&") components.\& Path is permitted to contain regular
symbolic links.\& These regular symbolic symlinks are permitted to
resolve to targets with parent (".\&.\&") components in them.\& Path may be
relative in which case it is resolved relative to the directory where
Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant directory creation and rename
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_MAKE_DIR\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant directory deletion and rename
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_REMOVE_DIR\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/mkbdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant block device creation
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_MAKE_BLOCK\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/mkcdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant character device creation
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_MAKE_CHAR\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-set\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a set of beneath paths to grant named pipe (FIFO) creation
access for \fBLock sandboxing\fR.\& This category corresponds to the Landlock
access right \fBLANDLOCK_ACCESS_FS_MAKE_FIFO\fR and only applies to the
content of the directory not the directory itself.\& As of version 3.\&46.\&0,
path must not contain magic symbolic links or parent (".\&.\&") components.\&
Path is permitted to contain regular symbolic links.\& These regular
symbolic symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Path may be relative in which case it is resolved
relative to the directory where Syd was executed.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fB(u16\-set, string\-set)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a list of allowed \fIbind\fR(2) ports and UNIX domain socket paths
for \fBLock sandboxing\fR.\& This category corresponds to the \fIlandlock\fR(7)
access rights \fBLANDLOCK_ACCESS_NET_BIND_TCP\fR and
\fBLANDLOCK_ACCESS_FS_MAKE_SOCK\fR and only applies to the content of the
directory not the directory itself.\& Argument is either a single port, a
closed range in format \fBport1\-port2\fR, a comma\-separated list of ports
and/or ranges such as \fB80,443,8000\-9000\fR, or an absolute UNIX domain
socket path.\& \fIlandlock\fR(7) network support requires ABI 4 or later.\&
Fourth \fIlandlock\fR(7) ABI was introduced with Linux 6.\&7.\& On older
kernels, this command is a no\-op when specified with port arguments and
does not do any network confinement.\& As of version 3.\&46.\&0, path must not
contain magic symbolic links or parent (".\&.\&") components.\& Path is
permitted to contain regular symbolic links.\& These regular symbolic
symlinks are permitted to resolve to targets with parent (".\&.\&")
components in them.\& Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS allow/lock/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fB(u16\-set, string\-set)\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies a list of allowed \fIconnect\fR(2) ports and pathname UNIX domain
socket paths for \fBLock sandboxing\fR.\& This category corresponds to the
\fIlandlock\fR(7) access rights \fBLANDLOCK_ACCESS_NET_CONNECT_TCP\fR and
\fBLANDLOCK_ACCESS_FS_RESOLVE_UNIX\fR.\& The latter restricts both
\fIconnect\fR(2) and \fIsendmsg\fR(2) with an explicit recipient address to UNIX
domain sockets created outside the \fIlandlock\fR(7) domain.\& Argument is
either a single port, a closed range in format \fBport1\-port2\fR, a
comma\-separated list of ports and/or ranges such as \fB80,443,8000\-9000\fR,
or an absolute UNIX domain socket path.\& \fIlandlock\fR(7) network support
requires ABI 4 or later.\& Fourth \fIlandlock\fR(7) ABI was introduced with
Linux 6.\&7.\& UNIX domain socket support requires ABI 9 or later.\& Ninth
\fIlandlock\fR(7) ABI was introduced with Linux 7.\&1.\& On older kernels, this
command is a no\-op when specified with the unsupported argument kind and
does not do any confinement.\& As of version 3.\&46.\&0, path must not contain
magic symbolic links or parent (".\&.\&") components.\& Path is permitted to
contain regular symbolic links.\& These regular symbolic symlinks are
permitted to resolve to targets with parent (".\&.\&") components in them.\&
Noop without \fBsandbox/lock:on\fR.\&
.PP
.SS warn/fs
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to warn for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS warn/walk
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBWalk sandboxing\fR.\&
.PP
.SS warn/list
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBList sandboxing\fR.\&
.PP
.SS warn/stat
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBStat sandboxing\fR.\&
.PP
.SS warn/read
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBRead sandboxing\fR.\&
.PP
.SS warn/write
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBWrite sandboxing\fR.\&
.PP
.SS warn/exec
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBExec sandboxing\fR.\&
.PP
.SS warn/create
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBCreate sandboxing\fR.\&
.PP
.SS warn/delete
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBDelete sandboxing\fR.\&
.PP
.SS warn/rename
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBRename sandboxing\fR.\&
.PP
.SS warn/readlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBReadlink sandboxing\fR.\&
.PP
.SS warn/symlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBSymlink sandboxing\fR.\&
.PP
.SS warn/truncate
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBTruncate sandboxing\fR.\&
.PP
.SS warn/chdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChdir sandboxing\fR.\&
.PP
.SS warn/readdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBReaddir sandboxing\fR.\&
.PP
.SS warn/mkdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBMkdir sandboxing\fR.\&
.PP
.SS warn/rmdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBRmdir sandboxing\fR.\&
.PP
.SS warn/chown
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChown sandboxing\fR.\&
.PP
.SS warn/chgrp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChgrp sandboxing\fR.\&
.PP
.SS warn/chmod
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChmod sandboxing\fR.\&
.PP
.SS warn/chattr
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChattr sandboxing\fR.\&
.PP
.SS warn/chroot
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBChroot sandboxing\fR.\&
.PP
.SS warn/notify
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBNotify sandboxing\fR.\&
.PP
.SS warn/utime
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBUtime sandboxing\fR.\&
.PP
.SS warn/mkdev
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBMkdev sandboxing\fR.\&
.PP
.SS warn/mkfifo
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBMkfifo sandboxing\fR.\&
.PP
.SS warn/mktemp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to warn for \fBMktemp sandboxing\fR.\&
.PP
.SS warn/net/bind
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to warn for \fBBind network sandboxing\fR.\&
.PP
.SS warn/net/accept
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to warn for \fBAccept network sandboxing\fR.\&
.PP
.SS warn/net/connect
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to warn for \fBConnect network sandboxing\fR.\&
.PP
.SS warn/net/sendfd
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to warn for \fBSendFd network sandboxing\fR.\&
.PP
.SS deny/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to deny for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS deny/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBWalk sandboxing\fR.\&
.PP
.SS deny/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBList sandboxing\fR.\&
.PP
.SS deny/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBStat sandboxing\fR.\&
.PP
.SS deny/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBRead sandboxing\fR.\&
.PP
.SS deny/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBWrite sandboxing\fR.\&
.PP
.SS deny/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBExec sandboxing\fR.\&
.PP
.SS deny/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBCreate sandboxing\fR.\&
.PP
.SS deny/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBDelete sandboxing\fR.\&
.PP
.SS deny/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBRename sandboxing\fR.\&
.PP
.SS deny/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBReadlink sandboxing\fR.\&
.PP
.SS deny/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBSymlink sandboxing\fR.\&
.PP
.SS deny/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBTruncate sandboxing\fR.\&
.PP
.SS deny/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChdir sandboxing\fR.\&
.PP
.SS deny/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBReaddir sandboxing\fR.\&
.PP
.SS deny/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBMkdir sandboxing\fR.\&
.PP
.SS deny/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBRmdir sandboxing\fR.\&
.PP
.SS deny/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChown sandboxing\fR.\&
.PP
.SS deny/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChgrp sandboxing\fR.\&
.PP
.SS deny/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChmod sandboxing\fR.\&
.PP
.SS deny/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChattr sandboxing\fR.\&
.PP
.SS deny/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBChroot sandboxing\fR.\&
.PP
.SS deny/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBNotify sandboxing\fR.\&
.PP
.SS deny/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBUtime sandboxing\fR.\&
.PP
.SS deny/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBMkdev sandboxing\fR.\&
.PP
.SS deny/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBMkfifo sandboxing\fR.\&
.PP
.SS deny/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to deny for \fBMktemp sandboxing\fR.\&
.PP
.SS deny/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to deny for \fBBind network sandboxing\fR.\&
.PP
.SS deny/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to deny for \fBAccept network sandboxing\fR.\&
.PP
.SS deny/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to deny for \fBConnect network sandboxing\fR.\&
.PP
.SS deny/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to deny for \fBSendFd network sandboxing\fR.\&
.PP
.SS filter/fs
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to filter for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS filter/walk
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBWalk sandboxing\fR.\&
.PP
.SS filter/list
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBList sandboxing\fR.\&
.PP
.SS filter/stat
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBStat sandboxing\fR.\&
.PP
.SS filter/read
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBRead sandboxing\fR.\&
.PP
.SS filter/write
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBWrite sandboxing\fR.\&
.PP
.SS filter/exec
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBExec sandboxing\fR.\&
.PP
.SS filter/create
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBCreate sandboxing\fR.\&
.PP
.SS filter/delete
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBDelete sandboxing\fR.\&
.PP
.SS filter/rename
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBRename sandboxing\fR.\&
.PP
.SS filter/readlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBReadlink sandboxing\fR.\&
.PP
.SS filter/symlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBSymlink sandboxing\fR.\&
.PP
.SS filter/truncate
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBTruncate sandboxing\fR.\&
.PP
.SS filter/chdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChdir sandboxing\fR.\&
.PP
.SS filter/readdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBReaddir sandboxing\fR.\&
.PP
.SS filter/mkdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBMkdir sandboxing\fR.\&
.PP
.SS filter/rmdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBRmdir sandboxing\fR.\&
.PP
.SS filter/chown
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChown sandboxing\fR.\&
.PP
.SS filter/chgrp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChgrp sandboxing\fR.\&
.PP
.SS filter/chmod
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChmod sandboxing\fR.\&
.PP
.SS filter/chattr
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChattr sandboxing\fR.\&
.PP
.SS filter/chroot
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBChroot sandboxing\fR.\&
.PP
.SS filter/notify
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBNotify sandboxing\fR.\&
.PP
.SS filter/utime
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBUtime sandboxing\fR.\&
.PP
.SS filter/mkdev
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBMkdev sandboxing\fR.\&
.PP
.SS filter/mkfifo
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBMkfifo sandboxing\fR.\&
.PP
.SS filter/mktemp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to filter for \fBMktemp sandboxing\fR.\&
.PP
.SS filter/net/bind
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to filter for \fBBind network sandboxing\fR.\&
.PP
.SS filter/net/accept
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to filter for \fBAccept network sandboxing\fR.\&
.PP
.SS filter/net/connect
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to filter for \fBConnect network sandboxing\fR.\&
.PP
.SS filter/net/sendfd
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to filter for \fBSendFd network sandboxing\fR.\&
.PP
.SS panic/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to panic for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS panic/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBWalk sandboxing\fR.\&
.PP
.SS panic/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBList sandboxing\fR.\&
.PP
.SS panic/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBStat sandboxing\fR.\&
.PP
.SS panic/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBRead sandboxing\fR.\&
.PP
.SS panic/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBWrite sandboxing\fR.\&
.PP
.SS panic/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBExec sandboxing\fR.\&
.PP
.SS panic/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBCreate sandboxing\fR.\&
.PP
.SS panic/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBDelete sandboxing\fR.\&
.PP
.SS panic/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBRename sandboxing\fR.\&
.PP
.SS panic/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBReadlink sandboxing\fR.\&
.PP
.SS panic/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBSymlink sandboxing\fR.\&
.PP
.SS panic/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBTruncate sandboxing\fR.\&
.PP
.SS panic/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChdir sandboxing\fR.\&
.PP
.SS panic/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBReaddir sandboxing\fR.\&
.PP
.SS panic/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBMkdir sandboxing\fR.\&
.PP
.SS panic/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBRmdir sandboxing\fR.\&
.PP
.SS panic/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChown sandboxing\fR.\&
.PP
.SS panic/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChgrp sandboxing\fR.\&
.PP
.SS panic/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChmod sandboxing\fR.\&
.PP
.SS panic/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChattr sandboxing\fR.\&
.PP
.SS panic/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBChroot sandboxing\fR.\&
.PP
.SS panic/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBNotify sandboxing\fR.\&
.PP
.SS panic/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBUtime sandboxing\fR.\&
.PP
.SS panic/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBMkdev sandboxing\fR.\&
.PP
.SS panic/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBMkfifo sandboxing\fR.\&
.PP
.SS panic/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to panic for \fBMktemp sandboxing\fR.\&
.PP
.SS panic/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to panic for \fBBind network sandboxing\fR.\&
.PP
.SS panic/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to panic for \fBAccept network sandboxing\fR.\&
.PP
.SS panic/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to panic for \fBConnect network sandboxing\fR.\&
.PP
.SS panic/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to panic for \fBSendFd network sandboxing\fR.\&
.PP
.SS stop/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to stop for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS stop/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBWalk sandboxing\fR.\&
.PP
.SS stop/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBList sandboxing\fR.\&
.PP
.SS stop/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBStat sandboxing\fR.\&
.PP
.SS stop/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBRead sandboxing\fR.\&
.PP
.SS stop/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBWrite sandboxing\fR.\&
.PP
.SS stop/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBExec sandboxing\fR.\&
.PP
.SS stop/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBCreate sandboxing\fR.\&
.PP
.SS stop/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBDelete sandboxing\fR.\&
.PP
.SS stop/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBRename sandboxing\fR.\&
.PP
.SS stop/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBReadlink sandboxing\fR.\&
.PP
.SS stop/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBSymlink sandboxing\fR.\&
.PP
.SS stop/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBTruncate sandboxing\fR.\&
.PP
.SS stop/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChdir sandboxing\fR.\&
.PP
.SS stop/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBReaddir sandboxing\fR.\&
.PP
.SS stop/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBMkdir sandboxing\fR.\&
.PP
.SS stop/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBRmdir sandboxing\fR.\&
.PP
.SS stop/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChown sandboxing\fR.\&
.PP
.SS stop/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChgrp sandboxing\fR.\&
.PP
.SS stop/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChmod sandboxing\fR.\&
.PP
.SS stop/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChattr sandboxing\fR.\&
.PP
.SS stop/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBChroot sandboxing\fR.\&
.PP
.SS stop/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBNotify sandboxing\fR.\&
.PP
.SS stop/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBUtime sandboxing\fR.\&
.PP
.SS stop/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBMkdev sandboxing\fR.\&
.PP
.SS stop/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBMkfifo sandboxing\fR.\&
.PP
.SS stop/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to stop for \fBMktemp sandboxing\fR.\&
.PP
.SS stop/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to stop for \fBBind network sandboxing\fR.\&
.PP
.SS stop/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to stop for \fBAccept network sandboxing\fR.\&
.PP
.SS stop/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to stop for \fBConnect network sandboxing\fR.\&
.PP
.SS stop/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to stop for \fBSendFd network sandboxing\fR.\&
.PP
.SS abort/fs
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to abort for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS abort/walk
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBWalk sandboxing\fR.\&
.PP
.SS abort/list
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBList sandboxing\fR.\&
.PP
.SS abort/stat
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBStat sandboxing\fR.\&
.PP
.SS abort/read
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBRead sandboxing\fR.\&
.PP
.SS abort/write
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBWrite sandboxing\fR.\&
.PP
.SS abort/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBExec sandboxing\fR.\&
.PP
.SS abort/create
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBCreate sandboxing\fR.\&
.PP
.SS abort/delete
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBDelete sandboxing\fR.\&
.PP
.SS abort/rename
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBRename sandboxing\fR.\&
.PP
.SS abort/readlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBReadlink sandboxing\fR.\&
.PP
.SS abort/symlink
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBSymlink sandboxing\fR.\&
.PP
.SS abort/truncate
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBTruncate sandboxing\fR.\&
.PP
.SS abort/chdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChdir sandboxing\fR.\&
.PP
.SS abort/readdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBReaddir sandboxing\fR.\&
.PP
.SS abort/mkdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBMkdir sandboxing\fR.\&
.PP
.SS abort/rmdir
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBRmdir sandboxing\fR.\&
.PP
.SS abort/chown
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChown sandboxing\fR.\&
.PP
.SS abort/chgrp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChgrp sandboxing\fR.\&
.PP
.SS abort/chmod
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChmod sandboxing\fR.\&
.PP
.SS abort/chattr
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChattr sandboxing\fR.\&
.PP
.SS abort/chroot
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBChroot sandboxing\fR.\&
.PP
.SS abort/notify
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBNotify sandboxing\fR.\&
.PP
.SS abort/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, remove only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBUtime sandboxing\fR.\&
.PP
.SS abort/mkdev
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBMkdev sandboxing\fR.\&
.PP
.SS abort/mkfifo
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBMkfifo sandboxing\fR.\&
.PP
.SS abort/mktemp
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to abort for \fBMktemp sandboxing\fR.\&
.PP
.SS abort/net/bind
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to abort for \fBBind network sandboxing\fR.\&
.PP
.SS abort/net/accept
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to abort for \fBAccept network sandboxing\fR.\&
.PP
.SS abort/net/connect
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to abort for \fBConnect network sandboxing\fR.\&
.PP
.SS abort/net/sendfd
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to abort for \fBSendFd network sandboxing\fR.\&
.PP
.SS kill/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to kill for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS kill/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBWalk sandboxing\fR.\&
.PP
.SS kill/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBList sandboxing\fR.\&
.PP
.SS kill/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBStat sandboxing\fR.\&
.PP
.SS kill/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBRead sandboxing\fR.\&
.PP
.SS kill/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBWrite sandboxing\fR.\&
.PP
.SS kill/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBExec sandboxing\fR.\&
.PP
.SS kill/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBCreate sandboxing\fR.\&
.PP
.SS kill/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBDelete sandboxing\fR.\&
.PP
.SS kill/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBRename sandboxing\fR.\&
.PP
.SS kill/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBReadlink sandboxing\fR.\&
.PP
.SS kill/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBSymlink sandboxing\fR.\&
.PP
.SS kill/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBTruncate sandboxing\fR.\&
.PP
.SS kill/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChdir sandboxing\fR.\&
.PP
.SS kill/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBReaddir sandboxing\fR.\&
.PP
.SS kill/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBMkdir sandboxing\fR.\&
.PP
.SS kill/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBRmdir sandboxing\fR.\&
.PP
.SS kill/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChown sandboxing\fR.\&
.PP
.SS kill/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChgrp sandboxing\fR.\&
.PP
.SS kill/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChmod sandboxing\fR.\&
.PP
.SS kill/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChattr sandboxing\fR.\&
.PP
.SS kill/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBChroot sandboxing\fR.\&
.PP
.SS kill/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBNotify sandboxing\fR.\&
.PP
.SS kill/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBUtime sandboxing\fR.\&
.PP
.SS kill/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBMkdev sandboxing\fR.\&
.PP
.SS kill/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBMkfifo sandboxing\fR.\&
.PP
.SS kill/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to kill for \fBMktemp sandboxing\fR.\&
.PP
.SS kill/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to kill for \fBBind network sandboxing\fR.\&
.PP
.SS kill/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to kill for \fBAccept network sandboxing\fR.\&
.PP
.SS kill/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to kill for \fBConnect network sandboxing\fR.\&
.PP
.SS kill/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to kill for \fBSendFd network sandboxing\fR.\&
.PP
.SS exit/fs
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of filesystem types to exit for \fBFilesystem sandboxing\fR.\&
.PP
Accepts a comma\-delimited list of strings and unsigned 64\-bit integers
as argument.\& Prefix with \fB0x\fR for hexadecimal and \fB0o\fR for octal input.\&
.PP
.SS exit/walk
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBWalk sandboxing\fR.\&
.PP
.SS exit/list
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBList sandboxing\fR.\&
.PP
.SS exit/stat
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBStat sandboxing\fR.\&
.PP
.SS exit/read
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBRead sandboxing\fR.\&
.PP
.SS exit/write
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBWrite sandboxing\fR.\&
.PP
.SS exit/exec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBExec sandboxing\fR.\&
.PP
.SS exit/create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBCreate sandboxing\fR.\&
.PP
.SS exit/delete
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBDelete sandboxing\fR.\&
.PP
.SS exit/rename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBRename sandboxing\fR.\&
.PP
.SS exit/readlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBReadlink sandboxing\fR.\&
.PP
.SS exit/symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBSymlink sandboxing\fR.\&
.PP
.SS exit/truncate
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBTruncate sandboxing\fR.\&
.PP
.SS exit/chdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChdir sandboxing\fR.\&
.PP
.SS exit/readdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBReaddir sandboxing\fR.\&
.PP
.SS exit/mkdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBMkdir sandboxing\fR.\&
.PP
.SS exit/rmdir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBRmdir sandboxing\fR.\&
.PP
.SS exit/chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChown sandboxing\fR.\&
.PP
.SS exit/chgrp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChgrp sandboxing\fR.\&
.PP
.SS exit/chmod
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChmod sandboxing\fR.\&
.PP
.SS exit/chattr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChattr sandboxing\fR.\&
.PP
.SS exit/chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBChroot sandboxing\fR.\&
.PP
.SS exit/notify
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBNotify sandboxing\fR.\&
.PP
.SS exit/utime
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBUtime sandboxing\fR.\&
.PP
.SS exit/mkdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBMkdev sandboxing\fR.\&
.PP
.SS exit/mkfifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBMkfifo sandboxing\fR.\&
.PP
.SS exit/mktemp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to exit for \fBMktemp sandboxing\fR.\&
.PP
.SS exit/net/bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to exit for \fBBind network sandboxing\fR.\&
.PP
.SS exit/net/accept
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to exit for \fBAccept network sandboxing\fR.\&
.PP
.SS exit/net/connect
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to exit for \fBConnect network sandboxing\fR.\&
.PP
.SS exit/net/sendfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a list of network address patterns to exit for \fBSendFd network sandboxing\fR.\&
.PP
.SS append
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns.\& Matching paths are treated as
append\-only.\&
.PP
\fIopen\fR(2), \fIopenat\fR(2) and \fIopenat2\fR(2) are denied with \fBEPERM\fR when the
flags lack \fBO_APPEND\fR for writable access modes, or contain \fBO_TRUNC\fR
regardless of the access mode.\&
.PP
The following system calls are denied with \fBEPERM\fR on append\-only paths:
\fIchmod\fR(2), \fIchown\fR(2), \fIcreat\fR(2), \fIfallocate\fR(2), \fIfchmod\fR(2),
\fIfchmodat\fR(2), \fIfchmodat2\fR(2), \fIfchown\fR(2), \fIfchown32\fR(2),
\fIfchownat\fR(2), \fIfremovexattr\fR(2), \fIfsetxattr\fR(2), \fIftruncate\fR(2),
\fIftruncate64\fR(2), \fIfutimesat\fR(2), \fIlchown\fR(2), \fIlink\fR(2), \fIlinkat\fR(2),
\fIlremovexattr\fR(2), \fIlsetxattr\fR(2), \fIremovexattr\fR(2), \fIremovexattrat\fR(2),
\fIrename\fR(2), \fIrenameat\fR(2), \fIrenameat2\fR(2), \fIsetxattr\fR(2),
\fIsetxattrat\fR(2), \fItruncate\fR(2), \fItruncate64\fR(2), \fIunlink\fR(2),
\fIunlinkat\fR(2), \fIutime\fR(2), \fIutimensat\fR(2), \fIutimensat_time64\fR(2) and
\fIutimes\fR(2).\&
.PP
Clearing \fBO_APPEND\fR via \fIfcntl\fR(2) or \fIfcntl64\fR(2) \fBF_SETFL\fR is denied
with \fBEPERM\fR.\&
.PP
Writable shared memory mappings via \fImmap\fR(2) or \fImmap2\fR(2) with
\fBMAP_SHARED\fR and \fBPROT_WRITE\fR are denied with \fBEPERM\fR.\&
.PP
\fIpwritev2\fR(2) with the \fBRWF_NOAPPEND\fR flag is denied with \fBEOPNOTSUPP\fR
via a \fIseccomp\fR(2) filter installed in the sandbox process.\&
.PP
.SS mask
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-map\fR
T}
.TE
.sp 1
Specifies a list of \fIglob\fR(3p) patterns to mask for \fBRead & Write sandboxing\fR.\&
.PP
If a path is masked, Syd returns a file descriptor to \fB/dev/null\fR on any
sandbox granted attempt to \fIopen\fR(2) this path.\& Masking can effectively
be used to hide the contents of a file in a more relaxed and compatible
way than denying read/write access to it.\& \fIstat\fR(2) calls on a masked
file returns the original file metadata and a masked file may be
executed.\& After a successful mask operation, the mask path is \fInot\fR
checked for sandbox access.\&
.PP
As of version 3.\&35.\&1, the default mask path \fB/dev/null\fR may be changed
by specifying a colon\-separated extra path to the mask\-add command, e.\&g.\&
\fBmask+/dev/[fn]ull:/dev/zero\fR when both of the paths \fB/dev/full\fR and
\fB/dev/null\fR will be masked with the path \fB/dev/zero\fR.\& The mask path must
be a fully canonicalized path without symbolic links.\&
.PP
As of version 3.\&36.\&0, the default mask path may be overridden for
directories by specifying an additional colon\-separated extra path to
the mask\-add command, e.\&g.\& \fBmask+/proc/acpi/***:/dev/null:/var/empty\fR
when the path \fB/proc/acpi/wakeup\fR which is a regular file will return
\fB/dev/null\fR at \fIopen\fR(2) boundary but the directory \fB/proc/acpi\fR and any
subdirectory within will return \fB/var/empty\fR at \fIopen\fR(2) boundary.\& The
mask path must be a fully canonicalized path without symbolic links.\&
.PP
As of version 3.\&49.\&0, escape sequences are supported: "\e:" inserts a
literal colon and "\e\e" inserts a literal backslash.\& This allows
patterns containing colons, e.\&g.\& \fBmask+/path\e:with\e:colons\fR.\&
.PP
These escape sequences are resolved by the command parser before the
resulting pattern is matched as a \fIglob\fR(3p) expression.\& Within the glob
a backslash escapes the character that follows it, so a literal glob
metacharacter ("*", "?\&" or "[") is matched by preceding it with a
doubled backslash.\& The parser first collapses the doubled backslash to a
single backslash, which the glob matcher then applies to the following
metacharacter.\& A lone backslash that is not part of a "\e:" or "\e\e"
sequence is rejected with \fBEINVAL\fR ("Invalid argument").\&
.PP
As of version 3.\&51.\&0, masked paths return the information of the target
path at \fIstat\fR(2) boundary and masked paths are protected against
filesystem writes akin to \fBappend\fR only paths.\&
.PP
This feature provides a non\-privileged alternative to the \fBbind\fR command
because it does not require the creation of a mount namespace.\& In addition,
\fBmask\fR commands may be specified dynamically after startup using the
\fIsyd\fR(2) API allowing for fine\-tuned and/or incremental confinement.\&
.PP
.SS block
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBip\-range\fR
T}
T{
drop
T}	T{
\fByes, add only\fR
T}
.TE
.sp 1
Specifies a range of IP networks to be blocked when specified as the
target address of \fBconnect\fR group system calls which are \fIconnect\fR(2),
\fIsendto\fR(2), \fIsendmsg\fR(2), \fIsendmmsg\fR(2) and when received as the source
address in return from \fIaccept\fR(2) and \fIaccept4\fR(2) system calls for
IPv4 and IPv6 family sockets.\& Use \fBblock+<net>\fR and \fBblock\-<net>\fR to add
and remove ip networks from the range.\& Alternatively the range can also
be populated by including \fBipset\fR and \fBnetset\fR files from within Syd
configuration.\& Use \fBblock\(ha\fR to clear the list and \fBblock!\&\fR to simplify
the ip range by aggregating networks together.\& \fBblock!\&\fR is useful to
call after importing big IP blocklists, it helps reduce memory
consumption and improve matching performance.\& Below is a configuration
snippet that imports Feodo and DShield blocklists:
.PP
.nf
.RS 4
# Enable IP blocklists
# Source: https://github\&.com/firehol/blocklist\-ipsets\&.git
include /usr/src/blocklist\-ipsets/feodo\&.ipset
include /usr/src/blocklist\-ipsets/feodo_badips\&.ipset
include /usr/src/blocklist\-ipsets/dshield\&.netset
include /usr/src/blocklist\-ipsets/dshield_1d\&.netset
include /usr/src/blocklist\-ipsets/dshield_30d\&.netset
include /usr/src/blocklist\-ipsets/dshield_7d\&.netset
include /usr/src/blocklist\-ipsets/dshield_top_1000\&.ipset
block!
.fi
.RE
.PP
.SS domain
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Define, remove, or clear sandbox \fIdomains\fR.\& A domain is a named,
self\-contained sandbox policy.\& Refer to the \fBDomain Transitions\fR section
of the \fIsyd\fR(7) manual page for the model.\& The operators are:
.PP
.PD 0
.IP \(bu 4
\fBdomain+@<name>\fR: define a new, empty domain named \fI<name>\fR.\&
.IP \(bu 4
\fBdomain+@<name>:<seed>\fR: define \fI<name>\fR and initialise its policy
.PD
from \fI<seed>\fR, which is \fI@<other>\fR to clone an existing domain (e.\&g.\&
\fI@default\fR), an absolute path to read a configuration file, or a
built\-in profile name.\& The leading character selects the form (\fI@\fR a
domain, \fI/\fR a file, otherwise a profile name).\&
.PD 0
.IP \(bu 4
\fBdomain\-@<name>\fR: remove the domain \fI<name>\fR.\&
.IP \(bu 4
\fBdomain\(ha\fR: remove every domain except \fIdefault\fR.\&
.PD
.PP
The domain \fIdefault\fR always exists and may neither be redefined
(\fBEEXIST\fR: "File exists") nor removed (\fBEPERM\fR: "Operation not
permitted").\& A domain name is 1 to 16 bytes, letter\-first ASCII
alphanumeric with underscore (\fI[A\-Za\-z][A\-Za\-z0\-9_]*\fR).\& A longer name
fails with \fBENAMETOOLONG\fR ("File name too long"), and the empty name or
any byte that breaks the pattern (a leading digit or underscore,
punctuation, whitespace, a control byte, NUL, or non\-ASCII) fails with
\fBEILSEQ\fR ("Invalid or incomplete multibyte or wide character").\& At most
64 domains may be defined, including \fIdefault\fR, exceeding this fails
with \fBENOSPC\fR ("No space left on device").\& A domain that is the target
of a move (see the \fBmove\fR command) may not be removed while that move
exists (\fBEBUSY\fR: "Device or resource busy").\&
.PP
Configuration is directed to a defined domain by prefixing a per\-domain
command with \fI@<name>/\fR, e.\&g.\& \fI@web/allow/read+/etc/hosts\fR.\& An
unprefixed command applies to \fIdefault\fR.\& A reference to an undefined
domain fails with \fBEINVAL\fR ("Invalid argument").\& A process\-global
setting (one documented as \fIstatic\fR) is not part of any domain'\&s policy
and may not be addressed to a domain, the attempt fails with \fBEINVAL\fR
("Invalid argument").\&
.PP
.SS move
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
.TE
.sp 1
Declare automatic domain transitions, termed \fImoves\fR, for a domain.\&
Refer to the \fBDomain Transitions\fR section of the \fIsyd\fR(7) manual page
for the model.\& The forms are:
.PP
.nf
.RS 4
move/@<to>/<kind>+<pattern>    # Add a move\&.
move/@<to>/<kind>\-<pattern>    # Remove that move\&.
move/@<to>/<kind>^             # Remove all moves of this kind\&.
.fi
.RE
.PP
each optionally prefixed with \fI@<from>/\fR to attach it to a domain other
than \fIdefault\fR.\& While the sandbox is in the source domain, an allowed
operation of kind \fI<kind>\fR whose target matches \fI<pattern>\fR switches the
active domain to \fI<to>\fR.\& The move takes effect only when the operation
is itself permitted, and never grants a denied operation.\& The kinds and
their patterns are:
.PP
.PD 0
.IP \(bu 4
\fBexit\fR: the exit of a process whose executable path matches \fI<pattern>\fR.\&
.IP \(bu 4
\fBexec\fR: an \fIexecve\fR(2)/\fIexecveat\fR(2) of a binary whose path matches the
.PD
\fIglob\fR(3p) pattern \fI<pattern>\fR.\&
.PD 0
.IP \(bu 4
\fBchdir\fR: a \fIchdir\fR(2)/\fIfchdir\fR(2) to a directory matching \fI<pattern>\fR.\&
.IP \(bu 4
\fBmmap\fR: an \fImmap\fR(2) of a file whose path matches \fI<pattern>\fR.\&
.IP \(bu 4
\fBbind\fR: a \fIbind\fR(2) to an address matching \fI<pattern>\fR.\&
.IP \(bu 4
\fBconnect\fR: a \fIconnect\fR(2) or connected send to an address matching \fI<pattern>\fR.\&
.IP \(bu 4
\fBaccept\fR: an \fIaccept\fR(2)/\fIaccept4\fR(2) of a peer matching \fI<pattern>\fR.\&
.PD
.PP
The target domain \fI<to>\fR and any source domain \fI<from>\fR must already be defined
(\fBEINVAL\fR).\& For example:
.PP
.nf
.RS 4
move/@net/exec+/usr/bin/curl          # In the default domain, exec curl \-> @net
@web/move/@db/connect+0\&.0\&.0\&.0/0!5432  # In @web, an allowed :5432 connect \-> @db
.fi
.RE
.PP
Network patterns for \fBbind\fR, \fBconnect\fR, and \fBaccept\fR use the same syntax
as the network sandboxing rules.\&
.PP
.SS cmd/exec
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBcommand\fR
T}
.TE
.sp 1
Makes Syd execute an external command without sandboxing.\& The process is
executed in a new process group with its standard input attached to
\fB/dev/null\fR.\& Standard output and standard error file descriptors are
inherited.\& Syd also ensures no non\-standard file descriptors leak into
the new process utilizing the \fIclose_range\fR(2) system call.\& Current
working directory is changed to the root directory, i.\&e.\& \fB/\fR.\& The
\fIumask\fR(2) is set to 077.\& The program name and arguments must be
separated with the \fBUS\fR (unit separator, hex: 0x1f, octal: 037)
character.\& To ease usage, the \fIsyd\-exec\fR(1) helper utility is provided
to construct a sandbox command of this type:
.PP
.nf
.RS 4
; syd \-puser \-mlock:exec \-\- sh \-c \&'test \-c $(syd\-exec echo hello world)\&'
hello world
;
.fi
.RE
.PP
.SS cmd/move
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBcommand\fR
T}
.TE
.sp 1
Move the sandbox to a named domain.\& This is the manual form of a domain
transition.\& Refer to the \fBDomain Transitions\fR section of the \fIsyd\fR(7)
manual page.\& The active domain is switched with \fIcmd/move!\&<name>\fR.\& The
\fI@\fR sigil is optional after the \fI!\&\fR operator, so \fIcmd/move!\&web\fR and
\fIcmd/move!\&@web\fR are equivalent.\& The named domain must be defined,
otherwise the command fails with \fBEINVAL\fR ("Invalid argument").\&
.PP
.SS load
.PP
.TS
allbox;l l.
T{
type
T}	T{
\fBinteger (fd) or string (profile\-name)\fR
T}
.TE
.sp 1
Read configuration from the given file descriptor, the file must be a
regular file opened for reading.\& Syd uses \fIpidfd_getfd\fR(2) to acquire
the file descriptor and reads sandbox configuration from it.\& This
command is useful to load a set of sandbox commands into Syd in a single
step, e.\&g:
.PP
.nf
.RS 4
int fd = open("/tmp", O_RDWR | O_TMPFILE | O_CLOEXEC, 0);
if (fd == \-1) errx(1, "Failed to open temporary file");

const char *syd = "sandbox:stat/on\\nallow/stat+/***\\ndeny/stat+/\\nlock:on\\n";
errx(write(fd, syd, strlen(syd)) == \-1, "Failed to write config");
errx(lseek(fd, 0, SEEK_SET) == \-1, "Failed to seek in file");

char load[64];
sprintf(load, "/dev/syd/load/%d", fd);
errx(stat(load, NULL) == \-1, "Failed to load Syd profile");

errx(execvp("/bin/sh", (char *[]){"/bin/sh", "\-l", NULL}) == \-1, "execvp failed");
.fi
.RE
.PP
Due to security reasons, this command is only available via the virtual
\fIstat\fR(2) call, it may not be used with the \fB\-m\fR command line switch or
in a configuration file.\&
.PP
As of version 3.\&30.\&0, this command may be used to load builtin profiles,
when Syd falls back to parsing the "load" argument as a profile name if
parsing the argument as a file descriptor fails.\&
.PP
.SS trace/allow_safe_setuid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Enable \fBSafeSetID\fR and retain the Linux capability \fBCAP_SETUID\fR.\& This
option is implied at startup if any UID transits were defined with the
\fBsetuid\fR command.\& This feature allows Syd to change UID simultaneously
with the sandbox process.\& Because NPTL uses reserved signals to ensure
all threads share the same UID/GID, setting this option disables the
SROP mitigator.\& Refer to the \fBEnhanced Execution Control (EEC)\fR section
of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_safe_setgid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Enable \fBSafeSetID\fR and retain the Linux capability \fBCAP_SETGID\fR.\& This
option is implied at startup if any GID transits were defined with the
\fBsetuid\fR command.\& This feature allows Syd to change GID simultaneously
with the sandbox process.\& Because NPTL uses reserved signals to ensure
all threads share the same UID/GID, setting this option disables the
SROP mitigator.\& Refer to the \fBEnhanced Execution Control (EEC)\fR section
of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS setuid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fB[(uid_t, uid_t)]\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Add, remove a UID transition or reset UID transitions.\& Accepts only
numeric user IDs, not user names.\& Only a single transition from a source
UID can be defined.\& Target UID can not be less than or equal to the
build default \fB11\fR, which is typically the \fBoperator\fR user.\& Defining a
UID transit with this option implies \fBtrace/allow_safe_setuid:true\fR.\&
.PP
Usage:
.PP
.nf
.RS 4
setuid+0:65534      # Define a UID transition from root to nobody\&.
setuid\-0:65534      # Remove a previously defined UID transition\&.
setuid^0            # Remove all UID transitions matching source UID\&.
setuid^             # Remove all UID transitions\&.
.fi
.RE
.PP
.SS setgid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fB[(gid_t, gid_t)]\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Add, remove a GID transition or reset GID transitions.\& Accepts only
numeric group IDs, not group names.\& Only a single transition from a
source GID can be defined.\& Target GID can not be less than or equal to
the build default \fB14\fR, which is typically the \fBuucp\fR group.\& Defining a
GID transit with this option implies \fBtrace/allow_safe_setgid:true\fR.\&
.PP
Usage:
.PP
.nf
.RS 4
setgid+0:65534      # Define a GID transition from root to nogroup\&.
setgid\-0:65534      # Remove a previously defined GID transition\&.
setgid^0            # Remove all GID transitions matching source GID\&.
setgid^             # Remove all GID transitions\&.
.fi
.RE
.PP
.SS trace/allow_unsafe_setid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether Syd should deny with \fBEPERM\fR ("Operation
not permitted") rather than terminate \fIsetuid\fR(2) changes with target
UID less than or equal to the build default \fB11\fR, which is typically the
\fBoperator\fR user and \fIsetgid\fR(2) changes with target GID less than or
equal to the build default \fB14\fR, which is typically the \fBuucp\fR group.\&
.PP
.SS trace/allow_unsafe_cbpf
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether Syd should allow additional \fIseccomp\fR(2)
cbpf filters to be installed by sandbox processes.\& By default, this is
denied to mitigate confused deputy problems and \fIerrno\fR(3) is set to
\fBEINVAL\fR ("Invalid argument") for compatibility reasons.\& On the one
hand, stacked \fIseccomp\fR(2) cbpf filters allow for incremental
confinement and therefore added hardening, on the other hand they may be
abused to install system call filters with more precedent actions than
user\-notify thereby bypassing Syd'\&s own \fIseccomp\fR(2) cbpf filters.\& To
quote the \fIseccomp_unotify\fR(2): ".\&.\&.\& a user\-space notifier can be
bypassed if the existing filters allow the use of \fIseccomp\fR(2) or
\fIprctl\fR(2) to install a filter that returns an action value with a
higher precedence than \fBSECCOMP_RET_USER_NOTIF\fR (see \fIseccomp\fR(2)).\&"
Setting the option \fBtrace/allow_unsafe_prctl:true\fR overrides this option
and allows the \fBPR_SET_SECCOMP\fR \fIprctl\fR(2) operation inside the sandbox.\&
This may be changed in the future for clearer separation of mitigations.\&
.PP
.SS trace/allow_unsafe_ebpf
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Allows direct eBPF use inside the Syd sandbox using the \fIbpf\fR(2) system
call, whose unprivileged use is permitted since Linux\-4.\&4.\& On the one
hand, eBPF programs can be used for additional hardening, on the other
hand eBPF is a frequent source of vulnerabilities due to churn,
complexity, improper validation and complexity of validation.\& eBPF may
also be abused to implement efficient and portable rootkits.\&
.PP
As of version 3.\&37.\&0, Syd drops the capability \fBCAP_BPF\fR and denies the
privileged \fIbpf\fR(2) commands \fBBPF_MAP_CREATE\fR, \fBBPF_PROG_LOAD\fR, and
\fBBPF_BTF_LOAD\fR with the \fIerrno\fR(3) \fBEPERM\fR ("Operation not permitted")
\fBregardless\fR of the value of this option.\& This is in consistence with
the Linux kernel checks for the \fIkernel.\&unprivileged_bpf_disabled\fR
\fIsysctl\fR(8).\& Consult the \fIbpf\fR(2) and \fIcapabilities\fR(7) manual pages for
more information about the \fBCAP_BPF\fR Linux capability which is
implemented in Linux\-5.\&8 or newer.\&
.PP
.SS trace/allow_unsafe_dumpable
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
trusted
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether Syd should skip from setting its process
dumpable attribute to false.\& This allows core dumps for the Syd process,
and allows debugging/profiling/tracing the Syd process.\& You should not
set this option unless you'\&re developing Syd.\&
.PP
.SS trace/allow_unsafe_exec_ldso
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether \fIld.\&so\fR(8) exec indirection should be
allowed.\& This is not allowed by default to harden noexec boundaries.\&
.PP
.SS trace/allow_unsafe_exec_libc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether turning on secure\-execution mode for libc
should be skipped.\& Refer to the \fBEnforcing AT_SECURE and UID/GID
Verification\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_memory
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the Memory\-Deny\-Write\-Execute (MDWE) protections should be
bypassed.\& See \fBMemory\-Deny\-Write\-Execute Protections\fR section of the \fIsyd\fR(7)
manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_nopie
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether execution of non\-PIE binaries should be
allowed.\& This is generally not recommended but may be necessary on some
systems.\& Refer to the \fBEnforcing Position\-Independent Executables (PIE)\fR
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_noreg
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether executable memory mapping of non\-regular
files should be allowed.\& By default Syd blocks executable mappings
backed by non\-regular files, consistent with WhiteEgret.\& This is
generally not recommended but may be necessary on some systems.\&
.PP
.SS trace/allow_unsafe_exec_null
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether exec calls with NULL argument and
environment pointers should be allowed.\& Refer to the \fBEnhanced execve
and execveat Syscall Validation\fR section of the \fIsyd\fR(7) manual page for
more information.\&
.PP
.SS trace/allow_unsafe_exec_stack
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether execution of binaries with executable stack
should be allowed.\& This is generally not recommended by may be necessary
on some systems.\& Refer to the \fBEnforcing Non\-Executable Stack\fR section
of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_script
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Opt out of file vetting for interpreted exec.\& When off (default) on
Linux 6.\&14 and newer, Syd sets SECBIT_EXEC_RESTRICT_FILE and
SECBIT_EXEC_RESTRICT_FILE_LOCKED at startup so interpreters/dynamic
linkers must only execute a file if \fIexecveat\fR(2) with AT_EXECVE_CHECK
flag on its file descriptor would succeed (FD\-based check avoids
TOCTOU).\& When on, Syd does not set these bits (legacy behavior).\& No\-op
on kernels < 6.\&14.\& Bits are unprivileged\-settable; locks make the
policy sticky across exec.\& Refer to the \fBSecurebits and Kernel\-Assisted
Executability\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_interactive
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Opt out of interactive snippet denial.\& When off (default) on Linux 6.\&14
and newer, Syd sets SECBIT_EXEC_DENY_INTERACTIVE and its lock so
interpreters refuse interactive code (\-e, \-c, REPL, etc.\&) unless content
arrives via an FD and passes AT_EXECVE_CHECK of \fIexecveat\fR(2).\& When on,
Syd does not set these bits (legacy behavior).\& No\-op on kernels < 6.\&14.\&
Bits are unprivileged\-settable; locks persist the policy across exec.\&
Refer to the \fBSecurebits and Kernel\-Assisted Executability\fR section of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_exec_speculative
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether speculation controls should not be set to
enable Speculative Execution mitigations using the \fIprctl\fR(2) interface
at startup.\&  When this option is enabled, the \fIprctl\fR(2) operations
PR_GET_SPECULATION_CTRL, and PR_SET_SPECULATION_CTRL are allowed within
the sandbox.\& Refer to the \fBSpeculative Execution Mitigation\fR section of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_kptr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether syscall arguments taking pointers should
NOT be checked for kernel pointers.\& Refer to the \fBHardening against
kernel pointer misuse\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_sys_ptrace
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
trusted
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether the Linux capability \fBCAP_SYS_PTRACE\fR
should be passed to the sandbox process.\& By default this capability is
not inherited by sandboxed processes.\& Syd itself always retains
\fBCAP_SYS_PTRACE\fR for internal use (e.\&g.\& \fIpidfd_getfd\fR(2)).\& This option
only controls whether the capability is also made available inside the
sandbox.\&
.PP
\fBWarning\fR, this option allows the sandbox process to trivially break out
of the sandbox by e.\&g.\& attaching to the Syd main thread with \fIptrace\fR(2)
and getting a handle to the \fIseccomp\fR(2) notify file descriptor.\&
Therefore, \fBthis option should only be used in trusted environments.\&\fR
.PP
As of version 3.\&55.\&0, this option is split from
\fBtrace/allow_unsafe_ptrace\fR to allow fine\-grained control over
capability inheritance independently of \fIptrace\fR(2) handler
configuration.\&
.PP
This option requires the \fBtrusted\fR Cargo feature to take effect.\& Without
the feature, setting this option to true is ignored with a warning.\&
.PP
.SS trace/allow_unsafe_ptrace
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
trusted
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean to disable Syd'\&s use of \fIptrace\fR(2).\& Setting this option to
true effectively removes the \fIptrace\fR(2) dependency from the sandbox.\&
This is necessary to trace Syd together with its children, e.\&g.\& with
\fBstrace \-f\fR.\& This option also disables or changes the following features
that depend on Syd'\&s use of \fIptrace\fR(2):
.PP
.PD 0
.IP \(bu 4
Force sandboxing is disabled because it depends on
.PD
\fBPTRACE_EVENT_EXEC\fR.\&
.PD 0
.IP \(bu 4
SegvGuard is disabled because it depends on \fBPTRACE_EVENT_EXIT\fR.\&
.IP \(bu 4
Domain transitions with kind \fBexit\fR are disabled because they depend
.PD
on \fBPTRACE_EVENT_EXIT\fR.\&
.PD 0
.IP \(bu 4
\fIchdir\fR(2), \fIfchdir\fR(2), \fIexecve\fR(2), \fIexecveat\fR(2), \fImmap\fR(2), and
.PD
\fImmap2\fR(2) handlers switch to \fIseccomp_unotify\fR(2) versions which do not
have TOCTOU protections at syscall exit.\& A sandbox process may trivially
change to an arbitrary directory, execute an arbitrary file or map an
arbitrary library using the well\-known race conditions in system call
wrappers that continue the system call in the sandbox process.\&
.PP
As of version 3.\&50.\&0, this option requires the \fBtrusted\fR Cargo feature
to take effect.\& Without the feature, setting this option to true is
ignored with a warning.\&
.PP
.SS trace/allow_unsafe_perf
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether perf calls should be allowed within the sandbox.\&
.PP
As of version 3.\&40.\&0, the \fIprctl\fR(2) operations
\fBPR_TASK_PERF_EVENTS_ENABLE\fR, and \fBPR_TASK_PERF_EVENTS_DISABLE\fR are also
allowed if this option is set at startup.\&
.PP
.SS trace/allow_unsafe_create
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether to allow unsafe file creation.\& Refer to the
\fBTrusted File Creation\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_deleted
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether access to deleted files through open file
descriptors and \fIproc_pid_fd\fR(5) magic links should be allowed.\& Refer to
the \fBDeleted File Access Mediation\fR section of the \fIsyd\fR(7) manual page
for more information.\&
.PP
.SS trace/allow_unsafe_fcntl
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether \fIfcntl\fR(2) restrictions should be lifted.\&
When disabled (default), Syd denies \fBF_SETOWN\fR, \fBF_SETOWN_EX\fR, and
\fBF_SETSIG\fR operations to prevent bypassing \fIlandlock\fR(7) signal scoping
via the \fBSIGIO\fR delivery path.\& See \fIsyd\-ls fcntl\fR for the list of denied
\fIfcntl\fR(2) operations.\& Refer to the \fBRestricting fcntl operations and
trace/allow_unsafe_fcntl\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_filename
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether the restrictions on file names should be
lifted.\& By default, file names with control characters, forbidden
characters or invalid UTF\-8 are denied with \fBEINVAL\fR as necessary.\&
Read \fBEnhanced Path Integrity Measures\fR of the \fIsyd\fR(7) manual page for
more information.\&
.PP
.SS trace/allow_unsafe_hardlinks
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether to allow unsafe hardlink targets.\& Refer to
the \fBTrusted Hardlinks\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_machine_id
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether the sandbox substitutes \fImachine\-id\fR(5) with a
synthetic, per\-Syd random identifier or exposes the host value.\& The
substitution is done at \fIopen\fR(2) boundary after the access checks
grants access to this file.\& The files /etc/hostid and
/var/adm/hostid which are part of the \fIgethostid\fR(3) interface of
POSIX.\&1\-2008 as well as /sys/class/dmi/id/product_uuid are also
substituted as part of this mitigation.\& When \fIfalse\fR (default), at
startup Syd computes a SHA3\-512 digest using \fBAT_RANDOM\fR bytes and formats
the result as a 128\-character lowercase hexadecimal sandbox ID; the
first 32 characters of this string (\fBwhich must not be all zeroes\fR) are
presented in place of \fImachine\-id\fR(5), /etc/hostid, /var/adm/hostid, and
/sys/class/dmi/id/product_uuid to limit information leakage.\& Users may
override the sandbox ID by setting \fBSYD_ID\fR environment variable to a
128\-character lowercase hexadecimal string that satisfies the same
non\-all\-zero 32\-character prefix constraint.\& When true, no substitution
is performed and the real system \fImachine\-id\fR(5), /etc/hostid,
/var/adm/hostid, and /sys/class/dmi/id/product_uuid files are made
visible to the sandbox process (i.\&e.\&, the mitigation is disabled).\&
Refer to the following links for more information:
.PP
.PD 0
.IP \(bu 4
https://man7.\&org/linux/man\-pages/man5/machine\-id.\&5.\&html
.IP \(bu 4
https://pubs.\&opengroup.\&org/onlinepubs/9699919799/functions/gethostid.\&html
.PD
.PP
.SS trace/allow_unsafe_proc_dumpable
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether \fBPR_SET_DUMPABLE\fR \fIprctl\fR(2) operation with dumpable
argument set to \fBSUID_DUMP_DISABLE\fR should be turned into noop for
compatibility.\& This may be necessary to sandbox programs such as
\fIsftp\fR(1) which use this operation to make their per\-process \fIproc\fR(5)
directory inaccessible to other programs including Syd.\&
.PP
.SS trace/allow_unsafe_proc_files
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether internal \fIprocfs\fR(5) should NOT be mounted with the
option \fBsubset=pid\fR.\& This option is a no\-op unless \fBunshare/pid:true\fR is
also set.\&
.PP
.SS trace/allow_unsafe_proc_name
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether \fBPR_SET_NAME\fR \fIprctl\fR(2) operation to change process
name should be allowed.\& By default, this operation is logged and denied
with a success return, so from the perspective of the sandbox process
the call succeeds but no process name change takes place.\&
.PP
.SS trace/allow_unsafe_proc_pid_status
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether masking security\-sensitive fields in
\fIproc_pid_status\fR(5) files should be disabled.\& Refer to the \fBHardening
proc_pid_status(5)\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_magiclinks
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether /proc magic links should be followed even when
per\-process directory id differs from the caller process id.\& Magic links are
symbolic link\-like objects that are most notably found in \fIproc\fR(5); examples
include \fB/proc/pid/exe\fR and \fB/proc/pid/fd/*\fR.\& See \fIsymlink\fR(7) for more
details.\& Unknowingly opening magic links can be risky for some applications.\&
Examples of such risks include the following:
.PP
.PD 0
.IP \(bu 4
If the process opening a pathname is a controlling process that
currently has no controlling terminal (see \fIcredentials\fR(7)), then
opening a magic link inside \fB/proc/pid/fd\fR that happens to refer to a
terminal would cause the process to acquire a controlling terminal.\&
.IP \(bu 4
In a containerized environment, a magic link inside \fB/proc\fR may refer to
an object outside the container, and thus may provide a means to escape
from the container.\&
.PD
.PP
Because of such risks, Syd denies access to magic links which do not
belong to the current process by default.\&
.PP
.SS trace/allow_unsafe_symlinks
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether to allow following symlinks in \fIuntrusted\fR
directories.\& \fIUntrusted\fR directories are either group\-writable,
world\-writable, or have the sticky\-bit set.\& Refer to the \fBTrusted
Symbolic Links\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_sticky
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether immutable setgid/sticky bits enforcement
for directories should be disabled.\& By default, Syd preserves both the
setgid and sticky bits on directories at \fIchmod\fR(2) boundary: if a
directory already has setgid bit or sticky bit set, any \fIchmod\fR(2) call
that would remove either bit is corrected to retain the bit(s) with a
warning.\& Setting this option to true disables this enforcement, allowing
both bits to be freely toggled.\& Refer to the \fBImmutable Sticky Bit\fR
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_namespace
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBstring\-vec\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A list of namespaces to allow creation under the sandbox.\& Must be a
comma\-separated list of \fBmount\fR, \fButs\fR, \fBipc\fR, \fBuser\fR, \fBpid\fR, \fBnet\fR,
\fBcgroup\fR and \fBtime\fR.\& The special value \fBall\fR is supported as a
placeholder to specify all namespaces.\& The special values \fBnone\fR and
\fBoff\fR are supported to reset to no namespaces.\& An invocation of this
command overrides all previous invocations, ie only the list of
subnamespaces in the last invocation of this command will be allowed.\& By
default, subnamespace creation is not allowed.\& As of version 3.\&35.\&2, the
system calls \fIsethostname\fR(2) and \fIsetdomainname\fR(2) are only allowed in
the sandbox if \fButs\fR subnamespace is allowed.\& This is similar to the
mount family system calls which are only allowed if \fBmount\fR subnamespace
is allowed.\&
.PP
.SS trace/allow_unsafe_nice
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether process and I/O priority changes are
allowed for the sandbox.\& Refer to the \fBProcess Priority and Resource
Management\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_nocookie
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether enforcement of syscall argument cookies
should be disabled.\& Refer to the \fBSyscall Argument Cookies\fR section of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_nomseal
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether read\-only sealing critical regions of the Syd
sandbox policy using \fImseal\fR(2) when sandbox is locked should be disabled.\&
Refer to the \fBMemory Sealing of Sandbox Policy Regions on Lock\fR section
of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_noxom
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether the hardening to enforce immutability and
Execute\-Only Memory (XOM) protections on Syd'\&s own executable mappings
during initialization should be disabled.\& Refer to the \fBHardening
executable mappings\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_recvmsg
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether hooking the system calls \fIrecvmsg\fR(2) and
\fIrecvmmsg\fR(2) should be disabled.\& Syd handles these system calls only to
perform credentials management for \fBSCM_CREDENTIALS\fR, no sandboxing is
done for these system calls.\& Disabling these hooks is necessary to
receive \fBO_PATH\fR file descriptors with \fBSCM_RIGHTS\fR.\&
.PP
.SS trace/allow_unsafe_sendfd_dir
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending directory file descriptors using
\fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\&
This is denied by default which is consistent with \fIpledge\fR(2).\&
.PP
.SS trace/allow_unsafe_sendfd_bdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending block device file descriptors using
\fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_cdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending character device file descriptors
using \fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be
permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_symlink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending symbolic link file descriptors
using \fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be
permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_magiclink
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending magic symbolic link file
descriptors using \fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR
should be permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_memfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending memory file descriptors using
\fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_secretmem
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending secret memory file descriptors
using \fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be
permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_socket
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending socket file descriptors using
\fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_fifo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending FIFO file descriptors using
\fIsendmsg\fR(2) and \fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\&
.PP
.SS trace/allow_unsafe_sendfd_misc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether sending unknown, miscellaneous file
descriptors such as \fIepoll\fR(7) file descriptors using \fIsendmsg\fR(2) and
\fIsendmmsg\fR(2) with \fBSCM_RIGHTS\fR should be permitted.\& Pipewire needs this
option set to function correctly.\&
.PP
.SS trace/allow_unsafe_chown
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Makes Syd keep the capability \fBCAP_CHOWN\fR and allows sandbox process to
\fIchown\fR(2) files to arbitrary uid/gid.\& Without this option, \fIchown\fR(2)
family calls are confined to caller'\&s own effective UID and GID.\&
Attempts to change ownership to a different uid or gid are denied with
\fBEPERM\fR ("Operation not permitted").\&
.PP
.SS trace/allow_unsafe_chroot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Disable Chroot sandboxing and turn \fIchroot\fR(2) system call into a no\-op.\&
Refer to the explanation of \fBchroot\fR sandbox category in the SANDBOXING
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_pivot_root
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Turn \fIpivot_root\fR(2) system call into a no\-op rather than
unconditionally denying it with the \fIerrno\fR(3) \fBEPERM\fR.\& Refer to the
explanation of \fBchroot\fR sandbox category in the SANDBOXING section of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_copy
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Allow the \fBMSG_COPY\fR flag for \fImsgrcv\fR(2).\&
.PP
.SS trace/allow_unsafe_oob
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Allow the \fBMSG_OOB\fR flag for \fIsend\fR(2), \fIsendto\fR(2), \fIsendmsg\fR(2),
\fIsendmmsg\fR(2), \fIrecv\fR(2), \fIrecvfrom\fR(2), \fIrecvmsg\fR(2), and \fIrecvmmsg\fR(2)
system calls to send and receive out\-of\-band data, and allow the
\fIsetsockopt\fR(2) option \fBSO_OOBINLINE\fR which selects the inline urgent
data delivery path.\& Refer to the \fBDenying MSG_OOB Flag in send/recv
System Calls\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_open_kfd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether \fIopen\fR(2) calls to AMD KFD character
devices should be continued in the sandbox process rather than opening
them in the Syd emulator thread and sending the file descriptor.\& The
\fB/dev/kfd\fR character device requires per\-application access to the GPU
device, therefore opening the device in the Syd emulator thread and then
continuing the subsequent \fIioctl\fR(2) system calls in the sandbox process
is going to return \fBEBADF\fR ("Bad file number").\& Until Syd has a way to
fully emulate the \fIioctl\fR(2) request space and is able to call the
\fIioctl\fR(2) system call directly from Syd emulator threads, this option
may be used to access such character devices.\& \fBSetting this option opens
a TOCTOU attack vector, whereby the sandbox process can open an
arbitrary file instead of the character device in question!\&\fR Syd applies
the following mitigations to limit the scope of the attack vector:
.PP
.PD 0
.IP \(bu 4
Syd \fBcontinues\fR the system call if and only if \fBO_RDWR\fR is set in the flags
argument.\&
.IP \(bu 4
Syd does not \fBcontinue\fR the system call if at least one of the flags
\fBO_CREAT\fR, \fBO_TRUNC\fR or \fBO_TMPFILE\fR is set in the flags argument.\&
.IP \(bu 4
Syd returns \fBENOSYS\fR ("Function not implemented") for the \fIopenat2\fR(2)
system call rather than \fBcontinuing\fR it in the sandbox process to
prevent the \fBstruct open_how\fR pointer indirection to bypass the
restrictions applied to the flags argument.\& Refer to the \fIopenat2\fR(2)
manual page for more information.\&
.IP \(bu 4
This option may be changed at runtime, and it is highly recommended to
unset this option using the \fIsyd\fR(2) virtual system call API right after
the character device is opened.\&
.PD
.PP
.SS trace/allow_unsafe_open_path
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether the mitigation to turn \fBO_PATH\fR file
descriptors into \fBO_RDONLY\fR file descriptors for safe emulation should
be disabled.\& With this option, Syd continues the \fIopen\fR(2) system calls
with the \fBO_PATH\fR in the sandbox process which opens a TOCTOU vector.\&
.PP
.SS trace/allow_unsafe_open_suid
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
A boolean specifying whether the mitigation to prevent opening files
with set\-user\-ID or set\-group\-ID mode bits should be disabled.\& With this
option, Syd allows opening SUID/SGID files regardless of mode.\& When
disabled, opening SUID/SGID files with write modes returns \fBEACCES\fR
("Permission denied") \fIerrno\fR(3).\&
.PP
.SS trace/allow_unsafe_mkbdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe block device access should be allowed.\& When set,
Syd does not drop the capability \fBCAP_MKNOD\fR on startup for itself, but
it is still dropped for the sandbox process.\& This allows:
.PP
.PD 0
.IP \(bu 4
block device creation with \fImknod\fR(2).\&
.IP \(bu 4
open block devices with \fIopen\fR(2).\&
.IP \(bu 4
list block devices with \fIgetdents64\fR(2).\&
.PD
.PP
.SS trace/allow_unsafe_mkcdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe character device creation should be allowed.\& When
set, Syd does not drop the capability \fBCAP_MKNOD\fR on startup for itself,
but it is still dropped for the sandbox process.\& This allows creation of
character devices with \fImknod\fR(2).\&
.PP
.SS trace/allow_unsafe_stat_bdev
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIstat\fR(2) family calls on block devices should return
last access and modification times as\-is.\& Refer to the \fBDevice
Sidechannel Mitigations\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_stat_cdev
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIstat\fR(2) family calls on character devices should
return last access and modification times as\-is.\& Refer to the \fBDevice
Sidechannel Mitigations\fR section of the \fIsyd\fR(7) manual page for more
information.\&
.PP
.SS trace/allow_unsafe_notify_bdev
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe event generation for \fIfanotify_mark\fR(2) and
\fIinotify_add_watch\fR(2) system calls should be allowed for block devices.\&
Refer to the \fBDevice Sidechannel Mitigations\fR section of the \fIsyd\fR(7)
manual page for more information.\&
.PP
.SS trace/allow_unsafe_notify_cdev
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe event generation for \fIfanotify_mark\fR(2) and
\fIinotify_add_watch\fR(2) system calls should be allowed for character devices.\&
Refer to the \fBDevice Sidechannel Mitigations\fR section of the \fIsyd\fR(7)
manual page for more information.\&
.PP
.SS trace/allow_unsafe_cpu
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether CPU emulation system calls should be allowed.\& By
default, as of version 3.\&22.\&1, Syd denies the \fImodify_ldt\fR(2),
\fIsubpage_prot\fR(2), \fIswitch_endian\fR(2), \fIvm86\fR(2), and \fIvm86old\fR(2)
system calls, which are associated with CPU emulation functionalities.\&
Enabling this option (trace/allow_unsafe_cpu:1) permits these calls,
thus relaxing the restriction.\& This option should be used with caution,
as allowing these system calls can introduce potential vulnerabilities
by enabling processes to modify CPU state or memory protections.\& Use
this setting only in trusted environments where the execution of these
system calls is necessary.\&
.PP
.SS trace/allow_unsafe_deprecated
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether deprecated system calls such as \fIremap_file_pages\fR(2),
\fIstime\fR(2), and \fIuselib\fR(2) should be allowed.\& Refer to the output of
the command \fBsyd\-ls deprecated\fR for the full list of deprecated system
calls for your installation.\&
.PP
.SS trace/allow_unsafe_kcapi
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether access to the Linux kernel cryptography API (aka:
"KCAPI") should be allowed when network sandboxing is on.\& This option
has no effect when network sandboxing is off.\&
.PP
As most things in life, cryptography has good and evil uses: KCAPI is
convenient as it may be used to implement cryptography without depending
on user\-space libraries such as OpenSSL but it may also enable malicious
code to efficiently turn itself into ransomware.\& KCAPI is also
vulnerable to attacks such as CVE\-2026\-31431 aka copy.\&fail.\& Adhering to
the goal to be secure by default Syd disallows this access by default.\&
.PP
Syd does not hook into \fIsetsockopt\fR(2) and the \fBALG_SET_KEY\fR operation
to set the encryption key is directly handled by the host kernel
therefore the encryption key is not copied into Syd'\&s address space.\&
.PP
Syd hooks into \fIbind\fR(2), \fIsendto\fR(2), \fIsendmsg\fR(2), and \fIsendmmsg\fR(2)
but \fBnot\fR \fIread\fR(2), \fIwrite\fR(2), \fIrecv\fR(2), or \fIsplice\fR(2).\& To reduce
syscall overhead, user is recommended to use the unhooked system calls
when they can to interact with KCAPI.\&
.PP
.SS trace/allow_unsafe_kcmp
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether the \fIkcmp\fR(2) system call should be allowed
inside the sandbox.\& This call may be unsafe if it'\&s directed to a
process which sandbox process does not own.\&
.PP
.SS trace/allow_unsafe_keyring
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the \fIadd_key\fR(2), \fIkeyctl\fR(2), and \fIrequest_key\fR(2)
system calls should be allowed.\& Enabling this setting permits key
management within the sandbox, which can introduce security risks by
allowing keyring manipulations.\& Use only in trusted environments.\&
.PP
.SS trace/allow_unsafe_pipe
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Allow creating notification pipes using the "O_NOTIFICATION_PIPE" flag
to the \fIpipe2\fR(2) system call.\& Refer to the \fBDenying O_NOTIFICATION_PIPE
Flag in pipe2\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_pkey
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether the \fIpkey_alloc\fR(2), \fIpkey_free\fR(2), and
\fIpkey_mprotect\fR(2) system calls should be allowed.\& By default, these
calls are denied to enhance security.\& Setting this option to true
enables these system calls, allowing the use of memory protection keys.\&
This option should be used with caution and only in trusted environments
where the use of these system calls is necessary.\&
.PP
.SS trace/allow_unsafe_madvise
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether \fImadvise\fR(2) system call should NOT be hardened.\& By
default, only a subset of advice are permitted, see \fBsyd\-ls madvise\fR.\&
Refer to the \fBmadvise(2) Hardening\fR section of the \fIsyd\fR(7) manual page
for more information.\&
.PP
.SS trace/allow_unsafe_numa
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether the NUMA memory\-policy and page\-migration system calls
should be allowed.\& See \fBsyd\-ls numa\fR for the list of NUMA system calls.\&
By default these system calls are denied.\&
.PP
.SS trace/allow_unsafe_page_cache
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether the system calls \fIcachestat\fR(2) and \fImincore\fR(2)
should be allowed.\& By default, these calls are denied to enhance
security as it has been documented that they can be misused to perform
page\-cache attacks.\& Refer to the \fBMitigation against Page Cache Attacks\fR
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_setsockopt
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether \fIsetsockopt\fR(2) hardening should be disabled.\& Refer to
the "\fIsetsockopt\fR(2) Hardening" section of the \fIsyd\fR(7) manual page for
more information.\&
.PP
.SS trace/allow_unsafe_socketcall
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specifies whether \fIsocketcall\fR(2) multiplexer system call should be
allowed.\& Enabling this option gives the sandbox process a way to bypass
"\fIsetsockopt\fR(2) Hardening" on architectures x86, m68k, mips, mipsel,
ppc, ppc64, ppc64le, s390, s390x, sheb, and sh.\& This is only necessary
for compatibility with libcs which don'\&t yet support the newer
non\-multiplexed system calls available as of Linux\-4.\&3.\& GNU Libc added
support for new system calls as of version 2.\&23 and removed support for
the old \fIsocketcall\fR(2) fallback as version 2.\&37.\& musl added support for
new system calls as of version 1.\&2.\&2.\&
.PP
.SS trace/allow_unsafe_time
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether system calls which adjust the system time are
allowed.\& This also causes Syd to keep the \fBCAP_SYS_TIME\fR capability.\&
Use \fBsyd\-ls time\fR to see the list of system calls allowed by this
setting.\&
.PP
.SS trace/allow_unsafe_uring
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether system calls of the \fIio_uring\fR(7) interface are
allowed.\& Normally, these are denied because they may be used to bypass path
sandboxing.\& Use \fBsyd\-ls uring\fR to see the list of system calls allowed by
this setting.\&
.PP
.SS trace/allow_unsafe_xattr
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether the extended attributes restrictions on
\fIsecurity\fR, \fIsystem\fR, and \fItrusted\fR namespaces should be lifted.\& If this
option is not set only sandbox processes with access to the sandbox lock
can view or change these extended attribute namespaces.\&
.PP
.SS trace/allow_unsafe_caps
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
T{
trusted
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether Syd should skip dropping Linux
\fIcapabilities\fR(7) at startup.\& This setting can be used to construct
privileged containers and should be used with extreme care.\&
.PP
As of version 3.\&50.\&0, this option requires the \fBtrusted\fR Cargo feature
to take effect.\& Without the feature, setting this option to true is
ignored with a warning.\&
.PP
As of version 3.\&57.\&0, the following \fIcapabilities\fR(7) are dropped
regardless of the value this option: \fBCAP_AUDIT_CONTROL\fR,
\fBCAP_BLOCK_SUSPEND\fR, \fBCAP_BPF\fR, \fBCAP_CHECKPOINT_RESTORE\fR,
\fBCAP_IPC_OWNER\fR, \fBCAP_KILL\fR, \fBCAP_MAC_ADMIN\fR, \fBCAP_MAC_OVERRIDE\fR,
\fBCAP_NET_ADMIN\fR, \fBCAP_SYS_ADMIN\fR, \fBCAP_SYS_BOOT\fR, \fBCAP_SYS_MODULE\fR,
\fBCAP_SYS_PACCT\fR, \fBCAP_SYS_RAWIO\fR, \fBCAP_SYS_RESOURCE\fR,
\fBCAP_SYS_TTY_CONFIG\fR, and \fBCAP_WAKE_ALARM\fR.\&
.PP
.SS trace/allow_unsafe_cap_fixup
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Opt out of hardened UID/capability transitions.\& When off (default), Syd
clears \fBSECBIT_KEEP_CAPS\fR, sets \fBSECBIT_NO_SETUID_FIXUP\fR, and applies
their lock bits at startup so capabilities are dropped when all UIDs
become nonzero and are not implicitly gained or adjusted by later
setuid\-style UID changes; capability sets then only change via explicit
\fIcapset\fR(2) and \fIprctl\fR(2) calls.\& When on, Syd leaves \fBSECBIT_KEEP_CAPS\fR
and \fBSECBIT_NO_SETUID_FIXUP\fR (and their locks) as inherited from the
parent, preserving the kernel'\&s traditional "setuid fixup" behavior and
any \fBPR_SET_KEEPCAPS\fR use by the application (legacy behavior).\& No\-op on
kernels that do not support securebits.\& Refer to the \fBSecurebits and
Kernel\-Assisted Executability\fR section of the \fIsyd\fR(7) manual page for
more information.\&
.PP
.SS trace/allow_unsafe_env
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe environment variables should be allowed into the
environment of the sandbox process.\& See \fBsyd\-ls env\fR for the list of unsafe
environment variables.\&
.PP
.SS trace/allow_safe_syslog
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unprivileged sandbox processes can access Syd'\&s
\fIsyslog\fR(2) emulation using \fIdmesg\fR(8).\& Unprivileged processes include
the set of \fIall\fR sandbox processes with the sandbox lock "off", and \fIall
but the initial\fR sandbox process with the sandbox lock set to "exec".\&
This option has nothing to do with access to the host syslog which is
never allowed.\&
.PP
.SS trace/allow_safe_bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the socket address arguments of successful \fIbind\fR(2)
calls should be allowed for \fIconnect\fR(2), \fIsendto\fR(2), \fIsendmsg\fR(2), and
\fIsendmmsg\fR(2) system calls.\&
.PP
\fBNote\fR, these addresses are allowed globally and not per\-process for
usability reasons.\& Thus, for example, a process which forks to call
\fIbind\fR(2) will have its address allowed for their parent as well.\&
.PP
.SS trace/allow_unsafe_bind
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the Linux capability \fBCAP_NET_BIND_SERVICE\fR, which
allows a process to \fIbind\fR(2) to ports lower than 1024, should be
retained.\& When this option is set, Syd keeps the capability on startup
for itself, but it is still dropped for the sandbox process.\&
.PP
.SS trace/allow_unsafe_any_addr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether connections to wildcard "any" addresses are allowed to
cross \fIbind\fR(2), \fIconnect\fR(2), \fIsendto\fR(2), \fIsendmsg\fR(2), and
\fIsendmmsg\fR(2) boundaries unchanged.\& When unset (default), Syd rewrites
IPv4 0.\&0.\&0.\&0 to 127.\&0.\&0.\&1 and IPv6 :: to ::1 at \fIbind\fR(2) to prevent
unintended exposure on all interfaces, and denies \fIconnect\fR(2),
\fIsendto\fR(2), \fIsendmsg\fR(2), and \fIsendmmsg\fR(2) to wildcard addresses with
the \fIerrno\fR(3) \fBENETUNREACH\fR ("Network is unreachable"), consistent with
FreeBSD'\&s \fInet.\&inet.\&ip.\&connect_inaddr_wild\fR sysctl.\& When set, both the
rewrite and the rejection are disabled.\&
.PP
.SS trace/allow_unsafe_ipv6_rthdr
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether \fBIPV6_RTHDR\fR ancillary data on \fIsendmsg\fR(2) and
\fIsendmmsg\fR(2) is allowed to cross the network sandbox unchanged,
including RFC 2292 alias \fBIPV6_2292RTHDR\fR.\& When unset (default), Syd
strips any such control message from message header before forwarding
the call to Linux and logs the event.\& \fBIPV6_RTHDR\fR installs an IPv6
routing header on the outgoing packet.\& Type\-2 routing header defined for
Mobile IPv6 (\fIRFC 6275\fR) is unprivileged on Linux and doesn'\&t require
\fBCAP_NET_RAW\fR unlike \fBIPV6_HOPOPTS\fR, \fBIPV6_DSTOPTS\fR, and
\fBIPV6_RTHDRDSTOPTS\fR.\& Linux rewrites the outgoing packet'\&s destination
address to the first segment of routing header, bypassing the address
only access check that Syd performs on the syscall destination argument.\&
.PP
.SS trace/allow_unsafe_ipv6_scope
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether a non\-zero \fIsin6_scope_id\fR (RFC 4007 zone identifier) in
the IPv6 socket address of \fIbind\fR(2), \fIconnect\fR(2), \fIsendto\fR(2),
\fIsendmsg\fR(2), and \fIsendmmsg\fR(2) is allowed to cross the network sandbox
unchanged.\& When unset (default), Syd zeroes out \fIsin6_scope_id\fR before
forwarding the call to Linux and logs the event.\& The address\-only access
check cannot match the egress interface encoded in \fIsin6_scope_id\fR,
which Linux honours for link\-scoped destinations (\fIfe80::/10\fR,
\fIff02::/16\fR).\&
.PP
.SS trace/allow_unsafe_ip_pktinfo
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fBIP_PKTINFO\fR, \fBIPV6_PKTINFO\fR, and the RFC 2292 alias
\fBIPV6_2292PKTINFO\fR ancillary data on \fIsendmsg\fR(2) and \fIsendmmsg\fR(2) are
allowed to cross the network sandbox unchanged.\& When unset (default),
Syd strips any such control message from message header before
forwarding the call to Linux and logs the event.\& These control messages
override the per\-packet egress interface and source address, bypassing
the address\-only access check.\& When set, this option also allows the
\fIsetsockopt\fR(2) options \fBIP_PKTINFO\fR, \fBIPV6_PKTINFO\fR,
\fBIPV6_RECVPKTINFO\fR, and \fBIPV6_2292PKTINFO\fR regardless of the value of
the option \fItrace/allow_unsafe_setsockopt\fR.\&
.PP
.SS trace/allow_unsafe_ip_retopts
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether \fBIP_RETOPTS\fR ancillary data on \fIsendmsg\fR(2) and
\fIsendmmsg\fR(2) is allowed to cross the network sandbox unchanged.\& When
unset (default), Syd strips any such control message from message header
before forwarding the call to Linux and logs the event.\& \fBIP_RETOPTS\fR
installs IPv4 options for the outgoing packet, including the \fBLoose
Source and Record Route\fR (LSRR) and \fBStrict Source and Record Route\fR
(SSRR) source routing options.\& Linux kernel rewrites the packet'\&s
destination address to the first hop encoded in the LSRR or SSRR option,
bypassing the address only access check that Syd performs on the syscall
destination argument.\&
.PP
.SS trace/allow_unsafe_socket
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe socket families should be allowed.\& When set, Syd
does not drop the capability \fBCAP_NET_RAW\fR on startup for itself, but it
is still dropped for the sandbox process.\& This allows:
.PP
.PD 0
.IP \(bu 4
use of RAW and PACKET sockets.\&
.IP \(bu 4
bind to any address for transparent proxying.\&
.IP \(bu 4
make use of the \fIping\fR(1) command.\&
.PD
.PP
.SS trace/allow_unsupp_socket
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsupported socket families such as netlink sockets
should be allowed access when network sandboxing is on.\& By default Syd
allows sandboxed access to unix, ipv4 and ipv6 sockets.\& This option has
no effect when network sandboxing is off.\&
.PP
As of version 3.\&52.\&0 Syd allows access to algorithm sockets with the
\fBtrace/allow_unsafe_kcapi\fR option rather than with this option.\&
Algorithm sockets are used to interact with the Linux kernel
cryptography API.\&
.PP
As of version 3.\&42.\&0, Transparent Inter\-Process Communication (AF_TIPC)
sockets at \fIsocketpair\fR(2) boundary are only permitted if this option is
set to true.\&
.PP
.SS trace/allow_unsupp_cmsg
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
.TE
.sp 1
Specify whether unsupported control messages for \fIsendmsg\fR(2) and
\fIsendmmsg\fR(2) are allowed to cross the network sandbox unchanged.\& When
unset (default), Syd strips any such control message from message
header before forwarding the call to Linux and logs the event.\&
.PP
.SS trace/allow_unsafe_personality
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIpersonality\fR(2) restrictions should be lifted.\& See \fBsyd\-ls
personality\fR for the list of allowlisted \fIpersonality\fR(2) personas.\&
Refer to the \fBPersonality Syscall Restrictions\fR section of the \fIsyd\fR(7)
manual page for more information.\&
.PP
.SS trace/allow_unsafe_prctl
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIprctl\fR(2) restrictions should be lifted.\& See \fBsyd\-ls prctl\fR for
the list of allowed prctl requests.\&
.PP
.SS trace/allow_unsafe_prlimit
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIprlimit\fR(2) restrictions should be lifted.\&
.PP
.SS trace/allow_unsafe_shm
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fIsysvipc\fR(7) system calls should be allowed.\& Refer to
the \fBShared Memory Hardening\fR section of the \fIsyd\fR(7) manual page for
more information.\& Use \fBsyd\-ls shm\fR to see the list of system calls
allowed by this setting.\&
.PP
.SS trace/allow_unsafe_perm_shm
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe permissions in mode arguments of \fIshmget\fR(2),
\fImsgget\fR(2), and \fIsemget\fR(2) system calls and the \fBIPC_SET\fR operation of
\fIshmctl\fR(2), \fImsgctl\fR(2), and \fIsemctl\fR(2) system calls should be
permitted.\& Refer to the \fBShared Memory Permissions Hardening\fR section of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_msgqueue
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether \fImq_overview\fR(7) system calls should be allowed.\& Refer
to the \fBShared Memory Hardening\fR section of the \fIsyd\fR(7) manual page for
more information.\& Use \fBsyd\-ls msgqueue\fR to see the list of system calls
allowed by this setting.\&
.PP
.SS trace/allow_unsafe_perm_msgqueue
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe permissions in mode argument of \fImq_open\fR(2)
system call should be permitted.\& Refer to the \fBShared Memory Permissions
Hardening\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_rseq
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether unsafe Restartable Sequences with the \fIrseq\fR(2) system
call should be permitted.\& Refer to the \fBDenying Restartable Sequences\fR
section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/allow_unsafe_sud
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether the \fBPR_SET_SYSCALL_USER_DISPATCH\fR
\fIprctl\fR(2) operation should be permitted within the sandbox.\& By default
it is denied with \fIerrno\fR(3) \fBEINVAL\fR ("Invalid argument").\& This
operation is only used by compatibility layers such as Wine.\&
.PP
.SS trace/allow_unsafe_sysinfo
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the \fIsysinfo\fR(2) randomizer should be disabled at startup.\&
If this option is set at startup the \fIsysinfo\fR(2) system call becomes
allowed and provides identical info to the files \fB/proc/loadavg\fR and
\fB/proc/meminfo\fR which are disabled by default by common profiles such
as the \fBlinux\fR and \fBuser\fR profiles.\& Notably this mitigation is unset
for the \fBpaludis\fR profile because leaking this side\-channel is
irrelevant for package builds.\&
.PP
.SS trace/allow_unsafe_syslog
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the Linux capability \fBCAP_SYSLOG\fR should be retained.\& This
allows the process to perform privileged \fIsyslog\fR(2) operations.\& This is
useful when sandboxing a service such as syslogd.\&
.PP
.SS trace/allow_unsafe_sync
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the \fIsync\fR(2) and \fIsyncfs\fR(2) system calls should be
allowed inside the sandbox.\& By default these system calls are turned
into no\-ops to prevent potential local DoS, however it may be useful to
disable this restriction in scenarios where sync is actually expected to
work such as when sandboxing databases.\&
.PP
.SS trace/allow_unsafe_memfd
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, off only\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether executable memory file descriptors should
be enabled.\& By default Syd strips the \fBMFD_EXEC\fR and adds the
\fBMFD_NOEXEC_SEAL\fR flag to \fImemfd_create\fR(2) flags argument.\& This ensures
the memory file descriptor can never be made executable.\& The
\fBMFD_NOEXEC_SEAL\fR flag requires Linux\-6.\&3 or newer therefore on older
kernels this option must be enabled to make memory file descriptors
work.\& However, the user should be aware that allowing encrypted memory
file descriptors does allow an attacker to bypass Exec, Force and TPE
sandboxing and execute denylisted code.\&
.PP
.SS trace/allow_unsafe_uname
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
A boolean specifying whether \fIuname\fR(2) hardening should be disabled.\&
Refer to the \fBHardened uname(2)\fR section of the \fIsyd\fR(7) manual page for
more information.\&
.PP
.SS trace/allow_unsafe_vmsplice
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether the \fIvmsplice\fR(2) system call should be allowed inside
the sandbox.\& By default this system call is not permitted.\& Refer to the
\fBRestricting vmsplice System Call\fR section of the \fIsyd\fR(7) manual page
for more information.\&
.PP
.SS trace/deny_dotdot
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether \fB.\&.\&\fR components should be denied during path resolution for
\fIchdir\fR(2) and \fIopen\fR(2) family system calls.\& This is useful in mitigating path
traversal attacks.\& See \fBPath Resolution Restriction For Chdir and Open Calls\fR of
the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/deny_exec_elf32
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Deny the execution of 32\-bit ELF binaries.\&
.PP
.SS trace/deny_exec_elf_dynamic
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Deny the execution of dynamically linked ELF binaries.\&
.PP
.SS trace/deny_exec_elf_static
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Deny the execution of statically linked ELF binaries.\&
.PP
.SS trace/deny_exec_script
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Deny the execution of scripts (files with #!\&<interpreter> on first line).\&
.PP
The \fIexecve\fR(2) TOCTOU mitigations do not cover this option which means
\fBthe functionality is vulnerable to TOCTOU\fR.\& This allows an attacker to
execute a script whose path is denylisted.\& This TOCTOU is limited to
scripts and requires the interpreter binary to be allowlisted for exec.\&
Hence this vulnerability does not allow an attacker to execute
denylisted binaries.\& This is why the user is recommended to deny the
respective interpreter binaries for execution instead for a safe and
secure approach.\&
.PP
On Linux\-6.\&14 and newer, kernel\-assisted executability provides a safe
way to deny execution of scripts in cooperation with enlightened
interpreters.\& Refer to the \fBSecurebits and Kernel\-Assisted
Executability\fR section of the \fIsyd\fR(7) manual page for more information.\&
.PP
.SS trace/deny_tsc
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether reading the timestamp counter should be denied.\& Without an
accurate timer, many timing attacks are going to be harder to perform.\&
.PP
.PD 0
.IP \(bu 4
This works on \fBaarch64, x32, x86, and x86_64 only\fR.\&
.IP \(bu 4
This breaks time related calls in the vDSO, which can be trivially worked 
around by writing a LD_PRELOAD library to call the respective system calls 
directly.\& See \fBlibsydtime\fR, https://lib.\&rs/libsydtime, for a reference 
implementation.\&
.IP \(bu 4
This has a negative performance impact on programs that rely on 
\fIgettimeofday\fR(2) being a vDSO call.\&
.PD
.PP
.SS trace/deny_vdso
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether access to vDSO should be prevented by overwriting the
auxiliary vector members \fBAT_SYSINFO\fR and \fBAT_SYSINFO_EHDR\fR at \fIexec\fR(3)
boundary.\& This option becomes a no\-op if \fItrace/allow_unsafe_exec_libc\fR
is set to true.\&
.PP
.SS trace/exit_wait_all
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Specify whether Syd should wait for all processes to exit before exiting.\& By
default, Syd exits with the eldest process and any leftover processes in the
background are automatically killed.\&
.PP
.SS trace/force_cloexec
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether the "O_CLOEXEC" flag should be enforced for all
\fIcreat\fR(2), \fIopen\fR(2), \fIopenat\fR(2), \fIopenat2\fR(2), \fImemfd_create\fR(2),
\fIsocket\fR(2), \fIaccept\fR(2), and \fIaccept4\fR(2) system calls made by the
sandbox process.\& When this feature is enabled, Syd ensures that every
file descriptor opened by the sandbox process is automatically set with
the "O_CLOEXEC" flag, which prevents these file descriptors from being
inherited by newly executed programs.\& This measure enhances security by
closing file descriptors during \fIexec\fR(3) calls, preventing risk of file
descriptor leakage which could lead to unauthorized access to sensitive
files or resources.\& The feature can be toggled at runtime using Syd'\&s
virtual \fIstat\fR(2) API, providing flexible control over the confinement
level of sandboxed processes.\&
.PP
.SS trace/force_rand_fd
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether file descriptors returned by all \fIcreat\fR(2), \fIopen\fR(2),
\fIopenat\fR(2), \fIopenat2\fR(2), \fImemfd_create\fR(2), \fIsocket\fR(2), \fIaccept\fR(2),
and \fIaccept4\fR(2) system calls made by the sandbox process should be
randomized.\&  When this feature is enabled, Syd specifies a random
available slot (rather than the lowest\-numbered one) to the
\fBSECCOMP_IOCTL_NOTIF_ADDFD\fR operation which is used to install a file
descriptor to the sandbox process.\& Randomizing file descriptor numbers
makes it significantly harder for an attacker to predict or deliberately
reuse critical descriptors, thereby raising the bar against
file\-descriptor reuse and collision attacks.\& Note that enabling this may
break programs which rely on the POSIX guarantee that \fIopen\fR(2) returns
the lowest available descriptor.\& This behavior can be toggled at runtime
via Syd'\&s virtual \fIstat\fR(2) API, allowing operators to enable or disable
descriptor randomization without restarting or recompiling the sandboxed
process.\&  We'\&re also cooperating with the HardenedBSD project to
implement a similar feature in the BSD kernel.\& Refer to the following
link for more information:
https://git.\&hardenedbsd.\&org/hardenedbsd/HardenedBSD/\-/issues/117
.PP
This feature uses the \fIkcmp\fR(2) system call and requires a Linux kernel
configured with the \fBCONFIG_KCMP\fR option.\& On a kernel without this
option, all system calls that are part of this feature will return
\fBENOSYS\fR (\fBFunction not implemented\fR).\&
.PP
As of version 3.\&38.\&0, this option is enabled for the \fBuser\fR profile.\&
.PP
.SS trace/force_ro_open
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether creating and writing \fIopen\fR(2) family system calls
should be denied regardless of the path argument.\& This option is
restricted to \fIcreat\fR(2), \fIopen\fR(2), \fIopenat\fR(2), and \fIopenat2\fR(2)
system calls and provided for convenience.\& To stop all write\-like access
completely, including e.\&g.\& \fImkdir\fR(2), \fItruncate\fR(2) etc.\&, use the
\fBreadonly\fR profile instead which uses the rule "deny/wrset/***" to
prevent all write\-like access.\& See "PROFILES" section of the \fIsyd\fR(5)
manual page for more information.\&
.PP
.SS trace/force_wx_open
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether creating and writing \fIopen\fR(2) family system calls for
executable files should be denied regardless of the path argument.\& This
option is restricted to \fIcreat\fR(2), \fIopen\fR(2), \fIopenat\fR(2), and
\fIopenat2\fR(2) system calls.\& This option may be combined with
"trace/force_umask" option to confine the filesystem as W\(haX (Write XOR
Execute).\& See the "user" profile for an example.\& See "PROFILES" section
of the \fIsyd\fR(5) manual page for more information.\&
.PP
.SS trace/force_local_net
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Force local networking, rewrites all addresses to loopback for bind/connect.\&
.PP
.SS trace/force_no_symlinks
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether path resolution for the \fIopen\fR(2) family is forced to
use the \fBRESOLVE_NO_SYMLINKS\fR resolve flag.\& This flag is forced during
path canonicalization, therefore this mitigation applies to all hooked
path system calls, not just the \fIopen\fR(2) family.\& When enabled,
traversal of symbolic links is disallowed during lookup; all pathname
components must be non\-symlink entries.\& This affects only the pathname
resolution step and does not modify other flags or access checks.\&
.PP
.SS trace/force_no_magiclinks
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether path resolution for the \fIopen\fR(2) family is forced to
use the \fBRESOLVE_NO_MAGICLINKS\fR resolve flag.\& This flag is forced during
path canonicalization, therefore this mitigation applies to all hooked
path system calls, not just the \fIopen\fR(2) family.\& When enabled,
traversal of magic links (such as special \fIproc\fR(5) links that do not
behave like regular symbolic links) is disallowed during lookup; all
pathname components must be non\-magiclink entries.\& This affects only the
pathname resolution step and does not modify other flags or access
checks.\& As of version 3.\&49.\&0, Syd honours this option when listing files
under \fIproc\fR(5) filesystem thereby hiding magic links when this option
is enabled.\&
.PP
.SS trace/force_no_xdev
.PP
.TS
allbox;l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
drop
T}	T{
\fByes, on only\fR
T}
.TE
.sp 1
Specify whether path resolution for the \fIopen\fR(2) family is forced to
use the \fBRESOLVE_NO_XDEV\fR resolve flag.\& This flag is forced during path
canonicalization, therefore this mitigation applies to all hooked path
system calls, not just the \fIopen\fR(2) family.\& When enabled, traversal of
mount points, including bind mounts, is disallowed during lookup; the
path must reside on the same mount as the directory referenced by dirfd
(or the current working directory when dirfd == AT_FDCWD).\& This affects
only the pathname resolution step and does not modify other flags or
access checks.\&
.PP
.SS trace/force_umask
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBoctal\fR
T}
T{
default
T}	T{
\fB7000\fR
T}
T{
drop
T}	T{
\fByes, raise only\fR
T}
.TE
.sp 1
Specify an umask mode to force for regular files.\& To unset a previously
configured force umask use \fB\-1\fR or \fBoff\fR as the value.\& As of version
3.\&15.\&6, \fIchmod\fR(2) family system calls also honour force umask for added
hardening.\& As of version 3.\&22.\&1, this setting does not apply to
directory creation for \fImkdir\fR(2) and \fImkdirat\fR(2) system calls.\& As of
version 3.\&26.\&2, this setting does not apply to UNIX domain socket
creation for \fIbind\fR(2) system calls, and non\-regular file creation for
\fImknod\fR(2) and \fImknodat\fR(2) system calls.\& As of version 3.\&54.\&0, default
value is \fB7000\fR which ignores setuid/setgid/sticky bits for \fIchmod\fR(2)
family system calls.\& This is in consistency with OpenBSD \fIpledge\fR(2).\&
.PP
.SS trace/memory_access
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBinteger\fR
T}
T{
default
T}	T{
\fB2\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Set mode on cross memory attach and \fIproc_pid_mem\fR(5) usage.\& Cross
memory attach is done using the system calls \fIprocess_vm_readv\fR(2) and
\fIprocess_vm_writev\fR(2) which requires a Linux kernel configured with the
\fBCONFIG_CROSS_MEMORY_ATTACH\fR option enabled.\& Supported modes are:
.PP
.PD 0
.IP \(bu 4
\fB0\fR: Use cross memory attach if available, use \fIproc_pid_mem\fR(5) otherwise.\&
.IP \(bu 4
\fB1\fR: Use \fI/proc/pid/mem\fR(5) unconditionally.\&
.IP \(bu 4
\fB2\fR: Use cross memory attach unconditionally.\&
.PD
.PP
From a security point of view, these two modes of access have an
important distinction where cross memory attach honours page protections
of the target process, however using \fI/proc/pid/mem\fR(5) does not.\& This
makes direct \fIproc_pid_mem\fR(5) access dangerous in that a Syd deputy
process may be confused into corrupting or even controlling memory
regions the sandbox process otherwise does not have direct access to.\&
This is the main reason why mode \fB2\fR has been added as of version 3.\&32.\&6
as a secure default alternative to the previous default mode \fB0\fR whose
fallback behaviour can be unpredictable and is against the idea of
secure defaults.\& Therefore as of version 3.\&32.\&6, the user is asked
to change the memory access mode explicitly if their Linux kernel
is not configured with the \fBCONFIG_CROSS_MEMORY_ATTACH\fR option.\&
You may also use the environment variables \fBSYD_NO_CROSS_MEMORY_ATTACH\fR
and \fBSYD_PROC_PID_MEM_FALLBACK\fR, refer to the \fBENVIRONMENT\fR section of
the \fIsyd\fR(1) manual page for more information.\& For further information
about the security impact of \fIproc_pid_mem\fR(5) writes refer to the
following links:
.PP
.PD 0
.IP \(bu 4
https://lore.\&kernel.\&org/lkml/202403011451.\&C236A38@keescook/T/
.IP \(bu 4
https://lwn.\&net/Articles/476947/
.IP \(bu 4
https://issues.\&chromium.\&org/issues/40089045
.PD
.PP
.nf
.RS 4
; strace \-q \-eprocess_vm_readv \-fc \-\- syd \-poff \-pD \-mtrace/memory_access:0 true
% time     seconds  usecs/call     calls    errors syscall
\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
100\&.00    0\&.000031          10         3           process_vm_readv
\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
100\&.00    0\&.000031          10         3           total
; strace \-q \-eprocess_vm_readv \-fc \-\- syd \-poff \-pD \-mtrace/memory_access:1 true
; strace \-q \-eprocess_vm_readv \-fc \-\- syd \-poff \-pD \-mtrace/memory_access:2 true
% time     seconds  usecs/call     calls    errors syscall
\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
100\&.00    0\&.000008           2         3           process_vm_readv
\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
100\&.00    0\&.000008           2         3           total
.fi
.RE
.PP
.SS trace/sync_seccomp
.PP
.TS
allbox;l l
l l
l l.
T{
type
T}	T{
\fBboolean\fR
T}
T{
default
T}	T{
\fBtrue\fR
T}
T{
static
T}	T{
\fByes\fR
T}
.TE
.sp 1
Use synchronous mode for seccomp\-notify so each Syd syscall handler
thread wakes up on the same CPU as the respective sandbox thread that
executed the system call.\& This option makes no functional difference and
typically helps with performance.\& Use \fIperf\fR(1) to benchmark seccomp
synchronous mode on your system:
.PP
.nf
.RS 4
; perf bench sched seccomp\-notify
# Running \&'sched/seccomp\-notify\&' benchmark:
# Executed 1000000 system calls
Total time: 6\&.736 [sec]
6\&.736395 usecs/op
148447 ops/sec
; perf bench sched seccomp\-notify \-\-sync\-mode
# Running \&'sched/seccomp\-notify\&' benchmark:
# Executed 1000000 system calls
Total time: 4\&.188 [sec]
4\&.188846 usecs/op
238729 ops/sec
.fi
.RE
.PP
.SH PATTERN MATCHING
.PP
Syd uses shell\-style pattern matching for path\-based allowlists and
filters, and for UNIX socket address patterns.\& The matcher is a
derivative of the wildmatch matcher of \fIrsync\fR(1) with Syd\-specific
extensions, refer to the \fBPATTERN MATCHING RULES\fR section of the
\fIrsync\fR(1) manual for background.\& Matching operates on raw bytes rather
than characters: the matcher is 8\-bit clean, case\-sensitive, and
independent of the locale, performing no Unicode normalization or code
point interpretation.\& A pattern is a sequence of bytes in which the
following constructs carry special meaning, any other byte matches
itself:
.PP
.TS
allbox;l lx
l lx
l lx
l lx
l lx.
T{
*
T}	T{
Matches any sequence of bytes, never matching the directory separator /.\&
T}
T{
**
T}	T{
Matches any sequence of bytes, including the directory separator /.\&
T}
T{
?\&
T}	T{
Matches exactly one byte, never matching the directory separator /.\&
T}
T{
[.\&.\&.\&]
T}	T{
Matches exactly one byte out of the given class, see below.\&
T}
T{
\e
T}	T{
Escapes the next byte, stripping it of any special meaning.\&
T}
.TE
.sp 1
Consistent with the filter rules of \fIrsync\fR(1), a trailing triple star
matches the path itself in addition to everything below it: a pattern of
the form \fIP/***\fR is exactly equivalent to the pair of patterns \fIP\fR
and \fIP/**\fR.\& For instance, \fI/dev/***\fR matches both \fI/dev\fR and any
file recursively under \fI/dev\fR, whereas \fI/dev/**\fR matches strictly
below \fI/dev\fR.\& The triple star is only meaningful as a trailing
component.\& In addition, Syd applies one extension to \fIrsync\fR(1)
semantics, \fBcomponent elision\fR: a \fB**\fR between two separators also
matches zero path components, e.\&g.\& \fI/usr/**/bin/bash\fR matches both
\fI/usr/bin/bash\fR and \fI/usr/local/bin/bash\fR.\& A character class matches a
single byte against a set:
.PP
.TS
allbox;l lx
l lx
l lx
l lx
l lx.
T{
[abc]
T}	T{
Matches one of the given bytes.\& The byte ] may be included by placing it first in the class, e.\&g.\& \fI[]a]\fR.\&
T}
T{
[!\&abc], [\(haabc]
T}	T{
Negated class, matches any byte not in the given class, e.\&g.\& \fI[\(ha0\-9]\fR matches any byte which is not an ASCII digit.\&
T}
T{
[a\-f]
T}	T{
Range, matches any byte between the given bounds inclusive.\& A \- placed first or last is literal.\&
T}
T{
[\ex]
T}	T{
Escapes the next byte inside a class.\&
T}
T{
[[:name:]]
T}	T{
POSIX character class, where \fIname\fR is one of \fIalnum\fR, \fIalpha\fR, \fIblank\fR, \fIcntrl\fR, \fIdigit\fR, \fIgraph\fR, \fIlower\fR, \fIprint\fR, \fIpunct\fR, \fIspace\fR, \fIupper\fR, or \fIxdigit\fR.\& Consistent with byte\-wise matching, classes apply to ASCII range only.\&
T}
.TE
.sp 1
Patterns are matched against canonicalized, absolute pathnames: symbolic
links are resolved, and neither \fI.\&\fR (dot), nor \fI.\&.\&\fR (dotdot), nor
consecutive separators occur in the matched text, hence patterns should
be written in canonical form as well.\& A valid pattern starts with one of
the characters \fI/\fR for pathnames, \fI@\fR for abstract UNIX socket
addresses, or \fI!\&\fR for special addresses such as \fI!\&unnamed\fR (see \fBADDRESS
MATCHING\fR), or memory file descriptor names such as \fI!\&memfd:*\fR.\&
Patterns may include environment variables which are expanded once at
configure time (see \fBconfig/expand\fR).\& Finally, a pattern may be given
hex\-encoded, e.\&g.\& as produced by \fIsyd\-hex\fR(1), to express bytes which
cannot be written in a configuration file, such as newlines: a pattern
which is in its entirety a valid hexadecimal encoding is decoded before
use.\& Decoding is unambiguous since canonical patterns start with one of
\fI/\fR, \fI@\fR, or \fI!\&\fR, none of which is a hexadecimal digit.\& For efficient
evaluation, Syd classifies each pattern at configure time into one of
three match methods.\& This classification is an internal optimization
with no semantic effect:
.PP
.TS
allbox;l lx
l lx
l lx.
T{
Literal
T}	T{
A pattern including none of \fI*\fR, \fI?\&\fR, or \fI[\fR is matched by plain byte equality.\&
T}
T{
Prefix
T}	T{
A pattern of the form \fILITERAL/**\fR or \fILITERAL/***\fR is matched by a prefix comparison which honours component boundaries, e.\&g.\& \fI/dev/***\fR matches \fI/dev/null\fR but not \fI/devices\fR.\&
T}
T{
Wildcard
T}	T{
Any other pattern is matched with the full matcher, an iterative algorithm with constant additional memory based on Kirk Krauss'\&s \fBFastWildCompare\fR, extended with dual backup points for the \fI*\fR and \fI**\fR wildcards, and SIMD\-accelerated literal scanning.\&
T}
.TE
.sp 1
Syd gets patterns from multiple sources: a configuration file, a
profile, the \fB\-m\fR command line switch (see \fIsyd\fR(1) and \fIsyd\fR(5)), or a
\fIstat\fR(2) call with the \fB/dev/syd\fR prefix.\& There is no precedence
between different sources: all rules accumulate in order into a single
list per sandboxing capability, and pattern matching during access
control happens in a single step where \fBthe last matching pattern
decides the outcome.\&\fR In particular, precedence is positional rather
than structural: a later, more general pattern overrides an earlier,
more specific one.\& If no pattern matches, the default action of the
respective sandboxing capability applies (see the \fBdefault/\fR family of
commands).\&
.PP
.SH ADDRESS MATCHING
.PP
Syd has a simple address scheme to match network addresses.\& Addresses
can either be \fIglob\fR(3p) patterns to match \fIUNIX\fR and \fIabstract UNIX\fR
socket addresses, or IP CIDR followed by a port specification to match
IPv4 and IPv6 addresses.\& Port specification can be a single port, a
closed range in format \fIport1\-port2\fR, or a comma\-separated list of ports
and/or ranges such as \fI80,443,8000\-9000\fR.\& The address and the port
specification must be split by the character \fI!\&\fR.\& The precedence logic
is same as \fBPATTERN MATCHING\fR where \fBthe last matching pattern decides
the outcome.\&\fR UNIX socket addresses are matched against \fIglob\fR(3p)
patterns as follows:
.PP
.PD 0
.IP \(bu 4
\fB/path\fR: UNIX domain sockets are matched by their canonicalized socket
.PD
path, hence the patterns always start with the character \fI/\fR, e.\&g.\&
\fI/run/foo.\&sock\fR, or \fI/run/user/*/bus\fR
.PD 0
.IP \(bu 4
\fB@name\fR: Abstract UNIX sockets are prefixed with the character \fI@\fR
.PD
before the access check, hence the patterns must start with the
character \fI@\fR, e.\&g.\& \fI@dbus\-*\fR matches abstract sockets whose name
starts with \fIdbus\-\fR.\& Abstract socket names are kernel\-side identifiers,
they'\&re not filesystem paths and they'\&re not canonicalized
.PD 0
.IP \(bu 4
\fB!\&unnamed\fR: Unnamed UNIX sockets are matched with the dummy address
.PD
\fI!\&unnamed\fR.\& This is used for the \fIsocketpair\fR(2) system call, and for
socket operations on UNIX sockets without a pathname or an abstract name
.PP
Some examples are given below:
.PP
.TS
allbox;l lx
l lx
l lx
l lx.
T{
allow/net/bind+/run/foo.\&sock
T}	T{
Allow \fIbind\fR(2) to the UNIX socket /run/foo.\&sock.\&
T}
T{
allow/net/connect+/run/user/*/bus
T}	T{
Allow \fIconnect\fR(2) to user D\-Bus sockets.\&
T}
T{
allow/net/bind+@dbus\-*
T}	T{
Allow \fIbind\fR(2) to abstract sockets with name prefix \fIdbus\-\fR.\&
T}
T{
allow/net/bind,net/connect+!\&unnamed
T}	T{
Allow \fIsocketpair\fR(2) and operations on unnamed UNIX sockets.\&
T}
.TE
.sp 1
As of version 3.\&56.\&0, Syd supports \fIdial\fR(3) strings in the style of
Plan9 and go, which extend the address scheme with protocol filtering.\&
A \fIdial\fR(3) string has the form \fInetwork!\&netaddr!\&service\fR:
.PP
.PD 0
.IP \(bu 4
\fBnetwork\fR: One of the predefined network names \fItcp\fR, \fItcp4\fR, \fItcp6\fR,
.PD
\fImptcp\fR, \fImptcp4\fR, \fImptcp6\fR, \fIudp\fR, \fIudp4\fR, \fIudp6\fR, \fIudplite\fR,
\fIudplite4\fR, \fIudplite6\fR, \fIsctp\fR, \fIsctp4\fR, \fIsctp6\fR, \fIdccp\fR, \fIdccp4\fR,
\fIdccp6\fR, \fInet\fR, \fInet4\fR, \fInet6\fR, \fIunix\fR, \fIunixgram\fR, or \fIunixpacket\fR.\&
Network names are case\-insensitive.\& The \fItcp\fR names match TCP sockets,
the \fImptcp\fR names match Multipath TCP sockets, the \fIudp\fR names match UDP
sockets, the \fIudplite\fR names match UDP\-Lite sockets, the \fIsctp\fR names
match SCTP sockets, the \fIdccp\fR names match DCCP sockets, and the \fInet\fR
names match any protocol.\& Each protocol\-qualified name matches only its
own protocol.\& To cover a host across every protocol use a \fInet\fR name or
the legacy format.\& The \fI4\fR and \fI6\fR suffixes constrain the address family
of \fInetaddr\fR.\&
.PD 0
.IP \(bu 4
\fBnetaddr\fR: An IP address, an IP CIDR network, a network \fIalias\fR such
.PD
as \fIloopback\fR (see below), or the wildcard \fI*\fR which is an alias for
\fIany\fR.\& Hostnames are not supported.\&
.PD 0
.IP \(bu 4
\fBservice\fR: A port specification as described above, or the wildcard
.PD
\fI*\fR which matches all ports.\& Named services are not supported, the
service must be numeric.\&
.PP
Protocol of a socket is determined at system call time using the
\fBSO_PROTOCOL\fR socket option.\& The network names form a predefined set,
there'\&s no \fIndb\fR(8) lookup.\& Every field of a \fIdial\fR(3) string may be set
with environment variables which are expanded at configure time, e.\&g.\&
\fItcp!\&${ADDR}!\&${PORT}\fR, or \fI${PROTO}!\&127.\&0.\&0.\&1!\&80\fR.\& For network names
\fIunix\fR, \fIunixgram\fR, and \fIunixpacket\fR, the \fIservice\fR field is omitted and
\fInetaddr\fR is a \fIglob\fR(3p) pattern matching UNIX and abstract UNIX socket
addresses with the conventions described above: \fIunix!\&/run/foo.\&sock\fR is
equivalent to \fI/run/foo.\&sock\fR, \fIunix!\&@dbus\-*\fR is equivalent to
\fI@dbus\-*\fR, and \fIunix!\&!\&unnamed\fR is equivalent to \fI!\&unnamed\fR.\& The three
UNIX network names are equivalent, the socket type is not used in
matching.\& Some examples are given below:
.PP
.TS
allbox;l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
tcp!\&127.\&0.\&0.\&1!\&80
T}	T{
TCP to 127.\&0.\&0.\&1 port 80
T}
T{
udp!\&9.\&9.\&9.\&9!\&53
T}	T{
UDP to 9.\&9.\&9.\&9 port 53
T}
T{
tcp!\&10.\&0.\&0.\&0/8!\&22,80,443
T}	T{
TCP to the 10.\&0.\&0.\&0/8 network on ports 22, 80, and 443
T}
T{
tcp6!\&*!\&443
T}	T{
TCP over IPv6 to any address on port 443
T}
T{
sctp!\&10.\&0.\&0.\&7!\&9899
T}	T{
SCTP to 10.\&0.\&0.\&7 port 9899
T}
T{
udp!\&loopback!\&*
T}	T{
UDP to the loopback addresses on any port
T}
T{
net!\&::1!\&8080
T}	T{
Any protocol to ::1 port 8080
T}
T{
unix!\&/run/***
T}	T{
UNIX sockets under /run
T}
T{
unix!\&@dbus\-*
T}	T{
Abstract UNIX sockets with the name prefix \fIdbus\-\fR
T}
T{
unix!\&!\&unnamed
T}	T{
Unnamed UNIX sockets
T}
.TE
.sp 1
\fIdial\fR(3) strings expanding to multiple networks add one rule per
network, e.\&g.\& \fIallow/net/connect+tcp!\&loopback!\&80\fR is equivalent to
\fIallow/net/connect+tcp!\&127.\&0.\&0.\&0/8!\&80\fR followed by
\fIallow/net/connect+tcp!\&::1/128!\&80\fR.\& Addresses in the legacy format match
\fIany\fR protocol, hence the legacy format is equivalent to the \fInet\fR
network name, and existing configuration retains its behaviour, e.\&g.\&
\fIallow/net/connect+::1!\&8080\fR is equivalent to
\fIallow/net/connect+net!\&::1!\&8080\fR.\& In addition there are some \fIaliases\fR,
which may be used instead of specifying an address:
.PP
.TS
allbox;l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
any
T}	T{
any4 + any6
T}
T{
any4
T}	T{
Whole IPv4 address space: 0.\&0.\&0.\&0/0
T}
T{
any6
T}	T{
Whole IPv6 address space: ::/0
T}
T{
loopback
T}	T{
loopback4 + loopback6
T}
T{
loopback4
T}	T{
127.\&0.\&0.\&0/8
T}
T{
loopback6
T}	T{
::1/128
T}
T{
linklocal
T}	T{
linklocal4 + linklocal6
T}
T{
linklocal4
T}	T{
169.\&254.\&0.\&0/16
T}
T{
linklocal6
T}	T{
fe80::/10
T}
T{
local
T}	T{
local4 + local6
T}
T{
local4
T}	T{
Loopback network and \fBRFC1918\fR private networks: 127.\&0.\&0.\&0/8 + 10.\&0.\&0.\&0/8 + 172.\&16.\&0.\&0/12 + 192.\&168.\&0.\&0/16
T}
T{
local6
T}	T{
::1/128 + fe80::/10 + fc00::/7 + fec0::/10
T}
T{
multicast
T}	T{
multicast4 + multicast6
T}
T{
multicast4
T}	T{
IPv4 multicast address space: 224.\&0.\&0.\&0/4
T}
T{
multicast6
T}	T{
IPv6 multicast address space: ff00::/8
T}
.TE
.sp 1
.SH SECURITY
.PP
The interface is only available if the sandbox lock is not set for the calling
process.\& Similarly, command\-line option parsing and configuration file parsing
stops once a \fBlock:on\fR clause is executed.\&
.PP
.SH RETURN VALUE
.PP
For \fIstat\fR(2) calls, on success, zero is returned.\& On error, \-1 is
returned, and \fIerrno\fR(3) is set to indicate the error.\&
.PP
For \fIopen\fR(2) calls, on success the new file descriptor (a nonnegative
integer) is returned.\& The file descriptor is randomized.\& On error, \-1 is
returned and \fIerrno\fR(3) is set to indicate the error.\&
.PP
On a successful call the \fIstat\fR(2) buffer has the following fields
masked, other fields are equivalent to the character device \fI/dev/null\fR:
.PP
.PD 0
.IP \(bu 4
Inode is zero.\&
.IP \(bu 4
Mode field represents the file type (character device) and
permissions, with special bits set as follows: sticky bit for
\fIunshare/mount:1\fR, SUID bit for \fIunshare/user:1\fR, SGID bit for
\fIunshare/net:1\fR, user read/write/exec bits for Read, Write and Exec
sandboxing, group read bit for Stat sandboxing, group write bit for
Proxy sandboxing, group exec bit for TPE sandboxing, world read bit
for Lock sandboxing, world write bit for Crypt sandboxing, and world
exec bit for Force sandboxing.\&
.IP \(bu 4
Nlink field represents the lower 32 bits of sandboxing capabilities,
encoded as: \fIlock\fR, \fIwalk\fR, \fIlist\fR, \fIstat\fR, \fIread\fR, \fIwrite\fR, \fIexec\fR,
\fIioctl\fR, \fIcreate\fR, \fIdelete\fR, \fIrename\fR, \fIreadlink\fR, \fIsymlink\fR,
\fItruncate\fR, \fIchdir\fR, \fIreaddir\fR, \fImkdir\fR, \fIrmdir\fR, \fIchown\fR, \fIchgrp\fR,
\fIchmod\fR, \fIchattr\fR, \fIchroot\fR, \fInotify\fR, \fIutime\fR, \fImkbdev\fR, \fImkcdev\fR,
\fImkfifo\fR, \fImktemp\fR, \fInet/bind\fR, \fInet/connect\fR, and \fInet/sendfd\fR.\&
.IP \(bu 4
Device type represents \fIsyd\fR(2) API version (major, minor)
.IP \(bu 4
Access, creation, and modification times are non\-zero constants.\&
.PD
.PP
.SH ERRORS
.PP
.TS
l lx.
T{
\fBEINVAL\fR
T}	T{
Sandbox command is syntactically incorrect.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBENOENT\fR
T}	T{
Result of the given sandbox query is false (e.\&g.\& \fBtest \-c /dev/syd/sandbox/stat?\&\fR).\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBENOENT\fR
T}	T{
Sandbox lock is on, no commands are allowed.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEPERM\fR
T}	T{
Attempted to raise privileges in \fBlock:drop\fR mode.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEBUSY\fR
T}	T{
Attempted to edit a setting at runtime that must be configured at startup.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEEXIST\fR
T}	T{
Overwriting rule is not permitted in \fBlock:drop\fR mode.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEEXIST\fR
T}	T{
Attempted to add an UID/GID transition for SafeSetID but a transition with the same source UID/GID exists.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBENODATA\fR
T}	T{
SafeSetID is on but no UID/GID transits were defined for the current user/group.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBENOKEY\fR
T}	T{
Crypt sandboxing is on but no encryption key was supplied.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEKEYREVOKED\fR
T}	T{
Session keyring is not linked to the user keyring for Crypt sandboxing.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEOPNOTSUPP\fR
T}	T{
Hash algorithm is not supported for Force sandboxing.\&
T}
.TE
.sp 1
.TS
l lx.
T{
\fBEOPNOTSUPP\fR
T}	T{
Sandbox command is not supported for \fIsyd\-oci\fR(1).\&
T}
.TE
.sp 1
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(5), \fIsyd\fR(7), \fIsyd\-ls\fR(1), \fIopen\fR(2), \fIstat\fR(2),
\fIperf\fR(1), \fIpledge\fR(2), \fIptrace\fR(2), \fIseccomp\fR(2), \fIstrace\fR(1),
\fIglob\fR(3p), \fIio_uring\fR(7), \fIgdb\fR(1), \fIvalgrind\fR(1), \fIwordexp\fR(3)
.PP
.PD 0
.IP \(bu 4
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org
.IP \(bu 4
\fBlibsyd\fR homepage: https://libsyd.\&exherbo.\&org
.IP \(bu 4
\fBgosyd\fR homepage: https://gosyd.\&exherbo.\&org
.IP \(bu 4
\fBplsyd\fR homepage: https://plsyd.\&exherbo.\&org
.IP \(bu 4
\fBpysyd\fR homepage: https://pysyd.\&exherbo.\&org
.IP \(bu 4
\fBrbsyd\fR homepage: https://rbsyd.\&exherbo.\&org
.IP \(bu 4
\fBsyd.\&el\fR homepage: https://sydel.\&exherbo.\&org
.IP \(bu 4
\fBlibsydtime\fR homepage: https://lib.\&rs/libsydtime
.IP \(bu 4
\fBLandLock\fR homepage: https://landlock.\&io/
.IP \(bu 4
\fBvDSO\fR wiki: https://en.\&wikipedia.\&org/wiki/VDSO
.IP \(bu 4
\fBparse\-size\fR documentation: https://docs.\&rs/parse\-size/1.\&0.\&0/parse_size/
.IP \(bu 4
\fBipnetwork\fR documentation: https://docs.\&rs/ipnetwork
.PD
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&