[](https://git.sr.ht/~alip/syd)
# SydB☮x: The ☮ther SⒶndbøx
[](https://en.wikipedia.org/wiki/Syd_Barrett)
[](https://git.sr.ht/~alip/syd/tree/main/item/COPYING)
[](https://blog.rust-lang.org/2023/06/01/Rust-1.70.0.html)
[](https://builds.sr.ht/~alip/syd?)
[](https://git.sr.ht/~alip/syd)
[](https://deps.rs/repo/sourcehut/~alip/syd)
[](https://repology.org/project/sydbox/versions)
[](https://todo.sr.ht/~alip/syd)
[](https://www.gnu.org/philosophy/philosophy.html)
[](https://www.kernel.org/category/about.html)
[](https://www.exherbolinux.org/docs/gettingstarted.html)
[](https://www.musl-libc.org/)
[](https://github.com/seccomp/libseccomp)
[](https://paludis.exherbolinux.org)
# Introduction
SydB☮x has been the default sandbox of [`Exherbo`
`GNU/Linux`](https://exherbolinux.org) distribution for over a decade. We use it
to provide a restricted environment under which package builds run with
controlled access to file system and network resources.
[`Exherbo`](https://exherbolinux.org) package description format, currently
[`exheres-0`](https://exherbolinux.org/docs/eapi/exheres-for-smarties.html),
uses a shell function called `esandbox` to interact with `sydbox`. See the
[Sandboxing section of Exheres for
Smarties](https://exherbolinux.org/docs/eapi/exheres-for-smarties.html#sandboxing)
for more information.
## Quick Start
- [`sydbox-0`](https://git.sr.ht/~alip/syd/tree/sydbox-0) is a `ptrace` based
sandbox.
- [`sydbox-1`](https://git.sr.ht/~alip/syd/tree/sydbox-1) is a `ptrace+seccomp`
based sandbox.
- [`sydbox-2`](https://git.sr.ht/~alip/syd/tree/sydbox-1) is a
`seccomp+seccomp-unotify` based sandbox.
- `sydbox-3` is a rewrite of `sydbox-2` in Rust and it's what you are looking
at.
This codebase has a history of a bit over 10 years and up to this point we have
used [`C11`](https://en.wikipedia.org/wiki/C11_(C_standard_revision)) as our
implementation language for various reasons. With `sydbox-3` we are moving
forwards one step and writing the sandbox from scratch using the `Rust`
programming language with the only `!Rust` dependency being `libsecc☮mp`.
Although we inherit many ideas and design decisions from the old codebase, we
also don't shy away from radically changing the internal implementation making
it much simpler, idiomatic, and less prone to bugs. We have **proper multiarch
support** since release 3.0.11, e.g on x86-64, you can run your x32 or x86
binaries just fine under SydB☮x. Surprisingly **[all multiarch support is
implemented in only 50 lines of
code.](https://git.sr.ht/~alip/syd/tree/26316f41f1ca2f11c1b68791002ca23748d13d36/item/src/hook.rs#L1087-1137)**
This version **takes advantage of multithreading and handles system calls using
a thread pool whose size is equal to the number of CPUs on the running machine**
and **utilizes globsets to match a list of patterns at once**, thus continues to
perform reasonably well even with very long rulesets. Moreover, **access
violations are logged into [syslog](https://en.wikipedia.org/wiki/Syslog)**, so
you may use a command like `journalctl SYSLOG_IDENTIFIER=syd` (or shortly `syd
log`) to view the sandbox logs. This version also comes with two new sandboxing
types called [Lock Sandboxing](#lock-sandboxing) and [Stat
Sandboxing](#stat-sandboxing): [Lock Sandboxing](#lock-sandboxing) utilizes the
kernel [LSM](https://en.wikipedia.org/wiki/Linux_Security_Modules)
[LandLock](https://landlock.io), wherease [Stat Sandboxing](#stat-sandboxing)
can be used to **effectively hide files and directories from the sandboxed
process**. Finally, the new SydB☮x has support and namespaces:
- Use the command-line arguments `--unshare-mount,uts,ipc,user,pid,net,cgroup` to
create namespaces.
You may use SydB☮x as your login shell because it is very practical to have a
restricted user. To do this simply add `/path/to/syd` to the file `/etc/shells`
and do `chsh -s /path/to/syd username` as root. In this mode the sandbox may be
configured using the files `/etc/user.syd-3` and `~/.user.syd-3`. If you want to
restrict user configuration of the sandbox, lock the sandbox using `lock:on`
at the end of the site-wide configuration file.
The program may easily be built statically, with a size about `1.1Mb` for the
[x86-64](https://builds.sr.ht/~alip/syd/commits/main/linux-x86-64.yml) build
, and `1.0Mb` for the
[aarch64](https://builds.sr.ht/~alip/syd/commits/main/linux-arm64.yml) build.
After [UPX](https://upx.github.io/) compression compress both have a size around `350Kb`.
After each push, the CI builds binaries with static linking using a
[musl](https://www.musl-libc.org/) target and keeps them available for download
for 90 days. To download, browse to one of the URLs given below depending on
your machine architecture, choose a succeeding build, and download the
artifact `syd` on the left part of the build page. To run integration tests,
download `syd-test` and `syd-test-do` artifacts as well.
- **x86-64**
- Host: `Linux build 6.1.55-0-lts #1-Alpine SMP PREEMPT_DYNAMIC Sun, 24 Sep 2023 23:14:02 +0000 x86_64 Linux`
- List: https://builds.sr.ht/~alip/syd/commits/main/linux-x86-64.yml
- **aarch64**
- Host: `Linux build 5.10.0-8-arm64 #1 SMP Debian 5.10.46-4 (2021-08-03) aarch64 GNU/Linux`
- List: https://builds.sr.ht/~alip/syd/commits/main/linux-arm64.yml
To install from source, use `cargo install --locked syd`. To follow the latest
developments, checkout the git repository at <https://git.sr.ht/~alip/syd> and
run `cargo build --release` on it. Make sure to have
[libsecc☮mp](https://github.com/seccomp/libsecc☮mp) development files installed.
The command to install [libsecc☮mp](https://github.com/seccomp/libsecc☮mp)
library for some Linux distributions are given below.
- **Alpine**: `apk add libsecc☮mp-dev libsecc☮mp-static`
- **Debian**: `apt install libsecc☮mp-dev`
- **Ubuntu**: `apt install libsecc☮mp-dev`
The following distributions have SydB☮x already packaged:
1. [**Exherbo**](https://exherbolinux.org): [`cave resolve sydbox`](https://gitlab.exherbo.org/exherbo/arbor/-/tree/master/packages/sys-apps/sydbox)
2. [**Gentoo**](https://gentoo.org): [`emerge syd`](https://packages.gentoo.org/packages/sys-apps/syd)
SydB☮x exposes the functionality of the following crates in their sandbox API:
1. [globset](https://docs.rs/globset): Pattern matching with Unix shell
style patterns, see
[Wikipedia:Glob](https://en.wikipedia.org/wiki/Glob_(programming)) for more information.
2. [ipnetwork](https://docs.rs/ipnetwork): Pattern matching with Classless
Inter-Domain Routing, see [Wikipedia:Cidr](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
for more information.
This manual page gives only brief information on [Pattern
Matching](#pattern-matching), and [Address Matching](#address-matching). The
user is recommended to read the documentation of the respective crates to get
more information on the details of [pattern matching](#pattern-matching), and
[address matching](#address-matching).
# Manual
## NAME
syd - seccomp and landlock based application sandbox with support for namespaces
## SYNOPSIS
```
syd [-hv]
[--lock] [--root]
[-m command...] [-c path...] [-p name...]
[--unshare-mount,uts,ipc,user,pid,net,cgroup]
[-A arg0] [--map-root]
[--] {command [arg...]}
syd --check
syd --print name
syd --read name
syd --sh
syd --test [<name-regex>|<number>|<number>..<number>]..
syd exec {command [arg...]}
syd log
```
## DESCRIPTION
SydB☮x is a
[**seccomp(2)**](https://www.man7.org/linux/man-pages/man2/seccomp.2.html) based
sandboxing utility for modern Linux\[\>=5.6\] machines to sandbox unwanted
process access to filesystem and network resources. SydB☮x requires *no root
access* and *no ptrace* rights. All you need is a recent Linux kernel and
libsecc☮mp which is available on many different architectures, including
**x86**, **x86\_64**, **x32**, **arm**, **aarch64**, **mips**, **mips64**...
This makes it very easy for a regular user to use. This is the motto of SydB☮x:
*bring easy, simple, flexible and powerful access restriction to the Linux
user!*
The basic idea of SydB☮x is to run a command under certain restrictions. These
restrictions define which system calls the command is permitted to run and which
argument values are permitted for the given system call. The restrictions may be
applied via two ways. *seccomp-bpf* can be used to apply simple Secure Computing
user filters to run sandboxing fully on kernel space, and *seccomp-notify*
functionality can be used to run sandboxing on kernel space and fallback to user
space to dereference pointer arguments of system calls (**See
[Security](#security) about `TOCTOU` et. al**), which are one of
**[pathname](https://en.wikipedia.org/wiki/Path_(computing))**, **[UNIX socket
address](https://en.wikipedia.org/wiki/Unix_domain_socket)**,
**[IPv4](https://en.wikipedia.org/wiki/IPv4)** or
**[IPv6](https://en.wikipedia.org/wiki/IPv6)** network address, and make dynamic
decisions using [Unix shell style patterns](https://docs.rs/globset) such as
`allowlist/write+/home/sydbox/***`, or `allowlist/write+/run/user/*/pulse` for
**[pathnames](https://en.wikipedia.org/wiki/Path_(computing))**, and using
**[CIDR](https://docs.rs/ipnetwork)** notation such as
`allowlist/net/connect+127.0.0.1/8@9050`, or
`allowlist/net/connect+::1/8@9050` for
**[IPv4](https://en.wikipedia.org/wiki/IPv4)** and
**[IPv6](https://en.wikipedia.org/wiki/IPv6)** addresses and perform an action
which is by default denying the system call with an appropriate error, which is
usually **access denied**, aka `EACCES`. For default disallowed system calls,
such as `ptrace` or `process_vm_writev` (**See [Security](#security) about
`TOCTOU` et. al**) SydB☮x returns `EACCES` as well.
To be able to use SydB☮x, you need a recent Linux kernel with the system calls
[**pidfd_getfd**](https://www.man7.org/linux/man-pages/man2/pidfd_getfd.2.html),
[**pidfd_send_signal**](https://man7.org/linux/man-pages/man2/pidfd_send_signal.2.html).
The Secure Computing facility of the Linux kernel should support the
**SECCOMP_USER_NOTIF_FLAG_CONTINUE** operation. It is recommended to have the
**CONFIG_CROSS_MEMORY_ATTACH** kernel option enabled, if this option is not
enabled, SydB☮x will fallback to reading/writing from `/proc/$pid/mem`.
Linux-5.11 or later is recommended.
## OPTIONS
The following options are understood:
**-h**, **\--help**
> Show usage and exit
**-v**, **\--version**
> Show version and exit
**-m** *command*, **\--magic**=*command*
> Run a sandbox command during init, may be repeated. See the section
> called [CONFIGURATION](#configuration) for more information.
**-c** *path*, **\--config**=*path*
> Run a configuration file during init, may be repeated. See the section
> called [CONFIGURATION](#configuration) for more information.
**-p** *name*, **\--profile**=*name*
> Use a sandbox profile during init, may be repeated. See the section
> called [CONFIGURATION](#configuration) for more information.
**-l**, **\--lock**
> Lock sandbox commands after initialization. By default, SydB☮x may be
> configured during runtime from inside the sandbox by interacting with the
> paths under the virtual path `/dev/syd`. Locking prevents this and makes
> SydB☮x sandbox tamper-free making it a true jail replacement. (**See
> [Security](#security) about `TOCTOU` et. al**)
**-r**, **\--root**
> In **fakeroot** mode, the system will return a user/group id of `0`, mimicking
> the root user. This allows users to execute commands with apparent root
> privileges, without actual superuser rights. It's useful for tasks like package
> building where root-like environment is needed, but not actual root
> permissions. You may also use the environment variable `SYD_FAKEROOT` to this
> effect.
**\--check**
> Exit with success if the process is running under SydB☮x.
**\--export**=*mode*
> Export secure computing rules with the given format to standard output and
> exit. Mode must be one of **bpf** or **pfc**. **bpf**, aka **Berkeley Packet
> Filter** is a binary, machine readable format whereas **pfc**, aka
> **Pseudo Filter Code** is a textual, human readable format.
**\--list**=*set*
> Print the names of the system calls which belong to the given set and exit
> Set must be exactly one of **allow**, **deny**, **hook**, **ioctl**, or
> **prctl**.
> If set is "ioctl", print the list of **allowlisted ioctl requests**.
> If set is "prctl", print the list of **allowlisted prctl options**.
**\--print**=*name*
> Print out the rules of the given sandbox profile and exit
**\--read**=*path*
> Print the canonicalized path name followed by a newline and exit
**\--sh**
> Output a shell script which defines "esyd" the SydB☮x helper function.
> You may use `eval "$(esyd --sh)"` in your shell init file.
**\--test**
> Run integration tests and exit.
> Requires `syd-test` and `syd-test-do` programs to be in `PATH`.
**-M**, **\--unshare-mount**
> Unshare mount namespace
**-S**, **\--unshare-uts**
> Unshare UTS namespace
**-I**, **\--unshare-ipc**
> Unshare IPC namespace
**-U**, **\--unshare-user**
> Unshare user namespace
**-P**, **\--unshare-pid**
> Unshare pid namespace
**-N**, **\--unshare-net**
> Unshare net namespace
**-G**, **\--unshare-cgroup**
> Unshare cgroup namespace
**-A** *alias*, **\--arg0**=*alias*
> Set alias of the command.
> Passed as `argv[0]` to the program
**-R**, **\--map-root**
> Map current user to root in the sandbox
> Implies **--unshare-user**
- **syd exec** may be used to construct a sandbox command to execute a process
outside the sandbox. See the description of [**cmd/exec**](#cmdexec) command
for more information.
- **syd log** may be used to access sandbox logs using
[`journalctl`](https://www.man7.org/linux/man-pages/man1/journalctl.1.html).
### Profiles
1. **paludis**: Used by the [Paludis](http://paludis.exherbolinux.org/) package mangler.
2. **noipv4**: Disables
[IPv4](https://en.wikipedia.org/wiki/Internet_Protocol_version_4) connectivity.
3. **noipv6**: Disables [IPv6](https://en.wikipedia.org/wiki/IPv6) connectivity.
4. **user**: Allows user-specific directories, and connections, and
parses the following files if they exist:
1. `/etc/login.syd-3`
2. `~/.user.syd-3`
When invoked without arguments, the current shell is executed under sandbox with
the **user** profile.
### Environment Variables
- **SYD\_LOG**: Set log level. See the ["Enabling
Logging"](https://docs.rs/env_logger/latest/env_logger/#enabling-logging)
section of **env-logger** crate documentation for more information.
- **SYD\_NPROC**: Set the number of system call handler threads. By default this
is the number of CPUs on the machine.
- **SYD\_NO\_SYSLOG**: Disable logging to **syslog**. By default logs of
severity `Warn` and higher are logged to **syslog**.
- **SYD\_NO\_CROSS\_MEMORY\_ATTACH**: Disable cross memory attach and fallback
to `/proc/pid/mem`.
- **SYD\_FAKEROOT**: Equivalent to passing `--root`.
- **SYD\_SH**: Pick the shell to spawn when invoked as a login shell, defaults to **/bin/bash**
- **SYD\_UNSHARE\_MOUNT**: Equivalent to passing `--unshare-mount`
- **SYD\_UNSHARE\_UTS**: Equivalent to passing `--unshare-uts`
- **SYD\_UNSHARE\_IPC**: Equivalent to passing `--unshare-ipc`
- **SYD\_UNSHARE\_PID**: Equivalent to passing `--unshare-pid`
- **SYD\_UNSHARE\_NET**: Equivalent to passing `--unshare-net`
- **SYD\_UNSHARE\_CGROUP**: Equivalent to passing `--unshare-cgroup`
### Exit Codes
Sydb☮x exits with the same exit code as the sandbox process itself. If the
sandbox process exits with a signal, Sydb☮x exits with 14 which stands for
**EFAULT**. In case there was an error in spawning or waiting for the sandbox
process, Sydb☮x exits with **errno** indicating the error condition. E.g. `syd
true` returns 0, `syd false` return 1, and `syd -- syd true` returns 16 which
stands for **EBUSY** which stands for "Device or resource busy" indicating there
is already a secure computing filter loaded. tl;dr Sydb☮x won't run under
Sydb☮x, similarly many process inspection tools such as `ltrace`, `strace`, or
`gdb` won't work under Sydb☮x. Thus the sandbox process can either be traced by
attaching from outside the sandbox or running the tracer in follow fork mode,
e.g. `strace -f syd true`.
## SANDBOXING
There are six sandboxing types:
1. [Lock Sandboxing](#lock-sandboxing)
2. [Read sandboxing](#read-sandboxing)
3. [Stat sandboxing](#stat-sandboxing)
4. [Write sandboxing](#write-sandboxing)
5. [Exec sandboxing](#exec-sandboxing)
6. [Network sandboxing](#network-sandboxing)
Sandboxing may be on and off.
- **off**: Sandboxing is off, none of the relevant system calls are checked and
all access is allowed.
- **on**: Sandboxing defaults to deny, allowlists and denylists can be used to
refine access rights.
In addition, there are filters for every sandboxing to prevent Sydb☮x
from reporting an access violation. Note, access is still denied in such
cases.
### Lock Sandboxing
This sandboxing utilizes the [Landlock](https://landlock.io/)
[LSM](https://en.wikipedia.org/wiki/Linux_Security_Modules) for simple
unprivileged access control. This sandboxing type is not dynamic and is applied
at the kernel level on startup. The sandboxing may be turned on with the
**sandbox/lock:on** sandbox command, and read-only, and read-write allowlists
can be populated using the sandbox commands **allowlist/lock/read+/path** and
**allowlist/lock/write+/path**. Note the Sydb☮x process is also included in this
sandbox for added security such that a compromised Sydb☮x process is still stuck
inside the [Landlock](https://landlock.io/) sandbox.
### Read Sandboxing
This sandboxing checks certain system calls for filesystem read access.
If a system call tries to read a path, this attempt is reported and the
system call is denied. See the section called [Write Sandboxing](#write-sandboxing) for
more information on how to customize this behaviour.
List of filtered system calls are: **access**, **faccessat**, **faccessat2**,
**open**, **openat**, **openat2**, **getxattr**, **lgetxattr**, **fgetxattr**,
**listxattr**, **flistxattr**, and **llistxattr**.
### Stat Sandboxing
This sandboxing checks certain system calls for filesystem statistics access.
This can be one of listing a directory, changing into a directory, or using a
**stat** system call to query file metadata. This sandboxing type may be used to
effectively **hide files and directories** from the sandbox process.
List of filtered system calls are: **chdir**, **fchdir**, **getdents**,
**getdents64**, **stat**, **fstat**, **lstat**, **statx**, **newfstatat**.
### Write Sandboxing
This sandboxing checks certain system calls for filesystem write access. If a system
call tries to write, modify or change attributes of a path, this attempt is reported
in system log and the system call is denied. There are two ways to customize this
behaviour. Sydb☮x may be configured to "allowlist" some path patterns. If the path
argument of the system call which is subject to be modified matches a pattern in the
list of allowlisted path patterns, this attempt is not denied. If, however it
matches a pattern in the list of "denylist" path patterns the attempt is denied
(**last matching pattern wins**). Additionally, Sydb☮x may be configured to
"filter" some path patterns. In this case a match will prevent Sydb☮x from reporting
a warning about the access violation, the system call is still denied though.
List of filtered system calls are: **access**, **faccessat**, **faccessat2**,
**chmod**, **fchmod**, **fchmodat**, **chown**, **chown32**, **fchown**,
**lchown**, **lchown32**, **fchownat**, **open**, **openat**, **openat2**,
**creat**, **mkdir**, **mkdirat**, **mknod**, **mknodat**, **rmdir**,
**truncate**, **truncate64**, **ftruncate**, **mount**, **umount**, **umount2**,
**utime**, **utimes**, **utimensat**, **futimesat**, **unlink**, **unlinkat**,
**link**, **linkat**, **rename**, **renameat**, **renameat2**, **symlink**,
**symlinkat**, **setxattr**, **fsetxattr**, **lsetxattr**, **removexattr**,
**fremovexattr** and **lremovexattr**.
### Exec Sandboxing
This sandboxing denies **execve**, and **execveat** calls in case
the path argument does not match one of the allowlisted patterns. Note,
all **exec** family functions are sandboxed because these functions
are just wrappers of either one of **execve** or **execveat**
system calls. See the section called [Write Sandboxing](#write-sandboxing) for
more information on how to customize this behaviour.
### Network Sandboxing
This sandboxing exposes a way to prevent unwanted network calls. The
filtered system calls are: **bind**, **connect**, **sendto**,
**recvmsg**, and **sendmsg**. To increase usability, these system
calls are filtered in two groups: *bind* and *connect*. **bind**
belongs to the first group, whereas the other system calls belong to the
*connect* group. See the section called [Write Sandboxing](#write-sandboxing) for
more information on how to customize this behaviour.
## Further Restrictions
There are other ways to further restrict access which are listed below.
- `exec/kill`: Kill the exec process in case it matches a path pattern. See
[Examples](#examples) for more information.
## CONFIGURATION
Sydb☮x is configured through sandbox commands. There are two ways to supply
sandbox commands:
1. Sydb☮x may be configured using a configuration file. The path to the
configuration file is speficied using the **-c** command line switch. More
than one configuration file may be specified this way. Single commands may
also be passed via **-m** command line switch. Some default configuration sets
may be applied using the **-p** command line switch. The available sets are
`paludis`, `noipv4`, `noipv6`, and `user`. See [Profiles](#profiles) for more
information. More than one profile may be specified. For multiple matching
rules (e.g. two rules matching the same path), **the last matching rule
wins**.
2. Sydb☮x may be configured using "magic" **stat** calls during runtime. This
is achieved by calling **stat()** system call on the special path `/dev/syd`
followed by the sandbox command. Note that runtime configuration is only
possible if the sandbox lock is *unset*. The system call **stat()** was
chosen because it is practical to invoke using builtin shell commands like:
`test -c /dev/syd/sandbox/read:on`
which enables read sandboxing for a shell running under Sydb☮x. It is
also possible to query certain values using the return value of the
**stat** call:
```
test -c /dev/syd/sandbox/read? &&\
```
Note, some of these shell builtins may actually call other system calls such as
**fstat**, **lstat**, **newfstatat**, or **statx**. Sydb☮x supports the same
interface through all these system calls transparently.
### Command Types
Every sandbox command accepts an argument of a certain type. The available types
are listed below:
- **void**: This command accepts no argument.
- **boolean**: A boolean type may have one of the two values, *true* or *false*.
In addition you can use the short forms *t* or *f* and you can also use *1* or *0*.
- **integer**: This type represents the basic integer type.
- **string**: This type represents the basic string type.
- **string-array**: This type represents a list of strings. Other types arent
allowed within this type.
- **command**: This is a special type which is used to make Sydb☮x execute certain
functions. It is meant to be used as a basic interprocess communication to
workaround some tracing limitations.
### Specifying Sandbox Commands
As mentioned in the section called [CONFIGURATION](#configuration), Sydb☮x may
be configured using sandbox commands. Format of the sandbox commands is simple:
`${PREFIX}/section/of/option${OPERATION_CHARACTER}value` where *`${PREFIX}`* is
/dev/syd by default (may be altered at compile-time using *MAGIC\_PREFIX*
definition in `config.rs`). This prefix is only required for **stat()** call,
not for **-m** command line switch.
*`${OPERATION_CHARACTER}`* determines the operation of the sandbox
command. Possible values are listed below:
- **:**
This term is used to set a value. Value must be either a boolean, an
integer or a string.
- **?**
This term is used to query a value. Boolean values and certain other
values may be queried.
- **\+**
This term is used to append to a string array.
- **\-**
This is used to remove an element from a string array.
- **!**
This is used to execute a special Sydb☮x command.
### Configuration File Format
Configuration file format of Sydb☮x is simple. It is just a way to supply many
commands in a convenient way. All empty lines and lines starting with the
sign **\#** are ignored. All the other lines are treated as if they were supplied to
Sydb☮x via the **-m** command line switch.
### Configuration File Naming
Configuration file naming of Sydb☮x follows a naming scheme which makes it
possible to extract command API version from the file name. A Sydb☮x
configuration file must have the extension "syd-" followed by the API version
(e.g. **"syd-3"** for API version 3).
Current command API of Sydb☮x version is **3**.
Note, in addition to the **stat** interface of `/dev/syd`, you can also
read from the virtual node `/dev/syd` to output Sydb☮x state as JSON.
### Commands
Sydb☮x recognizes the following commands:
#### stat
- type: **void**
- default: *none*
- query: *no*
This command causes Sydb☮x to output sandbox state on standard error.
#### lock
- type: **string**
- default: *exec*
- query: *no*
A string specifying the state of the sandbox lock. Possible values are *on*, *off*
and *exec*. If the sandbox lock is *on* no sandbox commands are allowed. If *exec* is
specified, the sandbox lock is set to *on* for all processes except the initial
process, aka Sydb☮x exec child.
#### sandbox/lock
- type: **string**
- default: *off*
- query: *yes*
A string specifying whether [Landlock](https://landlock.io/) sandboxing should
be enabled. See the section called [Lock Sandboxing](#lock-sandboxing) for more
information.
#### sandbox/exec
- type: **string**
- default: *off*
- query: *yes*
A string specifying how **exec** calls should be sandboxed.
See the section called [Exec Sandboxing](#exec-sandboxing) for more information.
#### sandbox/read
- type: **string**
- default: *off*
- query: *yes*
A string specifying how read sandboxing should be done. See the
section called [Read Sandboxing](#read-sandboxing) for more information.
#### sandbox/stat
- type: **string**
- default: *off*
- query: *yes*
A string specifying how stat sandboxing should be done. See the
section called [Stat Sandboxing](#stat-sandboxing) for more information.
#### sandbox/write
- type: **string**
- default: *on*
- query: *yes*
A string specifying how write sandboxing should be done. See the
section called [Write Sandboxing](#write-sandboxing) for more information.
#### sandbox/net
- type: **string**
- default: *on*
- query: *yes*
A string specifying how network sandboxing should be done. See the
section called [Network Sandboxing](#network-sandboxing) for more information.
#### trace/allow_unsafe_ioctl
- type: **boolean**
- default: *false*
- query: *no*
A boolean specifying whether ioctl restrictions should be lifted.
See [**Security**](#security) for more information.
#### trace/allow_unsafe_prctl
- type: **boolean**
- default: *false*
- query: *no*
A boolean specifying whether prctl restrictions should be lifted.
See [**Security**](#security) for more information.
#### trace/allow_unsafe_chmod
- type: **boolean**
- default: *false*
- query: *no*
A boolean specifying whether chmod restrictions should be lifted.
See [**Security**](#security) for more information.
#### trace/allow_unsafe_getrandom
- type: **boolean**
- default: *false*
- query: *no*
A boolean specifying whether getrandom restrictions should be lifted.
See [**Security**](#security) for more information.
#### trace/allow_successful_bind
- type: **boolean**
- default: *true*
- query: *no*
A boolean specifying whether the socket address arguments of successful **bind**
calls should be allowlisted for **connect**, **sendto**, **recvmsg**, and
**sendmsg** system calls. **Note**, these socket addresses are allowlisted
globally and not per-process for usability reasons. Thus, for example, a process
which forks to call **bind** will have its socket address allowlisted for their
parent as well.
#### trace/allow_unsupported_socket_families
- type: **boolean**
- default: *true*
- query: *no*
A boolean specifying whether unknown socket families should be allowed
access when network sandboxing is on.
#### trace/memory\_access
- type: **integer**
- default: *0*
- query: *no*
Mode on using cross memory attach or **/proc/pid/mem**. Cross memory
attach requires a Linux kernel with the
**CONFIG\_CROSS\_MEMORY\_ATTACH** option enabled. Default mode is
**0**.
- 0: Use cross memory attach if available, use /proc otherwise.
- 1: Use `/proc/pid/mem` unconditionally. You may also use the environment
variable `SYD_NO_CROSS_MEMORY_ATTACH` to this effect:
```
⇒ strace -q -eprocess_vm_readv -fc -- syd -m trace/memory_access:1 true; echo $?
[pid 1100565] ????( <detached ...>
0
⇒ strace -q -eprocess_vm_readv -fc -- syd -m trace/memory_access:0 true; echo $?
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- -----------------
100,00 0,000155 6 24 process_vm_readv
------ ----------- ----------- --------- --------- -----------------
100,00 0,000155 6 24 total
0
⇒
```
#### unshare/mount
- type: **boolean**
- default: *false*
- query: *yes*
Create Mount namespace on startup, equivalent to **--unshare-mount**.
#### unshare/uts
- type: **boolean**
- default: *false*
- query: *yes*
Create UTS namespace on startup, equivalent to **--unshare-uts**.
#### unshare/ipc
- type: **boolean**
- default: *false*
- query: *yes*
Create IPC namespace on startup, equivalent to **--unshare-ipc**.
#### unshare/user
- type: **boolean**
- default: *false*
- query: *yes*
Create User namespace on startup, equivalent to **--unshare-user**.
#### unshare/pid
- type: **boolean**
- default: *false*
- query: *yes*
Create Pid namespace on startup, equivalent to **--unshare-pid**.
#### unshare/net
- type: **boolean**
- default: *false*
- query: *yes*
Create Net namespace on startup, equivalent to **--unshare-net**.
#### unshare/cgroup
- type: **boolean**
- default: *false*
- query: *yes*
Create CGroup namespace on startup, equivalent to **--unshare-cgroup**.
#### exec/kill
- type: **string-array**
- default: [empty array]
- query: *no*
This setting specifies a list of path patterns. If one of these
patterns matches the resolved path of an **exec** system call,
the process in question is killed. See the section called [PATTERN
MATCHING](#pattern-matching) for more information on glob patterns.
#### filter/exec
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to filter for **exec** sandboxing. See the
section called [Exec Sandboxing](#exec-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### filter/read
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to filter for **read** sandboxing. See the
section called [Read Sandboxing](#read-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### filter/stat
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to filter for **stat** sandboxing. See the
section called [Stat Sandboxing](#stat-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### filter/write
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to filter for **write** sandboxing. See
the section called [Write Sandboxing](#write-sandboxing) and the section called [PATTERN
MATCHING](#pattern-matching).
#### filter/net
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of network addresses to filter for **network**
sandboxing. See the section called [Network Sandboxing](#network-sandboxing) and the
section called [ADDRESS MATCHING](#address-matching).
#### allowlist/lock/read
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of beneath paths to allowlist as read-only for
[Landlock](https://landlock.io/) sandboxing. See the section called [Lock
Sandboxing](#lock-sandboxing) for more information.
#### allowlist/lock/write
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of beneath paths to allowlist as read-write for
[Landlock](https://landlock.io/) sandboxing. See the section called [Lock
Sandboxing](#lock-sandboxing) for more information.
#### allowlist/exec
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to allowlist for **exec** sandboxing. See the
section called [Exec Sandboxing](#exec-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### allowlist/read
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to allowlist for **read** sandboxing.
See the section called [Read Sandboxing](#read-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### allowlist/stat
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to allowlist for **stat** sandboxing.
See the section called [Stat Sandboxing](#stat-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### allowlist/write
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to allowlist for **write** sandboxing.
See the section called [Write Sandboxing](#write-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### allowlist/net/bind
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of network addresses to allowlist for **bind network** sandboxing.
See the section called [Network Sandboxing](#network-sandboxing) and the section called
[ADDRESS MATCHING](#address-matching).
#### allowlist/net/connect
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of network addresses to allowlist for **connect network** sandboxing.
See the section called [Network Sandboxing](#network-sandboxing) and the section called
[ADDRESS MATCHING](#address-matching).
#### denylist/exec
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to denylist for **exec** sandboxing. See the section
called [Exec Sandboxing](#exec-sandboxing) and the section called [PATTERN MATCHING](#pattern-matching).
#### denylist/read
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to denylist for **read** sandboxing. See
the section called [Read Sandboxing](#read-sandboxing) and the section called [PATTERN
MATCHING](#pattern-matching).
#### denylist/stat
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to denylist for **stat** sandboxing. See
the section called [Stat Sandboxing](#stat-sandboxing) and the section called [PATTERN
MATCHING](#pattern-matching).
#### denylist/write
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of path patterns to denylist for **write** sandboxing.
See the section called [Write Sandboxing](#write-sandboxing) and the section called
[PATTERN MATCHING](#pattern-matching).
#### denylist/net/bind
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of network addresses to denylist for **bind network** sandboxing. See
the section called [Network Sandboxing](#network-sandboxing) and the section called [ADDRESS MATCHING](#address-matching).
#### denylist/net/connect
- type: **string-array**
- default: [empty array]
- query: *no*
Specifies a list of network addresses to denylist for **connect network** sandboxing.
See the section called [Network Sandboxing](#network-sandboxing) and the section called [ADDRESS
MATCHING](#address-matching).
#### cmd/exec
- type: **command**
- default: none
- query: *no*
Makes SydB☮x execute an external command without sandboxing. The program name
and arguments must be separated with the **US** (unit separator, octal: 037)
character. To ease usage, the **syd exec** subcommand is provided to construct a
sandbox command of this type:
```
⇒ syd -- bash -c 'test -c $(syd exec echo hello world)'
{"caps":2,"cmd":"bash -c test -c $(target/debug/syd exec echo hello world)","ctx":"access","id":"syd","l":2,"path":"/dev/tty","pid":771840,"sys":"openat","t":1696548946}
{"caps":2,"cmd":"bash -c test -c $(target/debug/syd exec echo hello world)","ctx":"access","id":"syd","l":2,"path":"/dev/pts/8","pid":771840,"sys":"openat","t":1696548946}
{"abs":false,"caps":8,"cmd":"target/debug/syd exec echo hello world","ctx":"access","id":"syd","l":2,"pid":771842,"sys":"connect","t":1696548946,"unix":"/dev/log"}
{"cmd":"target/debug/syd exec echo hello world","ctx":"syd/exec","id":"syd","l":2,"path":"/dev/syd/cmd/exec!echo\u001fhello\u001fworld","pid":771842,"t":1696548946}
{"cmd":"target/debug/syd -- bash -c test -c $(target/debug/syd exec echo hello world)","ctx":"cmd/exec","id":"syd","l":2,"pid":771847,"t":1696548946}
hello world
```
### PATTERN MATCHING
Sydb☮x uses shell-style pattern matching for allowlists and filters. The
matching code uses the [globset](https://docs.rs/globset) crate. Check their
documentation for more information about patterns. Note, patterns are case
sensitive, the [empty
alternates](https://docs.rs/globset/latest/globset/struct.GlobBuilder.html#method.empty_alternates)
option is set when building patterns, i.e. `foo{,.txt}` in a pattern will match
both `foo` and `foo.txt` and Sydb☮x applies the **triple star** extension to
patterns, i.e. `/dev/***` matches both `/dev` and any file recursively under
`/dev`. Note also, Sydb☮x gets patterns from multiple sources: a configuration
file, a profile, the *-m* command line switch, or a *stat* call with `/dev/syd`
prefix. There is no precedence between different sources. All patterns in a
list are compiled together in a
[GlobSet](https://docs.rs/globset/latest/globset/struct.GlobSet.html) and
pattern matching during access control happens in a single step where **the last
matching pattern decides the outcome.**
### ADDRESS MATCHING
Sydb☮x has a simple address scheme to match network addresses. The addresses can
either be a [glob](https://docs.rs/globset) pattern to match UNIX and
abstract UNIX socket addresses, or an [IP CIDR](https://docs.rs/ipnetwork)
followed by a port range to match IPv4 and IPv6 addresses. Port range can either
be a single port or a range in format `port1-port2`. The address and the port
range must be splitted by the character `@`. In addition there are some aliases,
you may use instead of specifying an address:
- **ANY**: Expanded to *0.0.0.0/0* which matches the whole Ipv4 address space.
- **ANY6**: Expanded to *::/0* which matches the whole Ipv6 address space.
- **LOOPBACK**: Expanded to *127.0.0.0/8*
- **LOOPBACK6**: Expanded to *::1/8*
- **LOCAL**: Expanded to four addresses as defined in RFC1918:
- *127.0.0.0/8*
- *10.0.0.0/8*
- *172.16.0.0/12*
- *192.168.0.0/16*
- **LOCAL6**: Expanded to four addresses:
- *::1*
- *fe80::/7*
- *fc00::/7*
- *fec0::/7*
## EXAMPLES
Below are examples of invocation and configuration of Sydb☮x.
### Invocation Examples
Below are some invocation examples:
Deny all reads and writes, allow read access to /dev/zero and write access to
/dev/full. The executable dd is not static in this case thus allow access to
/lib64 where it will load its shared libraries from as well. Note, on the
system of the author the `dd` binary links only to libraries under `/usr/lib`,
use `ldd` to check the linked libraries on your system. Note also the quoting
to escape shell expansion.
```
⇒ syd -m sandbox/read:on -m 'allowlist/read+/usr/lib/**' -m allowlist/read+/dev/zero -m allowlist/write+/dev/full -- dd if=/dev/zero of=/dev/full count=1
dd: writing to '/dev/full': No space left on device
1+0 records in
0+0 records out
0 bytes copied, 0,00168969 s, 0,0 kB/s
```
Kill common bittorrent applications. Note 14 stands for **EFAULT** which means
the sandbox process was killed by a signal.
```
⇒ syd -m 'exec/kill+/usr/bin/[kr]torrent' -- bash; echo $?
$ rtorrent
14
⇒ syd -m 'exec/kill+/usr/bin/[kr]torrent' -- bash; echo $?
$ ktorrent
14
⇒
```
Hide some files and directories.
```
⇒ syd -puser bash
$ ls /
bin boot cdrom data dev etc home lib lib32 lib64 libx32 lost+found media mnt nix opt proc root run sbin snap srv sys tmp usr var
$ test -c /dev/syd/denylist/stat+/boot && echo ok
ok
$ test -c /dev/syd/denylist/stat+/tmp && echo ok
ok
$ ls /
bin cdrom data dev etc home lib lib32 lib64 libx32 lost+found media mnt nix opt proc root run sbin snap srv sys usr var
$ cd /tmp
bash: cd: /tmp: Operation not permitted
$ test -c /dev/syd/allowlist/stat+/tmp && echo ok
ok
cd /tmp
$ pwd
/tmp
$
```
## BUGS
```
Hey you, out there beyond the wall,
Breaking bottles in the hall,
Can you help me?
```
Report bugs to ___SydB☮x___'s bug tracker at <https://todo.sr.ht/~alip/syd/>:
1. Always **be polite**, respectful, and kind:
<https://css-tricks.com/open-source-etiquette-guidebook/>
2. Keep your final change as **small and neat** as possible:
<https://tirania.org/blog/archive/2010/Dec-31.html>
3. Attaching poems with the bug report encourages consideration tremendously.
## SECURITY
This is a tricky area. The main advantage SydB☮x brings to the table is that it
requires **no elevated privileges: no root access or `ptrace` capabilities** are
needed. This makes SydB☮x very easy to set up and use. Moreover, SydB☮x allows
the user to **configure the sandbox dynamically from within the sandbox**, and
lock it as necessary afterwards. This is done with great care. To prevent
[time-of-check to
time-of-use](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) attacks
from breaking the sandbox, SydB☮x uses the flag
**SECCOMP\_USER\_NOTIF\_FLAG\_CONTINUE** very sparingly: within the security
policy of the sandbox, this only happens in **exec** and **chdir** system call
hooks because these system calls can not be emulated due to seccomp limitations.
This may change in the future.
- SydB☮x takes other precautions to make
[`TOCTOU`](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) attacks
less likely such as disallowing system calls which can access remote process
memory such as `ptrace` and `process_vm_writev`, and disallowing write access to
`/proc/${pid}/mem`. This makes the attack vectors much harder to realize.
- SydB☮x denies the creation of setuid/setgid files under the sandbox. Since
3.2.2 this may be disabled using the sandbox command
`trace/allow_unsafe_chmod:1`.
- Since 3.1.9, the set-id family system calls -- **setuid**, **setgid** et al.
-- are no-ops under SydB☮x. This means these system calls always succeed
without doing anything.
- SydB☮x disallows the `TIOCSTI` **ioctl** inside the sandbox which would allow
sandbox processes to write to the controling terminal.
- SydB☮x disallows the `PR_SET_MM` **prctl** inside the sandbox which can be
used to create self-modifying executables.
- SydB☮x disallows **io-uring** family system calls which may be used to bypass
path sandboxing.
- Since 3.1.10, SydB☮x disallows **getrandom** calls with the **GRND\_RANDOM**
flag to protect system entropy. Since 3.2.2, this may be disabled with the
sandbox command `trace/allow_unsafe_getrandom:1`.
- Since 3.1.12, SydB☮x disallows the creation of device special files and named
pipes using the
[**mknod**](https://man7.org/linux/man-pages/man2/mknod.2.html) and
[**mknodat**](https://man7.org/linux/man-pages/man2/mknod.2.html) system
calls. Moreover SydB☮x disallows opening already existing device special files
and named pipes.
- Since 3.0.1, SydB☮x can utilize [Landlock](https://landlock.io/)
[LSM](https://en.wikipedia.org/wiki/Linux_Security_Modules) to do filesystem
sandboxing. In this mode the SydB☮x process is also included in the
[Landlock](https:://landlock.io/) sandbox for added security. See [Lock
Sandboxing](#lock-sandboxing) for more information.
- Since 3.0.2, SydB☮x has support for creating [Linux
namespaces](https://en.wikipedia.org/wiki/Linux_namespaces).
- Since 3.0.17, SydB☮x drops the following
[capabilities(7)](https://man7.org/linux/man-pages/man7/capabilities.7.html)
at startup which are inherited by the sandbox:
- `CAP_AUDIT_READ`
- `CAP_AUDIT_WRITE`
- `CAP_AUDIT_CONTROL`
- `CAP_BLOCK_SUSPEND`
- `CAP_BPF`
- `CAP_DAC_OVERRIDE`
- `CAP_DAC_READ_SEARCH`
- `CAP_FOWNER`
- `CAP_FSETID`
- `CAP_SETGID`
- `CAP_SETUID`
- `CAP_LINUX_IMMUTABLE`
- `CAP_IPC_LOCK`
- `CAP_SYS_CHROOT`
- `CAP_SYS_PTRACE`
- `CAP_SYS_PACCT`
- `CAP_MAC_ADMIN`
- `CAP_MAC_OVERRIDE`
- `CAP_MKNOD`
- `CAP_LEASE`
- `CAP_NET_ADMIN`
- `CAP_NET_RAW`
- `CAP_PERFMON`
- `CAP_SYSLOG`
- `CAP_SYS_ADMIN`
- `CAP_SYS_BOOT`
- `CAP_SYS_CHROOT`
- `CAP_SYS_MODULE`
- `CAP_SYS_NICE`
- `CAP_SYS_PACCT`
- `CAP_SYS_PTRACE`
- `CAP_SYS_RAWIO`
- `CAP_SYS_RESOURCE`
- `CAP_SYS_TIME`
- `CAP_WAKE_ALARM`
- `CAP_SETPCAP`
- Since 3.1.3 SydB☮x only allows the following list of ioctl requests:
- `FIOCLEX`
- `FIONCLEX`
- `FIONREAD`
- `FIONBIO`
- `FIOASYNC`
- `GIO_UNIMAP`
- `TCGETS`
- `TCSETS`
- `TCSETSW`
- `TCSETSF`
- `TCGETA`
- `TCSETA`
- `TCSETAW`
- `TCSETAF`
- `TIOCGLCKTRMIOS`
- `TIOCSLCKTRMIOS`
- `TIOCGWINSZ`
- `TIOCSWINSZ`
- `TCSBRK`
- `TCSBRKP`
- `TIOCSBRK`
- `TIOCCBRK`
- `TCXONC`
- `TIOCINQ`
- `TIOCOUTQ`
- `TCFLSH`
- `TIOCGPTN`
- `TIOCSPTLCK`
- `TIOCGDEV`
- `TCGETX`
- `TCSETX`
- `TCSETXF`
- `TCSETXW`
- `TIOCSIG`
- `TIOCVHANGUP`
- `TIOCGPKT`
- `TIOCGPTLCK`
- `TIOCGEXCL`
- `TIOCGPTPEER`
- `TIOCGPGRP`
- `TIOCSPGRP`
- `TIOCGSID`
- `TIOCEXCL`
- `TIOCGEXCL`
- `TIOCNXCL`
- `TIOCGETD`
- `TIOCSETD`
- `TIOCPKT`
- `TIOCGPKT`
- `TIOCSPTLCK`
- `TIOCGPTLCK`
- `TIOCGPTPEER`
- `TIOCGSOFTCAR`
- `TIOCSSOFTCAR`
- `SECCOMP_IOCTL_NOTIF_ID_VALID`
- `SECCOMP_IOCTL_NOTIF_RECV`
- `SECCOMP_IOCTL_NOTIF_SEND`
- `SECCOMP_IOCTL_NOTIF_ADDFD`
- Since 3.1.3 SydB☮x only allows the following list of prctl requests:
- [PR_SET_PDEATHSIG](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_PDEATHSIG](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_DUMPABLE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_DUMPABLE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_ALIGN](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_SETALIGN](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_KEEPCAPS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_KEEPCAPS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_FPEMU](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_FPEMU](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_FPEXC](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_FPEXC](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_TIMING](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_TIMING](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_NAME](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_NAME](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_ENDIAN](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_ENDIAN](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_SECCOMP](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_SECCOMP](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_CAPBSET_READ](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_CAPBSET_DROP](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_TSC](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_TSC](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_SECUREBITS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_SECUREBITS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_TIMERSLACK](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_TIMERSLACK](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_MCE_KILL](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_MCE_KILL_GET](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_CHILD_SUBREAPER](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_CHILD_SUBREAPER](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_NO_NEW_PRIVS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_NO_NEW_PRIVS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_TID_ADDRESS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_THP_DISABLE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_THP_DISABLE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_FP_MODE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_FP_MODE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_CAP_AMBIENT](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SVE_SET_VL](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SVE_GET_VL](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_PAC_RESET_KEYS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_TAGGED_ADDR_CTRL](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_TAGGED_ADDR_CTRL](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_IO_FLUSHER](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_GET_IO_FLUSHER](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SET_SYSCALL_USER_DISPATCH](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_PAC_SET_ENABLED_KEYS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_PAC_GET_ENABLED_KEYS](https://man7.org/linux/man-pages/man2/prctl.2.html)
- [PR_SCHED_CORE](https://man7.org/linux/man-pages/man2/prctl.2.html)
- The full list of denylisted system calls by SydB☮x are as follows, note this
list is automatically generated. Since SydB☮x's default seccomp action is to
deny the system call, any newly added system calls are going to be denied as
well:
- [acct](https://man7.org/linux/man-pages/man2/acct.2.html)
- [add_key](https://man7.org/linux/man-pages/man2/add_key.2.html)
- [adjtimex](https://man7.org/linux/man-pages/man2/adjtimex.2.html)
- [afs_syscall](https://man7.org/linux/man-pages/man2/afs_syscall.2.html)
- [bpf](https://man7.org/linux/man-pages/man2/bpf.2.html)
- [chroot](https://man7.org/linux/man-pages/man2/chroot.2.html)
- [clock_adjtime](https://man7.org/linux/man-pages/man2/clock_adjtime.2.html)
- [create_module](https://man7.org/linux/man-pages/man2/create_module.2.html)
- [delete_module](https://man7.org/linux/man-pages/man2/delete_module.2.html)
- [finit_module](https://man7.org/linux/man-pages/man2/finit_module.2.html)
- [fsconfig](https://man7.org/linux/man-pages/man2/fsconfig.2.html)
- [fsmount](https://man7.org/linux/man-pages/man2/fsmount.2.html)
- [fsopen](https://man7.org/linux/man-pages/man2/fsopen.2.html)
- [fspick](https://man7.org/linux/man-pages/man2/fspick.2.html)
- [get_kernel_syms](https://man7.org/linux/man-pages/man2/get_kernel_syms.2.html)
- [init_module](https://man7.org/linux/man-pages/man2/init_module.2.html)
- [io_cancel](https://man7.org/linux/man-pages/man2/io_cancel.2.html)
- [io_destroy](https://man7.org/linux/man-pages/man2/io_destroy.2.html)
- [io_getevents](https://man7.org/linux/man-pages/man2/io_getevents.2.html)
- [ioperm](https://man7.org/linux/man-pages/man2/ioperm.2.html)
- [io_pgetevents](https://man7.org/linux/man-pages/man2/io_pgetevents.2.html)
- [iopl](https://man7.org/linux/man-pages/man2/iopl.2.html)
- [io_setup](https://man7.org/linux/man-pages/man2/io_setup.2.html)
- [io_submit](https://man7.org/linux/man-pages/man2/io_submit.2.html)
- [io_uring_enter](https://man7.org/linux/man-pages/man2/io_uring_enter.2.html)
- [io_uring_register](https://man7.org/linux/man-pages/man2/io_uring_register.2.html)
- [io_uring_setup](https://man7.org/linux/man-pages/man2/io_uring_setup.2.html)
- [kexec_file_load](https://man7.org/linux/man-pages/man2/kexec_file_load.2.html)
- [kexec_load](https://man7.org/linux/man-pages/man2/kexec_load.2.html)
- [keyctl](https://man7.org/linux/man-pages/man2/keyctl.2.html)
- [mbind](https://man7.org/linux/man-pages/man2/mbind.2.html)
- [migrate_pages](https://man7.org/linux/man-pages/man2/migrate_pages.2.html)
- [mount_setattr](https://man7.org/linux/man-pages/man2/mount_setattr.2.html)
- [move_mount](https://man7.org/linux/man-pages/man2/move_mount.2.html)
- [move_pages](https://man7.org/linux/man-pages/man2/move_pages.2.html)
- [name_to_handle_at](https://man7.org/linux/man-pages/man2/name_to_handle_at.2.html)
- [nfsservctl](https://man7.org/linux/man-pages/man2/nfsservctl.2.html)
- [open_tree](https://man7.org/linux/man-pages/man2/open_tree.2.html)
- [perf_event_open](https://man7.org/linux/man-pages/man2/perf_event_open.2.html)
- [pivot_root](https://man7.org/linux/man-pages/man2/pivot_root.2.html)
- [process_vm_readv](https://man7.org/linux/man-pages/man2/process_vm_readv.2.html)
- [process_vm_writev](https://man7.org/linux/man-pages/man2/process_vm_writev.2.html)
- [ptrace](https://man7.org/linux/man-pages/man2/ptrace.2.html)
- [putpmsg](https://man7.org/linux/man-pages/man2/putpmsg.2.html)
- [query_module](https://man7.org/linux/man-pages/man2/query_module.2.html)
- [quotactl](https://man7.org/linux/man-pages/man2/quotactl.2.html)
- [quotactl_fd](https://man7.org/linux/man-pages/man2/quotactl_fd.2.html)
- [reboot](https://man7.org/linux/man-pages/man2/reboot.2.html)
- [request_key](https://man7.org/linux/man-pages/man2/request_key.2.html)
- [sched_rr_get_interval](https://man7.org/linux/man-pages/man2/sched_rr_get_interval.2.html)
- [sched_setparam](https://man7.org/linux/man-pages/man2/sched_setparam.2.html)
- [security](https://man7.org/linux/man-pages/man2/security.2.html)
- [set_mempolicy](https://man7.org/linux/man-pages/man2/set_mempolicy.2.html)
- [settimeofday](https://man7.org/linux/man-pages/man2/settimeofday.2.html)
- [swapoff](https://man7.org/linux/man-pages/man2/swapoff.2.html)
- [swapon](https://man7.org/linux/man-pages/man2/swapon.2.html)
- [_sysctl](https://man7.org/linux/man-pages/man2/_sysctl.2.html)
- [sysfs](https://man7.org/linux/man-pages/man2/sysfs.2.html)
- [syslog](https://man7.org/linux/man-pages/man2/syslog.2.html)
- [tuxcall](https://man7.org/linux/man-pages/man2/tuxcall.2.html)
- [uselib](https://man7.org/linux/man-pages/man2/uselib.2.html)
- [userfaultfd](https://man7.org/linux/man-pages/man2/userfaultfd.2.html)
- [vhangup](https://man7.org/linux/man-pages/man2/vhangup.2.html)
- [vserver](https://man7.org/linux/man-pages/man2/vserver.2.html)
## COPYRIGHT
- **SPDX-License-Identifier:** *GPL-3.0-or-later*
- **Copyright ©** 2010, 2011, 2012, 2013, 2014, 2015, 2018, 2020, 2021, 2023 Ali Polatel <alip@chesswob.org>
ChangeLog
=========
# 3.2.2
- Add statistics about the file in reports for path access violations.
- Access violation returns EACCES if file exists and the errno if the file does
not exist. Previously it would always return ENOENT in the latter case.
- Do not follow symbolic links in mkdir and mkdirat handlers.
- Lift chmod and getrandom restrictions for the paludis profile.
- `trace/allow_unsafe_getrandom` sandbox command may be used to lift getrandom
restrictions and allow the use of `GRND_RANDOM` flag with getrandom which
accesses `/dev/random` under the hood.
- `trace/allow_unsafe_chmod` sandbox command may be used to lift chmod
restrictions and allow the creation of setuid/setgid files.
- Return correct errno on open errors due to remote path canonicalization
failures.
- System call handlers properly return EBADF on invalid fd arguments now.
- Fix symbolic link handling in open syscall handlers.
- Fix symlink loop detection in remote path canonicalization.
- We issue continue syscall for connection-mode sockets in recvfrom/sendto
system calls. Since the pointer argument is NULL in these cases we're safe
from TOCTOU.
- Do not follow symbolic links in rename, renameat, and renameat2 handlers.
- Return correct errno on failures from statx and newfstatat handlers.
- Use original target argument in symlink, symlinkat handlers so that creation
of relative symbolic links is now possible under SydB☮x.
- Honor sandbox process umask in link and linkat system calls.
- Honor sandbox process umask when creating UNIX sockets.
- Honor sandbox process umask in mkdir, mkdirat, mknod, and mknodat syscall handlers.
- Trailing slash handling has been improved across all system call handlers.
- link, and linkat handlers no longer follow symbolic links in newpath as
mandated by POSIX.
- linkat now honours `AT_SYMLINK_FOLLOW` correctly when following symlinks.
- link no longer follows symbolic links on its first argument as it should.
- open, and openat with `O_CREAT` now properly returns ENOENT on paths ending
with a trailing slash.
- Handle mkdir, mkdirat, rmdir, and unlinkat correctly and return EINVAL when
the last component is a dot.
- Fix a path canonicalization bug to follow symbolic links in the last component
in case the component ends with a slash, ie if it has to be a directory.
- Simplify stat handling.
- Various fixes for xattr related system call handlers, above all handle value
argument being NULL gracefully.
- Avoid resolving target path in **symlink** and **symlinkat** emulators.
# 3.2.1
- Fix handling of `lchown{,32}` emulators where we mistakenly followed symbolic
links before.
- Use use a fd with `O_PATH+RESOLVE_NO_SYMLINKS` during syscall emulation for
safety against symlink attacks, we hard require Linux-5.6 or newer with this.
- Sandbox **ftruncate**, **fgetxattr** and **lgetxattr**.
- Call renameat2 directly as a syscall as musl libc is lacking this function at
the moment and their usage breaks musl builds.
# 3.2.0
- Numerous minor fixes to path normalization and canonicalization.
- Emulate all sandboxing calls but **exec**, and **chdir**.
- Handle symbolic links and the `AT_SYMLINK_NOFOLLOW` flag correctly.
- Handle empty paths and the `AT_EMPTY_PATH` flag correctly in system calls.
- `trace/allow_successful_bind` is now fixed to correctly allow successful bind
calls.
- SydB☮x now emulates all the respective system calls for network sandboxing
**making network sandboxing completely TOCTOU-free.**
- SydB☮x no longer allows the opening of existing device special files or named pipes.
- SydB☮x no longer allows the creation of device special files or named pipes.
# 3.1.11
- Fix an issue with network address filtering causing some filters to match
regardless of their port restrictions.
- Fix an issue with network address matching causing some rules to match
regardless of their port restrictions.
# 3.1.10
- Add sample user configuration file under `data/user.syd-3`.
- Use `/etc/user.syd-3` rather than `/etc/rc.syd-3` which is more consistent.
- SydB☮x now properly spawns the underlying shell as a login shell when SydB☮x
itself is invoked as a login shell.
- Add sandbox commands **unshare/{mount,uts,ipc,user,pid,net,cgroup}** which are
equivalent to the command line options
`--unshare-{mount,uts,ipc,user,pid,net,cgroup}`. In addition they may be
queried using the stat interface during runtime, e.g. `test -e
/dev/syd/unshare/user?'
- Implement `trace/allow_unsafe_{io,pr}ctl` sandbox commands which may be
used to lift the restrictions on the respective system calls.
- The function `syd::proc::proc_cmdline` now trims overly long command lines.
- Simplify capabilities handling. Drop `CAP_BPF`.
# 3.1.9
- The lock is honoured during initial configuration updates so e.g.
setting the sandbox lock in the file `/etc/rc.syd-3` will prevent
`~/.user.syd-3` from loading. This is useful to enforce site-wide
configuration.
- **user** profile now parser `/etc/rc.syd-3` before `~/.user.syd-3`.
- SydB☮x now honours the environment variables
`SYD_UNSHARE_{MOUNT,UTS,IPC,USER,PID,NET,CGROUP}` to create namespaces.
- You may now use SydB☮x as your login shell by adding it to `/etc/shells`. The
actual shell to execute under SydB☮x defaults to `/bin/bash` and can be
changed on runtime via `SYD_SHELL` environment variable or during compile time
by changing the variable `SYD_SH` in `src/config.rs`.
- Fix a bug with path normalization to handle double dots at root position
correctly.
- The set-id family calls are now no-ops under SydB☮x.
- The `/dev/syd` may be read to get SydB☮x state in JSON in case sandbox is
unlocked.
- Better ZSH compatibility for the `data/esyd.sh` script which is also available
via `esyd --sh`.
# 3.1.8
- Fix linkat, renameat, and renameat2 system call handlers' argument handling.
- Fix dropping of capabilities with `--map-root`.
- Listing `/dev` now lists `/dev/syd` in case the sandbox lock is off.
- Simplify handling of the special paths `/proc/self` and `/dev/fd`.
- SydB☮x now properly returns `ENAMETOOLONG` for too long paths.
- Ensure the validity of the sandbox process is checked using
`SECCOMP_IOCTL_NOTIF_ID_VALID` after every interaction with the sandbox
process memory.
- SydB☮x now allows **ioctl** requests for **PTY** handling.
- SydB☮x now properly closes the seccomp notify file descriptor after poll
errors.
- SydB☮x now sets the **no\_new\_privs** attribute for the SydB☮x process as
well as the sandbox process. Previously we only set this in the child process.
- Fix a bug in path canonicalization function preventing an infinite loop,
when following certain symbolic links.
# 3.1.7
- Vendor in the caps crate and avoid using **thiserror** which breaks static
linking.
# 3.1.6
- Stop using the **thiserror** crate which breaks static linking.
# 3.1.5
- Stop using the `derive` feature of the **serde** crate which breaks static
linking.
# 3.1.4
- Allow the system calls **setgid**, **setgriups**, **setregid**, **setresgid**,
**setresuid**, **setreuid**, **setuid** inside the sandbox. Since we drop the
capabilities `CAP_SETUID` and `CAP_SETGID` on startup this is safe.
- Vendor in the landlock create, use bitflags rather than enumflags2 which
depends on emumflags2\_derive crate and that used to break both static linking
and address sanitizer.
- Reading from files under `/dev/syd` succeeds with the lock off. This is to
provide consistency with the stat interface. The open system call handler just
opens `/dev/null` instead under the hood.
- Handle pipes under `/proc/pid/task/fd` directories correctly.
- `syd-test` now honours the **SYD\_TEST\_VALGRIND** environment variable to run
SydB☮x under valgrind during integration tests.
- SydB☮x now logs the current user id with the log messages.
- The stack size of the SydB☮x execve child has been increased from 4k to 128k.
- Block **getrandom** calls with **GRND\_RANDOM** flag. Sandbox processes are
not allowed to access **/dev/random**. Access to **/dev/urandom** is fine.
- Fix environment clearing code which fixes the broken functionality of
`SYD_NO_SYSLOG` and `SYD_NO_CROSS_MEMORY_ATTACH` environment variables.
- The **stat** system call handler now properly handles symbolic links.
- **paludis** and **user** profiles allow access to files `/proc/version` and
`/proc/pid/map`.
- Fix and document **ioctl**, **prctl** restrictions.
- SydB☮x now writes "deny" to `/proc/pid/setgroups` before writing the `gid_map`
file. This way `setgroups(2)` is permanently disabled in user namespace and
writing to the gid map file can succeed without having the `CAP_SETGID`
capability.
# 3.1.3
- SydB☮x restricts prctl usage with a list of allowlisted prctls. This prevents
potentially dangerous prctls such as **PR_SET_MM** which can create
self-modifying executables. The list of allowlisted prctls can be listed using
`syd --list prctl`.
- SydB☮x restricts ioctl usage with a list of allowlisted ioctls. This prevents
sandbox escapes such as utilizing **TIOCSTI** to write to the controlling
terminal. The list of allowlisted ioctls can be listed using `syd --list
ioctl`.
- Use the errno **EACCES** rather than **EPERM** on access violations.
- **paludis** profile disables read access to `/dev/random`. stat access to this
file is granted. Read access to `/dev/urandom` works too.
# 3.1.2
- The stat system call handler now handles deleted files correctly and fstats on
the fd rathet than the dangling /proc symlink
- The stat system call handler now handles special files such as sockets or poll
file descriptors correctly and fstats on the fd rather than the dangling
/proc symbolic link.
- **paludis** and **user** profiles allow read/stat access to `/proc/stat` now
so that `ps` works correctly in the sandbox.
- Add `--sh` option which makes SydB☮x drop a shell script to standard output
which defines **esyd** the sandbbox helper.
# 3.1.1
- CGroups support has been dropped, use other means to create CGroups and then
spawn SydB☮x inside.
- The *paludis* and *user* profiles now allow read/stat access to
the files `/proc/sys/kernel/osrelease` and `/proc/uptime`.
- Fix a panic trying to log paths with non UTF-8 pathnames.
# 3.1.0
- The **stat** system call emulator no longer fails to fstat on pipes.
The solution is **TOCTOU-free**, when we hit on a pipe fd, we get the
file descriptor, fstat it and close it, then return the stat buffer.
- Add support for CGroups via `--limit-{cpu,io,mem,pid}`. The command-line
arguments have conservative defaults. RTFM for more information.
- Disallow the system calls **bpf**, **ioperm**, **iopl**, **setgid**,
**setgroups**, **setregid**, **setresgid**, **setresuid**, setreuid**, and
**vhangup** inside the sandbox to improve security.
- Improve architecture-dependent code, improve support for ARM and S390.
- Edit **paludis** and **user** profiles to have a "deny-by-default and
allowlist known goods" strategy for the directories `/dev` and `/proc`. This
brings added safety as it adds read restrictions and hides many sensitive
paths such as `/dev/kmem` or `/proc/pid/mem`.
- The **memfd_secret** system call is now allowed in the sandbox.
- The **act** and **syslog** system calls are no longer allowed in the sandbox.
- SydB☮x drops some capabilities on startup which provides added safety to the
sandbox. The list of dropped capabilities are listed under
[Security](#security).
- Implement **--map-root** command line flag to map current user to root in the
sandbox. This implies **--unshare-user**.
- Fix the prevention of **setuid**/**setgid** files to be created in the
sandbox.
# 3.0.16
- SydB☮x now allows the system calls **setdomainname**, **sethostname**,
**syslog**, and **signalfd4** system calls inside the sandbox.
- The **stat** family system calls are no fully emulated and do not suffer from
**TOCTOU** issues.
- SydB☮x no longer allows the `TIOCSTI` **ioctl** call which can be used to
write to the controlling terminal for added security.
- When SydB☮x is invoked with `--unshare-user` option to create a new user
namespace, the creation of new user namespaces inside the sandbox is no longer
allowed for added security.
- SydB☮x now allows the system calls **pidfd\_open** and **unshare**.
- SydB☮x no longer allows the system calls **mbind**, **migrate\_pages**,
**move\_pages**, **perf\_event\_open**, **set\_mempolicy**, and
**userfaultfd** inside the sandbox for added security.
- SydB☮x no longer allows setuid/setgid files to be created inside the sandbox.
- **fchmod**, and **fchown** system calls are now sandboxed.
# 3.0.15
- Turn on the [empty
alternates](https://docs.rs/globset/latest/globset/struct.GlobBuilder.html#method.empty_alternates)
building Globs such that `foo{,txt}` in a pattern will match both `foo` and
`foo.txt`.
- Take advantage of **globset** crate's ability to match a set of patterns at
once. This way regardless of how many rules are present in a glob pattern
list, such as allowlist/read, denylist/stat, SydB☮x does a single pattern
match during access control. This increase performance considerably,
especially for very long rulesets.
- replace **glob-match** crate with **globset** crate. **globset** can work
directly on `Path`s and requires no `String` conversion.
- Use `Path`/`PathBuf` rather than `&str`/`String` in many places where we
handle path names. This ensures path names with invalid UTF-8 in their names
are handled correctly.
# 3.0.14
- SydB☮x now uses Landlock ABI version 3 rather than version 1. A Linux kernel
running version 6.2 or newer is required to get the most out of it. However
older versions also work quite well. See [this
table](https://man.archlinux.org/man/landlock.7.en#VERSIONS) for an overview
on Landlock features and the corresponding kernel version when they were
implemented.
# 3.0.13
- **esyd check** now utilizes `syd --check` rather than stating the file
`/dev/syd`. This way it can still detect if the process is running under
SydB☮x despite the sandbox lock being on.
- **esyd exec** subcommand has been fixed.
- The **user** profile added `/dev/tty` to the list of read-write allowed paths
for LandLock sandboxing.
- The **user** profile now allows read access to **/var/log/journal** for
systemd journal access.
- **esyd dump** subcommand now forwards it command line arguments and pipes its
output to **jq** if it's available.
- **Security**: Start emulating **creat** system call which prevents the
`TOCTOU` scenario where an attacker can create a denylisted file by
editing the dereferenced pointer argument after the access control but
before the system call actually happens. We have an integration test,
called **ptrmod_toctou_creat** which confirms the fix.
- The **esyd** helper saw some fixes, fixing `deny*` subcommands.
# 3.0.12
- SydB☮x now logs sandbox command attempts so as to better couple with **esyd**.
- Many improvements, fixes and documentation for the **esyd** helper.
# 3.0.11
- Added new network aliases `ANY` and `ANY6` which match the whole Ipv4 and Ipv6
address spaces respectively.
- **Security**: Add `NULL` guards to all system call hooks which prevents
potential crashes if one of the pointer arguments is 0, one of which was
discovered by trinity on the getdents handler here:
https://builds.sr.ht/~alip/job/1077263
- **Security**: Fix a crash in getdents handler discovered by trinity fuzzer in
this build: https://builds.sr.ht/~alip/job/1077263
- Support compatible system call ABIs as necessary, e.g. on `x86-64`, we now
support `x86`, and `x32` ABIs, on `aarch64` we support `arm` too etc. With
this out of the way, the default bad architecture action has been changed to
"kill process".
- Added helper script `data/esyd.bash` which when sourced into a bash
environment, defines the convenience function `esyd` to interact with SydB☮x
sandbox commands.
- Stat'ing the magic path `/dev/syd/stat` prints the SydB☮x status on standard
error.
- Reading from the magic path `/dev/syd/dump` returns the current SydBox
state as JSON. This is only available when the sandbox is not locked, or
it's only available to the SydBox execve child via `lock:exec`.
- `syd --read path` may be used to canonicalize a path.
- Log messages with process ID information are now enriched with the current
working directory of the process.
- **lchown**, and **lgetxattr** system calls are now sandboxed.
- Implement `--list set` to display the list of system calls in the given set.
The supported sets are **allow**, **deny**, and **hook**.
- Fix BusyBox compatibility issues in integration tests.
# 3.0.10
- Fix unit tests
# 3.0.9
- Fix yet another case where a path with invalid UTF-8 would make SydB☮x panic.
- **Security**: SydB☮x now normalizes the **path** argument of the emulated
**open** system call which prevents some jail breaks, the simplest being to
invoke `cat /proc/./self/status` inside SydB☮x which erroneously opens the
proc directory of SydB☮x rather then that of the process. We have added about
80 integration tests which test various relative paths to break the sandbox
and SydB☮x passes all these tests after this fix.
- Use the **paludis** profile rather than the **user** in tests to improve
reproducibility. Since the **user** profile parsers `~/.user.syd-3` this could
cause random test failures.
- Calling a system call in an inaccessible directory would fail with `EACCES`
even if the path argument is an absolute path. This is now fixed.
# 3.0.8
- Fix a panic in open system call hook for invalid UTF-8 paths.
- Add `/home` to the list of read-only directories for Landlock for `user`
profile.
- `SYD_NPROC` environment variable can be used to configure the number of system
call handler threads.
- Command options are now pretty printed in `test -e /dev/syd/dump` output.
- Reduce the duration of write lock contention in open system call handlers.
- Consider open calls with the flag `O_CREAT` for write sandboxing regardless of
access mode.
# 3.0.7
- Use `epoll` rather than `poll` in the SydB☮x poll thread.
- Ensure the SydB☮x process supervisor does not leak the seccomp file descriptor
on error conditions.
- SydB☮x's thread group id determiner function which reads `/proc/pid/status`
would hang forever in case the process exits after we open the file but before
we're finished with reading. This is now fixed.
- The --print-profile CLI option has been renamed to --print.
- Added `syd --check` to check if the process is running under SydB☮x.
# 3.0.6
- SydB☮x now honors the umask of the environment rather than setting a strict
umask.
- Fix the open emulator to properly handle open calls with `O_TMPFILE` flag.
# 3.0.5
- Handle **AT\_EMPTY\_PATH** flag properly in **execveat**, **fchownat**,
**linkat**, **statx**, **newfstatat**, and **utimensat** syscall hooks.
# 3.0.4
- The system call hook of **open** family system calls now properly sets umask
to that of the process before emulating open so the umasks in sandbox are now
properly honoured.
- Properly handle system calls with a file descriptor and an empty path as
argument.
- Follow symbolic links in path resolution regardless of the system call.
- New command line option **--print-profile** to print the rules of the given
sandbox profile.
- The sandbox profiles **paludis** and **user** have been hardened by utilizing
[Read Sandboxing](#read-sandboxing) and [Stat Sandboxing](#stat-sandboxing).
Many sensitive paths such as **/proc/pid/mem**, **/dev/mem** are both hidden
and denylisted for read.
- **Landlock** errors are no longer fatal.
- **SydB☮x** has now basic support for UID/GID mapping inside user namespaces,
where by default the current user is mapped with the same UID/GID inside the
container.
- **syd-test** now changes its current working directory to a temporary
directory before running integration tests. There is also a new validation in
place when **syd-test** will refuse to run as root. This is due to the fact
that the integration tests will fail randomly when run with elevated
privileges.
- Use **SECCOMP_IOCTL_NOTIF_ADDFD** in **open**, **openat** and **openat2**
calls to close the **TOCTOU** window, providing security. Once POC for
**open** system call which utilizes pointer modification to break out of jail
has been included in the test suite and is fixed with this change.
# 3.0.3
- **Security**: SydB☮x did not check the target argument of **symlink** and
**symlinkat** system calls which makes a jail break possible through a symlink
attack. Two POCs, one for each system call respectively, are included in the
test suite. With SydB☮x checking the target argument these breaks no longer
work.
- `syd -t`, and `syd-test` now accept many of either a name regex, a test index,
or a test index range as arguments to filter which integration tests to run.
# 3.0.2
- `-H, --hostname name`, `-D, --domainname name` added to set host, domain name
of sandboxed process. This requires `--unshare-uts`.
- `-u name, --uid=name` and `-g name, --gid=name` options have been added to run
the sandboxed process as another user.
- `-A alias, --arg0=alias` has been added to set an alias for the sandbox
process.
- `-W dir, --work-dir=dir` option has been added to change into a directory before
executing sandbox process.
- `-C dir, --chroot=dir` option has been added to chroot into a directory before
executing sandbox process.
- `--unshare-pid,net,mount,uts,ipc,user` command line arguments have been added
for namespaces support.
- `--export pfc` now has detailed information about the seccomp rules, and lists
of allowed and notified system calls.
- The old and unused **_sysctl** system call is no longer allowed by SydB☮x.
- SydB☮x now reports libsecc☮mp version in `--version` output.
- Remove read beneath /home for landlock in user profile.
- Clean SydB☮x related environment variables from the environment of the
sandboxed process.
# 3.0.1
- New sandboxing type [Lock Sandboxing](#lock-sandboxing) to utilize
[Landlock](https://landlock.io/)
[LSM](https://en.wikipedia.org/wiki/Linux_Security_Modules).
- SydB☮x no longer sets umask to 077 for the sandbox process.
- Disable **setuid** system call in the sandbox for added security. Since this
system call normally requires an environment with new privileges, this is not
possible under SydB☮x as the sandbox has "no new privileges" flag set.
# 3.0.0
- **Milestone**: Paludis builds under SydB☮x with recommended tests using this
[MR](https://gitlab.exherbo.org/paludis/paludis/-/merge_requests/86).
- Sandbox command lock now defaults to **exec** rather than **off** for added
security.
- `allowlist/successful_bind` was broken by a recent change. This is now fixed.
- The `trace/memory_access` command is fixed, `strace -c` confirms the results
# 3.0.0-beta.15
- Test suite now properly recognizes that it is running under SydB☮x and skips
the integration tests.
- SydB☮x now properly exits with the exit code of the sandbox process and exit
codes for error conditions are documented in `--help`.
- Fix an issue with triple star extension in path glob matches.
# 3.0.0-beta.14
- Fix an issue with /proc/pid/cmdline reader.
- `symlink` and `symlinkat` system call interceptors no longer check the target
for access.
- Skip running integration tests when running under SydB☮x.
- `lock:exec` no longer waits for the initial **exec** call to lock the sandbox
for all processes except the SydB☮x exec child.
# 3.0.0-beta.13
- Drop the `built` crate dependency.
- Drop the `procfs` crate dependency.
- Use the `built` crate without the `git2` feature.
- Don't use `snmalloc` as the global allocator anymore. This fixes issues with
static linking on Gentoo.
# 3.0.0-beta.12
- Fix an issue of **stat** sandboxing with path hiding.
- The environment variable **SYD\_NO\_CROSS\_MEMORY\_ATTACH** may be set to
disable using cross memory attach and fallback to `/proc/pid/mem`.
- The environment variable **SYD\_NO\_SYSLOG** may be set to disable logging to **syslog**.
- Canonicalize UNIX socket addresses before sandbox access check.
- Add common system directories to the allowlist in **user** profile to make
usage more practical.
- Add `--export` argument to export secure computing rules in binary **Berkeley
Packet Filter** format and textual **Pseudo Filter Code** formats.
- System call hooks now use system call name and arguments to determine whether
remote path canonicalization should resolve symbolic links.
- bump MSRV from `1.69` to `1.70`.
- `error` and `warn` level logs are not written to standard error unless
standard error is a terminal. Since logs of these levels also go to **syslog**
this is no loss for the user. This is merely to provide convenience when
running terminal user interfaces under SydB☮x.
- `user` profile now enables `stat` sandboxing with the user home directory
allowlisted.
# 3.0.0-beta.11
- Added `stat` sandboxing which can be used to hide files and directories from
the sandboxed process.
- The sandbox command `denylist/network` has been renamed to `denylist/net`.
- The sandbox command `allowlist/network` has been renamed to `allowlist/net`.
- The sandbox command `filter/network` has been renamed to `filter/net`.
- The sandbox command `sandbox/network` has been renamed to `sandbox/net`.
- `user` profile now properly allowlists screen and tmux connections.
# 3.0.0-beta.10
- When debug mode is enabled with `SYD_LOG=debug`, SydB☮x now logs all system
calls with seccomp action other than `Allow` to the kernel log. This is useful
in tackling problems with build failures.
- System calls with bad architecture know return `ENOSYS` rather than SydB☮x
killing the thread.
- Disallowed system calls are now denied with `EACCES` rather than `ENOSYS`.
- SydB☮x now sets seccomp system call priority of hotter system calls to a
higher value to improve performance.
- Fix a potential panic with `/proc/self` -> `/proc/pid` handling in remote
paths.
# 3.0.0-beta.9
- Fix an issue with remote path canonicalization.
# 3.0.0-beta.8
- Consolidate error handling, making it faster and more robust.
- Various fixes and improvements for the remote path canonicalization code which
makes it faster and more robust with regards to error handling.
# 3.0.0-beta.7
- SydB☮x now ignores the signals `SIGHUP`, `SIGTSTP`, `SIGTTOU`, and `SIGTTIN`
for uninterrupted tracing.
- The **user** profile now sets the environment variable
`GIT_CEILING_DIRECTORIES` to `HOME` to save the user from some useless and
annoying access violations.
# 3.0.0-beta.6
- Make the **user** profile Exherbo friendly.
# 3.0.0-beta.5
- The `user` profile now has **read** and **exec** sandboxing enabled as well as
**write** and **network** sandboxing.
- The **triple star** extension is applied to glob patterns, ie `/dev/***`
matches both `/dev` and any file recursively under `/dev`.
- When run without arguments, the home directory of the current user is now
looked up from `passwd(5)` data rather than using the `HOME`
environment variable.
- The clause **last matching rule wins** was not honored at all times. This is
now fixed.
# 3.0.0-beta.4
- The `user` profile now also parses the file `~/.user.syd-3` if it exists.
Note, syd uses this profile when invoked without arguments. This provides an
easy way to spawn a working shell under sandbox.
- Fix UDP network sandboxing which was broken due to invalid error handling for
connection-mode sockets.
- Some glob patterns in sandbox profiles `paludis`, and `user` have been fixed.
# 3.0.0-beta.3
- Run tests as integration tests, drop the `test-bin` development dependency.
# 3.0.0-beta.2
- Added the new `user` sandbox profile which allows access to user-specific
directories such as `HOME`, and connections such as `X`, `screen`, `tmux` etc.
When invoked without arguments, `syd` now drops to a shell with this profile.
- Replace `regex` crate with the more lightweight and performant `regex-lite`
crate.
- Implement the `cmd/exec` sandbox command and the `syd exec` subcommand.
- Switch from `glob` crate to the `glob-match` crate for matching glob patterns.
- Fallback to `/proc/$pid/mem` if cross memory attach is not enabled in the
kernel. Use `SYD_PROC_MEM` environment variable or the sandbox command
`trace/memory_access:1` to force `/proc` fallback.
- `exec/kill_if_match` has been renamed to `exec/kill` which is a **breaking
change**.
- Set `panic = abort` in release builds for reduced binary size.
- Name the polling thread `syd-poll`.
- Better error handling, and cleaner code.
- Use `parking_lot` crate for `Mutex`, and `RwLock`.
- The default magic virtual device path has been updated from `/dev/sydbox` to
`/dev/syd` saving three letters on each typing!! This is a **breaking
change**.
- The `core/` prefix has been removed from the configuration items
`core/sandbox`, e.g use `sandbox/exec:on` rather than `core/sandbox/exec:on`.
`allowlist/successful_bind` has been renamed to `trace/allow_successful_bind`,
and `allowlist/unsupported_socket_families` has been renamed to
`trace/allow_unsupported_socket_families`. Moreover the config item
`core/trace/magic_lock` has been renamed to simply `lock`. This is a
**breaking change**.
- The prefixes `unix:`, `unix-abstract:`, `inet:`, `inet6:` are no longer used
in network addresses. Instead the pattern is treated as a UNIX shell style
pattern if it starts with `/`, and as an IP address otherwise. There is no
distinction between unix sockets and abstract unix sockets anymore. This is a
**breaking change**. Check the `data/` subdirectory for a `sydbox.bash` for
use with `Paludis`.
- Fix a bug with remote path canonicalization.
- Access violations are logged to syslog now. Use, e.g. `journalctl
SYSLOG_IDENTIFIER=syd` to view them.
# 3.0.0-alpha.2
- When run without arguments, `sydbox` now drops into user's current running
shell allowlisting the `HOME` directory.
- Document the CLI option `-p`, `--profile` and add `noipv4` and `noipv6`
profiles in addition the `paludis` profile. These profiles may be stacked by
specifying more than one `-p` arguments.
- Use a Seccomp `BPF` filter rather than a `Notify` filter for fakeroot mode.
- Improve logging to achieve consistency. We have a very simple Logger which logs
to standard error in format `JSON` lines. There are some common keys `id` is
always `syd`, `l` gives the `Log::Level` as an integer whereby the lower the
value of the integer the more severe is the log condition. `t` gives a UNIX
time stamp in seconds, and `ctx` has short context on the log entry. Errors are
represented with the `err` key, and system call names are given with the `sys`
key.
- The `--profile <profile-name>` and `--config @<profile-name>` is now
supported. `Paludis` uses the former so it is important for compatibility.
The profile file is **no longer** installed under `${sharedir}/sydbox` where
`{sharedir}` is usually `/usr/share` and is kept as a static array in the
program itself. In the future when `sydbox-3` has an exheres we can improve on
this but for now this gets us going.
- The `setuid` system call is now allowed in the sandbox.
- Use `snmalloc` as the global allocator for improved performance.
# 3.0.0-alpha.1
- **New**: Added `core/allowlist/successful_bind`.
- Utilizes `getsockname` hook, `pidfd_getfd`, and `process_vm_writev` for complete emulation.
- Features a `TTL` of 3 mins for tracking addresses to manage zero port arguments in `bind()` system calls.
- **Improved**: Refined read, write, network/{bind,connect} sandboxing.
- Simpler implementation, yet compatible with `Paludis` via `esandbox`.
- No per-process sandboxing or process tree tracking; uses `/proc/$pid/cwd` when required.
- Single set of sandbox rules with configurations pushed upfront.
- **API Change**: Replaced `allow`, `deny` modes with simpler `on/off` toggle.
- `core/sandbox/network` can be set to `bind` or `connect` for selective sandboxing.
- Rule matching favors the latest rule for configuration stacking.
- Streamlined `core/trace/magic_lock:exec` due to lack of parent/child tracking.
- **New**: Introduced `seccomp` process supervision.
- Implemented primarily in `syd::hook` and `syd::remote`.
- Derived from the `greenhook` crate, but with a deny-by-default `seccomp` policy.
- Allowlisted system calls maintained in `syd::config` (currently immutable by users).
- Notable system calls like `ptrace`, `process_vm_writev`, and `io-uring` are disabled to counteract `TOCTOU` vulnerabilities.