SYD-MDWE(1)                 General Commands Manual                SYD-MDWE(1)

NAME
       syd-mdwe - Run a program under Memory-Deny-Write-Execute protections

SYNOPSIS
       syd-mdwe [-hms] {command [args...]}

DESCRIPTION
       syd-mdwe utility runs a program under Memory-Deny-Write-Execute (MDWE)
       protections. The protections can be applied using prctl(2) and
       seccomp(2), These protections are identical to what Syd applies by
       default.

OPTIONS

       -h   Display help.
       -m   Enable MDWE protections using prctl(2) PR_SET_MDWE (default:
            both).
       -s   Enable MDWE protections using seccomp(2) (default: both).


EXAMPLES
       Running pax-test once standalone and once under syd-mdwe(1) on a 6.8
       kernel we get the following differences:

       +------------------+------------+--------+
       |PaX Testcase      | standalone |  mdwe  |
       +------------------+------------+--------+
       |Executable        |   Killed   | Killed |
       |anonymous mapping |            |        |
       +------------------+------------+--------+
       |Executable bss    |   Killed   | Killed |
       +------------------+------------+--------+
       |Executable data   |   Killed   | Killed |
       +------------------+------------+--------+
       |Executable heap   |   Killed   | Killed |
       +------------------+------------+--------+
       |Executable stack  |   Killed   | Killed |
       +------------------+------------+--------+
       |Executable shared |   Killed   | Killed |
       |library bss       |            |        |
       +------------------+------------+--------+
       |Executable shared |   Killed   | Killed |
       |library data      |            |        |
       +------------------+------------+--------+
       |Executable        | Vulnerable | Killed |
       |anonymous mapping |            |        |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable bss    | Vulnerable | Killed |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable data   | Vulnerable | Killed |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable heap   | Vulnerable | Killed |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable stack  | Vulnerable | Killed |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable shared | Vulnerable | Killed |
       |library bss       |            |        |
       |(mprotect)        |            |        |
       +------------------+------------+--------+
       |Executable shared | Vulnerable | Killed |
       |library data      |            |        |
       |(mprotect):       |            |        |
       +------------------+------------+--------+
       |Writable text     | Vulnerable | Killed |
       |segments          |            |        |
       +------------------+------------+--------+
       The test was performed with paxtest-0.9.15:

           PaXtest - Copyright(c) 2003-2016 by Peter Busser <peter@adamantix.org> and Brad Spengler <spender@grsecurity.net>
           Released under the GNU Public Licence version 2 or later

           Mode: 1
           Blackhat
           Kernel:
           Linux syd 6.8.0-syd-13213-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux

EXIT STATUS
       On clean exit, syd-mdwe exits with the same code as the child process.
       On unclean termination, exit code is set to 128 plus signal number. In
       case executing the child process fails syd-mdwe exits with the errno(3)
       number.

CAVEATS
       By default, prctl(2) error setting PR_SET_MDWE(2const) is not fatal.
       Use the -m option to make this error fatal. This utility does not work
       on MIPS architectures where Linux requires executable stack.

SEE ALSO
       syd(1), syd(2), syd(5), syd-lock(1), syd-ofd(1), syd-pds(1),
       syd-ring(1), syd-sec(1), syd-tsc(1), seccomp(2), prctl(2),
       PR_SET_MDWE(2const)

       syd homepage: https://sydbox.exherbo.org/

AUTHORS
       Maintained by Ali Polatel. Up-to-date sources can be found at
       https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at
       rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to
       https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox
       on Libera Chat or in #sydbox:mailstation.de on Matrix.

                                  2026-09-01                       SYD-MDWE(1)