.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD\-PTY" "1" "2026\-09\-01"
.PP
.SH NAME
.PP
\fBsyd\-pty\fR \- PTY to STDIO bidirectional forwarder
.PP
.SH SYNOPSIS
.PP
\fBsyd\-pty\fR \fI[\-dh]\fR \fI\-i <pty\-fd>\fR \fI[\-x <x\-size>]\fR \fI[\-y <y\-size>]\fR
.PP
.SH DESCRIPTION
.PP
Forwards data between given \fIpty\fR(7) main file descriptor and \fIstdio\fR(3).\&
.PP
.SH OPTIONS
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB\-h\fR
T}	T{
Display help.\&
T}
T{
\fB\-d\fR
T}	T{
Run in debug mode without confinement.\&
T}
T{

T}	T{
This is permitted only if Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fB\-i\fR \fBpty\-fd\fR
T}	T{
PTY main file descriptor.\&
T}
T{
\fB\-x\fR \fBx\-size\fR
T}	T{
Specify window row size (default: inherit).\&
T}
T{
\fB\-y\fR \fBy\-size\fR
T}	T{
Specify window column size (default: inherit).\&
T}
.TE
.sp 1
.SH USAGE
.PP
\fIsyd\-pty\fR(1) is not meant to be used as a standalone tool.\& Syd invokes
\fIsyd\-pty\fR(1) at startup when PTY sandboxing is set to on with
\fBsandbox/pty:on\fR.\& See PTY SANDBOXING section in \fIsyd\fR(7) manual page for
more information.\& If you want to use \fIsyd\-pty\fR(1) in your own project,
create a new pseudoterminal with \fIposix_openpt\fR(3) or \fIopenpty\fR(3) and
pass main end of file descriptor pair to \fIsyd\-pty\fR(1) with \fB\-i <pty\-fd>\fR
argument.\& \fIsyd\-pty\fR(1) is going to set terminal to raw mode and make no
attempt to save/reset original terminal settings which is caller'\&s
responsibility.\&
.PP
.SH IMPLEMENTATION
.PP
\fIsyd\-pty\fR(1) is designed for performance, security, and privacy, using
edge\-triggered \fIepoll\fR(7) for event notification and fully asynchronous
operations to handle pseudoterminal activities without blocking.\& It
transfers data with zero\-copy \fIsplice\fR(2), moving bytes directly between
file descriptors within kernel without exposing plaintext in user space.\&
Two pairs of pipes carry bidirectional traffic between \fIpty\fR(7) and
\fIstdio\fR(3).\& execution environment is confined with \fIseccomp\fR(2) and
\fIlandlock\fR(7), restricting system calls and file access to minimum
required.\&
.PP
.SH SECURITY
.PP
\fIsyd\-pty\fR(1) applies multiple confinement layers to mitigate risks
associated with running outside Syd sandbox, preventing potential
Meddler\-in\-the\-Middle (MITM) attacks against containers.\& Linux
\fIcapabilities\fR(7) are dropped early and no\-new\-privs attribute is set so
no unwanted capability leaks into the process.\& \fBTOSTOP\fR flag is set for
terminal \fIsyd\-pty\fR(1) reads from to disable background processes from
writing.\& Resource limits \fBRLIMIT_CORE\fR, \fBRLIMIT_FSIZE\fR, \fBRLIMIT_NOFILE\fR,
\fBRLIMIT_NPROC\fR, \fBRLIMIT_LOCKS\fR, \fBRLIMIT_MEMLOCK\fR, and \fBRLIMIT_MSGQUEUE\fR
are set to zero to prevent core dumps and file/fd/process/msgqueue
creation inside main loop.\& \fIseccomp\fR(2) filters are configured to allow
only required syscalls.\& This list excludes memory, file system and
network system calls.\& \fIlandlock\fR(7) and \fInamespaces\fR(7), if available,
enforce further restrictions by disallowing all filesystem and network
access, providing an additional layer of security.\& Root directory is
moved into \fI/proc/self/fdinfo\fR with \fIpivot_root\fR(2) and old root is
detached with \fBMNT_DETACH\fR, so no path to host filesystem remains in
mount namespace.\& These combined techniques ensure that even if
\fIsyd\-pty\fR(1) is compromised, scope of malicious actions is significantly
limited, maintaining integrity and security of the system.\&
.PP
.SH ENVIRONMENT
.PP
.TS
l lx
l lx.
T{
\fBSYD_PTY_DEBUG\fR
T}	T{
Run in debug mode without confinement, equivalent to \fB\-d\fR option.\&
T}
T{

T}	T{
This is ignored unless Syd is built with \fBtrusted\fR Cargo feature.\&
T}
.TE
.sp 1
.SH BUGS
.PP
\fIsplice\fR(2) support for ttys was removed in commit
36e2c7421f02a22f71c9283e55fdb672a9eb58e7 (merged for Linux 6.\&5) and later
restored in commit 9bb48c82aced07698a2d08ee0f1475a6c4f6b266 (merged for Linux
6.\&6).\& When running under a problematic Linux kernel \fIsyd\-pty\fR(1) will exit with
22, aka \fBEINVAL\fR or \fBInvalid argument\fR.\& See following links for more
information:
.PP
.PD 0
.IP \(bu 4
https://git.\&kernel.\&org/linus/36e2c7421f02a22f71c9283e55fdb672a9eb58e7
.IP \(bu 4
https://git.\&kernel.\&org/linus/9bb48c82aced07698a2d08ee0f1475a6c4f6b266
.PD
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(1), \fIsyd\fR(2), \fIsyd\fR(7), \fIstdio\fR(3), \fIpty\fR(7)
.PP
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on Libera
Chat or in #sydbox:mailstation.\&de on Matrix.\&