---
name: "syd-ring"
section: "1"
platform: "linux"
package: "syd"
version: "3.59.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/syd-ring"
---

# syd-ring(1)

Run a program under io\_uring(7) restrictions

## NAME

**syd-ring** - Run a program under [*io\_uring*(7)](/io_uring/7.md) restrictions

## SYNOPSIS

**syd-ring** *\[-hvV\]* *\[-o op\[,op...\]\]...* *\[-r reg\[,reg...\]\]...* *\[-f flag\[,flag...\]\]...* *{command \[args...\]}*

## DESCRIPTION

**syd-ring** runs a program under [*io\_uring*(7)](/io_uring/7.md) task-level restrictions, which require Linux-7.0 or newer. Without such a restriction, [*io\_uring*(7)](/io_uring/7.md) can bypass path and network sandboxing because it performs operations from kernel worker threads that [*seccomp*(2)](/seccomp/2.md) cannot observe. The restriction is an allowlist enforced by Linux. Only the submission queue operations, registrations and entry flags that are explicitly permitted may be issued, and it applies to calling task and any program it executes into.

Submission queue operations are set with *-o*, registrations with *-r* and submission queue entry flags with *-f*. Each option takes a comma separated list of names and may be repeated. An option that is not given leaves its list at the default. An option that is given replaces the default for that list with the names supplied. Repeated options accumulate. The other two lists stay unchanged.

The default operations are *epoll\_ctl*, *read*, *readv*, *write* and *writev*. The default registration is *register\_probe*. The default flag is *async*.

Names may be enumerated with *-o list*, *-r list* and *-f list*. Refer to **Uring Sandboxing** section of [*syd*(7)](/syd/7.md) manual page for more information.

## OPTIONS

| | |
| --- | --- |
| **-h** | Display help. |
| **-v** | Be verbose. Print [*io\_uring*(7)](/io_uring/7.md) restriction status to [*stderr*(3)](/stderr/3.md) before running the program. |
| **-V** | Check for [*io\_uring*(7)](/io_uring/7.md) task-level restriction support in Linux. |
| **-o** *op\[,op...\]* | Allow submission queue operations, may be repeated. |
|  | Use *-o list* to print the list of known operations. |
| **-r** *reg\[,reg...\]* | Allow registrations, may be repeated. |
|  | Use *-r list* to print the list of known registrations. |
| **-f** *flag\[,flag...\]* | Allow submission queue entry flags, may be repeated. |
|  | Use *-f list* to print the list of known flags. |

## HISTORY

- •

  Task-level [*io\_uring*(7)](/io_uring/7.md) restrictions were introduced with Linux-7.0.

Refer to following links for more information:

- •

  https://git.kernel.org/stable/c/ed82f35b926b2e505c14b7006473614b8f58b4f4

## EXIT STATUS

- •

  **syd-ring** exits with the same code as the child process.

- •

  **syd-ring** exits with **22** (EINVAL: "Invalid argument") for invalid CLI arguments.

**syd-ring -V** exits with one of the following exit codes based on support for task-level [*io\_uring*(7)](/io_uring/7.md) restrictions:

| | |
| --- | --- |
| **0** | Supported. |
| **127** | Not supported. |

## SEE ALSO

[*io\_uring*(7)](/io_uring/7.md), [*syd*(1)](/syd/1.md), [*syd*(2)](/syd/2.md), [*syd*(5)](/syd/5.md), [*syd*(7)](/syd/7.md), [*syd-lock*(1)](/syd-lock/1.md), [*syd-mdwe*(1)](/syd-mdwe/1.md), [*syd-ofd*(1)](/syd-ofd/1.md), [*syd-pds*(1)](/syd-pds/1.md), [*syd-sec*(1)](/syd-sec/1.md), [*syd-tsc*(1)](/syd-tsc/1.md)

**syd** homepage: https://sydbox.exherbo.org/

## AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.