---
name: "syd-ofd"
section: "1"
platform: "linux"
package: "syd"
version: "3.59.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/syd-ofd"
---

# syd-ofd(1)

Take a lock on a file, then execute into another program

## NAME

**syd-ofd** - Take a lock on a file, then execute into another program

## SYNOPSIS

**syd-ofd** *\[-n \| -N\]* *\[-t timeout\]* *\[-d fd\]* *\[-s=-r \| -x=-w\]* *file* {command \[arg...\]}

## DESCRIPTION

syd-ofd takes a lock on a file, then executes into another program. It is functionally identical to the *s6-setlock*(1) utility except it uses OFD locks which are new in POSIX 2024. This lock type is also known as "file-private locks" and is open file description-based rather than process based like the old-style POSIX locks that *s6-setlock*(1) uses. This allows [*syd*(1)](/syd/1.md) to pass the file descriptor to the sandbox process and close its own copy while the sandbox process still holding the lock which is not possible with old style locks and *s6-setlock*(1).

## OPTIONS

| | |
| --- | --- |
| **-h** | Display help. |
| **-n** | Nonblocking lock. If syd-ofd cannot acquire the lock, it will exit 11 ("EAGAIN": Try again) immediately. |
| **-N** | Blocking lock. syd-ofd will wait until it can acquire the lock. This is the default. |
| **-t timeout** | Timed lock. If syd-ofd cannot acquire the lock after timeout milliseconds, it will exit 4 ("EINTR": Interrupted system call). |
| **-s=-r** | Shared lock. Other shared locks on the same file will not prevent the lock from being acquired (but an exclusive lock will). |
|  | The **-r** option is retained for compatibility with the *s6-setlock*(1) utility. |
| **-x=-w** | Exclusive lock. This is the default. |
|  | The **-w** option is retained for compatibility with the *s6-setlock*(1) utility. |
| **-d fd** | Make the lock visible in *program* on file descriptor *fd*. |

## EXIT STATUS

On clean exit, **syd-ofd** exits with the same code as the child process. On unclean termination, exit code is set to 128 plus signal number. In case executing the child process fails **syd-ofd** exits with the [*errno*(3)](/errno/3.md) number.

## SECURITY

**syd-ofd** uses [*openat*(2)](/openat/2.md) with the resolve flags RESOLVE\_NO\_MAGICLINKS and RESOLVE\_NO\_SYMLINKS when opening or creating the lock file. Consequently, if any component of the specified path is a symbolic link, the call fails and returns error code 40 (ELOOP: "Too many symbolic links encountered"). In the same manner, the presence of any **..** (dot-dot) component in the lock-file path causes the call to fail and return error code 13 (EACCES: "Permission denied"). This restriction is intended to mitigate confused-deputy vulnerabilities during lock-file creation and related file operations by preventing an intermediary or less-privileged actor from redirecting the operation via symbolic links or parent-directory (**..**) components to an unintended filesystem location.

## SEE ALSO

[*syd*(1)](/syd/1.md), [*syd*(2)](/syd/2.md), [*syd*(5)](/syd/5.md), [*syd-lock*(1)](/syd-lock/1.md), [*syd-mdwe*(1)](/syd-mdwe/1.md), [*syd-pds*(1)](/syd-pds/1.md), [*syd-ring*(1)](/syd-ring/1.md), [*syd-sec*(1)](/syd-sec/1.md), [*syd-tsc*(1)](/syd-tsc/1.md), *s6-setlock*(1), [*fcntl*(2)](/fcntl/2.md), *[F\_OFD\_SETLKW(2const)](/F_OFD_SETLKW/2const.md)*, [*openat2*(2)](/openat2/2.md)

- •

  **syd** homepage: https://sydbox.exherbo.org/

- •

  **s6-setlock** manpage: https://skarnet.org/software/s6/s6-setlock.html

- •

  **POSIX 2024** [*fcntl*(2)](/fcntl/2.md) manpage: https://pubs.opengroup.org/onlinepubs/9799919799/functions/fcntl.html

## AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.