syd-pty1
Pty to stdio bidirectional forwarder
Usage
syd-pty [-dh]
-i
<pty-fd>
[-x
<x-size>]
[-y
<y-size>]
Overview
Forwards data between given pty(7) main file descriptor and stdio(3).
Options
| -h | Display help. |
| -d | Run in debug mode without confinement. |
| This is permitted only if Syd is built with the trusted Cargo feature. | |
| -i pty-fd | PTY main file descriptor. |
| -x x-size | Specify window row size (default: inherit). |
| -y y-size | Specify window column size (default: inherit). |
Usage
syd-pty(1) is not meant to be used as a standalone tool. Syd invokes syd-pty(1) at startup when PTY sandboxing is set to on with sandbox/pty:on. See PTY SANDBOXING section in syd(7) manual page for more information. If you want to use syd-pty(1) in your own project, create a new pseudoterminal with posix_openpt(3) or openpty(3) and pass main end of file descriptor pair to syd-pty(1) with -i <pty-fd> argument. syd-pty(1) is going to set terminal to raw mode and make no attempt to save/reset original terminal settings which is caller's responsibility.
Implementation
syd-pty(1) is designed for performance, security, and privacy, using edge-triggered epoll(7) for event notification and fully asynchronous operations to handle pseudoterminal activities without blocking. It transfers data with zero-copy splice(2), moving bytes directly between file descriptors within kernel without exposing plaintext in user space. Two pairs of pipes carry bidirectional traffic between pty(7) and stdio(3). execution environment is confined with seccomp(2) and landlock(7), restricting system calls and file access to minimum required.
Security
syd-pty(1) applies multiple confinement layers to mitigate risks associated with running outside Syd sandbox, preventing potential Meddler-in-the-Middle (MITM) attacks against containers. Linux capabilities(7) are dropped early and no-new-privs attribute is set so no unwanted capability leaks into the process. TOSTOP flag is set for terminal syd-pty(1) reads from to disable background processes from writing. Resource limits RLIMIT_CORE, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_LOCKS, RLIMIT_MEMLOCK, and RLIMIT_MSGQUEUE are set to zero to prevent core dumps and file/fd/process/msgqueue creation inside main loop. seccomp(2) filters are configured to allow only required syscalls. This list excludes memory, file system and network system calls. landlock(7) and namespaces(7), if available, enforce further restrictions by disallowing all filesystem and network access, providing an additional layer of security. Root directory is moved into /proc/self/fdinfo with pivot_root(2) and old root is detached with MNT_DETACH, so no path to host filesystem remains in mount namespace. These combined techniques ensure that even if syd-pty(1) is compromised, scope of malicious actions is significantly limited, maintaining integrity and security of the system.
Environment
| SYD_PTY_DEBUG | Run in debug mode without confinement, equivalent to -d option. |
| This is ignored unless Syd is built with trusted Cargo feature. |