syd 3.18.1

rock-solid user-space kernel to sandbox applications on Linux>=5.19
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

[![msrv](https://img.shields.io/badge/rustc-1.71%2B-green?style=plastic)](https://blog.rust-lang.org/2023/07/13/Rust-1.71.0.html)
[![repology](https://repology.org/badge/latest-versions/sydbox.svg)](https://repology.org/project/sydbox/versions)
[![build status](https://builds.sr.ht/~alip/syd.svg)](https://builds.sr.ht/~alip/syd?)
[![pipeline status](https://gitlab.exherbo.org/sydbox/sydbox/badges/main/pipeline.svg)](https://gitlab.exherbo.org/sydbox/sydbox/-/pipelines)

[![license](https://img.shields.io/crates/l/syd.svg)](https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/COPYING)
[![maintenance-status](https://img.shields.io/badge/maintenance-actively--developed-brightgreen.svg)](https://git.sr.ht/~alip/syd)
[![dependency status](https://deps.rs/repo/sourcehut/~alip/syd/status.svg)](https://deps.rs/repo/sourcehut/~alip/syd)
[![OpenSSF best practices](https://www.bestpractices.dev/projects/8040/badge)](https://www.bestpractices.dev/projects/8040)

[![Shine On You Crazy Diamond!](https://img.shields.io/badge/Shine%20On%20You%20Crazy%20Diamond!-8A2BE2)](https://en.wikipedia.org/wiki/Syd_Barrett)
[![Try to Avoid Chance!](https://img.shields.io/badge/Try_to_Avoid_Chance!-gray)](https://en.wikiquote.org/wiki/Tigran_Petrosian)

[![syd](https://gitlab.exherbo.org/sydbox/sydbox/-/raw/main/data/sydbox160.png)](https://man.exherbolinux.org)

[Syd](https://en.wikipedia.org/wiki/Syd_Barrett) is a
[rock-solid](https://en.wikipedia.org/wiki/Tigran_Petrosian)
[user-space](https://en.wikipedia.org/wiki/User_space_and_kernel_space)
[kernel](https://en.wikipedia.org/wiki/Kernel_(operating_system))
to [sandbox](https://en.wikipedia.org/wiki/Sandbox_(computer_security))
[applications](https://en.wikipedia.org/wiki/Application_software)
on [Linux>=5.19](https://en.wikipedia.org/wiki/Linux).
[Syd](https://en.wikipedia.org/wiki/Syd_Barrett) is similar to
[Bubblewrap](https://github.com/containers/bubblewrap),
[Firejail](https://firejail.wordpress.com/),
[GVisor](https://en.wikipedia.org/wiki/GVisor), and
[minijail](https://google.github.io/minijail/).
[Syd](https://en.wikipedia.org/wiki/Syd_Barrett) is
[secure by default](https://en.wikipedia.org/wiki/Secure_by_default), and
intends to provide a
[simple](https://en.wikipedia.org/wiki/KISS_principle)
[interface](https://en.wikipedia.org/wiki/API)
over various intricate
[Linux](https://en.wikipedia.org/wiki/Linux)
[sandboxing](https://en.wikipedia.org/wiki/Sandbox_(computer_security))
mechanisms such as
[LandLock](https://landlock.io/),
[Namespaces](https://en.wikipedia.org/wiki/Linux_namespaces),
[ptrace](https://en.wikipedia.org/wiki/Ptrace), and
[seccomp](https://en.wikipedia.org/wiki/Seccomp)-{[bpf](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter),[notify](https://www.man7.org/linux/man-pages/man3/seccomp_notify_receive.3.html)}.
You may run [Syd](https://en.wikipedia.org/wiki/Syd_Barrett) [_as a regular user,
with no extra privileges_](https://en.wikipedia.org/wiki/Privilege_separation),
and you can even set [Syd](https://en.wikipedia.org/wiki/Syd_Barrett) as your
[_login shell_](https://linuxhandbook.com/login-shell/).
A brief overview of
[Syd](https://en.wikipedia.org/wiki/Syd_Barrett)'s
capabilities are as follows:

- [Read sandboxing](http://man.exherbolinux.org/syd.7.html#Read_Sandboxing)
- [Write sandboxing](http://man.exherbolinux.org/syd.7.html#Write_Sandboxing)
  (and [Path Masking](http://man.exherbolinux.org/syd.7.html#Path_Masking))
- [Stat sandboxing](http://man.exherbolinux.org/syd.7.html#Stat_Sandboxing)
  (aka **Path Hiding**)
- [Exec sandboxing](http://man.exherbolinux.org/syd.7.html#Exec_Sandboxing)
  (and [SegvGuard](http://man.exherbolinux.org/syd.7.html#SegvGuard))
- [Force sandboxing](http://man.exherbolinux.org/syd.7.html#Force_Sandboxing)
  (aka **Binary verification**)
- [Network sandboxing](http://man.exherbolinux.org/syd.7.html#Network_Sandboxing)
  (feat.
  [UNIX](https://en.wikipedia.org/wiki/Unix_domain_socket),
  [IPv4](https://en.wikipedia.org/wiki/Internet_Protocol_version_4),
  [IPv6](https://en.wikipedia.org/wiki/IPv6), and
  [KCAPI](https://en.wikipedia.org/wiki/Crypto_API_(Linux))
  sockets)
- [Lock sandboxing](http://man.exherbolinux.org/syd.7.html#Lock_Sandboxing)
  (uses [Landlock LSM](https://landlock.io/))
- [Memory sandboxing](http://man.exherbolinux.org/syd.7.html#Memory_Sandboxing)
- [PID sandboxing](http://man.exherbolinux.org/syd.7.html#PID_sandboxing)
  (simpler alternatives to [Control Groups](https://en.wikipedia.org/wiki/Cgroups))
- [Namespaces and Containerization](https://en.wikipedia.org/wiki/Containerization_(computing))

Read the fine manuals of [syd](https://man.exherbolinux.org/),
[libsyd](https://libsyd.exherbolinux.org/),
[gosyd](https://gosyd.exherbolinux.org/),
[plsyd](https://plsyd.exherbolinux.org/),
[pysyd](https://pysyd.exherbolinux.org/),
[rbsyd](https://rbsyd.exherbolinux.org/),
[syd.el](https://sydel.exherbolinux.org/) and watch the asciicasts [Memory
Sandboxing](https://asciinema.org/a/625243), [PID
Sandboxing](https://asciinema.org/a/625170), [Network
Sandboxing](https://asciinema.org/a/623664), and [Sandboxing Emacs with
syd](https://asciinema.org/a/627055). Join the CTF event at
https://ctftime.org/event/2178 and try to read the file `/etc/CTF`¹ on
syd.chesswob.org with ssh user/pass: syd.

- Use cargo to install from source, requires [libseccomp](https://github.com/seccomp/libseccomp).
- To use with [Docker](https://www.docker.com/) or
  [Podman](https://podman.io/) build with the "oci" feature,
  see: https://man.exherbolinux.org/syd-oci.1.html
- Packaged on [Exherbo](https://exherbolinux.org/) as `sys-apps/sydbox`.
- Packaged on [Gentoo](https://gentoo.org/) as `sys-apps/syd`.
- Binary releases located at https://distfiles.exherbolinux.org/#sydbox/
- Releases are signed with this key: https://keybase.io/alip/pgp_keys.asc
- Change Log is here: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md
- [VIM](https://www.vim.org/)
  [syntax highlighting](https://en.wikipedia.org/wiki/Syntax_highlighting)
  file for
  [Syd](https://en.wikipedia.org/wiki/Syd_Barrett)
  profiles is here: https://gitlab.exherbo.org/sydbox/sydbox/-/tree/main/vim
- Tested on [arm64](https://en.wikipedia.org/wiki/Arm64),
  [armv7](https://en.wikipedia.org/wiki/Armv7),
  [x86](https://en.wikipedia.org/wiki/X86), and
  [x86-64](https://en.wikipedia.org/wiki/X86-64) with
  [GitLab Pipelines](https://gitlab.exherbo.org/sydbox/sydbox/-/pipelines), and
  [SourceHut Builds](https://builds.sr.ht/~alip/syd?).

Maintained by Ali Polatel. Up-to-date sources can be found at
https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to
<https://gitlab.exherbo.org/groups/sydbox/-/issues>. Follow toots with the [#sydbox
hashtag](https://mastodon.online/tags/sydbox) and discuss in [#sydbox on Libera
Chat](ircs://irc.libera.chat/#sydbox).

¹: The [SHA256](https://en.wikipedia.org/wiki/SHA-2)
checksum is `f1af8d3946546f9d3b1af4fe15f0209b2298166208d51a481cf51ac8c5f4b294`.

²: [That cat's something I can't explain!](https://gitlab.exherbo.org/paludis/paludis/-/commit/dd0566f16e27f2110581234fe1c48a11d18a7d64)

<!-- vim: set spell spelllang=en : -->