.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "SYD" "1" "2026\-09\-01"
.PP
.SH NAME
.PP
\fBsyd\fR \- Rock solid application kernel
.PP
.SH SYNOPSIS
.PP
\fBsyd\fR [\-acefhlmpqtxEPV] [\-\-] {command [arg.\&.\&.\&]}
.PP
\fBsyd\fR \-\-api
.PP
\fBsyd\fR \-\-check
.PP
\fBsyd\fR \-\-el
.PP
\fBsyd\fR \-\-sh
.PP
.SH DESCRIPTION
.PP
Syd is a utility that uses the \fIseccomp\fR(2) system call to sandbox
processes on Linux systems version 5.\&19 or later.\& It enables per\-syscall
control over a process'\&s filesystem and network access \fIwithout
requiring root privileges\fR.\& Syd is designed for ease of use across a
wide array of architectures, including \fBx86\fR, \fBx86_64\fR, \fBx32\fR, \fBarmv7\fR,
\fBaarch64\fR, \fBloongarch64\fR, \fBmips\fR, \fBmips64\fR, \fBmips64el\fR, \fBppc\fR, \fBppc64\fR,
\fBppc64le\fR, \fBriscv64\fR, and \fBs390x\fR embodying the principle of providing
simple, flexible, and reliable access control to Linux users.\&
.PP
The core functionality of Syd revolves around restricting a process'\&s
resource access through several mechanisms:
.PP
.PD 0
.IP \(bu 4
\fBBind Mounts\fR: Utilized within a mount namespace to enforce restrictions at 
the \fBVirtual File System (VFS)\fR level, such as \fBread\-only\fR, \fBnodev\fR, \fBnoexec\fR, 
\fBnosuid\fR, and \fBnosymfollow\fR.\&
.IP \(bu 4
\fBLandlock\fR: Employs read\-only and read\-write path restrictions at the kernel level.\&
.IP \(bu 4
\fBseccomp\-bpf\fR: Applies Secure Computing user filters for kernel\-space sandboxing.\&
.IP \(bu 4
\fBseccomp\-notify\fR: Enables sandboxing in kernel space with user space 
fallback for dereferencing pointer arguments in system calls, 
including pathnames and network addresses.\& Access checks use 
UNIX shell\-style patterns and CIDR notation, defaulting to denying 
system calls with \fBEACCES\fR while attempting to emulate successful 
calls to mitigate \fBTime\-of\-Check to Time\-of\-Use (TOCTOU)\fR 
attack vectors.\&
.PD
.PP
Prerequisites for Syd include a Linux kernel supporting \fIpidfd_getfd\fR(2) and
\fIpidfd_send_signal\fR(2) system calls, \fBSECCOMP_USER_NOTIF_FLAG_CONTINUE\fR
operation in the Secure Computing facility, and preferably the
\fBCONFIG_CROSS_MEMORY_ATTACH\fR kernel option.\& For syscall emulation, Syd uses the
seccomp operation \fBSECCOMP_IOCTL_NOTIF_ADDFD\fR.\& Syd also sets the
\fBSECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV\fR flag to correctly handle interrupts
during tracing.\& While \fILinux version 5.\&19 or later is required\fR, for Landlock
support Syd requires a kernel configured with the option \fBCONFIG_LSM_LANDLOCK\fR
supporting \fILandlock ABI version 3\fR, with \fIsyd\-lock\fR(1) available as a helper
program to verify kernel support.\& Linux kernel options \fBCONFIG_KCMP\fR and
\fBCONFIG_UNIX_DIAG\fR are recommended.\&
.PP
By default, Syd restricts the resource space accessible to sandboxed
processes as tightly as possible.\& The \fBSECURITY\fR section of the \fIsyd\fR(7)
manual page lists all hardening measures and the
\fItrace/allow_unsafe_*\fR options to relax specific restrictions when
needed.\&
.PP
.SH OPTIONS
.PP
The following options are understood:
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fB\-h\fR, \fB\-\-help\fR
T}	T{
Show usage and exit.\&
T}
T{
\fB\-V\fR, \fB\-\-version\fR
T}	T{
Show version and exit.\&
T}
T{
\fB\-C\fR, \fB\-\-check\fR
T}	T{
Print sandboxing support information about the current system and exit.\&
T}
T{
\fB\-v\fR, \fB\-\-verbose\fR
T}	T{
Increase verbosity, equivalent to incrementing \fBlog/verbose\fR by one.\&
T}
T{
\fB\-c\fR
T}	T{
Login shell compatibility
T}
T{

T}	T{
Causes command to be executed under a shell with the \fBuser\fR profile.\&
T}
T{

T}	T{
The shell to execute is \fI/bin/sh\fR by default.\&
T}
T{

T}	T{
Use the environment variable \fBSYD_SHELL\fR to override.\&
T}
T{
\fB\-f\fR
T}	T{
Login shell compatibility.\&
T}
T{

T}	T{
Causes Syd to parse the \fBuser\fR profile on startup.\&
T}
T{
\fB\-l\fR, \fB\-\-login\fR
T}	T{
Login shell compatibility
T}
T{

T}	T{
Causes Syd to parse the \fBuser\fR profile on startup.\&
T}
T{
\fB\-q\fR
T}	T{
Enable quick boot mode for faster startup times.\&
T}
T{

T}	T{
This must be passed as the first option or it will be ignored.\&
T}
T{

T}	T{
See the explanation of the environment variable \fBSYD_QUICK_BOOT\fR for the safety of this option.\&
T}
T{
\fB\-x\fR
T}	T{
Enable \fBtrace\fR aka "dry run" mode.\&
T}
T{

T}	T{
In this mode Syd will allow system calls even if they raise access violations.\&
T}
T{

T}	T{
This mode with extended logging can be used to build sandboxing profiles in an automated way.\&
T}
T{

T}	T{
See \fIpandora\fR(1) which is a tool that uses Syd'\&s trace mode to automatically generate sandbox profiles.\&
T}
T{
\fB\-m config\fR
T}	T{
Configure sandbox during init, may be repeated.\&
T}
T{
\fB\-p name\fR
T}	T{
Use a sandbox profile during init, may be repeated.\&
T}
T{
\fB\-P path\fR
T}	T{
Run a configuration file during init, may be repeated.\&
T}
T{
\fB\-a alias\fR
T}	T{
Set alias of the command.\& Passed as \fBargv[0]\fR to the program.\&
T}
T{
\fB\-e\fR
T}	T{
Use \fB\-e var=val\fR to put var=val in the environment for command, may be repeated.\&
T}
T{

T}	T{
Use \fB\-e var\fR to remove var from the environment for command, may be repeated.\&
T}
T{

T}	T{
Use \fB\-e var=\fR to pass\-through an unsafe environment variable, may be repeated.\&
T}
T{
\fB\-t timeout\fR
T}	T{
Specify sandbox timeout in human readable format.\&
T}
T{

T}	T{
Equivalent to \fBtimeout\fR option, refer to \fIsyd\fR(2) for more information.\&
T}
T{
\fB\-E mode\fR
T}	T{
Export secure computing rules with the given format to standard output and exit.\&
T}
T{

T}	T{
Mode must be one of \fBbpf\fR or \fBpfc\fR:
T}
T{

T}	T{
\fBbpf\fR, aka \fBBerkeley Packet Filter\fR is a binary, machine readable format, whereas
T}
T{

T}	T{
\fBpfc\fR, aka \fBPseudo Filter Code\fR is a textual, human readable format.\&
T}
T{
\fB\-\-api\fR
T}	T{
Output \fIsyd\fR(2) API specification in JSON format.\&
T}
T{

T}	T{
This specification is intended to ease generation of language bindings.\&
T}
T{

T}	T{
This specification is also available via the magic path \fB/dev/syd\fR.\&
T}
T{
\fB\-\-el\fR
T}	T{
Output \fBsyd.\&el\fR which is the Emacs Lisp implementation of Syd \fIstat\fR(2) interface.\&
T}
T{

T}	T{
This file is also available via the magic path \fB/dev/syd.\&el\fR.\&
T}
T{
\fB\-\-sh\fR
T}	T{
Output a shell script which defines the \fBesyd\fR helper function.\&
T}
T{

T}	T{
This file is also available via the magic path \fB/dev/syd.\&sh\fR.\&
T}
T{

T}	T{
Works with POSIX sh, bash and zsh.\&
T}
T{

T}	T{
You may use \fBeval "$(syd \-\-sh)"\fR in your shell init file.\&
T}
.TE
.sp 1
.SH INVOCATION
.PP
Syd executes a command with the specified arguments under a sandbox and
exits with the same status.\& The sandbox may be constructed by
command\-line arguments and configuration files.\& \fIsyd\fR(2) API is
available for dynamic configuration if the sandbox lock allows it.\& An
IPC socket may be configured with the \fIipc\fR command to configure Syd
through a UNIX socket.\& Refer to the \fIsyd\fR(2) manual page for more
information.\&
.PP
.SH ENVIRONMENT
.PP
.TS
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx
l lx.
T{
\fBSYD_IPC\fR
T}	T{
Specify UNIX socket address for runtime configuration.\&
T}
T{

T}	T{
Equivalent to the \fBipc\fR command, see the \fIsyd\fR(2) manual page.\&
T}
T{

T}	T{
\fBipc\fR command has precedence over this environment variable.\&
T}
T{
\fBSYD_LOG\fR
T}	T{
Set log level to \fBemerg\fR, \fBalert\fR, \fBcrit\fR, \fBerror\fR, \fBwarn\fR, \fBnotice\fR, \fBinfo\fR or \fBdebug\fR.\&
T}
T{
\fBSYD_LOG_BUF_LEN\fR
T}	T{
Set \fIsyslog\fR(2) ring buffer capacity.\&
T}
T{

T}	T{
By default, ring buffer is allocated on the stack with 256k size.\&
T}
T{

T}	T{
Setting this variable makes Syd allocate ring buffer on the heap with user\-specified size.\&
T}
T{

T}	T{
The value is parsed using the \fBparse\-size\fR crate.\&
T}
T{

T}	T{
Refer to their documentation for information on formatting.\&
T}
T{
\fBSYD_LOG_FD\fR
T}	T{
Set log file descriptor, defaults to \fIstderr\fR(3).\&
T}
T{

T}	T{
Negative values are permitted as a shorthand to disable logging.\&
T}
T{

T}	T{
Positive values must be valid FDs or Syd will exit with \fBEBADF\fR ("Bad file number").\&
T}
T{
\fBSYD_PDS\fR
T}	T{
Set parent\-death signal with \fIPR_SET_PDEATHSIG\fR(2const) using signal name or number.\&
T}
T{
\fBSYD_PID_FN\fR
T}	T{
Set pid filename, makes Syd write its process ID to this file at startup.\&
T}
T{

T}	T{
The file must not exist and is going to be created with user\-only read permissions.\&
T}
T{
\fBSYD_NPROC\fR
T}	T{
Set the number of core syscall handler threads, defaults to the number of CPUs.\&
T}
T{

T}	T{
The number must be at least 1.\&
T}
T{
\fBSYD_NPROC_MAX\fR
T}	T{
Set the number of maximum syscall handler threads, defaults to usize::MAX.\&
T}
T{

T}	T{
The number must be greater than \fBSYD_NPROC\fR.\&
T}
T{
\fBSYD_CHDIR\fR
T}	T{
Change current working directory to a safe directory at startup.\&
T}
T{

T}	T{
This is implied if no optional arguments are given.\&
T}
T{
\fBSYD_COMPAT_SOCKET\fR
T}	T{
Allow the legacy \fIsocketcall\fR(2) multiplexer system call.\&
T}
T{

T}	T{
This is only necessary for compatibility with libcs which don'\&t yet support the newer non\-multiplexed system calls available as of Linux\-4.\&3.\&
T}
T{

T}	T{
Equivalent to \fBtrace/allow_unsafe_socketcall:1\fR.\&
T}
T{
\fBSYD_SHELL\fR
T}	T{
Pick the shell to spawn when invoked as a login shell.\& It is not split into words.\&
T}
T{

T}	T{
Defaults to \fB/usr/bin/bash \-\-login \-\-noprofile \-\-norc \-\-restricted\fR.\&
T}
T{
\fBSYD_DUMP_SCMP\fR
T}	T{
Export secure computing rules with the given format, equivalent to the \fB\-E\fR option.\&
T}
T{
\fBSYD_SKIP_SCMP\fR
T}	T{
Skip \fIseccomp\fR(2) confinement of per\-Syd threads.\&
T}
T{

T}	T{
This is \fBunsafe\fR and should only used for profiling.\&
T}
T{

T}	T{
Syd honours \fBRUST_BACKTRACE\fR environment variable when this is set.\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_SKIP_NAME\fR
T}	T{
Skip randomizing Syd thread names which is useful for debugging.\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_FORCE_NO_UNIX_DIAG\fR
T}	T{
Force disable UNIX socket diagnostics, to test fallback paths used on kernels configured without \fBCONFIG_UNIX_DIAG\fR.\&
T}
T{

T}	T{
This is intended for testing and should not be used in production.\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_FORCE_NO_SYMLINKS\fR
T}	T{
Force \fBRESOLVE_NO_SYMLINKS\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_symlinks:1\fR.\&
T}
T{
\fBSYD_FORCE_NO_MAGICLINKS\fR
T}	T{
Force \fBRESOLVE_NO_MAGICLINKS\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_magiclinks:1\fR.\&
T}
T{
\fBSYD_FORCE_NO_XDEV\fR
T}	T{
Force \fBRESOLVE_NO_XDEV\fR resolve flag at \fIopen\fR(2) boundary.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_no_xdev:1\fR.\&
T}
T{
\fBSYD_FORCE_CLOEXEC\fR
T}	T{
Force close\-on\-exec for file descriptors.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_cloexec:1\fR.\&
T}
T{
\fBSYD_FORCE_RAND_FD\fR
T}	T{
Use randomized file descriptors to harden against fd reuse.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_rand_fd:1\fR.\&
T}
T{

T}	T{
This environment variable is ignored if \fIkcmp\fR(2) isn'\&t supported.\&
T}
T{
\fBSYD_FORCE_RO_OPEN\fR
T}	T{
Reject creating and writing \fIopen\fR(2) calls.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_ro_open:1\fR.\&
T}
T{
\fBSYD_FORCE_WX_OPEN\fR
T}	T{
Reject creating and writing \fIopen\fR(2) calls for executables.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_wx_open:1\fR.\&
T}
T{
\fBSYD_FORCE_LOCAL_NET\fR
T}	T{
Force local networking, rewrites all addresses to loopback for bind/connect.\&
T}
T{

T}	T{
Equivalent to \fBtrace/force_local_net:1\fR.\&
T}
T{
\fBSYD_FORCE_TTY\fR
T}	T{
Force TTY output which is pretty\-printed JSON.\&
T}
T{
\fBSYD_QUIET_TTY\fR
T}	T{
Force quiet TTY output which is line\-oriented JSON.\&
T}
T{
\fBSYD_PROXY_HOST\fR
T}	T{
Override the default value of \fBproxy/ext/host\fR,
T}
T{

T}	T{
If the value is a hostname and not an IP address,
T}
T{

T}	T{
Syd resolves this hostname at startup and selects a response IP randomly.\&
T}
T{
\fBSYD_PROXY_PORT\fR
T}	T{
Override the default value of \fBproxy/ext/port\fR.\&
T}
T{
\fBSYD_PROXY_UNIX\fR
T}	T{
Set the default value for \fBproxy/ext/unix\fR which overrides \fBproxy/ext/host\fR.\&
T}
T{
\fBSYD_QUICK_BOOT\fR
T}	T{
Enable quick boot mode, this makes Syd startup noticeably faster:
T}
T{

T}	T{
However, quick boot removes a layer of defense against some container breaks!\&
T}
T{

T}	T{
Use this if you frequently re\-execute \fIsyd\fR(1) or \fIsyd\-oci\fR(1),
T}
T{

T}	T{
as Exherbo Linux does during \fIcave\-generate\-metadata\fR(1).\&
T}
T{

T}	T{
This is ignored unless Syd is built with the \fBtrusted\fR Cargo feature.\&
T}
T{
\fBSYD_RLIMIT_AS\fR
T}	T{
Set the default value for \fBrlimit/as\fR.\&
T}
T{
\fBSYD_RLIMIT_CORE\fR
T}	T{
Set the default value for \fBrlimit/core\fR.\&
T}
T{
\fBSYD_RLIMIT_DATA\fR
T}	T{
Set the default value for \fBrlimit/data\fR.\&
T}
T{
\fBSYD_RLIMIT_FSIZE\fR
T}	T{
Set the default value for \fBrlimit/fsize\fR.\&
T}
T{
\fBSYD_RLIMIT_MEMLOCK\fR
T}	T{
Set the default value for \fBrlimit/memlock\fR.\&
T}
T{
\fBSYD_RLIMIT_NICE\fR
T}	T{
Set the default value for \fBrlimit/nice\fR.\&
T}
T{
\fBSYD_RLIMIT_NOFILE\fR
T}	T{
Set the default value for \fBrlimit/nofile\fR.\&
T}
T{
\fBSYD_RLIMIT_NPROC\fR
T}	T{
Set the default value for \fBrlimit/nproc\fR.\&
T}
T{
\fBSYD_RLIMIT_RTPRIO\fR
T}	T{
Set the default value for \fBrlimit/rtprio\fR.\&
T}
T{
\fBSYD_RLIMIT_RTTIME\fR
T}	T{
Set the default value for \fBrlimit/rttime\fR.\&
T}
T{
\fBSYD_RLIMIT_SIGPENDING\fR
T}	T{
Set the default value for \fBrlimit/sigpending\fR.\&
T}
T{
\fBSYD_RLIMIT_STACK\fR
T}	T{
Set the default value for \fBrlimit/stack\fR.\&
T}
T{
\fBSYD_TMOUT\fR
T}	T{
Set the default value for \fBtimeout\fR.\&
T}
T{
\fBSYD_NO_CROSS_MEMORY_ATTACH\fR
T}	T{
Disable cross memory attach and use \fIproc_pid_mem\fR(5) unconditionally.\&
T}
T{
\fBSYD_PROC_PID_MEM_FALLBACK\fR
T}	T{
By default, Syd uses cross memory attach unconditionally.\&
T}
T{

T}	T{
Setting this variable causes Syd to fall back to \fIproc_pid_mem\fR(5) automatically,
T}
T{

T}	T{
if \fIprocess_vm_readv\fR(2) or \fIprocess_vm_writev\fR(2) fails with \fBENOSYS\fR,
T}
T{

T}	T{
which indicates kernel support is missing for these system calls.\&
T}
T{

T}	T{
The variable \fBSYD_NO_CROSS_MEMORY_ATTACH\fR has precedence over this variable.\&
T}
T{
\fBSYD_ASSUME_KERNEL\fR
T}	T{
Override \fIuname\fR(2) to get host Linux kernel version used for feature detection.\&
T}
T{

T}	T{
Syd reports the major and minor kernel version at \fIuname\fR(2) boundary within the sandbox.\&
T}
T{

T}	T{
The micro version is randomized per\-Syd run to prevent information leaks.\&
T}
T{

T}	T{
This environment variable is ignored unless Syd is built with the "trusted" feature.\&
T}
T{
\fBSYD_PALUDIS_LPATH\fR
T}	T{
Override \fIsandbox/lpath\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_NPATH\fR
T}	T{
Override \fIsandbox/npath\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_LIST\fR
T}	T{
Override \fIsandbox/list\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_WALK\fR
T}	T{
Override \fIsandbox/walk\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_IOCTL\fR
T}	T{
Override \fIsandbox/ioctl\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_PALUDIS_PASSFD\fR
T}	T{
Override \fIsandbox/passfd\fR option for the \fIpaludis\fR profile, defaults to off.\&
T}
T{
\fBSYD_USER_LPATH\fR
T}	T{
Override \fIsandbox/lpath\fR option for the \fIuser\fR profile, defaults to on.\&
T}
.TE
.sp 1
.SH LOGGING
.PP
There'\&re eight log levels: emerg, alert, crit, error, warn, notice,
info, and debug with descending priority.\& Log level may be set with the
\fBSYD_LOG\fR environment variable.\& Logs go to \fIstderr\fR(3) unless a file
descriptor is specified with the environment variable \fBSYD_LOG_FD\fR.\& Syd
logs in JSON lines.\& Below is a list of commonly used log keys with their
descriptions:
.PP
.TS
allbox;l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l
l l.
T{
\fBKEY\fR
T}	T{
\fBDESCRIPTION\fR
T}
T{
\fBid\fR
T}	T{
Sandbox ID as 64 lowercase hexadecimal characters.\&
T}
T{
\fBctx\fR
T}	T{
Context of log entry, e.\&g.\& \fBaccess\fR, \fBsafesetid\fR, \fBsegvguard\fR etc.\&
T}
T{
\fBcap\fR
T}	T{
Sandbox capability
T}
T{
\fBact\fR
T}	T{
Sandbox action: \fBallow\fR, \fBwarn\fR, \fBdeny\fR, \fBpanic\fR, \fBstop\fR, \fBabort\fR, \fBkill\fR or \fBexit\fR
T}
T{
\fBpid\fR
T}	T{
Process ID
T}
T{
\fBpath\fR
T}	T{
Path argument of syscall
T}
T{
\fBaddr\fR
T}	T{
Network address argument of syscall, e.\&g.\& \fB127.\&0.\&0.\&1!\&22\fR
T}
T{
\fBunix\fR
T}	T{
UNIX socket address argument of syscall
T}
T{
\fBipv\fR
T}	T{
IP version of network address in \fBaddr\fR field (4 or 6)
T}
T{
\fBabs\fR
T}	T{
True if socket address in \fBunix\fR field is an abstract UNIX socket
T}
T{
\fBsys\fR
T}	T{
Name of syscall
T}
T{
\fBarch\fR
T}	T{
Architecture of syscall
T}
T{
\fBargs\fR
T}	T{
Arguments of syscalll
T}
T{
\fBcmd\fR
T}	T{
Process name, or command line if log output is a TTY or \fBlog\fR feature is enabled
T}
T{
\fBcwd\fR
T}	T{
Current working directory of sandbox process
T}
T{
\fBuid\fR
T}	T{
User ID
T}
T{
\fBtime\fR
T}	T{
Timestamp in ISO8601\-compatible format, currently \fBYYYYMMDDThhmmssZ\fR
T}
T{

T}	T{
Time format may change but it will always remain ISO8601\-compatible.\&
T}
T{

T}	T{
Formatting errors fallback to printing timestamp as an integer.\&
T}
T{
\fBerr\fR
T}	T{
Error information
T}
T{
\fBmsg\fR
T}	T{
Informational messages
T}
T{
\fBtip\fR
T}	T{
Educational messages on how to configure Syd
T}
.TE
.sp 1
.SH EXIT STATUS
.PP
Syd exits with same exit code as the sandbox process.\& If the sandbox
process exits with a signal, Syd exits with 128 plus value of the
signal.\& In case there was an error in spawning or waiting for the
sandbox process, Syd exits with \fIerrno\fR(3) indicating the error
condition.\& Syd exits with 101 on panics.\& Syd exits with 102 on fatal
allocator errors.\& Syd exits with 124 if sandbox timeout is exceeded.\&
.PP
.SH SEE ALSO
.PP
\fIsyd\fR(2), \fIsyd\fR(5), \fIsyd\fR(7), \fIsyd\-lock\fR(1), \fIsyd\-ls\fR(1), \fIsyd\-mdwe\fR(1),
\fIsyd\-ring\fR(1), \fIsydtutorial\fR(7)
.PP
.PD 0
.IP \(bu 4
\fBsyd\fR homepage: https://sydbox.\&exherbo.\&org/
.IP \(bu 4
\fBlibsyd\fR homepage: https://libsyd.\&exherbo.\&org/
.IP \(bu 4
\fBpandora\fR homepage: https://lib.\&rs/pandora_box
.IP \(bu 4
\fBpaludis\fR homepage: http://paludis.\&exherbo.\&org/
.IP \(bu 4
\fBLandlock\fR homepage: https://landlock.\&io
.PD
.PP
.SH AUTHORS
.PP
Maintained by Ali Polatel.\& Up\-to\-date sources can be found at
https://gitlab.\&exherbo.\&org/sydbox/sydbox.\&git and on Radicle at
rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF.\& Bugs/patches can be submitted to
https://gitlab.\&exherbo.\&org/groups/sydbox/\-/issues.\& Discuss in #sydbox on
Libera Chat or in #sydbox:mailstation.\&de on Matrix.\&