SYD-LOCK(1) General Commands Manual SYD-LOCK(1) (NAME) syd-lock - landlock (SYNOPSIS) syd-lock [-bchrvwASUV] [-C level] [-E errata] [-F flag]... [-l category[,category...]{+|-}path|port[-port][,port[-port]...]]... {command [args...]} (DESCRIPTION) syd-lock landlock(7) . landlock(7) () . : read write exec ioctl create delete rename symlink truncate readdir mkdir rmdir mkbdev mkcdev mkfifo bind connect. bind connect . . (magic symbolic links) (<<..>>) . . (<<..>>) . bind connect . (ephemeral) . bind (UNIX domain socket) mknod(2) . landlock(7) Sandboxing Lock Sandboxing syd(7) . (OPTIONS) -h . -v (verbose). landlock(7) stderr(3) . -V ABI landlock(7) stdout(3). -A ABI landlock(7) stdout(3) . . -l cat[,cat...]{+|-}path|port[-port] landlock(7) ( ) . <<+>> () <<->> () . bind connect . bind connect . bind mknod(2) S_IFSOCK . connect connect(2) sendmsg(2) . bind connect . . -C level landlock(7). hard-requirement soft-requirement best-effort . hard-requirement . hard ( h) soft ( s) best ( b) . -E errata (errata) landlock(7). -E list . . . . -F flags landlock_restrict_self(2). -F list . FLAGS . -S (scoped signals) landlock(7) ABI 6 . -U (scoped UNIX abstract sockets) landlock(7) ABI 6 . -r path . -l read,readdir,exec,ioctl+path . -w path - . -l all+path . -b port[-port][,port[-port]...] () bind(2) . -l bind+port . -c port[-port][,port[-port]...] () connect(2) . -l connect+port . (CONFIGURATION) landlock(7) ( ) -l . <<+>> () <<->> () . -l . -V landlock(7) . . -A ABI landlock(7) . (ABI) ABI landlock(7) . syd-lock landlock(7) ABI 10 7.2 . ABI landlock(7) HISTORY . (SETS) 3.38.0 . pledge(2) OpenBSD : all all-x exec rpath read readdir wpath write truncate cpath create delete rename dpath mkbdev mkcdev spath mkfifo symlink tpath mkdir rmdir inet bind connect (COMPATIBILITY LEVELS) 3.35.0 landlock(7) -C : hard-requirement ( hard h) soft-requirement ( short s) best-effort ( best b). hard-requirement . landlock(7) . open(2) ENOENT (<< >>) errno(3) (fatal) . soft-requirement . best-effort . soft-requirement best-effort open(2) ENOENT (<< >>) errno(3) . open(2) . (FLAGS) 3.38.0 landlock(7) -F . . . 7 ABI landlock(7) 6.15 . . ABI (NO-OP) . +-------------------+--------------------------------------------------+ |log_same_exec_off | 1: | | | | | | | | | (thread) | | | landlock(7) | | | | | | | | | | | | | | | | | | ( | | | | | | execve(2)) | | | . | | | | | | | | | | | | | | | execve(2) | | | | | | | | | . | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | | | ABI 7 | | | landlock(7) | | | 6.15 . | +-------------------+--------------------------------------------------+ |log_new_exec_on | 2: | | | | | | | | | execve(2) | | | | | | | | | | | | | | | | | | landlock(7) | | | | | | . | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | | | ABI 7 | | | landlock(7) | | | 6.15 . | +-------------------+--------------------------------------------------+ |log_subdomains_off | 4: | | | | | | | | | | | | landlock(7) | | | | | | | | | | | | . | | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | | | | | | | | | | | | | | | | | | | | | | | | landlock(7) | | | | | | | | | | | | | | | . | | | log_same_exec_off | | | | | | | | | | | | | | | . | | | | | | ABI 7 | | | landlock(7) | | | 6.15 . | +-------------------+--------------------------------------------------+ (SECURITY) 3.35.0 landlock(7) best-effort hard-requirement ENOENT (No such file or directory) best-effort . ( ) landlock(7) . : https://landlock.io/rust-landlock/landlock/trait.Compatible.html 3.46.0 (<<..>>) . . (<<..>>) . bind . syd-lock(1) . syd-lock(1) syd-mdwe(1) W^X . syd-mdwe(1) . (HISTORY) o 1 ABI landlock(7) 5.13 . o 2 ABI landlock(7) 5.19 . o 3 ABI landlock(7) 6.2 . o 4 ABI landlock(7) 6.7 . o 5 ABI landlock(7) 6.10 . o 6 ABI landlock(7) 6.12 . o 7 ABI landlock(7) 6.15 . o 8 ABI landlock(7) 7.0 . o 9 ABI landlock(7) 7.1 . o 10 ABI landlock(7) 7.2 . : o https://git.kernel.org/stable/c/17ae69aba89dbfa2139b7f8024b757ab3cc42f59 o https://git.kernel.org/stable/c/cb44e4f061e16be65b8a16505e121490c66d30d0 o https://git.kernel.org/stable/c/299e2b1967578b1442128ba8b3e86ed3427d3651 o https://git.kernel.org/stable/c/136cc1e1f5be75f57f1e0404b94ee1c8792cb07d o https://git.kernel.org/stable/c/2fc0e7892c10734c1b7c613ef04836d57d4676d5 o https://git.kernel.org/stable/c/e1b061b444fb01c237838f0d8238653afe6a8094 o https://git.kernel.org/stable/c/72885116069abdd05c245707c3989fc605632970 o https://git.kernel.org/stable/c/42fc7e6543f6d17d2cf9ed3e5021f103a3d11182 o https://git.kernel.org/stable/c/ae97330d1bd6a97646c2842d117577236cb40913 o https://git.kernel.org/stable/c/9a8ed15ce22472fe0363e33738b4317d06b13c3a (EXIT STATUS) syd-lock . . syd-lock(1) errno(3) . syd-lock -A ABI landlock(7) . syd-lock -E : 0 . 1 . 2 . syd-lock -V ABI landlock(7) : 0 (Fully enforced) 1 (Partially enforced) 2 (Not enforced) 127 (Not supported) syd-lock 22 (EINVAL) . (EXAMPLES) $ syd-lock wget -O/dev/null chesswob.org $ syd-lock -l read,exec+/ wget -O/dev/null chesswob.org /dev/null: Permission denied $ syd-lock -l read,exec+/ -l write+/dev/null wget -O/dev/null chesswob.org Prepended http:// to chesswob.org --2025-04-30 16:24:35-- http://chesswob.org Resolving chesswob.org (chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141 Connecting to chesswob.org (chesswob.org)|95.216.39.164|:80... failed: Permission denied. Connecting to chesswob.org (chesswob.org)|fe80::468a:5bff:fe88:2141|:80... failed: Permission denied. Retrying. ^C $ syd-lock -l read,exec+/ -l write+/dev/null -l connect+80 -l connect+443 wget -O/dev/null chesswob.org Prepended http:// to chesswob.org --2025-04-30 16:25:59-- http://chesswob.org Resolving chesswob.org (chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141 Connecting to chesswob.org (chesswob.org)|95.216.39.164|:80... connected. HTTP request sent, awaiting response... 302 Moved Temporarily Location: https://www.chesswob.org [following] --2025-04-30 16:25:59-- https://www.chesswob.org Loaded CA certificate /etc/ssl/certs/ca-certificates.crt Resolving www.chesswob.org (www.chesswob.org)... 95.216.39.164, fe80::468a:5bff:fe88:2141 Connecting to www.chesswob.org (www.chesswob.org)|95.216.39.164|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 148827 (145K) [text/html] Saving to: `/dev/null' /dev/null 100%[=============================================================>] 145.34K --.-KB/s in 0.01s 2025-04-30 16:25:59 (11.9 MB/s) - `/dev/null' saved [148827/148827] $ (SEE ALSO) landlock(7), syd(1), syd(2), syd(5), syd(7), syd-mdwe(1), syd-ofd(1), syd-pds(1), syd-ring(1), syd-sec(1), syd-tsc(1) syd: https://sydbox.exherbo.org Landlock: https://landlock.io Landlock: https://docs.kernel.org/userspace-api/landlock.html Landlock: https://docs.kernel.org/admin-guide/LSM/landlock.html (AUTHORS) Ali Polatel. https://gitlab.exherbo.org/sydbox/sydbox.git Radicle rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF . https://gitlab.exherbo.org/groups/sydbox/-/issues . #sydbox Libera Chat #sydbox:mailstation.de Matrix. 2026-09-01 SYD-LOCK(1)