---
name: "syd-sec"
section: "1"
platform: "linux"
package: "syd"
version: "3.59.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/syd-sec"
---

# syd-sec(1)

Print secure bits or run command with secure bits set

## NAME

**syd-sec** - Print secure bits or run command with secure bits set

## SYNOPSIS

**syd-sec** *\[-ahikprsxAIKPRSX\]* *{command \[args...\]}*

## DESCRIPTION

Given no arguments, print information on process secure bits in compact JSON.

Given no command, one or more of the secure bit options *\[-aikprsx\]* may be given to test for secure bits. Use capital letter options, *\[-AIKPRSX\]*, to test for locked versions of respective secure bits.

Given a command and arguments, with at least one of the secure bit options *\[-aikprsxAIKRSX\]* set the specified securebits, execute the command and exit with the same status.

## OPTIONS

| | |
| --- | --- |
| **-h** | Display help and exit. |

| | |
| --- | --- |
| **-p, -P** | Set/test process no\_new\_privs attribute. |

| | |
| --- | --- |
| **-r, -R** | Set/test secure bit SECBIT\_NOROOT. |

| | |
| --- | --- |
| **-s, -S** | Set/test secure bit SECBIT\_NO\_SETUID\_FIXUP. |

| | |
| --- | --- |
| **-k, -K** | Set/test secure bit SECBIT\_KEEP\_CAPS. |

| | |
| --- | --- |
| **-a, -A** | Set/test secure bit SECBIT\_NO\_CAP\_AMBIENT\_RAISE. |

| | |
| --- | --- |
| **-x, -X** | Set/test secure bit SECBIT\_EXEC\_RESTRICT\_FILE. |

| | |
| --- | --- |
| **-i, -I** | Set/test secure bit SECBIT\_EXEC\_DENY\_INTERACTIVE. |

## SECURE BITS

| | | |
| --- | --- | --- |
| **Securebit** | **Description** | **CAP\_SETPCAP required?** |
| NO\_NEW\_PRIVS | When set, [*execve*(2)](/execve/2.md) will not grant new privileges (e.g., set-user-ID/set-group-ID mode bits and file capabilities are ignored). Inherited across [*fork*(2)](/fork/2.md), [*clone*(2)](/clone/2.md), and [*execve*(2)](/execve/2.md); once set, cannot be unset. | No |
| NOROOT | Disable special handling of UID 0 for gaining capabilities on exec/setuid. NOROOT\_LOCKED is lock for NOROOT (prevents further changes; irreversible). | Yes |
| NO\_SETUID\_FIXUP | Stop kernel adjustments to permitted/effective/ambient capability sets when effective/filesystem UIDs toggle between 0 and nonzero. NO\_SETUID\_FIXUP\_LOCKED is lock for NO\_SETUID\_FIXUP (prevents further changes; irreversible). | Yes |
| KEEP\_CAPS | Allow retaining permitted capabilities when switching all UIDs from 0 to nonzero; always cleared on [*execve*(2)](/execve/2.md). KEEP\_CAPS\_LOCKED is lock for KEEP\_CAPS (prevents further changes; irreversible). | Yes |
| NO\_CAP\_AMBIENT\_RAISE | Disallow raising ambient capabilities via *prctl(PR\_CAP\_AMBIENT\_RAISE)*. NO\_CAP\_AMBIENT\_RAISE\_LOCKED is lock for NO\_CAP\_AMBIENT\_RAISE (prevents further changes; irreversible). | Yes |
| EXEC\_RESTRICT\_FILE | Interpreter/dynamic linker should execute a file only if [*execveat*(2)](/execveat/2.md) with AT\_EXECVE\_CHECK on the related file descriptor succeeds. EXEC\_RESTRICT\_FILE\_LOCKED is lock for EXEC\_RESTRICT\_FILE (prevents further changes; irreversible). | No |
| EXEC\_DENY\_INTERACTIVE | Interpreter should not accept interactive user commands; content via a file descriptor is allowed only if [*execveat*(2)](/execveat/2.md) with AT\_EXECVE\_CHECK succeeds. EXEC\_DENY\_INTERACTIVE\_LOCKED is lock for EXEC\_DENY\_INTERACTIVE (prevents further changes; irreversible). | No |

## EXIT STATUS

When querying secure bits, **syd-sec** exits with success if all the specified secure bits are set in process secure bits. When running a command, **syd-sec** exits with the same code as the child process. If [*PR\_SET\_SECUREBITS*(2const)](/PR_SET_SECUREBITS/2const.md) [*prctl*(2)](/prctl/2.md) operation fails prior to command execution, **syd-sec** exits with [*errno*(3)](/errno/3.md).

## SEE ALSO

[*syd*(1)](/syd/1.md), [*syd*(2)](/syd/2.md), [*syd*(5)](/syd/5.md), [*syd-lock*(1)](/syd-lock/1.md), [*syd-mdwe*(1)](/syd-mdwe/1.md), [*syd-ofd*(1)](/syd-ofd/1.md), [*syd-pds*(1)](/syd-pds/1.md), [*syd-ring*(1)](/syd-ring/1.md), [*syd-tsc*(1)](/syd-tsc/1.md), [*PR\_GET\_SECUREBITS*(2const)](/PR_GET_SECUREBITS/2const.md), [*PR\_SET\_SECUREBITS*(2const)](/PR_SET_SECUREBITS/2const.md)

**syd** homepage: https://sydbox.exherbo.org/

## AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.