Syd is an application sandbox designed to confine processes through a combination of Linux security facilities.
Formerly known as sydbox, the project has a long history as the default sandbox used by Exherbo for running package builds with restricted access to the host. The current implementation is written in Rust and provides fine-grained policy controls over filesystem operations, process execution and networking. It can be used as a general application sandbox, as part of a controlled build environment or to construct more specialised restricted execution setups.
This is free and open source software.
Key Features
- Uses seccomp and seccomp user notifications to inspect and restrict system activity.
- Integrates Landlock for additional filesystem access control.
- Supports mount, UTS, IPC, PID, network, user and cgroup namespaces.
- Provides separate controls for reading, writing, executing, creating, deleting and renaming files.
- Can restrict directory traversal, directory listings, ownership changes and permission changes.
- Controls symbolic links, truncation, temporary file creation and device creation.
- Provides configurable network sandboxing for bind and connect operations.
- Includes predefined profiles for common confinement scenarios.
- Can create restricted container-style environments using namespace profiles.
- May be used as a restricted login shell with system-wide and per-user configuration.
- Supports locking a sandbox policy so confined programs cannot subsequently relax its restrictions.
- Offers command-line companion utilities for inspecting and constructing sandbox policies.
Website: gitlab.exherbo.org/sydbox/sydbox
Support:
Developer: Ali Polatel
License: GNU General Public License v3.0
Syd is written in Rust. Learn Rust with our recommended free books and free tutorials.
Related Software
| Application Sandboxing Tools | |
|---|---|
| Firejail | Linux SUID sandbox for restricting application access |
| bubblewrap | Low-level tool for building unprivileged sandboxes |
| NsJail | Process isolation tool using namespaces, cgroups, and seccomp filters |
| Isolate | Secure execution environment for running untrusted programs with limits |
| Syd | Application sandbox providing configurable filesystem and syscall isolation |
| Hakoniwa | Process isolation tool built around Linux namespaces and security facilities |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.