.\" Generated by scdoc 1.11.5 .\" Complete documentation for this program is not available as a GNU info page .ie \n(.g .ds Aq \(aq .el .ds Aq ' .nh .ad l .\" Begin generated content: .TH "SYD\-FD" "1" "2026\-09\-01" .PP .SH NAME .PP \fBsyd\-fd\fR \- Interact with remote file descriptors .PP .SH SYNOPSIS .PP \fBsyd\-fd\fR \fI[\-h]\fR \fI[\-p pid]\fR \fI[\-f remote_fd[:local_fd]]\fR.\&.\&.\& \fI{command [args.\&.\&.\&]}\fR .br \fBsyd\-fd\fR \fI[\-hw]\fR \-u \fIsocket\fR \fI[\-m msg]\fR \fI[\-f fd[,fd.\&.\&.\&]]\fR.\&.\&.\& .PP .SH DESCRIPTION .PP \fBsyd\-fd\fR utility can be used to interact with file descriptors on Linux systems.\& It operates in one of two modes: transferring remote file descriptors with \fIpidfd_getfd\fR(2), or sending file descriptors over a UNIX domain socket with \fBSCM_RIGHTS\fR.\& .PP In first mode, given only a PID argument with \fI\-p\fR, it lists the open files of the process with the given PID in line\-oriented compact JSON format.\& Given no PID argument it lists the open files of the current process.\& The \fI\-f\fR argument can be used to transfer remote file descriptors using \fIpidfd_getfd\fR(2) which requires Linux>=5.\&6.\& Optionally a local file descriptor to use as the target may be appended after a colon.\& Specify "rand" as target to duplicate the file descriptor to a random available file descriptor slot.\& If a command is given it is executed and the file descriptors are transferred to the process.\& If no command is given "/bin/sh" is executed.\& .PP In second mode, selected with \fI\-u\fR, it connects to the given UNIX domain socket and sends a single message carrying the file descriptors given with \fI\-f\fR as \fBSCM_RIGHTS\fR ancillary data of \fIunix\fR(7).\& A leading \fB@\fR in the socket address denotes an \fIabstract\fR UNIX socket.\& The \fI\-f\fR arguments are local file descriptor numbers: caller is supposed to open them, e.\&g.\& with shell redirections.\& Message line may be given with \fI\-m\fR and defaults to empty.\& Both \fI\-m\fR and \fI\-f\fR are optional, so the mode may also be used to send plain messages without file descriptors.\& Any limit on the number of descriptors per message is the receiver'\&s policy: \fIsyd\fR(2) IPC socket accepts exactly one configuration file descriptor per message.\& By default syd\-fd exits right after the send without waiting for a response, given \fI\-w\fR it waits for a response regardless of what was sent, and prints it to standard output until peer closes the connection.\& Above all, this mode is useful to load sandbox configuration over the \fIsyd\fR(2) IPC socket.\& A received file descriptor constitutes the load request, and the message carrying it must consist of the sole command "load".\& .PP .SH OPTIONS .PP .TS l lx l lx l lx l lx l lx l lx. T{ \fB\-h\fR T} T{ Display help.\& T} T{ \fB\-p\fR \fIpid\fR T} T{ Specify process ID.\& If not given, list fds of current process.\& T} T{ \fB\-f\fR \fIremote_fd[:local_fd]\fR T} T{ Specify remote fd to transfer.\& A local target fd may be appended after a colon, or "rand" for a random target.\& T} T{ \fB\-u\fR \fIsocket\fR T} T{ Connect to the UNIX domain socket and send the given fds with \fBSCM_RIGHTS\fR.\& A leading \fB@\fR denotes an abstract socket.\& The fds to send are given with \fI\-f\fR, repeated or comma\-separated.\& T} T{ \fB\-m\fR \fIline\fR T} T{ Specify the message line to send with \fI\-u\fR.\& Optional, defaults to empty.\& T} T{ \fB\-w\fR T} T{ Wait for a response with \fI\-u\fR, regardless of what was sent, and print it to standard output.\& By default syd\-fd exits right after the send.\& T} .TE .sp 1 .SH EXIT STATUS .PP syd\-fd exits with the same exit code as the command.\& With \fI\-u\fR, it exits 0 on success, and with the \fIerrno\fR(3) of the failed system call on failure.\& .PP .SH EXAMPLES .PP Load sandbox configuration over \fIsyd\fR(2) IPC socket: .PP .nf .RS 4 $ syd\-fd \-w \-u @sandbox\&.sock \-m load \-f 3 3