---
name: "syd-mdwe"
section: "1"
platform: "linux"
package: "syd"
version: "3.59.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/syd-mdwe"
---

# syd-mdwe(1)

Run a program under Memory-Deny-Write-Execute protections

## NAME

**syd-mdwe** - Run a program under Memory-Deny-Write-Execute protections

## SYNOPSIS

**syd-mdwe** *\[-hms\]* *{command \[args...\]}*

## DESCRIPTION

**syd-mdwe** utility runs a program under Memory-Deny-Write-Execute (MDWE) protections. The protections can be applied using [*prctl*(2)](/prctl/2.md) and [*seccomp*(2)](/seccomp/2.md), These protections are identical to what Syd applies by default.

## OPTIONS

| | |
| --- | --- |
| **-h** | Display help. |
| **-m** | Enable MDWE protections using [*prctl*(2)](/prctl/2.md) PR\_SET\_MDWE (default: both). |
| **-s** | Enable MDWE protections using [*seccomp*(2)](/seccomp/2.md) (default: both). |

## EXAMPLES

Running pax-test once standalone and once under [*syd-mdwe*(1)](/syd-mdwe/1.md) on a 6.8 kernel we get the following differences:

| | | |
| --- | --- | --- |
| **PaX Testcase** | **standalone** | **mdwe** |
| Executable anonymous mapping | Killed | Killed |
| Executable bss | Killed | Killed |
| Executable data | Killed | Killed |
| Executable heap | Killed | Killed |
| Executable stack | Killed | Killed |
| Executable shared library bss | Killed | Killed |
| Executable shared library data | Killed | Killed |
| Executable anonymous mapping (mprotect) | Vulnerable | Killed |
| Executable bss (mprotect) | Vulnerable | Killed |
| Executable data (mprotect) | Vulnerable | Killed |
| Executable heap (mprotect) | Vulnerable | Killed |
| Executable stack (mprotect) | Vulnerable | Killed |
| Executable shared library bss (mprotect) | Vulnerable | Killed |
| Executable shared library data (mprotect): | Vulnerable | Killed |
| Writable text segments | Vulnerable | Killed |

The test was performed with paxtest-0.9.15:

```
PaXtest - Copyright(c) 2003-2016 by Peter Busser <peter@adamantix.org> and Brad Spengler <spender@grsecurity.net>
Released under the GNU Public Licence version 2 or later
Mode: 1
Blackhat
Kernel:
Linux syd 6.8.0-syd-13213-g70293240c5ce #9 SMP PREEMPT_DYNAMIC Mon Mar 25 04:40:47 CET 2024 x86_64 GNU/Linux
```

## EXIT STATUS

On clean exit, **syd-mdwe** exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails **syd-mdwe** exits with the [*errno*(3)](/errno/3.md) number.

## CAVEATS

By default, [*prctl*(2)](/prctl/2.md) error setting [*PR\_SET\_MDWE*(2const)](/PR_SET_MDWE/2const.md) is not fatal. Use the **-m** option to make this error fatal. This utility does not work on MIPS architectures where Linux requires executable stack.

## SEE ALSO

[*syd*(1)](/syd/1.md), [*syd*(2)](/syd/2.md), [*syd*(5)](/syd/5.md), [*syd-lock*(1)](/syd-lock/1.md), [*syd-ofd*(1)](/syd-ofd/1.md), [*syd-pds*(1)](/syd-pds/1.md), [*syd-ring*(1)](/syd-ring/1.md), [*syd-sec*(1)](/syd-sec/1.md), [*syd-tsc*(1)](/syd-tsc/1.md), [*seccomp*(2)](/seccomp/2.md), [*prctl*(2)](/prctl/2.md), [*PR\_SET\_MDWE*(2const)](/PR_SET_MDWE/2const.md)

**syd** homepage: https://sydbox.exherbo.org/

## AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.