Syd – configurable application sandbox for Linux

Syd is an application sandbox designed to confine processes through a combination of Linux security facilities.

Formerly known as sydbox, the project has a long history as the default sandbox used by Exherbo for running package builds with restricted access to the host. The current implementation is written in Rust and provides fine-grained policy controls over filesystem operations, process execution and networking. It can be used as a general application sandbox, as part of a controlled build environment or to construct more specialised restricted execution setups.

This is free and open source software.

Key Features

• Uses seccomp and seccomp user notifications to inspect and restrict system activity.
• Integrates Landlock for additional filesystem access control.
• Supports mount, UTS, IPC, PID, network, user and cgroup namespaces.
• Provides separate controls for reading, writing, executing, creating, deleting and renaming files.
• Can restrict directory traversal, directory listings, ownership changes and permission changes.
• Controls symbolic links, truncation, temporary file creation and device creation.
• Provides configurable network sandboxing for bind and connect operations.
• Includes predefined profiles for common confinement scenarios.
• Can create restricted container-style environments using namespace profiles.
• May be used as a restricted login shell with system-wide and per-user configuration.
• Supports locking a sandbox policy so confined programs cannot subsequently relax its restrictions.
• Offers command-line companion utilities for inspecting and constructing sandbox policies.

Website: gitlab.exherbo.org/sydbox/sydbox
Support:
Developer: Ali Polatel
License: GNU General Public License v3.0

Syd is written in Rust. Learn Rust with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.