190 stable releases

3.26.1 Sep 30, 2024
3.25.0 Aug 31, 2024
3.23.17 Jul 25, 2024
3.15.7 Mar 27, 2024
3.6.2 Nov 30, 2023

#29 in Unix APIs

Download history 127327/week @ 2024-06-19 139901/week @ 2024-06-26 167728/week @ 2024-07-03 172920/week @ 2024-07-10 107509/week @ 2024-07-17 126205/week @ 2024-07-24 130738/week @ 2024-07-31 129885/week @ 2024-08-07 127470/week @ 2024-08-14 127048/week @ 2024-08-21 126817/week @ 2024-08-28 114527/week @ 2024-09-04 126581/week @ 2024-09-11 112611/week @ 2024-09-18 123183/week @ 2024-09-25 106803/week @ 2024-10-02

486,922 downloads per month

GPL-3.0-or-later

3MB
65K SLoC

Change returns success. Going and coming without error. Action brings good fortune.

lev(syd,bsd)<e Shine On You Crazy Diamond! Try to Avoid Chance!

syd:discord #sydbox:mailstation.de #sydbox:irc.libera.chat

msrv repology build status pipeline status

license maintenance-status dependency status OpenSSF best practices

Syd is a rock-solid unikernel to sandbox applications on Linux>=5.19. Syd is similar to Bubblewrap, Firejail, GVisor, and minijail. Syd is secure by default, and intends to provide a simple interface over various intricate Linux sandboxing mechanisms such as LandLock, Namespaces, Ptrace, and Seccomp-{BPF,Notify}, most of which have a reputation of being brittle and difficult to use. You may run Syd as a regular user, with no extra privileges, and you can even set Syd as your login shell. Syd adheres to the UNIX philosophy and intends to do one thing and do it well with least privilege: Neither SETUID is required like Firejail, nor privileged kernel context is required like EBPF-based alternatives such as Falco or this. Syd is based mostly on and shares its Threat Model with Seccomp. Syd does not suffer from TOCTTOU issues like GSWTK and Systrace: As a unikernel, it executes system calls on behalf of the sandboxed process rather than continuing them in the sandbox process. LandLock ABI version 3 is supported for additional hardening. Use of Ptrace is minimal and optional with a negligible overhead. Use of unprivileged user namespaces is optional and off by default. A brief overview of Syd's capabilities are as follows:

Read the fine manuals of syd, libsyd, gosyd, plsyd, pysyd, rbsyd, syd.el and watch the asciicasts Memory Sandboxing, PID Sandboxing, Network Sandboxing, and Sandboxing Emacs with syd. Join the CTF event at https://ctftime.org/event/2178 and try to read the file /etc/CTF¹ on syd.chesswob.org with ssh user/pass: syd.²

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Follow toots with the #sydbox hashtag and discuss in #sydbox on Libera Chat.

¹: SHA256(/etc/CTF)=f1af8d3946546f9d3b1af4fe15f0209b2298166208d51a481cf51ac8c5f4b294

²: Start by reading the CTF sandbox profile.

³: That cat's something I can't explain!

Dependencies

~10–28MB
~378K SLoC