| SYD-RING(1) | General Commands Manual | SYD-RING(1) |
syd-ring - Run a program under io_uring(7) restrictions
syd-ring [-hvV] [-o op[,op...]]... [-f flag[,flag...]]... {command [args...]}
syd-ring runs a program under io_uring(7) task-level restrictions, which require Linux-7.0 or newer. Without such a restriction, io_uring(7) can bypass path and network sandboxing because it performs operations from kernel worker threads that seccomp(2) cannot observe. The restriction is an allowlist enforced by Linux. Only the submission queue operations and entry flags that are explicitly permitted may be issued, and it applies to calling task and any program it executes into.
Operations are allowed with -o and submission flags with -f, each taking a comma separated list of names and repeatable. With no -o or -f option allowlist defaults to operations read, readv, write, and writev and the flag async. This is the set required to make PostgreSQL work under syd(1) and may change in the future. Once an operation is given with -o the allowlist is built from an empty set instead. Names may be enumerated with -o list and -f list. Refer to Uring Sandboxing section of syd(7) manual page for more information.
| -h | Display help. |
| -v | Be verbose. Print io_uring(7) restriction status to stderr(3) before running the program. |
| -V | Check for io_uring(7) task-level restriction support in Linux. |
| -o op[,op...] | Allow submission queue operations, may be repeated. |
| Use -o list to print the list of known operations. | |
| -f flag[,flag...] | Allow submission queue entry flags, may be repeated. |
| Use -f list to print the list of known flags. |
Refer to following links for more information:
syd-ring -V exits with one of the following exit codes based on support for task-level io_uring(7) restrictions:
| 0 | Supported. |
| 127 | Not supported. |
io_uring(7), syd(1), syd(2), syd(5), syd(7), syd-lock(1), syd-mdwe(1), syd-ofd(1), syd-pds(1), syd-sec(1), syd-tsc(1)
syd homepage: https://sydbox.exherbo.org/
Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.
| 2026-07-19 |