.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-MDWE" "1" "2026\-09\-01"
.PP
.SH NAME
.PP
\fBsyd\-mdwe\fR \- Run a program under Memory\-Deny\-Write\-Execute protections
.PP
.SH SYNOPSIS
.PP
\fBsyd\-mdwe\fR \fI[\-hms]\fR \fI{command [args.\&.\&.\&]}\fR
.PP
.SH DESCRIPTION
.PP
\fBsyd\-mdwe\fR utility runs a program under Memory\-Deny\-Write\-Execute (MDWE)
protections.\& The protections can be applied using \fIprctl\fR(2) and
\fIseccomp\fR(2), These protections are identical to what Syd applies by
default.\&
.PP
.SH OPTIONS
.PP
.TS
l lx
l lx
l lx.
T{
\fB\-h\fR
T}	T{
Display help.\&
T}
T{
\fB\-m\fR
T}	T{
Enable MDWE protections using \fIprctl\fR(2) PR_SET_MDWE (default: both).\&
T}
T{
\fB\-s\fR
T}	T{
Enable MDWE protections using \fIseccomp\fR(2) (default: both).\&
T}
.TE
.sp 1
.SH EXAMPLES
.PP
Running pax\-test once standalone and once under \fIsyd\-mdwe\fR(1) on a 6.\&8
kernel we get the following differences:
.PP
.TS
allbox;l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c
l c c.
T{
\fBPaX Testcase\fR
T}	T{
\fBstandalone\fR
T}	T{
\fBmdwe\fR
T}
T{
Executable anonymous mapping
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable bss
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable data
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable heap
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable stack
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable shared library bss
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable shared library data
T}	T{
Killed
T}	T{
Killed
T}
T{
Executable anonymous mapping (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable bss (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable data (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable heap (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable stack (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable shared library bss (mprotect)
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Executable shared library data (mprotect):
T}	T{
Vulnerable
T}	T{
Killed
T}
T{
Writable text segments
T}	T{
Vulnerable
T}	T{
Killed
T}
.TE
.sp 1
The test was performed with paxtest\-0.\&9.\&15:
.PP
.nf
.RS 4
PaXtest \- Copyright(c) 2003\-2016 by Peter Busser <peter@adamantix\&.org> and Brad Spengler <spender@grsecurity\&.net>
Released under the GNU Public Licence version 2 or later

Mode: 1
Blackhat
Kernel: 
Linux syd 6\&.8\&.0\-syd\-13213\-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux
.fi
.RE
.PP
.SH EXIT STATUS
.PP
On clean exit, \fBsyd\-mdwe\fR exits with the same code as the child process.\&
On unclean termination, exit code is set to 128 plus signal number.\& In
case executing the child process fails \fBsyd\-mdwe\fR exits with the
\fIerrno\fR(3) number.\&
.PP
.SH CAVEATS
.PP
By default, \fIprctl\fR(2) error setting \fIPR_SET_MDWE\fR(2const) is not fatal.\&
Use the \fB\-m\fR option to make this error fatal.\& This utility does not work
on MIPS architectures where Linux requires executable stack.\&
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\-lock\fR(1), \fIsyd\-ofd\fR(1), \fIsyd\-pds\fR(1),
\fIsyd\-ring\fR(1), \fIsyd\-sec\fR(1), \fIsyd\-tsc\fR(1), \fIseccomp\fR(2), \fIprctl\fR(2), \fIPR_SET_MDWE\fR(2const)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&