--- name: "syd-fd" section: "1" platform: "linux" package: "syd" version: "3.59.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/syd-fd" --- # syd-fd(1) Interact with remote file descriptors ## NAME **syd-fd** - Interact with remote file descriptors ## SYNOPSIS **syd-fd** *\[-h\]* *\[-p pid\]* *\[-f remote\_fd\[:local\_fd\]\]*... *{command \[args...\]}*\ **syd-fd** *\[-hw\]* -u *socket* *\[-m msg\]* *\[-f fd\[,fd...\]\]*... ## DESCRIPTION **syd-fd** utility can be used to interact with file descriptors on Linux systems. It operates in one of two modes: transferring remote file descriptors with [*pidfd\_getfd*(2)](/pidfd_getfd/2.md), or sending file descriptors over a UNIX domain socket with **SCM\_RIGHTS**. In first mode, given only a PID argument with *-p*, it lists the open files of the process with the given PID in line-oriented compact JSON format. Given no PID argument it lists the open files of the current process. The *-f* argument can be used to transfer remote file descriptors using [*pidfd\_getfd*(2)](/pidfd_getfd/2.md) which requires Linux\>=5.6. Optionally a local file descriptor to use as the target may be appended after a colon. Specify "rand" as target to duplicate the file descriptor to a random available file descriptor slot. If a command is given it is executed and the file descriptors are transferred to the process. If no command is given "/bin/sh" is executed. In second mode, selected with *-u*, it connects to the given UNIX domain socket and sends a single message carrying the file descriptors given with *-f* as **SCM\_RIGHTS** ancillary data of [*unix*(7)](/unix/7.md). A leading **@** in the socket address denotes an *abstract* UNIX socket. The *-f* arguments are local file descriptor numbers: caller is supposed to open them, e.g. with shell redirections. Message line may be given with *-m* and defaults to empty. Both *-m* and *-f* are optional, so the mode may also be used to send plain messages without file descriptors. Any limit on the number of descriptors per message is the receiver's policy: [*syd*(2)](/syd/2.md) IPC socket accepts exactly one configuration file descriptor per message. By default syd-fd exits right after the send without waiting for a response, given *-w* it waits for a response regardless of what was sent, and prints it to standard output until peer closes the connection. Above all, this mode is useful to load sandbox configuration over the [*syd*(2)](/syd/2.md) IPC socket. A received file descriptor constitutes the load request, and the message carrying it must consist of the sole command "load". ## OPTIONS | | | | --- | --- | | **-h** | Display help. | | **-p** *pid* | Specify process ID. If not given, list fds of current process. | | **-f** *remote\_fd\[:local\_fd\]* | Specify remote fd to transfer. A local target fd may be appended after a colon, or "rand" for a random target. | | **-u** *socket* | Connect to the UNIX domain socket and send the given fds with **SCM\_RIGHTS**. A leading **@** denotes an abstract socket. The fds to send are given with *-f*, repeated or comma-separated. | | **-m** *line* | Specify the message line to send with *-u*. Optional, defaults to empty. | | **-w** | Wait for a response with *-u*, regardless of what was sent, and print it to standard output. By default syd-fd exits right after the send. | ## EXIT STATUS syd-fd exits with the same exit code as the command. With *-u*, it exits 0 on success, and with the [*errno*(3)](/errno/3.md) of the failed system call on failure. ## EXAMPLES Load sandbox configuration over [*syd*(2)](/syd/2.md) IPC socket: ``` $ syd-fd -w -u @sandbox.sock -m load -f 3 3