ChangeLog
=========

# 3.48.6

- Fix parsing of the `all-x` category set in sandbox rules.
- Add [`BUGS`](https://man.exherbo.org/syd.7.html#BUGS) section to the
  _syd_(7) manual page describing in detail all open issues concerning
  the safety of the Syd sandbox.
- Harden AES encryption threads by adding a per-thread _landlock_(7)
  sandbox which prevents all filesystem and network access.
- Harden AES encryption threads by unsharing `CLONE_FS` and
  `CLONE_SYSVSEM`.
- Harden interrupt, ipc, and timeout threads by unsharing
  `CLONE_SYSVSEM` in addition to `CLONE_FS` and `CLONE_FILES`.
- Harden emulator threads by unsharing `CLONE_SYSVSEM` in addition to
  `CLONE_FS` and `CLONE_FILES`.
- Add rule
  [`trace/allow_unsafe_any_addr:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_any_addr)
  to the `paludis` profile.
- Refine kill family system call handling, and teach _syd_ls_(1) the
  `kill` system call set. Syd hooks into these system calls for signal
  protection if and only if _landlock_(7) ABI 6 is not supported by the
  host Linux kernel. _landlock_(7) ABI 6 is new in Linux-6.12 and comes
  with the signal scoping feature which is a more efficient way to
  provide signal protections. Refer to the [`Sharing Pid namespace with
  signal
  protections`](https://man.exherbo.org/syd.7.html#Sharing_Pid_namespace_with_signal_protections)
  section of the _syd_(7) manual page for more information.

# 3.48.5

- Rewrite the glob matcher [Kirk Krauss's FastWildCompare
  algorithm](https://www.developforperformance.com/MatchingWildcards_AnImprovedAlgorithmForBigData.html)
  achieving a 50% speedup. This is alip's birthday present to the glob
  matcher of _rsync_(1) which was initially written 40 years ago.
- Add rule
  [`trace/allow_unsafe_pgrp:true`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_pgrp)
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_pgrp`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_pgrp)
  to prevent Syd from entering into a new process group at startup.
- Refine signal protections on older kernels where _landlock_(7)
  signal-scoping is not available. Signal scoping is new in
  _landlock_(7) ABI 6 which is new in Linux-6.12.

# 3.48.4

- Revert "Avoid setting Syd as the group leader to work around [issue
  242](https://gitlab.exherbo.org/sydbox/sydbox/-/issues/242)." This
  allows the sandbox process to send signals to Syd in certain setups
  which is certainly unwanted. Until we work on the correct solution,
  reverting this change to prevent any users from getting effected.

# 3.48.3

- Support environment variable `SYD_PALUDIS_PTY` to turn on [PTY
  Sandboxing](https://man.exherbo.org/syd.7.html#PTY_Sandboxing)
  for the `paludis` profile.
- Avoid setting Syd as the group leader to work around [issue
  242](https://gitlab.exherbo.org/sydbox/sydbox/-/issues/242).

# 3.48.2

- Fix a bug in path canonicalizer when resolving symlinks for final path
  component when path ends with a trailing slash. This bug was
  identified by the tests of the uutils project.
- Add environment variables `ASAN_OPTIONS`, `ASAN_SYMBOLIZER_PATH`,
  `LSAN_OPTIONS`, `MSAN_OPTIONS`, `MSAN_SYMBOLIZER_PATH`, `TSAN_OPTIONS`, and
  `UBSAN_OPTIONS` to the list of unsafe environment variables. Refer to the
  [`Restricting environment and
  trace/allow_unsafe_env`](https://man.exherbo.org/syd.7.html#Restricting_environment_and_trace/allow_unsafe_env)
  section of the manual page for more information. Refer also to this
  [oss-security mail](https://www.openwall.com/lists/oss-security/2016/02/17/9).
- Add new option
  [`trace/deny_vdso`](https://man.exherbo.org/syd.2.html#trace/deny_vdso)
  to deny access to vDSO by overwriting the auxiliary vector members
  **AT_SYSINFO** and **AT_SYSINFO_EHDR** at _exec_(3) boundary.
- Support
  [`trace/deny_tsc`](https://man.exherbo.org/syd.2.html#trace/deny_tsc)
  on arm64.
- Add new core utility
  [_syd-tsc_(1)](https://man.exherbo.org/syd-tsc.1.html) to run a
  command without access to the timestamp counter.
- Fix
  [`trace/force_umask`](https://man.exherbo.org/syd.2.html#trace/force_umask)
  to only change _umask_(2) for regular files at _chmod_(2) boundary.
- Consolidate [`Syscall Argument
  Cookies`](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  into a single hardened memory region with guard pages and _mseal_(2)
  protection.
- Remove the experimental stack pivot detection feature which comes with
  a lot of false positives and has [known
  bypasses](https://archive.ph/xS2Fl#selection-13.0-243.52) which are
  not trivial to detect. OpenBSD's stack pivot detection suffers from
  similar issues.
- Use `EPERM` _errno_(3) rather than `EACCES` to deny sub-namespace
  creation.
- Allow _clone3_(2) system call when
  [`trace/allow_unsafe_namespace:all`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_namespace)
  is set at startup in which case pointer dereference of the flags
  argument is irrelevant.

# 3.48.1

- Pin [`libc`](https://crates.io/crates/libc) crate to an earlier
  version to fix compilation on armv7, armhf and loongarch64.
- Improve display tips for Ioctl sandboxing access violations.

# 3.48.0

- Update `firefox` profile for the recent hardenings.
- Add rule
  [`rlimit/memlock:off`](https://man.exherbo.org/syd.2.html#rlimit/memlock)
  to the `paludis` profile.
- Add rules
  [`uts/host:none`](https://man.exherbo.org/syd.2.html#uts/host), and
  [`uts/domain:none`](https://man.exherbo.org/syd.2.html#uts/domain) to
  the `gui` profile because overriding host/domain name confuses X11
  authentication.
- Support keywords `none` and `off` as arguments to
  [`uts/host`](https://man.exherbo.org/syd.2.html#uts/host),
  [`uts/domain`](https://man.exherbo.org/syd.2.html#uts/domain), and
  [`uts/version`](https://man.exherbo.org/syd.2.html#uts/version) to
  pass-through the host name, domain name and version to the sandbox
  process respectively.
- Add rule
  [`trace/allow_unsafe_prlimit:true`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_prlimit)
  to the `firefox` profile to permit changing resource limits.
- Add new profile `gui` to turn off PTY sandboxing and pass through
  unsafe GUI environment variables. You may refer to this profile
  shortly as just `g`. This profile is included by the `firefox`
  profile. Refer to the
  [`PROFILES`](https://man.exherbo.org/syd.5.html#PROFILES) section of
  the _syd_(5) manual page for more information.
- Add GUI environment variables `DBUS_SESSION_BUS_ADDRESS`, `DISPLAY`,
  `GDK_PIXBUF_MODULE_FILE`, `GDM_LANG`, `GTK_MODULES`,
  `QT_QPA_PLATFORM_PLUGIN_PATH`, `SESSION_MANAGER`, `WAYLAND_DISPLAY`,
  `XAUTHORITY`, and `XDG_SESSION_COOKIE` to the list of unsafe
  environment variables.
- Add command [`passenv`](https://man.exherbo.org/syd.2.html#passenv) to
  specify pass-through unsafe environment variables, akin to the
  `-evar=` CLI option. Refer to the [`Restricting environment and
  trace/allow_unsafe_env`](https://man.exherbo.org/syd.7.html#Restricting_environment_and_trace/allow_unsafe_env)
  section for more information.
- Remove option `trace/allow_unsafe_msgsnd`. The system call _msgsnd_(2)
  is now denied as part of [`Shared Memory
  Hardening`](https://man.exherbo.org/syd.7.html#Shared_Memory_Hardening),
  and may be allowed using the option
  [`trace/allow_unsafe_shm:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_shm)
  together with the other _sysvipc_(7) system calls.
- Add rules
  [`trace/allow_unsafe_shm:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_shm),
  [`trace/allow_unsafe_msgqueue:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_msgqueue),
  [`trace/allow_unsafe_perm_shm:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_perm_shm),
  and
  [`trace/allow_unsafe_perm_msgqueue:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_perm_msgqueue)
  to the `paludis` profile.
- Deny access to _sysvipc_(7) and _mq_overview_(7) system calls by
  default, and add the options
  [`trace/allow_unsafe_shm`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_shm),
  and
  [`trace/allow_unsafe_msgqueue`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_msgqueue)
  to allow them. Refer to the [`Shared Memory
  Hardening`](https://man.exherbo.org/syd.7.html#Shared_Memory_Hardening)
  section of the _syd_(7) manual page for more information.
- Rename option `trace/allow_unsafe_shm` to
  [`trace/allow_unsafe_perm_shm`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_perm_shm)
  for clarity.
- Rename option `trace/allow_mqueue` to
  [`trace/allow_unsafe_perm_msgqueue`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_perm_msgqueue)
  for clarity.
- Support environment variable `SYD_TMOUT` to set the default value for
  [`timeout`](https://man.exherbo.org/syd.2.html#timeout).
- Support environment variable `SYD_RLIMIT_STACK` to set the default value for
  [`rlimit/stack`](https://man.exherbo.org/syd.2.html#rlimit/stack).
- Support environment variable `SYD_RLIMIT_SIGPENDING` to set the default value
  for
  [`rlimit/sigpending`](https://man.exherbo.org/syd.2.html#rlimit/sigpending).
- Support environment variable `SYD_RLIMIT_RTTIME` to set the default value for
  [`rlimit/rttime`](https://man.exherbo.org/syd.2.html#rlimit/rttime).
- Support environment variable `SYD_RLIMIT_RTPRIO` to set the default
  value for
  [`rlimit/rtprio`](https://man.exherbo.org/syd.2.html#rlimit/rtprio).
- Support environment variable `SYD_RLIMIT_NPROC` to set the default
  value for
  [`rlimit/nproc`](https://man.exherbo.org/syd.2.html#rlimit/nproc).
- Support environment variable `SYD_RLIMIT_NOFILE` to set the default
  value for
  [`rlimit/nofile`](https://man.exherbo.org/syd.2.html#rlimit/nofile).
- Support environment variable `SYD_RLIMIT_NICE` to set the default
  value for
  [`rlimit/nice`](https://man.exherbo.org/syd.2.html#rlimit/nice).
- Support environment variable `SYD_RLIMIT_MEMLOCK` to set the default
  value for
  [`rlimit/memlock`](https://man.exherbo.org/syd.2.html#rlimit/memlock).
- Support environment variable `SYD_RLIMIT_FSIZE` to set the default
  value for
  [`rlimit/fsize`](https://man.exherbo.org/syd.2.html#rlimit/fsize).
- Support environment variable `SYD_RLIMIT_DATA` to set the default
  value for
  [`rlimit/data`](https://man.exherbo.org/syd.2.html#rlimit/data).
- Support environment variable `SYD_RLIMIT_CORE` to set the default
  value for
  [`rlimit/core`](https://man.exherbo.org/syd.2.html#rlimit/core).
- Support environment variable `SYD_RLIMIT_AS` to set the default value
  for [`rlimit/as`](https://man.exherbo.org/syd.2.html#rlimit/as).
- Add interface to resource limits using the new options
  [`rlimit/as`](https://man.exherbo.org/syd.2.html#rlimit/as),
  [`rlimit/core`](https://man.exherbo.org/syd.2.html#rlimit/core),
  [`rlimit/cpu`](https://man.exherbo.org/syd.2.html#rlimit/cpu),
  [`rlimit/data`](https://man.exherbo.org/syd.2.html#rlimit/data),
  [`rlimit/fsize`](https://man.exherbo.org/syd.2.html#rlimit/fsize),
  [`rlimit/memlock`](https://man.exherbo.org/syd.2.html#rlimit/memlock),
  [`rlimit/msgqueue`](https://man.exherbo.org/syd.2.html#rlimit/msgqueue),
  [`rlimit/nice`](https://man.exherbo.org/syd.2.html#rlimit/nice),
  [`rlimit/nfile`](https://man.exherbo.org/syd.2.html#rlimit/nfile),
  [`rlimit/nproc`](https://man.exherbo.org/syd.2.html#rlimit/nproc),
  [`rlimit/rtprio`](https://man.exherbo.org/syd.2.html#rlimit/rtprio),
  [`rlimit/rttime`](https://man.exherbo.org/syd.2.html#rlimit/rttime),
  [`rlimit/sigpending`](https://man.exherbo.org/syd.2.html#rlimit/sigpending),
  and
  [`rlimit/stack`](https://man.exherbo.org/syd.2.html#rlimit/stack).
- Do stack pivot detection at _execve_(2) and _execveat_(2) boundaries
  and add the option
  [`trace/allow_unsafe_pivot_stack`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_pivot_stack)
  to disable. Refer to the [`Stack Pivot
  Detection`](https://man.exherbo.org/syd.7.html#Stack_Pivot_Detection)
  section of the _syd_(7) manual page for more information.
- Harden executable mappings of Syd at startup by making them
  Execute-Only using _mprotect_(2) and sealing them with _mseal_(2).
  This hardening is best-effort, only works on 64-bit and may be
  disabled at startup using the new option
  [`trace/allow_unsafe_noxom`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_noxom).
  Refer to the [`Hardening executable
  mappings`](https://man.exherbo.org/syd.7.html#Hardening_executable_mappings)
  section of the _syd_(7) manual page for more information.
- Raise the default stack size of emulator threads from `208k` to `2M`.
- Optimize memory usage of emulator threads utilizing
  [`TinyVec`](https://docs.rs/tinyvec/latest/tinyvec/enum.TinyVec.html)
  type of [`tinyvec`](https://crates.io/crates/tinyvec) crate for paths,
  and
  [`SgMap`](https://docs.rs/scapegoat/latest/scapegoat/struct.SgMap.html)
  type of [`scapegoat`](https://crates.io/crates/scapegoat) crate for
  path maps.
- Do not hook into system calls _kill_(2), _tkill_(2), _tgkill_(2),
  _rt_sigqueueinfo_(2), _rt_tgsigqueueinfo_(2), and _pidfd_open_(2) with
  _seccomp_(2) for signal protection if _landlock_(7) scoped signals are
  available and supported. _landlock_(7) scoped signals are supported
  with ABI-6 which is Linux-6.12 and newer. `syd --check` outputs
  information about scoped signals support so the user can easily check.
- Add new utility _syd-fs_(1) to print the filesystem type of the given
  file.
- Teach _syd-ls_(1) the new set `fs` to print the list of known
  filesystem types.
- Set `TOSTOP` flag for the terminal for _syd-pty_(1) to disable
  background processes from writing to the terminal. Refer to the
  _credentials_(7), and _termios_(3) manual pages for more information.
- Fix mask calculation for _fanotify_mark_(2) on 32-bit systems.
- Grant access to the _ioctl_(2) request `PROCMAP_QUERY` for the
  `paludis` profile.
- Grant access to the _ioctl_(2) requests `TCSBRK`, `TCSBRKP`,
  `TIOCSBRK`, and `TIOCCBRK` for the `tty` profile.
- Change _ioctl_(2) deny _errno_(3) from `EACCES` to `ENOTTY` for
  compatibility.
- Add the unprivileged `PIDFD_GET_INFO` _ioctl_(2) request to the
  default allow list for
  [`allow/ioctl`](https://man.exherbo.org/syd.2.html#allow/ioctl).
- Fix an off-by-one in symlink loop detection. This bug was discovered
  by LTP tests.
- Fix a validation in _openat2_(2) handler when the size of `struct
  open_how` is invalid. This bug was discovered by LTP tests.
- Harden syscall arguments against kernel pointer misuse and add option
  [`trace/allow_unsafe_kptr`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_kptr)
  to disable the mitigation. Refer to the [`Hardening against kernel
  pointer
  misuse`](https://man.exherbo.org/syd.7.html#Hardening_against_kernel_pointer_misuse)
  section of the _syd_(7) manual page for more information.
- Harden _syd-pty_(1) and _syd-tor_(1) resource limits by setting
  `RLIMIT_LOCKS`, `RLIMIT_MEMLOCK`, and `RLIMIT_MSGQUEUE` to zero.
- Add new command [`dump`](https://man.exherbo.org/syd.2.html#dump) to
  output sandbox state in pretty formatted JSON to standard error. This
  is similar to the [`stat`](https://man.exherbo.org/syd.2.html#stat)
  command which outputs sandbox state in human readable format to
  standard error.
- Change deny _errno_(3) for unsafe filenames from `EINVAL` ("Invalid
  argument") to `EILSEQ` ("Illegal byte sequence") to match ZFS
  behaviour. Refer to the [`Enhanced Path Integrity
  Measures`](https://man.exherbo.org/syd.7.html#Enhanced_Path_Integrity_Measures)
  section of the _syd_(7) manual page for more information.
- Recognize `zfs` as a valid filesystem type name.
- Accept an unsigned 64-bit integer as input as well as a string for
  filesystem type for commands
  [`allow/fs`](https://man.exherbo.org/syd.2.html#allow/fs),
  [`warn/fs`](https://man.exherbo.org/syd.2.html#warn/fs),
  [`deny/fs`](https://man.exherbo.org/syd.2.html#deny/fs),
  [`panic/fs`](https://man.exherbo.org/syd.2.html#panic/fs),
  [`stop/fs`](https://man.exherbo.org/syd.2.html#stop/fs),
  [`abort/fs`](https://man.exherbo.org/syd.2.html#abort/fs),
  [`kill/fs`](https://man.exherbo.org/syd.2.html#kill/fs), and
  [`exit/fs`](https://man.exherbo.org/syd.2.html#exit/fs). This allows
  user to add rules for filesystem types with unrecognized names.
- Revert back to mounting _sysfs_(5) at `/sys` as read-only for the
  `immutable` profile. Previous approach to mount _tmpfs_(5) caused
  breakage with tests of the multipath-tools project.
- Fix a panic in path canonicalizer detected by the trinity syscall
  fuzzer.
- Harden Syd by setting `RLIMIT_STACK` to `2M`. This may be changed at
  compile time by editing the file `src/config.rs`.

# 3.47.0

- Avoid binding `/etc` with `nosymfollow` option for the `immutable`
  profile.  This broke `/etc/alternatives` handling.
- Remove rule
  [`trace/force_no_magiclinks:1`](https://man.exherbo.org/syd.2.html#trace/force_no_magiclinks)
  from the `user` profile.
- Harden _syd-elf_(1) by setting `RLIMIT_FSIZE`, `RLIMIT_NOFILE`, and
  `RLIMIT_NPROC` resource limits to zero to prevent file/fd/process
  creation.
- Harden _syd-tor_(1) by setting `RLIMIT_FSIZE` and `RLIMIT_NPROC`
  resource limits to zero to prevent file/process creation.
- Harden _syd-pty_(1) by setting `RLIMIT_FSIZE`, `RLIMIT_NOFILE`, and
  `RLIMIT_NPROC` resource limits to zero to prevent file/fd/process
  creation.
- Include `local` profile from `user` profile to force local networking.
- Add new profile `local` as a shorthand to force local networking.  You
  may refer to the profile shortly as just `@`. Refer to the
  [`PROFILES`](https://man.exherbo.org/syd.5.html#PROFILES) section of
  the _syd_(7) manual page for more information.
- Add new option
  [`trace/force_local_net`](https://man.exherbo.org/syd.2.html#trace/force_local_net)
  to force local networking by rewriting all addresses to loopback at
  _bind_(2), _connect_(2), _sendto_(2), _sendmsg_(2), and _sendmmsg_(2)
  boundaries.
- Rewrite IPv4 `0.0.0.0` -> `127.0.0.1` and IPv6 `::` -> `::1` at
  _bind_(2), _connect_(2), _sendto_(2), _sendmsg_(2), and _sendmmsg_(2)
  boundaries unless
  [`trace/allow_unsafe_any_addr`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_any_addr)
  is set to true.
- Protect _fchdir_(2) and _umask_(2) with system call argument cookies
  for `syd_emu` emulator threads. Refer to the [`Syscall Argument
  Cookies`](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.
- Add new command
  [`timeout`](https://man.exherbo.org/syd.2.html#timeout) to exit with
  code `124` when the given duration in human readable format is
  exceeded.
- Make options
  [`config/expand`](https://man.exherbo.org/syd.2.html#config/expand),
  [`segvguard/expiry`](https://man.exherbo.org/syd.2.html#segvguard/expiry),
  and
  [`segvguard/suspension`](https://man.exherbo.org/syd.2.html#segvguard/suspension)
  accept durations in human readable format. Refer to the documentation
  of the [`dur`](https://docs.rs/dur/latest/dur/) crate for more
  information.
- Fix a race in _fchdir_(2) handling for Chdir sandboxing.
- Fix a race in _fcntl_(2) handler for append-only paths.
- Turn `PR_SET_PTRACER` _prctl_(2) into a no-op to prevent _ptrace_(2)
  detection.
- Harden _ptrace_(2) detection prevention against intelligent detectors
  as explained
  [here](https://seblau.github.io/posts/linux-anti-debugging). Refer to
  the
  [`Enhanced Handling of PTRACE_TRACEME`](https://man.exherbo.org/syd.7.html#Enhanced_Handling_of_PTRACE_TRACEME)
  section of the _syd_(7) manual page for more information.
- Change [`log/verbose`](https://man.exherbo.org/syd.2.html#log/verbose)
  default from `0` to `1` to get _ioctl_(2) name decoding enabled by
  default. This is cheap and quite informative.
- Fix a race in parent component (`..`) handling of path canonicalizer.
  This allows a sandbox process to access denylisted files. Users are
  highly recommended to update.
- Rename command `ioctl/allow` to
  [`allow/ioctl`](https://man.exherbo.org/syd.2.html#allow/ioctl), and
  `ioctl/deny` to
  [`deny/ioctl`](https://man.exherbo.org/syd.2.html#deny/ioctl) for
  consistency with other allow/deny commands.
- Use _ioctl_(2) seccomp hook for requests only, use `lock/ioctl`
  _landlock_(7) category for filesystem access.
- Harden _mmap_(2) against FD TOCTOU.
- Improve memory use of _ioctl_ name decoding.
- Harden _tmpfs_(5) mount permissions in `immutable` profile for `/run`,
  `/tmp`, and `/dev/shm` directories by reducing mode from 1777 to 1700.
- Mask files `/sys/class/dmi/id/product_uuid`, and
  `/sys/devices/virtual/dmi/id/product_uuid` with sandbox id like
  _machine-id_(5). This mitigation may be disabled using
  [`trace/allow_unsafe_machine_id:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_machine_id).
- Add `TIOCSSERIAL` serial _ioctl_(2) to the default list of denied
  requests as part of
  [`ioctl/deny`](https://man.exherbo.org/syd.2.html#ioctl/deny). Refer
  to the _kernel_lockdown_(7) manual page for more information.
- Start _sysinfo_(2) randomized timer from zero without randomized
  offsets if
  [`unshare/time:1`](https://man.exherbo.org/syd.2.html#unshare/time) is
  set at startup. Refer to the [`Cryptographically Randomized
  Sysinfo`](https://man.exherbo.org/syd.7.html#Cryptographically_Randomized_Sysinfo)
  section of the _syd_(7) manual page for more information.
- Use the new mount API new in Linux>=5.2 to perform mounts when
  [`unshare/mount`](https://man.exherbo.org/syd.2.html#unshare/mount) is
  in effect.
- Fix message size validation at _sendto_(2), _sendmsg_(2),
  _sendmmsg_(2), _recvmsg_(2), and _recvmmsg_(2) boundaries. This bug
  was identified by the tests of the Python programming language.
- Harden `user` profile by removing the rules that grant all access to
  the directory `/run/user/${SYD_UID}`. This directory may contain files
  that may aid in sandbox breaks. [One
  example](https://s1m.fr/systemd-sandbox/) is the systemd user service
  socket.
- Harden _personality_(2) restrictions by adding `ADDR_COMPAT_LAYOUT`
  and `MMAP_PAGE_ZERO` to the kill list in addition to
  `READ_IMPLIS_EXEC` and `ADDR_NO_RANDOMIZE`. In addition, clear these
  _personality_(2) flags at startup to prevent inheritance. Refer to the
  [`Personality Syscall
  Restrictions`](https://man.exherbo.org/syd.7.html#Personality_Syscall_Restrictions)
  section of the _syd_(7) manual page for more information.
- Add new profile `fs` to allow all but special filesystems.
  This profile is included by the `linux` profile.
- Add new sandboxing category `Filesystem sandboxing` to confine file
  opens based on filesystem type.
- Enrich logs by adding sandbox ID in the `id` field.
- Harden _setsockopt_(2) system call and provide the option
  [`trace/allow_unsafe_setsockopt:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_setsockopt)
  to relax the mitigation at startup. Refer to the [`setsockopt(2)
  Hardening`](https://man.exherbo.org/syd.7.html#setsockopt%282%29_Hardening)
  section of the _syd_(7) manual page for more information.
- Override the `PWD` environment variable with canonicalized current
  working directory, and add `OLDPWD` to the list of unsafe environment
  variables. Refer to the [`Restricting environment and
  trace/allow_unsafe_env`](https://man.exherbo.org/syd.7.html#Restricting_environment_and_trace/allow_unsafe_env)
  section of the _syd_(7) manual page for more information on unsafe
  environment variables.
- Report supported architectures and whether they support _ipc_(2) and
  _socketcall_(2) multiplexers in `syd --check` output.
- Add new profile `hide`, or just `h`, to turn on Chdir, Stat and Walk
  sandboxing.
- Add new alias `t` for the `tty` profile.
- Add new alias `L` for the `linux` profile.
- Add new profile `cwd` (or `pwd`, or just `d`) to grant all access to
  the current working directory. Refer to the
  [`PROFILES`](https://man.exherbo.org/syd.5.html#PROFILES) section of
  the _syd_(5) manual page for more information.
- Set the environment variable `SYD_PWD` to canonicalized current
  working directory for use in configuration with fallback to
  `/proc/self/fdinfo` on errors. Refer to the
  [`ENVIRONMENT`](https://man.exherbo.org/syd.5.html#ENVIRONMENT)
  section of the _syd_(5) manual page for more information.
- Fix a crash during verbose logging due to use of the _fstat_(2) system
  call which is no longer permitted in Syd emulator threads. Syd
  exclusively uses the _statx_(2) system call as of version 3.46.0 with
  per-thread _seccomp_(2) filters denying other _stat_(2) system calls.
- Increase the default stack size of the `syd_mon` monitor thread from
  `128k` to `192k` to fix a stack overflow introduced with the change to
  [`hardened-malloc`](https://crates.io/crates/hardened-malloc).
- Add _move_mount_(2) system call to the `mount` system call set. This
  set is denied by default and may be allowed by including _mount_
  namespace in
  [`trace/allow_unsafe_namespace`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_namespace)
  at startup. Refer to the output of `syd-ls mount` for the list of
  syscalls in the _mount_ set.
- Teach _syd-ls_(1) the `mount` system call set.

# 3.46.0

- Move rules `allow/lock/rpath+/dev`, `allow/lock/rpath+/run`, and
  `allow/lock/rpath+/var` from the `landlock` profile to the `paludis`
  profile.
- Implement _fstat_(2) and _newfstatat_(2) on top of _statx_(2), and
  remove these system calls from the allowed set of emulator threads and
  the main thread.
- Force `AT_STATX_DONT_SYNC` flag at _statx_(2) boundary unless
  `AT_STATX_FORCE_SYNC` is explicitly set to improve efficiency
  on networked filesystems.
- Report SELinux and AppArmor status in `syd --check` output.
- Use mount options `nr_blocks=1`, and `nr_inodes=1` for masking
  _tmpfs_(5) mounts for efficiency.
- Replace read-only _sysfs_(5) mount in `immutable` profile with a
  masking _tmpfs_(5) mount to prevent information leaks.
- Provide additional information in `struct stat` for magic _syd_(2)
  calls. Refer to the [`RETURN
  VALUE`](https://man.exherbo.org/syd.2.html#RETURN_VALUE) section of
  the _syd_(2) manual page or more information.
- Add rule
  [`trace/force_no_magiclinks:1`](https://man.exherbo.org/syd.2.html#trace/force_no_magiclinks)
  to the `user` profile.
- Add new commands
  [`setenv`](https://man.exherbo.org/syd.2.html#setenv),
  [`unsetenv`](https://man.exherbo.org/syd.2.html#unsetenv), and
  [`clearenv`](https://man.exherbo.org/syd.2.html#clearenv) to interact
  with the process environment from within Syd-3 profiles.
- Generalize `/proc/$pid` -> `/proc/self` handling in access check rules.
- Harden configuration file opens not to allow parent ("..") components
  in pathname and require regular files. Refer to the
  [`SECURITY`](https://man.exherbo.org/syd.5.html#SECURITY) section of
  the _syd_(5) manual page for more information.
- Harden _landlock_(7) rules to deny magic symbolic links and parent
  ("..") components. Path is permitted to contain regular symbolic links.
  These regular symbolic symlinks are permitted to resolve to targets with
  parent ("..") components in them. Path may be relative in which case it
  is resolved relative to the directory where Syd was executed.
- Fix exit with _errno_(3) code on _landlock_(7) errors for _syd_(1) and
  _syd-lock_(1).
- Honour `RUST_BACKTRACE` environment variable when `SYD_SKIP_SCMP`
  environment variable is set. Refer to the
  [`ENVIRONMENT`](https://man.exherbo.org/syd.1.html#ENVIRONMENT)
  section of the _syd_(1) manual page for more information.
- Turn [`log/verbose`](https://man.exherbo.org/syd.2.html#log/verbose)
  from a boolean to a `u8` integer. Supported log levels are in the
  closed range of 0..=3 where the default is 1. Refer to the _syd_(2)
  manual page for more information.
- Improve memory usage for the _ioctl_(2) name decoding functionality.
- Replace [`mimalloc`](https://crates.io/crates/mimalloc) crate with the
  [`hardened-malloc`](https://crates.io/crates/mimalloc) as the global
  allocator. Refer to the [`Default Memory Allocator Security
  Enhancement`](https://man.exherbo.org/syd.7.html#Default_Memory_Allocator_Security_Enhancement)
  section of the _syd_(7) manual page for more information. Thanks
  heirecka and Antiz for testing!
- Drop support to load libraries with the `.so` suffix to run the
  function `syd_main` in them and remove the utility `syd-load`.
- Drop [`mimalloc`](https://crates.io/crates/mimalloc) crate, and revert
  back to using the default Rust allocator which is the `libc`
  allocator. We may reconsider in the future if at least one of the
  issues described in [this
  comment](https://gitlab.exherbo.org/sydbox/sydbox/-/issues/41#note_56844)
  change. Thanks heirecka and Antiz for testing!
- Handle environment variables and hex decoding for source and
  destination fields of
  [`bind`](https://man.exherbo.org/syd.2.html#bind) commands.
  Thanks unguarded for identifying the issue.

# 3.45.2

- Fix listing vDSO calls in `syd --check` output on `ppc64` and `ppc64le`.
- Print page size in `syd --check` output.
- Add rule `mask+/boot/***:/dev/null:/var/empty` to the `linux` profile.
  This acts as an extra layer because this profile provides no access to
  the `/boot` directory to begin with.
- Move _uretprobe_(2) system call from `ebpf` syscall set to the `vDSO`
  syscall set. This system call is always allowed by the Linux kernel
  with a special exception so attempting to deny it makes no sense.
  Adding it to the `vDSO` set ensures it can be called in all Syd thread
  contexts as well as from sandbox processes.
- Allow vDSO syscalls in the parent process after namespace creation.
- Allow _riscv_hwprobe_(2) system call on RISCV-64 architecture. On
  newer Linux versions this system call is in vDSO.
- Fix file-descriptor-only check at _stat_(2) boundary when _statx_(2)
  is called with the flag `AT_EMPTY_PATH` and the argument is an empty
  string. This bug was identified during testing on an i686 [`compile
  farm`](https://portal.cfarm.net/) machine.
- Upgrade [`crc`](https://crates.io/crates/crc) crate from `3.3` to
  `3.4`.

# 3.45.1

- Revert to the stable `v2` branch of the
  [`mimalloc`](https://crates.io/crates/mimalloc) from the `v3` branch,
  which behaves more reasonable under the trinity system call fuzzer.
- Fix `MSG_OOB` restriction for _recvfrom_(2) and _sendto_(2) on 32-bit.
  Refer to the [`Denying MSG_OOB Flag in send/recv System
  Calls`](https://man.exherbo.org/syd.7.html#Denying_MSG_OOB_Flag_in_send/recv_System_Calls)
  section of the _syd_(7) manual page for more information.
- Harden _xattr_(7) system call handlers to prevent overallocations.
  This bug was discovered by the trinity system call fuzzer.
- Harden _sendmsg_(2) and _sendmmsg_(2) argument validation to prevent
  overallocations. This bug was discovered by the trinity system call
  fuzzer.
- Signal the `syd_int` interrupter thread from the `syd_mon` monitor
  thread when spawning new `syd_emu` emulator threads is not possible.
  This allows `syd_int` to manually signal stuck `syd_emu` emulator
  threads and make available new resources.
- Implement exponential back off on `EAGAIN` to prevent `syd_mon` thread
  from busy looping. This bug was discovered by the trinity system call
  fuzzer.
- Increase the default cycle time of the `syd_int` interrupt thread from
  10 milliseconds to 25 milliseconds. New default matches the cycle
  timeout of the `syd_mon` monitor thread and prevents `syd_int` thread
  from busy looping in some cases. This bug was discovered by the
  trinity system call fuzzer.
- Add rule [`time/mono:0`](https://man.exherbo.org/syd.2.html#time/mono)
  to the `paludis` profile. libevent's _epoll_(7) tests fail without
  this rule in time namespace when stacked with the `immutable` profile.
  See
  [sydbox#235](https://gitlab.exherbo.org/sydbox/sydbox/-/issues/235)
  for context.
- Add new commands
  [`time/boot`](https://man.exherbo.org/syd.2.html#time/boot), and
  [`time/mono`](https://man.exherbo.org/syd.2.html#time/mono) to set
  boottime and monotonic clock offsets separately in time namespace.
  The command [`time`](https://man.exherbo.org/syd.2.html#time) remains
  as a shorthand to set both to the same offset. Environment variables
  in values are expanded and the keywords `none` and `off` may be used
  to unset a previously set offset.

# 3.45.0

- Harden private root mounts inside mount namespace with the options
  `nodev`, `noexec`, `nosuid`, `nosymfollow`, `noatime`, and `mode=700`.
- Support [`root:ramfs`](https://man.exherbo.org/syd.2.html#root), or
  shortly [`root:ram`](https://man.exherbo.org/syd.2.html#root) or just
  [`root:r`](https://man.exherbo.org/syd.2.html#root) to mount a
  _ramfs_(5) as private root directory in mount namespace. _ramfs_(5) is
  limited compared to _tmpfs_(5) and should only be preferred when the
  host Linux kernel isn't configured with the `CONFIG_TMPFS` option.
- Confine `trusted` extended attribute namespace together with the
  `security` and `user.syd` namespaces. These namespaces cannot be
  listed or tampered by the sandbox process unless the sandbox lock is
  _off_. This restriction may be lifted using the option
  [`trace/allow_unsafe_xattr:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_xattr).
- Virtualise `/dev/console` character device like the `/dev/tty` device.
  When sandbox process opens these devices, Syd returns a file
  descriptor to the controlling terminal device of the process.
- Optimize `syd_int` interrupt thread to open _proc_pid_status_(5) file
  once per-interrupt rather than once per-check.
- Make `panic` action equivalent to `deny` when the handler thread is
  the main thread. Previously it was equivalent to `exit` because panics
  in the main thread are not recoverable.
- Build release builds with `panic=unwind`. `panic=abort` builds are not
  supported because they break the restart handler of the `syd_emu`
  threads.
- Grant `lpath` and `rpath` access to the file `/proc/self/loginuid` for
  the `paludis` profile. This is necessary to pass GNUlib's
  test-getlogin test.
- Use _sendfile_(2) to copy _syd_(1) executable into a memory fd at
  startup and fall back to _read_(2)/_write_(2) on `ENOSYS` ("Function
  not implemented") _errno_(3).
- Add new option
  [`trace/force_no_magiclinks`](https://man.exherbo.org/syd.2.html#trace/force_no_magiclinks)
  to force `RESOLVE_NO_MAGICLINKS` at _open_(2) boundary.
- Add new option
  [`trace/force_no_symlinks`](https://man.exherbo.org/syd.2.html#trace/force_no_symlinks)
  to force `RESOLVE_NO_SYMLINKS` at _open_(2) boundary.
- Fix `RESOLVE_BENEATH` and `RESOLVE_IN_ROOT` resolve flags to correctly
  imply `RESOLVE_NO_MAGICLINKS` at _openat2_(2) boundary.
- Support new environment variable `SYD_FORCE_CLOEXEC` to set
  [`trace/force_cloexec:1`](https://man.exherbo.org/syd.2.html#trace/force_cloexec).
- Support new environment variable `SYD_FORCE_RO_OPEN` to set
  [`trace/force_ro_open:1`](https://man.exherbo.org/syd.2.html#trace/force_ro_open).
- Environment variable to set
  [`trace/force_no_xdev:1`](https://man.exherbo.org/syd.2.html#trace/force_no_xdev)
  has been changed from `SYD_FORCE_NOXDEV` to `SYD_FORCE_NO_XDEV`.
- Environment variable to set
  [`trace/force_rand_fd:1`](https://man.exherbo.org/syd.2.html#trace/force_rand_fd)
  has been changed from `SYD_FORCE_RANDFD` to `SYD_FORCE_RAND_FD`.
- Raise the limit of maximum symbolic links in any one path lookup from
  `16` to `40` to match the Linux kernel limit.
- Prevent file creation through dangling symbolic links at _open_(2)
  boundary by default unless
  [`trace/allow_unsafe_create`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_create)
  is specified. Refer to the [`Trusted File
  Creation`](https://man.exherbo.org/syd.7.html#Trusted_File_Creation)
  section of the _syd_(7) manual page for more information.
- Support [`root:t`](https://man.exherbo.org/syd.2.html#root),
  and [`root:tmp`](https://man.exherbo.org/syd.2.html#root) as
  shorthands for [`root:tmpfs`](https://man.exherbo.org/syd.2.html#root).
- Use _proc_pid_fdinfo_(5) instead of creating a temporary directory for
  [`root:tmpfs`](https://man.exherbo.org/syd.2.html#root).
- Add rule
  [`trace/allow_unsafe_cap_fixup:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_cap_fixup)
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_cap_fixup`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_cap_fixup)
  to opt out of hardened UID/capability transitions. Refer to
  the [`Securebits and Kernel-Assisted
  Executability`](https://man.exherbo.org/syd.7.html#Securebits_and_Kernel-Assisted_Executability)
  section of the _syd_(7) manual page for more information.
- Fix _fallocate_(2) argument validation to check for valid file
  descriptor before checking valid offset and size. This bug was
  identified by the tests of the util-linux project.
- Add rule `bind+mqueue:/dev/mqueue:nodev,nosuid,noexec,nosymfollow` to the
  `immutable` profile.
- Add rule `bind+sysfs:/sys:ro,nodev,nosuid,noexec,nosymfollow` to the
  `immutable` profile.
- Refine _proc_(5) rules for the `paludis` profile to allow _ps_(1) to
  run under the sandbox. This bug was identified by the tests of the
  Perl programming language.
- Add rules
  [`trace/allow_unsafe_stat_bdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_stat_bdev),
  and
  [`trace/allow_unsafe_stat_cdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_stat_cdev),
  to the `paludis` profile.
- Fix _stat_(2) family to return correct information on _proc_(5) magic
  symbolic links when symlinks are not followed. This bug was identified
  by the Trinity fuzzer and caused _nftw_(3) on `/proc` to loop forever.
- Verify the file descriptor returned by _posix_openpt_(3) is indeed the
  character device `/dev/ptmx` for [`PTY
  Sandboxing`](https://man.exherbo.org/syd.7.html#PTY_Sandboxing) to
  mitigate potential symlink issues with _posix_openpt_(3).
- Fix a bug with [`PTY
  Sandboxing`](https://man.exherbo.org/syd.7.html#PTY_Sandboxing) which
  caused Syd to fail at startup with the error `ELOOP` ("Too many
  symbolic links encountered") on systems where `/dev/ptmx` is a
  symbolic link to `/dev/pts/ptmx` such as Gentoo Linux.
- Fix a bug in path canonicalization that caused the path `/.` to be
  mistakenly interpreted as the current working directory rather than
  the root directory. This bug was identified by the tests of the GNU
  coreutils project.

# 3.44.2

- Add rule
  [`trace/allow_unsafe_uname:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_uname)
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_uname`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_uname)
  to disable _uname_(2) hardening. Refer to the [`Hardened
  uname(2)`](https://man.exherbo.org/syd.7.html#Hardened_uname(2))
  section of the _syd_(7) manual page for more information.
- Teach _syd-read_(1) the new `-R` option to treat directory as root
  directory when resolving paths. This option is an interface to the
  `RESOLVE_IN_ROOT` resolve flag and it conflicts with the `-B` option
  which is an interface to the `RESOLVE_BENEATH` resolve flag.
- Add support for the `RESOLVE_IN_ROOT` resolve flag for the
  _openat2_(2) system call.
- Fix _rmdir_(2) handler to correctly return `EBUSY` on the root
  directory. Previously `ENOENT` was returned incorrectly.
- Fix _unlink_(2), _unlinkat_(2), and _rmdir_(2) handlers to return
  `EISDIR` and `ENOTDIR` respectively when the path is not an expected
  directory/non-directory. This bug was identified by the nolibc tests
  of the Linux kernel.
- Return Syd masked kernel version for file
  `/proc/sys/kernel/osrelease`, similar to `/proc/version`. This bug
  was identified by the nolibc tests of the Linux kernel.
- Fix a bug in _symlink_(2) handler which caused it to incorrectly fail
  with `ENOENT` rather than `EEXIST` on existing link paths. This bug
  was identified by the nolibc tests of the Linux kernel.
- Grant `fattr`, i.e `chmod`, `chattr`, and `utime`, access to memory
  file descriptors for the `paludis` profile. `exec`, `lpath`, `rpath`,
  `wpath`, and `cpath` access were already permitted in `paludis`
  profile so this change is consistent.
- Reject unknown mode bits with `EINVAL` at _openat2_(2) boundary.
  This bug was identified by the tests of the gnulib project.
- Fix an issue with _openat2_(2) validating `struct open_how` argument.
  This bug was identified by the tests of the gnulib project.
- Fix an issue with _seccomp_(2) filters when _proc_pid_mem_(5) fallback is
  enabled using
  [`trace/memory_access`](https://man.exherbo.org/syd.2.html#trace/memory_access).
- Enable path hiding in `trace` profile which is used by _pandora_(1).
- Improve _readlinkat_(2) wrapper to do less allocations in the hot-path.

# 3.44.1

- Grant `write` access to `/dev/zero` for `landlock` profile. `read`
  and `ioctl` rights were already granted. Similarly, `linux` profile
  allows `write` access to `/dev/zero`. This bug was identified by the
  tests of the zstd project.

# 3.44.0

- Setting [`pid/max`](https://man.exherbo.org/syd.2.html#pid/max) to a
  non-zero value at startup now implies
  [`sandbox/pid:on`](https://man.exherbo.org/syd.2.html#sandbox/pid).
- Setting [`mem/max`](https://man.exherbo.org/syd.2.html#mem/max), or
  [`mem/vm_max`](https://man.exherbo.org/syd.2.html#mem/vm_max) to a
  non-zero value at startup now implies
  [`sandbox/mem:on`](https://man.exherbo.org/syd.2.html#sandbox/mem).
- Change default value of
  [`pid/max`](https://man.exherbo.org/syd.2.html#pid/max) from `1` to `0`.
- Change default value of
  [`mem/max`](https://man.exherbo.org/syd.2.html#mem/max) from `256MB` to `0`.
- Report same information on reads from `/proc/version` as returned from
  _uname_(2). Previously this file was masked by the `linux` profile and
  returned empty contents.
- Change default value of
  [`default/mem`](https://man.exherbo.org/syd.2.html#default/mem) from
  `kill` to `deny` for consistency.
- Enforce strict memory limits based on allocation granularity for [`Memory
  Sandboxing`](https://man.exherbo.org/syd.7.html#Memory_Sandboxing).

# 3.43.0

- Improve performance of
  [`sandbox/mem`](https://man.exherbo.org/syd.2.html#sandbox/mem) by
  using the
  [`/proc/pid/smaps_rollup`](https://www.kernel.org/doc/Documentation/ABI/testing/procfs-smaps_rollup)
  file to calculate memory use rather than iterating through the memory
  maps in _proc_pid_smaps_(5). Benchmarks show up to 2x speedup for
  processes with high memory use.
- Add rule `allow/lpath,rpath+/dev/pts` to the `tty` profile. This
  fixes errors with the _tty_(1) program running under the sandbox.
- Add rule `sandbox/lpath:${SYD_USER_LPATH:-on}` to the `user` profile.
  The default setting adheres to the principle of secure defaults, while
  providing the user an option to easily override with the
  `SYD_USER_LPATH` environment variable.
- Turn off
  [`sandbox/chdir`](https://man.exherbo.org/syd.2.html#sandbox/chdir),
  [`sandbox/stat`](https://man.exherbo.org/syd.2.html#sandbox/stat), and
  [`sandbox/walk`](https://man.exherbo.org/syd.2.html#sandbox/walk)
  by default as they come with a noticeable overhead.
- Do not rely on Linux kernel returning `.` (dot) and `..` (dotdot) as
  first two entries from _getdents64_(2). This is usually the case but
  there're no guarantees.
- Handle truncation correctly at _readlink_(2) boundary for the special
  links `/proc/self` and `/proc/thread-self`.
- Reject `0` as invalid size at _readlink_(2) boundary. Previously this
  resulted in a no-op.

# 3.42.0

- Allow system calls when both the respective sandboxing categories are
  off and sandbox is locked at startup.
- Add rules `sandbox/lpath:off` and `sandbox/ioctl:off` to the `paludis`
  profile. They may be toggled back on using the environment variables
  `SYD_PALUDIS_LPATH` and `SYD_PALUDIS_IOCTL`.
- Make the options
  [`sandbox/chdir`](https://man.exherbo.org/syd.2.html#sandbox/chdir),
  [`sandbox/stat`](https://man.exherbo.org/syd.2.html#sandbox/stat), and
  [`sandbox/ioctl`](https://man.exherbo.org/syd.2.html#sandbox/ioctl)
  static for performance reasons. Static options only work at startup.
  Respective system calls are allowed at seccomp-bpf level when
  sandboxing is off.
- Allow sending symlink file descriptors using `SCM_RIGHTS` control
  messages with _sendmsg_(2) and _sendmmsg_(2) system calls when
  [`trace/allow_unsafe_symlinks:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_symlinks)
  is set.
- Confine _readlink_(2) and _readlinkat_(2) system calls as part
  of Stat sandboxing.
- Raise [`pid/max`](https://man.exherbo.org/syd.2.html#pid/max) minimum
  from `301` to `512` on s390x.
- Fix a bug with destination address calculation for _statfs64_(2) and
  _fstatfs64_(2) calls on 32-bit systems.
- Confine _socketpair_(2) system call for UNIX sockets with the
  `net/bind` category using the dummy path `!unnamed`. `AF_TIPC`
  socket-pairs are only allowed with
  [`trace/allow_unsupp_socket:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsupp_socket).
- Fix address length calculation at _accept_(2) boundary. This bug
  was identified by the tests of the AnyEvent perl library.
- Support flags `IN_EXCL_UNLINK`, `IN_MASK_CREATE` and `IN_MASK_ADD`
  at _inotify_add_watch_(2) boundary.
- Support flags `MSG_DONTROUTE`, `MSG_PROXY`, `MSG_FIN`, `MSG_SYN`,
  `MSG_CONFIRM`, `MSG_RST`, `MSG_BATCH`, `MSG_SOCK_DEVMEM`,
  `MSG_ZEROCOPY`, and `MSG_FASTOPEN` at _send_(2) and _recv_(2)
  boundaries.
- Return `EACCES` for access violations at _bind_(2), _connect_(2),
  _sendto_(2), _sendmsg_(2), and _sendmmsg_(2) boundaries. Previously
  Syd returned `EADDRNOTAVAIL` for _bind_(2), `ECONNREFUSED` for
  _connect_(2), and `ENOTCONN` for the _send_(2) family. New behaviour is
  consistent with SELinux and passes PHP tests.
- Fix `SCM_CREDENTIALS` process id reporting for connectionless UNIX
  datagram sockets. This bug was identified by the tests of the PHP
  programming language.
- Fix an undefined behaviour in _recvmsg_(2) handler which caused bogus
  name pointers to be returned. This bug was identified by the tests of
  the PHP programming language.

# 3.41.7

- Fix an undefined behaviour in _recvmmsg_(2) handler which caused bogus
  control lengths to be returned. This bug was identified by the tests
  of the nix crate.

# 3.41.6

- Confine _madvise_(2) advice for Syd threads, _syd-elf_(1),
  _syd-pty_(1), and _syd-tor_(1).
- Turn denied _madvise_(2) advice into no-ops for compatibility. Refer
  to the [`madvise(2)
  Hardening`](https://man.exherbo.org/syd.7.html#madvise(2)_Hardening)
  section of the _syd_(7) manual page for more information.
- Add `TCFLSH`, `TCGETA`, `TCSETA`, `TCSETAF`, `TCSETAW`, `TCSETS`,
  `TCSETS2`, `TCSETSF`, `TCSETSF2`, `TCSETSW`, `TCSETSW2`, and `TCXONC`
  _ioctl_(2) ops to the `tty_native` profile which is included by the
  `tty` profile.
- Use `TIOCGPTPEER` _ioctl_(2) rather than _ptsname_(3) and _open_(2) to
  open PTY peer for [`PTY
  Sandboxing`](https://man.exherbo.org/syd.7.html#PTY_Sandboxing).

# 3.41.5

- Change default value of
  [`uts/version`](https://man.exherbo.org/syd.2.html#uts/version)
  from empty string to randomized version string determined at startup.
- Fix address length truncation at _accept_(2) boundary.
- Improve sandbox lock checks at _access_(2), _stat_(2) and _open_(2)
  boundaries.

# 3.41.4

- Allow IPv{4,6} addresses to be specified with the `net/sendfd` category.
- Add option
  [`trace/allow_unsafe_vmsplice`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_vmsplice)
  to allow the _vmsplice_(2) system call inside the sandbox. Refer to
  the [`Restricting vmsplice System
  Call`](https://man.exherbo.org/syd.7.html#Restricting_vmsplice_System_Call)
  section of the _syd_(7) manual page for more information.
- Fix `IP_TOS` control message handling at _sendmsg_(2) boundary.
- Fix auto _bind_(2) to UNIX abstract socket by specifying address
  length as `sizeof(sa_family_t)`. Refer to _unix_(7) for more
  information.
- Fix `SCM_CREDENTIALS` returning incorrect PID at _recvmsg_(2) boundary.
- Fix _recvmsg_(2) address handling for connection-mode sockets.

# 3.41.3

- Harden _madvise_(2) system call by permitting a safe subset of advice
  and add option
  [`trace/allow_unsafe_madvise`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_madvise)
  to relax the restriction. Refer to the
  [`madvise(2)
  Hardening`](https://man.exherbo.org/syd.7.html#madvise(2)_Hardening)
  section of the _syd_(7) manual page for more information.

# 3.41.2

- Fix _recvfrom_(2) address handling for connection-mode sockets.

# 3.41.1

- Add new utility [`syd-tui`](https://crates.io/crates/syd-tui) which is
  a terminal user interface for Syd. _syd-tui_(1) lives in the same
  repository as Syd but it's distributed as a separate crate. To install
  do `cargo install --locked syd-tui`.
- Support the `SYD_IPC` environment variable to specify a UNIX socket
  for runtime configuration, equivalent to the
  [`ipc`](https://man.exherbo.org/syd.2.html#ipc) command. The
  command has precedence over the environment variable.
- Add `-U` flag to _syd-sys_(1) to list UNIX socket inodes using _proc_net_(5).
- Add `-u` flag to _syd-sys_(1) to list UNIX socket inodes using _netlink_(7).
- Add new utility [`syd-utc`](https://man.exherbo.org/syd-utc.1.html) to
  print UTC date and time in JSON format.
- Avoid reading `/etc/localtime` during logging.
- Deny `MSG_OOB` by default for _recv_(2) family system calls. See the
  [`Denying MSG_OOB Flag in send/recv System
  Calls`](https://man.exherbo.org/syd.7.html#Denying_MSG_OOB_Flag_in_send/recv_System_Calls)
  section of the _syd_(7) manual page for more information.
- Fix _getpeername_(2) and _recvfrom_(2) reporting incorrect information
  for UNIX domain sockets.  This bug was identified by the tests of the
  package
  [`dev-python/anyio`](https://summer.exherbo.org/packages/dev-python/anyio/index.html).
- Strip invalid mode bits from mode arguments of _open_(2), _chmod_(2),
  _mkdir_(2), and _mknod_(2) family system calls rather than returning
  `EINVAL`. This matches the behaviour of the Linux kernel.
- Add rules
  [`trace/allow_unsafe_mkbdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkbdev),
  and
  [`trace/allow_unsafe_mkcdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkbdev)
  to the `paludis` profile.
- Harden _wordexp_(3) confined process _procfs_(5) mount by using
  `hidepid=4` rather than `hidepid=2`.
- Make _wordexp_(3) confined process enter into a time namespace in
  addition to user, mount, pid, network, cgroup, ipc, and uts
  namespaces. _wordexp_(3) is preferred to the
  [`shellexpand`](https://lib.rs/crates/shellexpand) crate for
  configuration expansion when a non-zero timeout in seconds is
  specified with the
  [`config/expand`](https://man.exherbo.org/syd.2.html#config/expand)
  command.
- Make _wordexp_(3) more robust for empty arguments.
- Make ELF parser free of arithmetic side effects.
- Update [`yaxpeax-arm`](https://git.iximeow.net/yaxpeax-arm/) crate
  from `0.3` to `0.4`. This crate is used by _syd-asm_(1) instruction
  decoder.

# 3.41.0

- Add rule
  [`trace/allow_unsafe_chroot:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_chroot)
  to the paludis profile.
- Add option
  [`trace/allow_unsafe_exec_interactive:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_interactive),
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_exec_script:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_script),
  to the `paludis` profile.
- Initialize securebits with kernel-assisted exec policy on Linux 6.14
  and newer and degrade to unprivileged exec checks on `EPERM`; add
  options
  [`trace/allow_unsafe_exec_script`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_script),
  and
  [`trace/allow_unsafe_exec_interactive`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_interactive)
  to disable, respectively, script/file vetting and interactive-exec
  denial. Refer to the [`Securebits and Kernel-Assisted
  Executability`](https://man.exherbo.org/syd.7.html#Securebits_and_Kernel-Assisted_Executability)
  section of the _syd_(7) manual page for more information.
- Rename option `trace/allow_unsafe_spec_exec` to
  [`trace/allow_unsafe_exec_speculative`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_speculative).
- Rename option `trace/deny_script` to
  [`trace/deny_exec_script`](https://man.exherbo.org/syd.2.html#trace/deny_exec_script).
- Rename option `trace/deny_elf_static` to
  [`trace/deny_exec_elf_static`](https://man.exherbo.org/syd.2.html#trace/deny_exec_elf_static).
- Rename option `trace/deny_elf_dynamic` to
  [`trace/deny_exec_elf_dynamic`](https://man.exherbo.org/syd.2.html#trace/deny_exec_elf_dynamic).
- Rename option `trace/deny_elf32` to
  [`trace/deny_exec_elf32`](https://man.exherbo.org/syd.2.html#trace/deny_exec_elf32).
- Rename option `trace/allow_unsafe_memory` to
  [`trace/allow_unsafe_exec_memory`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_memory).
- Rename option `trace/allow_unsafe_stack` to
  [`trace/allow_unsafe_exec_stack`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_stack).
- Rename option `trace/allow_unsafe_nopie` to
  [`trace/allow_unsafe_exec_nopie`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_nopie).
- Rename option `trace/allow_unsafe_libc` to
  [`trace/allow_unsafe_exec_libc`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_libc).
- Rename option `trace/allow_unsafe_ldso` to
  [`trace/allow_unsafe_exec_ldso`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_ldso).
- Rename option `trace/allow_unsafe_exec` to
  [`trace/allow_unsafe_exec_null`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec_null).
- Add new core utility
  [_syd-sec_(1)](https://man.exherbo.org/syd-sec.1.html), which is a CLI
  interface to the secure bits.
- Fix prevention of `MSG_OOB` flag for _send_(2) system call on 32-bit.
- Fix connection reset issues with _syd_tor_(1) by gracefully handling
  I/O errors.
- Forward the `SIGPIPE` signal to the sandbox process when _send_(2),
  _sendto_(2), _sendmsg_(2), or _sendmmsg_(2) returns `EPIPE` and the
  flag `MSG_NOSIGNAL` is not set.
- Make
  [`trace/allow_unsafe_oob`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_oob)
  a startup-only flag and restrict `MSG_OOB` at parent _seccomp_(2)
  filter such that _syd_(1) cannot use this flag even if it wants to on
  architectures without the _socketcall_(2) multiplexer.

# 3.40.1

- Fix a hang in _syd-pty_(1) when applying terminal settings.
- Limit permitted _fnctl_(2) and _prctl_(2) operations for _syd-tor_(1).
- Limit permitted _prctl_(2) operations in per-thread _seccomp_(2) filters.
- Revert back to using [`mimalloc`](https://crates.io/crates/mimalloc)
  as the default memory allocator. We set the `secure` option on which
  adds guard pages, randomized allocation, encrypted free lists, etc.
  Refer to the [`Default Memory Allocator Security
  Enhancement`](https://man.exherbo.org/syd.7.html#Default_Memory_Allocator_Security_Enhancement)
  section of the _syd_(7) manual page for more information.
- Make _prctl_(2) error setting _PR_SET_MDWE_(2const) by default not
  fatal for _syd-mdwe_(1). This allows the use of the utility with only
  _seccomp_(2) filters on older Linux kernels without support for
  Memory-Deny-Write-Execute functionality. Using the option `-m` makes
  this error fatal.
- Remove the utility `syd-err`. Use the new `-e` flag to _syd-sys_(1)
  instead.
- Add _syd-sys_(1) the `-e` CLI argument to query _errno_(3) names and
  numbers rather than ioctls, signals or syscalls.
- Protect _pipe2_(2) system call usage of AES and emulator threads with syscall
  argument cookies for added hardening. See the [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies) section
  of the _syd_(7) manual page for more information.
- Protect _pipe2_(2) system call usage of _syd-tor_(1) with syscall
  argument cookies for added hardening. See the [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.
- Protect _accept4_(2), and _shutdown_(2) system calls usage of
  _syd-tor_(1) with syscall argument cookies for added hardening. See
  the [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information. _accept4_(2)
  is also confined to a single randomized file descriptor.
- Fix path sandbox check for encrypted files. This fixes fd-based
  operations on encrypted files such as _ftruncate_(2), _fallocate_(2)
  etc.
- Improve _epoll_(7) driven forwarding for _syd-tor_(1): avoid needless
  `EPOLL_CTL_DEL` on client teardown, and re-drive reads after write
  drains to eliminate ET starvation - reducing _epoll_(7) churn and
  making backpressure handling more robust and efficient.

# 3.40.0

- Support `IP_TOS` and `IPV6_TCLASS` control messages at _sendmsg_(2)
  and _sendmmsg_(2) boundary.
- Remove `overflow-checks=true` from release profile. Now that the Syd
  codebase is mostly free of arithmetic side effects we do not need to
  pay the overhead of these checks.
- Enhance PID sandboxing on Linux>=6.14 to set the namespaced
  `kernel.pid_max` _sysctl_(8) to `max(pid/max, 301)`.
- Replace the
  [`constant_time_eq`](https://crates.io/crates/constant_time_eq) with
  the better maintained [`subtle`](https://crates.io/crates/subtle)
  crate for constant time string comparisons.
- Support the `FALLOC_FL_WRITE_ZEROES` flag to _fallocate_(2) new in
  Linux>=6.17.
- Remove the utility `syd-open`. Use the new `-o` flag to _syd-sys_(1)
  instead.
- Add _syd-sys_(1) the `-o` CLI argument to query _open_(2) flag names
  and numbers rather than ioctls, signals or syscalls.
- Add _syd-sys_(1) the `-s` CLI argument to query _signal_(7) names and
  numbers rather than ioctls or syscalls.
- Add new option
  [`uts/version`](https://man.exherbo.org/syd.2.html#uts/version) to set
  the `version` field of the `utsname` structure at _uname_(2) boundary.
  Default is the empty string to prevent information leaks.
- Add new core utility
  [_syd-uts_(1)](https://man.exherbo.org/syd-uts.1.html), which is a CLI
  interface to the _uname_(2) system call.
- Print line-oriented JSON rather than pretty-printed JSON as output of
  _syd-stat_(1) command to improve script compatibility.
- Options
  [`uts/host`](https://man.exherbo.org/syd.2.html#uts/host), and
  [`uts/domain`](https://man.exherbo.org/syd.2.html#uts/domain) are no
  longer `static`: they may be changed at runtime provided that the
  sandbox [`lock`](https://man.exherbo.org/syd.2.html#lock) allows
  access.
- Remove the system calls _oldfstat_(2), _olduname_(2), and
  _oldolduname_(2) from the `deprecated` system call set. Refer to the
  output of `syd-ls deprecated` for the list of deprecated system calls.
- Return the values of the options
  [`uts/host`](https://man.exherbo.org/syd.2.html#uts/host), and
  [`uts/domain`](https://man.exherbo.org/syd.2.html#uts/domain) at
  _uname_(2) boundary in the `nodename` and `domainname` fields of the
  `utsname` structure regardless of the value of the
  [`unshare/uts`](https://man.exherbo.org/syd.2.html#unshare/uts)
  option. Both of these options are now supported by _syd-oci_(1).
- Change default value of the option
  [`uts/domain`](https://man.exherbo.org/syd.2.html#uts/domain) from
  `syd-3` to `(none)` to adhere to the principle of secure defaults
  preventing potential information leak.
- Change default value of the option
  [`uts/name`](https://man.exherbo.org/syd.2.html#uts/domain) from
  human-readable automatic name generation to `localhost` to adhere to
  the principle of secure defaults preventing potential information
  leak.
- Rename option `name/domain` to
  [`uts/domain`](https://man.exherbo.org/syd.2.html#uts/domain).
- Rename option `name/host` to
  [`uts/host`](https://man.exherbo.org/syd.2.html#uts/host).
- Harden Syd emulator threads' _seccomp_(2) filter by protecting the
  _uname_(2) system call with [`Syscall Argument
  Cookies`](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies).
- Print list of vDSO calls in `-C`, `--check` output. Notably,
  `__vdso_getrandom` is new as of Linux>=6.11.
- Harden _uname_(2) handler to avoid leaking distribution suffixes in
  release field, such as `6.16.4+deb14-arm64` and `6.16.1-arch1-1` to
  the sandbox process. Syd only reports the major and minor version
  as-is, the micro version is randomized per-Syd run.
- Improve _uname_(2) handler to honour the major and minor versions
  specified by the `SYD_ASSUME_KERNEL` environment variable. The
  reported micro version is randomized per-Syd run to avoid information
  leaks.
- Fix `SO_PASSCRED` feature on ARM where the _netlink_(7) buffer proved
  to be too small and caused truncation. Use a 32k buffer rather than a
  4k buffer as Linux kernel documentation recommends.
- Harden the `linux` profile against boot ID information leak by masking
  the per-boot randomized `/proc/sys/kernel/random/boot_id` file with
  the per-open randomized `/proc/sys/kernel/random/uuid` file.
- Fix `last matching rule wins` semantics for
  [`mask`](https://man.exherbo.org/syd.2.html#mask) rules.
- Allow the _prctl_(2) operations `PR_TASK_PERF_EVENTS_ENABLE`, and
  `PR_TASK_PERF_EVENTS_DISABLE` inside the sandbox when the option
  [`trace/allow_unsafe_perf`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_perf)
  is set at startup.
- Add new options
  [`trace/allow_unsafe_stat_bdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_stat_bdev),
  [`trace/allow_unsafe_stat_cdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_stat_cdev),
  [`trace/allow_unsafe_notify_bdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_notify_bdev),
  and
  [`trace/allow_unsafe_notify_cdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_notify_cdev),
  to disable [`Device Sidechannel
  Mitigations`](https://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations).

# 3.39.2

- Add new option
  [`trace/allow_unsafe_deprecated`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_deprecated)
  to allow deprecated system calls inside the sandbox. Refer to the
  output of `syd-ls deprecated` for the list of deprecated system calls.
- Fix negative PID handling for _rt_sigqueueinfo_(2) and
  _rt_tgsigqueueinfo_(2) system calls. This bug was identified by LTP
  tests.
- Add new option
  [`trace/allow_unsafe_mbind`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mbind)
  to allow _mbind_(2) system call within the sandbox.
- Fix file mode on `O_TMPFILE` opens. This bug was identified by LTP
  tests.
- Fix `SO_PASSCRED` reporting incorrect process IDs at _getsockopt_(2)
  boundary. This bug was identified by LTP tests.
- Refine memory file descriptor rules for the `paludis` profile.
- Report host kernel taint flags in `-C`, `--check` output.
- Remove rule
  [`trace/allow_unsafe_chroot:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_chroot)
  from the `paludis` profile.
- Ignore `SIGPIPE` in _syd_(1) and _syd-oci_(1) so that forwarding the
  `EPIPE` _errno_(3) works for network calls. This bug was identified by
  LTP tests.
- Do not return `EINVAL` for `SIGRTMAX` in _sigaction_(2) handler.
  This bug was identified by LTP tests.
- Allow `lpath`, `rpath`, `wpath`, and `ioctl` access to pidfds under
  `/proc/self/fd` for the `linux` profile. This allows the use of the
  new _ioctl_(2) request `PIDFD_GET_INFO`.
- Allow _ioctl_(2) access to _proc_pid_maps_(5) file for the `paludis`
  profile to allow usage of the new `PROCMAP_QUERY` _ioctl_(2) request.
- Add _ioctl_(2) requests `RNDADDTOENTCNT`, `RNDGETPOOL`,
  `RNDADDENTROPY`, `RNDZAPENTCNT`, and `RNDCLEARPOOL` to the
  [`ioctl/deny`](https://man.exherbo.org/syd.2.html#ioctl/deny) list.
- Add _ioctl_(2) request `RNDGETENTCNT` to
  [`ioctl/allow`](https://man.exherbo.org/syd.2.html#ioctl/allow) list.
- Allow _ioctl_(2) access to the character devices `/dev/random` and
  `/dev/urandom` for the `linux` profile. This is consistent with the
  `landlock` profile which allows this type of access already.

# 3.39.1

- Add rule
  [`trace/allow_unsafe_keyring:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_keyring)
  to the `paludis` profile. LTP tests for _add_key_(2).
- Add rule `ioctl/deny-FIGETBSZ` to the `paludis` profile. This
  _ioctl_(2) request is used by LTP tests.
- Improve the _ioctl_(2) handler to do a stat check on paths regardless
  of whether _ioctl_(2) request was allowed or denied. Add a check for
  `O_PATH` fds as well.
- Allow read and lookup access to files `/proc/self/pagemap` and
  `/proc/self/smaps` for the `paludis` profile.
- Validate flags argument of _linkat_(2).
- Validate flags argument of _utimensat_(2).
- Validate flags arguments of _statx_(2) and _newfstatat_(2).
- Fix `fattr` alias to correctly stand for the union of categories
  `chmod`, `chattr`, and `utime`. `chmod` was incorrectly marked as
  `chown` in previous versions.

# 3.39.0

- Add rule
  [`trace/allow_unsafe_proc_files:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_proc_files)
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_proc_files`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_proc_files)
  to disable passing `subset=pid` option to _procfs_(5) mount.
- Mount private _procfs_(5) with the option `subset=pid` when
  [`unshare/pid`](https://man.exherbo.org/syd.2.html#unshare/pid) is set
  to true at startup. This provides additional hardening with the option
  `hidepid=4` which has been in use as of version 3.37.2.
- Harden _syd-tor_(1) _seccomp_(2) filter by protecting the _socket_(2),
  and _connect_(2) system calls with [`Syscall Argument
  Cookies`](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies).
- Harden Syd emulator threads' _seccomp_(2) filter by protecting the
  _bind_(2), _accept4_(2) and _connect_(2) system calls with [`Syscall
  Argument
  Cookies`](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies).
- Harden Syd AES thread _seccomp_(2) filter by removing the right to the
  _connect_(2) system call which is not required.
- Harden Syd emulator threads' _seccomp_(2) filter by denying _clone_(2)
  with namespace flags. In addition _clone3_(2) is now unconditionally
  denied with ENOSYS ("Function not implemented") _errno_(3) for
  compatibility to prevent the struct-pointer `CLONE_NEW*` flag bypass.
- Harden Syd AES thread _seccomp_(2) filter by denying _clone_(2) with
  namespace flags. In addition _clone3_(2) is now unconditionally denied
  with ENOSYS ("Function not implemented") _errno_(3) for compatibility
  to prevent the struct-pointer `CLONE_NEW*` flag bypass.
- Add new [`lock`](https://man.exherbo.org/syd.2.html#lock) mode `read`
  to provide a read-only view of the sandbox policy to the sandbox
  process. This mode allows the sandbox process access to the read-only
  _open_(2) part of the _syd_(2) virtual system call API but edits using
  the _stat_(2) interface are not permitted. In this mode the sandbox
  policy is sealed using _mseal_(2) all the same like the `on` mode and
  entering this mode is similarly one-way and idempotent. Curious users
  are referred to the [CTF shell](https://ctftime.org/event/2178) where
  this mode is enabled for wider testing.
- Protect _accept4_(2), _ftruncate_(2) and _ftruncate64_(2) system call
  usage of Syd AES threads with syscall argument cookies for added
  hardening. See the [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.
- Teach [_syd-key_(1)](https://man.exherbo.org/syd-key.1.html) the `-P`
  CLI option to read a passphrase from _stdin_(3). The passphrase is
  hashed using SHA3-256 to produce a 256-bit AES-CTR encryption key and
  a 256-bit HMAC-SHA256 authentication key and saved directly to
  _keyrings_(7) with the key serial ID returned as output on standard
  output.
- Teach [_syd-key_(1)](https://man.exherbo.org/syd-key.1.html) the `-p`
  CLI option to read a passphrase from TTY (NOT standard input). The
  passphrase is hashed using SHA3-256 to produce a 256-bit AES-CTR
  encryption key and a 256-bit HMAC-SHA256 authentication key and saved
  directly to _keyrings_(7) with the key serial ID returned as output on
  standard output.
- Drop [`hkdf`](https://crates.io/crates/hkdf) crate from dependencies
  which is no longer needed as there's no key-derivation in userspace
  for [`Crypt
  sandboxing`](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing).
- Add new options
  [`crypt/key/enc`](https://man.exherbo.org/syd.2.html#crypt/key/enc),
  and
  [`crypt/key/mac`](https://man.exherbo.org/syd.2.html#crypt/key/mac) to
  set _keyrings_(7) ID for 256-bit AES-CTR encryption key, and 256-bit
  HMAC-SHA256 authentication key respectively. The option
  [`crypt/key`](https://man.exherbo.org/syd.2.html#crypt/key) which used
  to accept raw key material has been repurposed to be a short-hand for
  these two new options to set the same key serial ID for both. This
  provides practical safe key management using the _keyrings_(7) API
  without involving the userspace with key-derivation like we did
  before.
- Remove obsolete options `crypt/kdf/salt`, `crypt/kfd/info/enc`,
  `crypt/kfd/info/mac`.
- Replace raw key usage for [`Crypt
  sandboxing`](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing) with
  _keyrings_(7) interface. **Older Syd must be used to decrypt files
  previously encrypted using unsafe raw key material because key
  derivation using HKDF at userspace has been completely removed in the
  new version. This breaking change pertains only key management, file
  format has not changed.**
- Harden proc(5) file opens with the _openat_(2) resolve flag
  `RESOLVE_NO_XDEV`. The resolve flags `RESOLVE_BENEATH`,
  `RESOLVE_NO_MAGICLINKS`, and `RESOLVE_NO_SYMLINKS` were already
  applied. `RESOLVE_NO_XDEV` provides additional defense in depth.
- Add new core utility
  [_syd-pause_(1)](https://man.exherbo.org/syd-pause.1.html), which is a
  drop-in replacement for the
  [_s6-pause_(1)](https://skarnet.org/software/s6/s6-pause.html)
  program.
- Add new core utility
  [_syd-ofd_(1)](https://man.exherbo.org/syd-ofd.1.html), which is a
  drop-in replacement for the
  [_s6-setlock_(1)](https://skarnet.org/software/s6/s6-setlock.html)
  program using OFD locks, aka "open-file-description locks" or
  "file-private locks", new in POSIX 2024.
- Add new CLI option `-C`, `--check` to print sandboxing support
  information about the current system. Previously this information was
  available with the `-V`, `--version` option.
- Support the `-v`, `--verbose` CLI options which are equivalent to
  setting the option
  [`log/verbose:1`](https://man.exherbo.org/syd.2.html#log/verbose).
- Add `TZ` variable to the list of unsafe environment variables to avoid
  leaking timezone settings to the sandbox process. Refer to the
  [`Restricting environment and
  trace/allow_unsafe_env`](https://man.exherbo.org/syd.7.html#Restricting_environment_and_trace/allow_unsafe_env)
  section of the _syd_(7) manual page for more information.
- Add rule
  `mask+/usr/share/zoneinfo/**:/usr/share/zoneinfo/UTC:/var/empty` to
  the `linux` profile to prevent leaking the timezone to the sandbox
  process.
- Add rule `mask+/etc/localtime:/usr/share/zoneinfo/UTC` to the `linux`
  profile to prevent leaking the timezone to the sandbox process.
- Add `LANG` and all `LC_*` _locale_(7) variables to the list of unsafe
  environment variables to avoid leaking locale settings to the sandbox
  process. Refer to the [`Restricting environment and
  trace/allow_unsafe_env`](https://man.exherbo.org/syd.7.html#Restricting_environment_and_trace/allow_unsafe_env)
  section of the _syd_(7) manual page for more information.
- Add rule
  [`trace/allow_unsafe_machine_id`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_machine_id)
  to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_machine_id`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_machine_id)
  to disable _machine-id_(5) mitigations.
- Substitute _machine-id_(5) file and the `/etc/hostid` and
  `/var/adm/hostid` files which are part of the _gethostid_(5) interface
  of POSIX.1-2008 with a per-Syd instance random identifier generated at
  startup. User may override the random identifier with the `SYD_ID`
  environment variable. Refer to the ENVIRONMENT section of the _syd_(1)
  manual page for more information.
- Rename the option `trace/allow_unsafe_proc_status` to
  [`trace/allow_unsafe_proc_pid_status`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_proc_pid_status).
- Add environment variable `SYD_FORCE_NOXDEV` which is equivalent to
  setting
  [`trace/force_no_xdev:1`](https://man.exherbo.org/syd.2.html#trace/force_no_xdev).
  This is meant as a convenience to ease testing.
- Add new option
  [`trace/force_no_xdev`](https://man.exherbo.org/syd.2.html#trace/force_no_xdev)
  to force the resolve flag `RESOLVE_NO_XDEV` at _open_(2) boundary.
- The option `trace/allow_unsafe_kfd` has been renamed to
  [`trace/allow_unsafe_open_kfd`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_open_kfd).
- Add the new category set `lock/bnet` which is a shorthand for `lock/bind`.
- Add the new category set `lock/cnet` which is a shorthand for `lock/connect`.
- Add the new category set `bnet` which is a shorthand for `net/bind`.
- Add the new category set `cnet` which is a shorthand for `net/connect`.
- Add the new category set `snet` which is a shorthand for `net/sendfd`.
- Add the new category set `lpath` which is a union of `walk`, `stat`,
  `chdir`. The name `lpath` is chosen to stand for `lookup-only path`.
  The naming is consistent with the `CAP_LOOKUP` capsicum right of
  FreeBSD.
- Remove the categories `stat`, `chdir` from the `rpath` category set.
  This category set is now the union of `read`, `readdir` in consistence
  with the `lock/rpath` alias which is a union of `lock/read` and
  `lock/readdir`.
- The _pivot_root_(2) system call is now denied with `EPERM` _errno_(3)
  unless the new option
  [`trace/allow_unsafe_pivot_root:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_pivot_root)
  is set at startup to turn it into a no-op. This is done to adhere to
  the principle of secure defaults because the previous default of
  turning it into a no-op can be dangerous when the caller is not aware
  of the restriction.
- Entering [`ghost`](https://man.exherbo.org/syd.2.html#ghost)
  successfully no longer returns `EOWNERDEAD` to the virtual _stat_(2)
  caller. This implementation detail is now hidden from the API and this
  command returns success on successful initiation.
- Split `stat` category into `walk` and `stat`. `walk` category is only
  used during path canonicalization for path traversals. Like the `stat`
  category, `walk` access violations are logged with `notice` level.
- Switch from [`serde`](https://crates.io/crates/serde) crate to
  [`serde_core`](https://crates.io/crates/serde-core) crate to
  reduce compile times.
- Fix a validation bug in _socket_(2) handler for raw _netlink_(7) sockets.
- Rewrite _proc_pid_status_(5) masker to be more robust, fixing tests on
  systems with mitigations fully disabled.
- Exit with `ENODATA` if
  [`trace/allow_safe_setuid`](https://man.exherbo.org/syd.2.html#trace/allow_safe_setuid)
  is set to true at startup but no UID transits with the command
  [`setuid`](https://man.exherbo.org/syd.2.html#setuid) was defined for the
  current user.
  Similarly exit with `ENODATA` if
  [`trace/allow_safe_setgid`](https://man.exherbo.org/syd.2.html#trace/allow_safe_setuid)
  is set to true at startup but no GID transits with the command
  [`setgid`](https://man.exherbo.org/syd.2.html#setgid) was defined for the
  current group.
- The option
  [`trace/allow_safe_setuid`](https://man.exherbo.org/syd.2.html#trace/allow_safe_setuid)
  is now implied at startup if any UID transits with the command
  [`setuid`](https://man.exherbo.org/syd.2.html#setuid) was defined.
  Similarly the option
  [`trace/allow_safe_setgid`](https://man.exherbo.org/syd.2.html#trace/allow_safe_setgid)
  is now implied at startup if any GID transition with the command
  [`setgid`](https://man.exherbo.org/syd.2.html#setgid) was defined.
- Make the `FS_IOC_SETFLAGS` _ioctl_(2) rules in `paludis` profile
  arch-portable using exclamation mark as suffix. This _ioctl_(2)
  request doesn't exist on i686, x32 etc.
- The _ioctl_(2) names given as argument to the commands
  [`ioctl/allow`](https://man.exherbo.org/syd.2.html#ioctl/allow),
  and
  [`ioctl/deny`](https://man.exherbo.org/syd.2.html#ioctl/deny)
  may now be suffixed with an optional exclamation mark to denote
  _syd_(1) should not return `EINVAL`, i.e. `Invalid argument` in
  case the _ioctl_(2) name is not defined for any of the current
  supported architectures. This allows for writing rules generic
  across multiple incompatible architectures.
- Auto-update _ioctl_(2) name maps from `strace-6.16.0.24.2c52`.
- Bump [`clap`](https://crates.io/crates/clap) crate from `4.4` to
  `4.5`. This crate is a dependency of _syd-oci_(1).
- Bump [`indexmap`](https://crates.io/crates/indexmap) from `2.10` to
  `2.11` which is now possible thanks to the MSRV bump.
- Bump [`parse-size`](https://crates.io/crates/parse-size) from version
  `1.0` to `1.1` which is now possible thanks to the MSRV bump.
- Drop [`once_cell`](https://crates.io/crates/once_cell) crate
  dependency which is now possible thanks to the MSRV bump.
- Bump MSRV (Minimal Supported Rust Version) from `1.73` to `1.83`.
  Note, we already use features required by this version and the MSRV is
  determined automatically by
  [`cargo-msrv`](https://crates.io/crates/cargo-msrv), therefore it is
  likely users need this version for older Syd versions.

# 3.38.5

- Upgrade `procfs` and `procfs-core` crates from `0.17` to `0.18`.
  _syd_(1) uses `procfs-core` crate only, whereas `procfs` is a
  dependency of _syd-oci_(1).
- Panic the main thread if attaching to the sandbox process with the
  _ptrace_(2) request `PTRACE_SEIZE` fails, rather than leaving the
  sandbox process in a hanging state.
- Allow specifying special paths with the `!` prefix as argument to
  [`append`](https://man.exherbo.org/syd.2.html#append),
  [`crypt`](https://man.exherbo.org/syd.2.html#crypt), and
  [`mask`](https://man.exherbo.org/syd.2.html#mask) commands. This
  allows, e.g., marking memory file descriptors as append-only with
  `append+!memfd:*`.
- Drop the capabilities `CAP_CHOWN`, `CAP_MKNOD`,
  `CAP_NET_BIND_SERVICE`, and `CAP_NET_RAW` from inheritable set to
  ensure only syd-emulator threads can ever run the privileged
  _chown_(2), _mknod_(2), _bind_(2), and _socket_(2) calls. The
  functionality of the options
  [`trace/allow_unsafe_chown`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_chown),
  [`trace/allow_unsafe_mkbdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkbdev),
  [`trace/allow_unsafe_mkcdev`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkcdev),
  [`trace/allow_unsafe_bind`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_bind),
  and
  [`trace/allow_unsafe_socket`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_socket)
  is not affected with this change which makes it a notable hardening.
- Make SROP detection audit logs honour
  [`log/verbose`](https://man.exherbo.org/syd.2.html#log/verbose) which
  is primarily intended for malware analysis.

# 3.38.4

- Fix network system call handlers to return `EINVAL` _errno_(3) rather
  than `EOPNOTSUPP` when the family is invalid rather than not
  supported. This depends on a hard-coded max-family constant which is
  subject to change regularly.
- Fix _bind_(2) handler to correctly return the _errno_(3) `EADDRINUSE`
  when the UNIX socket already exists. Previously this handler
  incorrectly returned `ENOTDIR` in this case.
- Fix an issue with access violation reporting of _open_(2) handlers
  which caused the handler to silently deny access violations when
  multiple sandbox categories matched and only one of the categories was
  denied access.

# 3.38.3

- Configuring encryption using either one of the options
  [`crypt/key`](https://man.exherbo.org/syd.2.html#crypt/key),
  [`crypt/tmp`](https://man.exherbo.org/syd.2.html#crypt/tmp),
  [`crypt/kdf/salt`](https://man.exherbo.org/syd.2.html#crypt/kdf/salt)
  now implies
  [`sandbox/crypt:on`](https://man.exherbo.org/syd.2.html#sandbox/crypt).
  Similarly configuring files to be encrypted using the
  [`crypt`](https://man.exherbo.org/syd.2.html#crypt) now implies
  [`sandbox/crypt:on`](https://man.exherbo.org/syd.2.html#sandbox/crypt).
  This avoids the surprising case where a user supplies a key/acl but
  forgets to turn Crypt sandboxing on in which case the files marked
  for encryption would silently be written unencrypted.
- _syd-path_(1) now omits action in output unless `-k` or `-w` is given
  for actions `kill` and `warn` respectively.
- Log terminal path of the sandbox process under `tty` key on access
  violations.
- Add new option
  [`trace/allow_unsafe_ldso`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ldso)
  to allow _ld.so_(8) exec-indirecton. Previously the
  [`trace/allow_unsafe_exec`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec)
  action implied this. Unlike
  [`trace/allow_unsafe_exec`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec),
  [`trace/allow_unsafe_ldso`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ldso)
  may be changed after startup before the sandbox is locked.
- The installation of the _syd-sh_(1) utility is now gated behind its
  own `sh` feature rather than the `utils` feature. This feature
  defaults to on.
- Fix handling of _mmap_(2) rules where `MAP_SHARED==0` was broadly
  allowed. This bug caused `MAP_PRIVATE|PROT_EXEC` mappings (e.g.
  dynamic libraries) to bypass the Force/exec check, but only when
  [`append`](https://man.exherbo.org/syd.2.html#append)-only paths or
  [`Crypt
  sandboxing`](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing) were
  in use. Removing the overly broad allow ensures such mappings are now
  correctly verified, without introducing false positives on non-exec
  shared mappings. This bug was introduced in version 3.38.0 in an
  attempt to fix another bug. Integration tests were added to ensure
  neither bug resurfaces.
- Remove the unused _writev_(2) system call from the allow list of the
  _syd-elf_(1) utility.
- Remove the unused _writev_(2) system call from the allow list of main
  thread and emulator threads.
- Refine _write_(2) filters that confine logging.
- Fix a bug in _sigreturn_(2) and _rt_sigreturn_(2) handlers that caused
  a process to be prematurely terminated due to a failed _procfs_(5)
  _read_(1) even if no SROP was detected. Notably, this fixes graceful
  _nginx_(1) restarts under _syd_(1).
- Build release builds with `panic=abort` rather than `unwind`. Due to
  the confined nature of _syd_(1) threads we can not use the default
  panic handlers and stack unwinding is out of reach and compiling this
  feature out saves space. However, the panic handler installed by
  _syd_(1) displays file and line information which is usually adequate
  to understand the reason of the panic. Note that, we try hard to keep
  the _syd_(1) code panic-free, each explicit panic _must_ be explicitly
  allowed with a clippy lint and documented.
- Document
  [`trace/allow_unsafe_sigreturn`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_sigreturn)
  option in _syd_(2) manual page. Refer to the [`Mitigation against
  Sigreturn Oriented Programming
  (SROP)`](https://man.exherbo.org/syd.7.html#Mitigation_against_Sigreturn_Oriented_Programming_(SROP))
  section of the _syd_(7) manual page for more information about SROP
  mitigations.
- Add information about [ASLR](https://en.wikipedia.org/wiki/ASLR)
  status to version output using _proc_sys_kernel_(5) interface.

# 3.38.2

- Add `FIONREAD` _ioctl_(2) request to the default list of
  [`ioctl/allow`](https://man.exherbo.org/syd.2.html#ioctl/allow).
  This is consistent with _landlock_(7) which always allows this
  request.

# 3.38.1

- Add rule `allow/rpath+/var/db` to the `paludis` profile.
- Add new category set `all-x` which stands for all categories except
  `exec`. This set is intended to be used by the `esandbox` helper of
  _paludis_(1). See the
  [`SETS`](https://man.exherbo.org/syd.2.html#SETS) section of the
  _syd_(2) manual page for more information.

# 3.38.0

- The installation of the _syd-asm_(1) utility is now gated behind its
  own `asm` feature rather than the `utils` feature. This feature
  defaults to on.
- Add rule
  [`sandbox/pty:off`](https://man.exherbo.org/syd.2.html#sandbox/pty) to
  the `firefox` profile.
- Bind logging of process name changes to the
  [`log/verbose`](https://man.exherbo.org/syd.2.html#log/verbose)
  option. The special rule `filter/read+!proc/name` to silence process
  name changes is no longer supported. Verbose mode is intended for
  malware analysis and it defaults to off.
- The rule
  [`trace/allow_unsafe_filename:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_filename)
  has been removed from the builtin _firefox_(1) profile. See the
  [`PROFILES`](https://man.exherbo.org/syd.5.html#PROFILES) section of
  the _syd_(5) manual page for more information.
- Remove the characters `{` and `}` from the set of unsafe characters
  which are not permitted in filenames because _firefox_(1) uses these
  characters in filenames under the profile directory. See the section
  [`Enhanced Path Integrity Measures`] of the _syd_(7) manual page for
  more information.
- Remove the character `:` from the set of unsafe characters which are
  not permitted in filenames because the usage of this character is
  common across devfs and procfs. See the section [`Enhanced Path
  Integrity Measures`] of the _syd_(7) manual page for more information.
- Add OpenBSD _pledge_(2) like category sets for sandboxing categories.
  See the [`SETS`](https://man.exherbo.org/syd.2.html#SETS) section of
  the _syd_(2) manual page for more information.
- The keyword `all` can now be specified to
  [`allow/net/link`](https://man.exherbo.org/syd.2.html#allow/net/link)
  to allow all known _netlink_(7) families.
- Prevent unhiding paths by passing-through them during path resolution.
- Fix handling of _proc_pid_ns_(5) magic symlinks in path canonicalizer.
- Exit with `EBADF` if `SYD_LOG_FD` environment variable is a positive
  number but an invalid FD. Negative values are permitted as a shorthand
  to disable logging.
- Add rule
  [`trace/force_rand_fd:1`](https://man.exherbo.org/syd.2.html#trace/force_rand_fd)
  to the `user` profile to force randomized file descriptors. This
  feature makes use of _kcmp_(2) system call and requires `CONFIG_KCMP`
  option to be enabled for the host Linux kernel. See [`Force Randomized
  File
  Descriptors`](https://man.exherbo.org/syd.7.html#Force_Randomized_File_Descriptors)
  section of the _syd_(7) manual page for more information.
- Add rule
  [`trace/allow_unsafe_proc_status:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_proc_status)
  to the `paludis` profile.
- Teach _syd-lock_(1) the `-E errata` flag to query/list _landlock_(7)
  erratas which is new in _landlock_(7) ABI 7 supported by Linux>=6.15.
- Provide hardening for _proc_pid_status_(5) by masking
  security-sensitive fields such as `TracerPid` and `Seccomp`. This
  hardening may be disabled with the option
  [`trace/allow_unsafe_proc_status:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_proc_status).
  See the [Hardened
  proc\_pid\_status(5)](https://man.exherbo.org/syd.7.html#Hardened_proc_pid_status(5))
  section of the _syd_(7) manual page for more information.
- Rename the option `trace/allow_unsafe_open_cdev` to
  [`trace/allow_unsafe_kfd`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_kfd)
  and verify `/dev/kfd` metadata prior to continue. This is a specific
  workaround for AMD GPUs, therefore reducing the scope of the unsafe
  option to cover only this type of character devices provides some
  hardening.
- Add `lock/mkbdev` category to confine block device creation using
  _landlock_(7). Rename `lock/mkdev` category which confines character
  device creation to `lock/mkcdev`. These categories are also available
  using the _syd-lock_(1) utility.
- Add `mkbdev` category to confine block device creation. Rename
  `mkdev` category which confines character device creation to `mkcdev`.
  To use these categories for path-based access check on devices, the
  user must opt-in using
  [`trace/allow_unsafe_mkbdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkbdev),
  or
  [`trace/allow_unsafe_mkcdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkcdev)
  at startup.
- Refine device restrictions. Install a seccomp-bpf filter at startup to
  terminate processes which attempt to create a block or character
  device with _mknod_(2). Include the Syd process into the filter to
  ensure a compromised Syd process can't create devices either.
  Restrictions for block devices may be lifted using
  [`trace/allow_unsafe_mkbdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkbdev)
  at startup. Restrictions for character devices may be lifted using
  [`trace/allow_unsafe_mkcdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mkcdev)
  at startup.
- _syd-lock_(1) learned the `-S` argument to enable scoped signals, and
  the `-U` argument to enable scoped UNIX abstract sockets. Previously
  both scopes were enabled by default.
- _syd-lock_(1) utility learned the `-F flag` argument to specify flags
  for _landlock_restrict_self_(2) which are new in _landlock_(7) ABI 7.
  Use `-F list` to print a list of flags.
- Add boolean options
  [`log/lock/same_exec_off`](https://man.exherbo.org/syd.2.html#log/lock/same_exec_off),
  [`log/lock/new_exec_on`](https://man.exherbo.org/syd.2.html#log/lock/new_exec_on),
  and
  [`log/lock/subdomains_off`](https://man.exherbo.org/syd.2.html#log/lock/subdomains_off)
  to configure _landlock_(7) audit logging. These options are off by
  default and setting them is a NO-OP on systems where _landlock_(7) ABI
  7 is unsupported.
- Add support for _landlock_(7) ABI which is new in [Linux
  6.15](https://git.kernel.org/stable/c/72885116069abdd05c245707c3989fc605632970).
- Add `MUSL_LOCPATH` to the list of unsafe environment variables. musl
  libc ignores this environment variable in secure-execution mode. The
  `LOCPATH` environment variable was already listed as unsafe. Run
  `syd-ls env` to see a list of unsafe environment variables.
- Improve the [Enforcing AT\_SECURE and UID/GID
  Verification](https://man.exherbo.org/syd.7.html#Enforcing_AT_SECURE_and_UID/GID_Verification)
  section of the _syd_(7) manual page with a list of implications of
  the secure-execution mode.
- When
  [`trace/allow_unsafe_memfd:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_memfd)
  is set, do an additional access check for `exec` rights in addition to
  `create` at _memfd_create_(2) boundary so the user can easily confine
  executable memory file descriptors based on their names. Note, though,
  filtering on name is unsafe and should be used with care unlike the
  `!memfd:` and `!memfd-hugetlb:` prefixes which can not be altered by
  the sandbox process so the only safe use of name matching is done with
  a catch-all glob `**`, e.g. `allow/create,exec,truncate+!memfd:**`
  which is a rule used in the `paludis` profile where we allow
  executable memory file descriptors.
- Fix matching of hugetlb memory file descriptors with the
  `!memfd-hugetlb:` prefix for system calls other than
  _memfd_create_(2), e.g. _ftruncate_(2) which is used to allocate
  space.
- Change memory file descriptor name prefix used in pattern matching for
  access checks from `/memfd:` and `/memfd-hugetlb:` to `!memfd:` and
  `!memfd-hugetlb:` to indicate their special nature and prevent the
  user from allowing them using a catch-all rule like `allow/exec+/***`.
  This allows easy filtering of memory file descriptors, e.g.
  `allow/create+!memfd:**`, or `deny/truncate+!memfd-hugetlb:**`.
- Change default value of
  [`log/verbose`](https://man.exherbo.org/syd.2.html#log/verbose) to
  false. Verbose logging is primarily intended for malware analysis and
  should be turned on as necessary.
- Port to `x32` architecture.
- _syd-sys_(1) learned the `-i` argument to query _ioctl_(2) requests by
  name or number per-architecture.
- Fix _sysinfo_(2) handler on 32-bit architectures.
- Ports are now stored as a fixed bit set for _landlock_(7) network
  rules when using
  [`allow/lock/bind`](https://man.exherbo.org/syd.2.html#allow/lock/bind),
  and
  [`allow/lock/connect`](https://man.exherbo.org/syd.2.html#allow/lock/connect)
  enabling range additions and precise port removals with predictable
  behavior.
- Prevent shared memory mappings for append-only writable file
  descriptors when append-only feature is active. This feature is
  activated by either setting
  [`append`](https://man.exherbo.org/syd.2.html#append) paths or
  activating [Crypt
  Sandboxing](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing) This
  prevents an attacker from utilizing the _mmap_(2) system call to
  bypass append-only guarantees provided by the sandbox and has the same
  implications as the previous change log entry. Integration tests were
  added to ensure the problem does not resurface.
- Add a _seccomp_(2) filter to deny _pwritev2_(2) system call using the
  `RWF_NOAPPEND` flag which is new in Linux-6.9 with the `EOPNOTSUPP`
  _errno_(3) unless sandbox is locked at startup without any
  [`append`](https://man.exherbo.org/syd.2.html#append) clauses and
  without [Crypt
  Sandboxing](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing)
  setup. This prevents an attacker from utilizing this system call to
  bypass append-only guarantees provided by the sandbox. Users of the
  [`append`](https://man.exherbo.org/syd.2.html#append) feature are
  recommended to upgrade. Users of [Crypt
  Sandboxing](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing) are
  **strongly** recommended to upgrade because this vector can be used to
  corrupt encrypted files by first opening them as append-only and then
  writing to an arbitrary file offset using the _pwritev2_(2) system
  call thereby confusing the `syd_aes` thread to decide to mistakenly
  perform last block re-encryption where a full re-encryption is
  required. Integration tests were added to ensure the problem does not
  resurface. The filter is portable and designed to work when sandboxing
  `x32` binaries as well, where the flag is the 5th argument rather than
  the 6th like other architectures.
- Harden _personality_(2) system call filter to kill process upon uses
  of the unsafe flags `READ_IMPLIES_EXEC` and `ADDR_NO_RANDOMIZE`.
  Previously unsafe flags were denied with the `ENOSYS` _errno_(3).
  This hardening helps with the early notification of potentially
  malicious activity through the system audit log.
- _syd-mdwe_(1) has been promoted to a core utility and installed
  without the `utils` feature. This utility is especially useful in
  combination with the _syd-lock_(1) utility to build lightweight
  sandboxes.
- Deny `READ_IMPLIES_EXEC` and `ADDR_NO_RANDOMIZE` flags of the
  _personality_(2) system call for the _seccomp_(2) W^X filters applied
  by _syd-mdwe_(1) and _syd-load_(1) utilities. This hardens executable
  memory guarantees and is consistent with what _syd_(1) applies by
  default.
- Move _landlock_(7) access rights `lock/bind`, `lock/exec`,
  `lock/mkfifo`, and `lock/symlink` for the public directories
  `/dev/shm`, `/tmp`, and `/var/tmp` from the `landlock` profile to the
  `paludis` profile to adhere with safe defaults.
- Teach _syd-lock_(7) the new _landlock_(7) category sets. See
  [`SETS`](https://man.exherbo.org/syd-lock.1.html#SETS) section of the
  _syd-lock_(1) manual page for more information.
- Support category sets in _landlock_(7) rules.
- Remove `rdset`, `wrset` sets and define new OpenBSD _pledge_(2) like sets
  to streamline sandbox profile composition. See the
  [`SETS`](https://man.exherbo.org/syd.2.html#SETS) section of the _syd_(2)
  manual page for more information.
- Grant access to the directory `/proc/sys/net` for the `paludis`
  profile.
- Add support for _ioctl_(2) commands in for vim syntax file.
- Add support for _ioctl_(2) name to request conversion. The commands
  [`ioctl/deny`](https://man.exherbo.org/syd.2.html#ioctl/deny), and
  [`ioctl/allow`](https://man.exherbo.org/syd.2.html#ioctl/allow) now
  accept a comma-delimited list of _ioctl_(2) request names as argument.
  The old way of passing requests as number is still supported but it is
  strongly discouraged because request numbers may vary across
  architectures which is transparently handled when the request is
  passed as a name.
- Grant read access to files `/proc/self/cgroup` and
  `/proc/self/mountinfo` for the `paludis` profile.
- Harden the per-thread _seccomp_(2) filter of emulator threads by only
  allowing the required _socket_(2) domains and explicitly denying the
  raw and packet sockets unless
  [`trace/allow_unsafe_socket:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_socket)
  is set at startup. This hardening only works on 64-bit architectures
  where the _socketcall_(2) multiplexer is not available.

# 3.37.9

- Support `AT_EACCESS` flag for the _faccessat2_(2) system call.
- Support sandboxing 32-bit binaries on 64-bit powerpc.
- Fix executable stack detection on powerpc64 where ABI defaults to
  non-executable stack in the absence of a `PT_GNU_STACK` header.
- Add initial support for the M68k architecture.
- Finish MIPS porting work. Most tests now pass on `mips64el`,
  and other MIPSen should in theory just work too. We do not
  plan to publish release binaries for this architecture but
  it is easy enough to cross compile Syd for MIPS using a tool
  such as [cross](https://crates.io/crates/cross).
- Replace `procfs` crate with the `procfs_core` crate.
- Allow the _ioctl_(2) requests `TCGETS2`, `TCSETS2`, `TCSETSF2`, and
  `TCSETSW2` for the _syd-pty_(1) utility. This is in consistence with
  the `TCGETS`, `TCSETS`, `TCSETSF`, and `TCSETSW` requests that are
  already allowed and fixes panics on newer Linux.
- Turn on `overflow-checks` for release mode. We plan to turn this back
  off when the code is provably free of arithmetic side effects which is
  work in progress. In the meantime, these checks give us safe
  behaviour, e.g. an overflow occurring in an emulator thread will panic
  which will invoke the RAII guard on drop to deny the ongoing system
  call with `EACCES`.
- Improve [safe
  filename](https://man.exherbo.org/syd.7.html#Enhanced_Path_Integrity_Measures)
  checks to include UTF-8 whitespace into leading and trailing space
  checks, thanks to an idea by Jacob Bachmeyer, see [this
  link](https://seclists.org/oss-sec/2025/q3/123) for more information.
- Improve symlink loop detection in path canonicalizer, fixes #231.
- Allow _timer_settime64_(2) syscall in addition to the
  _timer_settime_(2) syscall for emulator threads. This
  fixes tests on x86.
- Harden `user` profile to set
  [`trace/force_umask`](https://man.exherbo.org/syd.2.html#trace/force_umask)
  to `7177` rather than the old `7077` to disable executable bits to
  enhance W^X.
- Harden `user` profile to deny read-access to all dotfiles except shell
  history files which are append-only. This includes critical paths such
  as `~/.gnupg`, and `~/.ssh` and adheres to the principle of secure
  defaults.
- Minimize `user` profile default access not to include DRI, sound, HID,
  syslog and systemd journal. These accesses may be added as separate
  profiles in the future to be stacked for finer confinement. This way
  we ensure the builtin `user` profile adheres to secure defaults.
- Fix compatibility issues with older landlock ABIs.
- Increase default stack size of the monitor thread from `96k` to
  `128k`.

# 3.37.8

- Replace `secure-string` crate dependency with the better
  maintained `zeroize` crate.
- Upgrade _syd-oci_(1) dependencies from youki: `libcgroups`,
  `libcontainer` and `liboci-cli` have been upgraded from version
  `0.5.4` to `0.5.5`. Similarly the `oci-spec` crate has been upgraded
  from version `0.8.1` to `0.8.2`.
- The `log` feature is now enabled by default and means only one thing
  which is to add support for Syd's _syslog_(2) emulation so access
  violations are readable from within sandbox using _dmesg_(2) provided
  that the sandbox process has access to the sandbox lock.
- The utility `syd-log` has been removed.
- Host syslog support has been removed. This was broken with the
  [`CLONE_FILES`
  isolation](https://man.exherbo.org/syd.7.html#Thread-Level_Filesystem_and_File-Descriptor_Namespace_Isolation).
  The libc implementation does not support per-thread syslog
  connections and therefore is no longer usable for Syd.
- Fix `RENAME_EXCHANGE` flag handling in _renameat2_(2) handler.
- Add rule `allow/read,stat+/proc/uptime` to the `container` profile.
  This file is time-namespace aware and therefore is not an information
  leak when `unshare/time:1` is set as done by the `container` profile.

# 3.37.7

- Harden deleted path handling in path canonicalizer.
- Harden dotdot and symbolic link handling in path canonicalizer.
- Fix a TOCTOU issue in path canonicalizer when the target of a magic
  symbolic link can change after _readlink_(2) but before _open_(2).
  This can allow a fellow attacker thread who shares a file descriptor
  or current working directory with the current thread to change where
  the magic symbolic link points to in between these two calls and
  potentially access resources outside the sandbox. The solution is to
  first _open_(2) the magic symbolic link and run the _readlink_(2) call
  on the resulting fd which is accessible by the current Syd emulator
  thread only. This is a good example of why you should build a
  multi-layered sandbox using [Lock
  Sandboxing](https://man.exherbo.org/syd.7.html#Lock_Sandboxing) for
  defense-in-depth.

# 3.37.6

- Enable synchronous seccomp with
  [`trace/sync_seccomp`](https://man.exherbo.org/syd.2.html#trace/sync_seccomp)
  by default and remove the environment variable `SYD_SYNC_SCMP`. In
  addition with the removal of CPU pinning for the emulator threads,
  this mode now reliably helps with performance, substantially reducing
  the kernel overhead.
- Change the emulator threads to simultaneously block on
  `SECCOMP_NOTIFY_RECV` _ioctl_(2) rather than using multithreaded
  _epoll_(7). This provides a more effective solution and fixes the
  thundering herd problem which reappeared after the introduction of
  [`CLONE_FILES`
  isolation](https://man.exherbo.org/syd.7.html#Thread-Level_Filesystem_and_File-Descriptor_Namespace_Isolation)
  for emulator threads. This solution requires POSIX timers to retire
  idle helper emulator threads which is enabled by default on Linux
  kernels, check for `CONFIG_POSIX_TIMERS`.
- Deny `O_NOTIFICATION_PIPE` flag for the _pipe2_(2) system call, and
  add the option
  [`trace/allow_unsafe_pipe`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_pipe)
  to lift the restriction. See the [Denying `O_NOTIFICATION_PIPE` Flag
  in
  pipe2](https://man.exherbo.org/syd.7.html#Denying_O_NOTIFICATION_PIPE_Flag_in_pipe2)
  section of the _syd_(7) manual page for more information.
- Deny `MSG_OOB` flag for _send_(2), _sendto_(2), _sendmsg_(2), and
  _sendmmsg_(2) system calls and add the option
  [`trace/allow_unsafe_oob`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_oob)
  to lift the restriction. See the [Denying MSG\_OOB Flag in send System
  Calls](https://man.exherbo.org/syd.7.html#Denying_MSG_OOB_Flag_in_send_System_Calls)
  section of the _syd_(7) manual page for more information.
- Add rule `trace/allow_unsafe_personality:1` to the `paludis` profile.

# 3.37.5

- Return `EACCES` rather than `EISDIR` when attempting to execute
  directories. Unlike what the _exec_(3) manual page claims, the
  original system call returns `EACCES` rather than `EISDIR` and this
  errno is corrected further down the call path. Thanks to GNU make
  tests for making us notice this!

# 3.37.4

- Add rule `trace/allow_unsafe_create:1` to the `paludis` profile.
- Add option
  [`trace/allow_unsafe_create`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_create)
  to disable `O_CREAT` hardening.
- Implement `O_CREAT` hardening. Refer to the [Trusted File
  Creation](https://man.exherbo.org/syd.7.html#Trusted_File_Creation)
  section of the _syd_(7) manual page for more information.
- Add rule `trace/allow_unsafe_hardlinks:1` to the `paludis`
  profile.
- Allow the _ioctl_(2) request `TCGETS2` for the `tty` profile.
  Note, the _ioctl_(2) request `TCGETS` was already allowed so
  this is consistent.
- Add option
  [`trace/allow_unsafe_hardlinks`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_hardlinks)
  to disable hardlink target hardening.
- Implement _link_(2) and _linkat_(2) target hardening a la
  `/proc/sys/fs/protected_hardlinks` and `CONFIG_GRKERNSEC_LINK`.
  Refer to the [Trusted
  Hardlinks](https://man.exherbo.org/syd.7.html#Trusted_Hardlinks)
  section of the _syd_(7) manual page for more information.
- Protect _linkat_(2) system call usage of Syd emulator threads with
  syscall argument cookies for added hardening. See the [Syscall
  Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.
- Fix a filesystem TOCTTOU in _link_(2) and _linkat_(2) system call
  handlers. The base name of the old path which was passed to the host
  Linux kernel is susceptible to change after access check providing the
  attacker a way to hardlink arbitrary files outwith sandbox access
  checks. Due to the fact that the `AT_SYMLINK_FOLLOW` flag was not
  passed to the Linux kernel, the exploitability is somewhat limited.
  The new implementation uses _procfs_(5) indirection and the base name
  is never passed to the host Linux kernel. The alternative of using the
  `AT_EMPTY_PATH` flag is rejected because it requires the
  `CAP_DAC_READ_SEARCH` capability which we cannot always assume to
  have.

# 3.37.3

- Add rule
  [`trace/allow_unsafe_symlinks:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_symlinks)
  to the `paludis` profile.
- Fix an issue with the new [Trusted
  Symlinks](https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links)
  feature and write tests to verify it works correctly.

# 3.37.2

- Mount _procfs_(5) with `hidepid=4` option rather than `hidepid=2` when
  `unshare/pid:true` is set. This option is new in Linux>=5.8.
- Allow the _ioctl_(2) requests `TIOCGPGRP`, aka _tcgetpgrp_(3), and
  `TIOCGSID`, aka _tcgetsid_(3), for the `tty` profile. Note, the
  _ioctl_(2) request `TIOCSPGRP`, aka _tcsetpgrp_(3), was already
  allowed so this is consistent.
- Add option
  [`trace/allow_unsafe_symlinks`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_symlinks)
  to disable _symlink_(7) hardening.
- Implement _symlink_(7) hardening for path canonicalizer. See the
  [Trusted Symbolic
  Links](https://man.exherbo.org/syd.7.html#Trusted_Symbolic_Links)
  section of the _syd_(7) manual page for more information.
- Add option
  [`tpe/root_mount`](https://man.exherbo.org/syd.2.html#tpe/root_mount)
  to pin all executions to the root filesystem.
- Harden [TPE
  sandboxing](https://man.exherbo.org/syd.7.html#TPE_sandboxing)
  with file based checks in addition to parent directory checks.
- Improve [TPE
  sandboxing](https://man.exherbo.org/syd.7.html#TPE_sandboxing) with
  more descriptive error messages akin to GrSecurity.
- Fix network system call handlers to correctly return `EBADF`
  _errno_(3) on `O_PATH` file descriptors rather than incorrectly
  returning `ENOTSOCK`. Thanks to LTP tests for making us notice this!
- Fix a bug in _xattr_(7) name validation when `EOPNOTSUPP` _errno_(3)
  was incorrectly returned instead of `EINVAL` when the name is not in
  `namespace.attribute` form. Thanks to
  [`sys-apps/attr`](https://summer.exherbo.org/packages/sys-apps/attr/index.html)'s
  tests for making us notice this!
- _unshare_(2) `CLONE_FS|CLONE_FILES` for emulator, IPC and interrupt
  threads for added hardening. Note, `CLONE_FS` was already unshared for
  emulator threads and `CLONE_FILES` _unshare_(2) for emulator threads
  is skipped if Crypt sandboxing is on. See the [Thread-Level Filesystem
  and File-Descriptor Namespace
  Isolation](https://man.exherbo.org/syd.7.html#Thread-Level_Filesystem_and_File-Descriptor_Namespace_Isolation)
  section of the _syd_(7) manual page for more information.
- Improve symbolic loop detection in path canonicalizer.
- Ensure all utilities return _errno_(3) number as exit code on error.
- Teach _syd-read_(1) options to configure path resolution.
  Particularly interesting are options `-B` for `RESOLVE_BENEATH`, `-F`
  for `RESOLVE_NO_SYMLINKS`, `-P` for `RESOLVE_NO_MAGICLINKS`, and `-X`
  for `RESOLVE_NO_XDEV`. See the _syd-read_(1) manual page for more
  information.
- Put PTY main file descriptor into exclusive mode using
  _TIOCEXCL_(2const) _ioctl_(2) request to harden _syd-pty_(1) against
  terminal sniffing.
- Flush output pipes on error for _syd-tor_(1) to guard against
  packet-loss.
- Add rule `trace/allow_unsafe_shm:true` to the `paludis` profile.
  Perl tests map executable shared memory and require this option.
- Protect syscall handlers' map using _mseal_(2). This is a critical
  data-structure which has function pointers to Syd's syscall handler
  functions and as such it can be a reliable target for control flow
  hijacking attacks.
- Ensure _xattr_(7) handlers return same error numbers as the host Linux
  kernel when an invalid name is passed to the syscalls. We have
  reported [bug
  220374](https://bugzilla.kernel.org/show_bug.cgi?id=220374) to address
  the issue in the Linux kernel.

# 3.37.1

- Further harden _xattr_(7) handlers by applying strict argument
  validation for name and length arguments.
- Fix a bug in _flistxattr_(2) handler which caused it to return
  incorrect buffer size on success when `trace/allow_unsafe_xattr:1` is
  in affect. Thanks to GNU tar's tests for making us notice this!
- Restrict the `linux` profile by removing access rights to
  _proc_pid_maps_(5). The rules to allow per-process _proc_pid_maps_(5)
  have been moved to the `paludis` profile. Access to the
  _proc_pid_maps_(5) file allows an attacker to easily circumvent ASLR.
- Harden the `linux` profile to deny access to `/lib/modules` to prevent
  leaking host kernel config/module information. Add the new rule
  `deny/exec,read,stat,chdir,readdir+/lib*/modules/***` which acts as an
  override to the `allow` rule with the same capabilities over the
  `/lib` directory.

# 3.37.0

- Fix a bug with _kcmp_(2) filters in `syd_emu` threads
  on ARMv7.
- Fix PID validation for _kill_(2) family system calls
  when Syd is built as 32-bit on a 64-bit platform.
- Support the new `SYD_PDS` environment variable to set
  the parent-death signal. The value may be a signal name
  or a signal number.
- Implement kernel-validated peer authentication for
  [`ipc`](https://man.exherbo.org/syd.2.html#ipc). Add options
  [`ipc/uid`](https://man.exherbo.org/syd.2.html#ipc/uid), and
  [`ipc/gid`](https://man.exherbo.org/syd.2.html#ipc/gid) to configure
  UID/GID overrides for IPC authentication which default to current
  UID/GID.
- Remove the restriction of requiring absolute pathnames for the
  [`ipc`](https://man.exherbo.org/syd.2.html#ipc) option.
- Remove the restriction of requiring absolute pathnames for the
  [`proxy/ext/unix`](https://man.exherbo.org/syd.2.html#proxy/ext/unix)
  option.
- Allow _sync_file_range2_(2) system call on ARM and PowerPC.
  This is consistent with the _sync_file_range_(2) system call
  which is already allowed.
- Optimize the parent _seccomp_(2) BPF filter by removing duplicate
  filters shared with the child _seccomp_(2) filter.
- Mitigate Linux kernel MDWE bypass, aka [bug
  219227](https://bugzilla.kernel.org/show_bug.cgi?id=219227) with a
  proactive file writability check at _mmap_(2) boundary for
  `PROT_READ|PROT_EXEC` mappings. See the third paragraph of the
  [Memory-Deny-Write-Execute
  Protections](https://man.exherbo.org/syd.7.html#Memory-Deny-Write-Execute_Protections)
  section of the _syd_(7) manual page for more information.
- Remove option `trace/lock_personality`.
- Restrict _personality_(2) personas to a default allowlist, and provide
  the option
  [`trace/allow_unsafe_personality`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_personality)
  to lift this restriction at startup. See the [Personality Syscall
  Restrictions](https://man.exherbo.org/syd.7.html#Personality_Syscall_Restrictions)
  section of the _syd_(7) manual page for more information.
- Upgrade _syd-oci_(1) dependencies from youki: `libcgroups`,
  `libcontainer` and `liboci-cli` have been upgraded from version
  `0.5.3` to `0.5.4`. Similarly the `oci-spec` crate has been upgraded
  from version `0.7` to `0.8`.
- Replace `hex-conservative` crate with the `data-encoding` crate. The
  former decided to remove the hex-encoding in the latest major version
  in an effort to stabilize the crate therefore we can no longer use it.
  Moreover, the latter allows us to do permissive hex decoding when
  parsing is done case-insensitively.
- Use pipes in packet mode for _syd-tor_(1), remove the `-b bufsiz`
  option which now is always `PIPE_BUF` to ensure no packet loss
  happens.
- Add new options
  [`trace/allow_unsafe_shm`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_shm),
  and
  [`trace/allow_unsafe_mqueue`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_mqueue)
  to relax shared memory permission restrictions.
- Deny `{SHM,SEM,MSG}_STAT_ANY` operation for _shmctl_(2), _semctl_(2),
  and _msgget_(2) system calls.
- Deny `IPC_SET` operation for _shmctl_(2), _semctl_(2), and _msgctl_(2)
  system calls.
- Deny unsafe permissions (ie, bits 0o177) for _shmget_(2), _semget_(2),
  _msgget_(2), and _mq_open_(2) system calls. See the [Shared Memory
  Permissions
  Hardening](https://man.exherbo.org/syd.7.html#Shared_Memory_Permissions_Hardening)
  section of the _syd_(7) manual page for more information.
- Move the system calls _fsconfig_(2), _fsmount_(2), _fsopen_(2),
  _fspick_(2), _open_tree_(2), _open_tree_attr_(2) from `dead`
  set to `mount` set.
- Fix elf parser to correctly take into account the last occurrence of
  the `PT_GNU_STACK` header to determine executable stack. Previously
  the parser incorrectly only looked at the first occurrence of the
  header.
- Seal the memory area where the external network address resides using
  _mseal_(2) on Linux>=6.10 for _syd-tor_(1) and add guard pages
  to surrounding memory to prevent overflow or adjacent corruption.
- Use `MADV_GUARD_INSTALL` _madvise_(2) operation on Linux>=6.13 to
  install lightweight-guard pages during sandbox policy lock.
- Deny Restartable Sequences with the _rseq_(2) system call by default
  and add the option
  [`trace/allow_unsafe_rseq`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_rseq)
  to allow _rseq_(2). See the [Denying Restartable
  Seqeuences](https://man.exherbo.org/syd.7.html#Denying_Restartable_Sequences)
  section of the _syd_(7) manual page for more information.
- Fixed a packet loss bug in _syd-tor_(1) by treating
  `EPOLLRDHUP`/`EPOLLHUP` as a final read drain under `EPOLLET` so no data
  is left stranded after an edge notification.
- Fix _connect_(2) handler in _syd-tor_(1) to check for the `EAGAIN`
  _errno_(3) together with the `EINPROGRESS` _errno_(3). The former
  may be returned by UNIX sockets.
- Add rules
  `allow/stat,exec,read,write,create,chmod,truncate+/memfd:**`,
  and
  `allow/stat,exec,read,write,create,chmod,truncate+/memfd-hugetlb:**`
  to the `paludis` profile.
- Make path canonicalizer aware of memory file descriptors. This allows
  for writing more intuitive access control rules for mfds.
- Prepend _memfd_create_(2) name argument with `/memfd-hugetlb:`, rather
  than `/memfd:` before access check when flags include `MFD_HUGETLB`.
- Add new builtin profile `rand` to enable [randomized file
  descriptors](https://man.exherbo.org/syd.7.html#Force_Randomized_File_Descriptors).
  You may refer to this profile shortly as just **r**.
- Add rule `trace/allow_unsafe_memfd:1` to the `paludis` profile.
- Make the `immutable` profile more portable by mounting a readonly
  _tmpfs_(5) over `/boot` rather than bind mounting `/var/empty` over
  it. `/var/empty` is not a standard directory and notably does not
  exist on Debian and Ubuntu distributions.
- Ensure file offset is always correctly set to the start of the file
  before ELF parsing.
- Validate flags argument early in _memfd_create_(2) hook.
- Fix _memfd_create_(2) hook to fallback to using _fchmod_(2) to remove
  executable bits on kernels which does not support the
  `MFD_NOEXEC_SEAL` flag. This flag is new in Linux>=6.3.
- Set [BIG TCP](https://lwn.net/Articles/884104/) for the internal
  loopback device when
  [`unshare/net`](https://man.exherbo.org/syd.2.html#unshare/net) is set
  to true at startup.
- Harden
  [`trace/allow_unsafe_ebpf:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ebpf)
  to always drop the `CAP_BPF` Linux capability and deny the _bpf_(2)
  commands `BPF_MAP_CREATE` and `BPF_PROG_LOAD` with the _errno_(3)
  `EPERM`. This is in consistence with the Linux kernel checks for the
  `kernel.unprivileged_bpf_disabled` _sysctl_(8).
- Fix a race in [`Crypt
  sandboxing`](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing)
  which caused some blocks not to be written to the output file when
  appending consecutively to the same file in rapid succession. Users
  of Crypt sandboxing are highly recommended to update.
- Do not put syd into its own process group to defend the parent
  against group signals on systems not supporting Landlock ABI 6
  which is Linux>=6.12.
- Use cargo-auditable to build auditable binaries on builds.sr.ht.
- Switch `ubuntu/plucky` CI to `debian/stable` on builds.sr.ht.
- Fix per-thread _seccomp_(2) filter loading logic of the main thread
  filter to honour `SYD_SKIP_SCMP` environment variable to skip
  filtering rather than the (old default) `SYD_LOG=debug` in consistence
  with other per-syd-thread _seccomp_(2) filters.
- Ensure Crypt sandboxing keys are sent to host Linux kernel and wiped
  from Syd memory before execution of the sandbox process to prevent any
  potential race with the sandbox process.
- Reduce memory allocations in _sendmsg_(2) and _sendmmsg_(2) handlers
  for the `SCM_RIGHTS` request.
- Ensure memory sealing of sandbox happens before execution of the
  sandbox process when sandbox lock is set at startup to prevent
  any potential race with the sandbox process. This is the default.
- Cap `MMAP_MIN_ADDR` at `PAGE_SIZE` to respect OpenBSD's _mmap_(2)
  floor. Linux allows processes with the `CAP_SYS_RAWIO` capability to
  edit/override `vm.mmap_min_addr` and this provides hardening against
  such edits.
- Increase [`mem/max`](https://man.exherbo.org/syd.2.html#mem/max)
  default from `128MB` to `256MB`.
- PTY sandboxing is now only activated when both standard input and
  standard output is attached to a terminal. Previously only standard
  input was checked.
- Teach _syd_(1) the _--api_ option to output _syd_(2) API specification
  in JSON format. This specification is intended to ease generation of
  language bindings and is also available via the magic path `/dev/syd`.
- Support the `SYD_OCI_NO_CONFIG` environment variable to skip
  configuration parsing for _syd-oci_(1) and to parse the `oci` profile.
  This is primarily intended for testing.
- Add _kcmp_(2) to the allowlisted system calls for _syd-oci_(1). This
  system call is only used by Syd unless
  [`trace/allow_unsafe_ptrace:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ptrace)
  is set at startup in which case the sandbox processes are allowed to
  call it as well.
- Teach _syd-x_(1) the _-l_ option to list executables of the given
  processes using `PROCMAP_QUERY` _ioctl_(2) request on Linux-6.11
  and newer and fall back to parsing _proc_pid_maps_(5) textually
  on older Linux.
- Use the new `PROCMAP_QUERY` _ioctl_(2) request on Linux-6.11 and
  newer to parse _proc_pid_maps_(5) efficiently at _ptrace_(2)
  `PTRACE_EVENT_EXEC` boundary.
- Fix a path canonicalizer bug where bad directory file descriptors were
  incorrectly not allowed with absolute paths. Thanks to gnulib tests
  for identifying this regression!
- Print detected host Linux kernel features in version output.
- Support the `SYD_ASSUME_KERNEL` environment variable to override
  host Linux version for feature detection.
- Deny installing new signal handlers using the _sigaction_(2) and
  _rt_sigaction_(2) system calls in per-thread seccomp filters of the
  main thread, emulator threads and aes threads for added hardening.
- Disable _ld.so_(8) exec indirection check if
  [`trace/allow_unsafe_exec:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_exec)
  is set at startup.
- Check for file type before file executability check
  in _exec_(3) handlers.
- Avoid using `codegen-units=1` for release builds.
- Use `thin` LTO rather than `fat` LTO for release builds.
- Add rule `trace/allow_unsafe_xattr:1` to the `paludis` profile.
- Add new option
  [`trace/allow_unsafe_xattr`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_xattr)
  to lift extended attributes restrictions for `user.syd.*` and
  `security.*`.

# 3.36.0

- Add rule `sandbox/pty:off` to the `paludis` profile. Paludis creates
  TTYs on its own as necessary.
- Add
  [`trace/allow_safe_bind`](https://man.exherbo.org/syd.2.html#trace/allow_safe_bind)
  the ability to allow implicit binds as part of _connect_(2) UDP calls
  (thx mixi!).
- Add new commands
  [`pty/row`](https://man.exherbo.org/syd.2.html#pty/row) (or shortly
  just `pty/x`) and
  [`pty/col`](https://man.exherbo.org/syd.2.html#pty/col) command to set
  the default size of the pseudoterminal window created by _syd-pty_(1)
  for PTY sandboxing.
- Add new sandboxing type [PTY
  Sandboxing](https://man.exherbo.org/syd.7.html#PTY_Sandboxing) to
  run the process inside a PTY managed by _syd-pty_(1).
- Add new utility _syd-pty_(1) to do PTY forwarding.
- Move the _ioctl_(2) requests `FIFREEZE`, `FITHAW`, `FS_IOC_FIEMAP`,
  `FIGETBSZ`, `FS_IOC_GETFSUUID`, and `FS_IOC_GETFSSYSFSPATH` from the
  _ioctl_(2) allowlist to the _ioctl_(2) denylist to prevent leaking
  on-disk layout to the sandbox process.
- Add the rule `ioctl/allow+0x5401` to the `tty` profile which stands
  for the _ioctl_(2) request `TCGETS` used by _isatty_(3) and
  _tcgetattr_(3) etc.
  _ioctl_(2) requests to magic links are now denied unless
  [`trace/allow_unsafe_magiclinks`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_magiclinks`)
  option is set.
- _ioctl_(2) requests to block devices are now always denied.
- Apply a _seccomp_(2) filter early during sandbox process startup to
  deny seccomp-notify _ioctl_(2) requests. Since seccomp-notify
  sandboxes are not stackable, these requests have no point in the
  sandbox. To identify misbehaviour easily, the default action is to
  `KillProcess` rather than denying with an _errno_(3).
- The command
  [`sandbox/pid`](https://man.exherbo.org/syd.2.html#sandbox/pid) may
  now be used dynamically to enable/disable PID sandboxing after startup
  before the sandbox is locked. Previously, this command was _static_, ie
  could only be passed to Syd at startup.
- Set
  [`sandbox/ioctl`](https://man.exherbo.org/syd.2.html#sandbox/ioctl)
  default to `on` to adhere to the principle of safe defaults.
- The `log` feature is now required to log to the host _syslog_(3). Due
  to the current _seccomp_(2) confinements regarding the _socket_(2)
  system call, a reconnection to the host syslog during a Syd run is not
  permitted and will result in immediate termination. Syd preempts this
  termination by panicking at the first error to send a message to the
  host syslog. The environment variable `SYD_NO_SYSLOG` has no effect if
  the `log` feature was not enabled at build time.
- The `log` feature is now required for the utility _syd-log_(1) to be
  installed. _syd-log_(1) utility is a simple wrapper around
  _journalctl_(1) and currently has no function on non-systemd systems.
- Use the safe `nix` _syslog_(3) interface to send log messages to the
  host _syslogd_(8) rather than the unsafe `libc` interface.
- The `log` feature is no longer on by default. The only default
  enabled feature currently is `utils`.
- Raise the default cycle period of the `syd_int` interrupt thread
  from 5 milliseconds to 10 milliseconds. This is a compile-time
  default which may be changed by editing `src/config.rs`.
- Reduce the stack size of the `syd_int` interrupt thread from 256 bytes
  to 128 bytes. Note, this thread is confined by _seccomp_(2) such that
  it can only deallocate memory and attempts in memory allocation will
  result in instant process termination enforced by the host Linux
  kernel.
- Change interrupt handling to preopen path to _proc_pid_status_(5) in
  emulator threads. Further confine `syd_int` thread to remove read
  access to _procfs_(5) with Landlock and remove the _seccomp_(2) allow
  clause for the _openat2_(2) system call filter. _openat2_(2) is now
  denied in the interrupt thread with the `ENOSYS`, aka "Function not
  implemented", error like the other _open_(2) and _stat_(2) family
  system calls for compatibility. With this change, the interrupt
  thread now runs with no access to the filesystem and network.
- Exclude per-thread blocked signals during interrupt delivery in
  `syd_int` interrupt handler thread. Previously, blocked signals caused
  incorrect interruption of the ongoing system call. Notably, this made
  `go mod download` fail with `EEXIST`, aka "File exists" errors when a
  go thread is preempted with a `SIGURG` signal during an ongoing,
  exclusively creating _open_(2) system call.
- Print information on open file limits in version output.
- Make `syd_int` interrupt handler send the unblocking `SIGALRM` signal
  to the `syd_emu` syscall handler thread even if the respective sandbox
  process gets killed mid-way. This fixes a hang in miniupnpc tests (thx
  kepstin!)
- Add rule `mask^` to the `paludis` profile so as not to inherit path
  masking rules from the `linux` profile. These rules are intended for
  secure defaults and _not_ package building.
- Extend the `linux` profile to
  [`mask`](https://man.exherbo.org/syd.2.html#mask) many critical
  _procfs_(5) and _sysfs_(5) files and directories previously mounted
  over using [`bind`](https://man.exherbo.org/syd.2.html#bind) by the
  `immutable` profile. The list is heavily inspired by that of
  _podman_(1), and it extends it with wider-range of paths for secure
  defaults. See `syd-cat -plinux | grep mask` for the complete list of
  patterns. Note, these
  [`bind`](https://man.exherbo.org/syd.2.html#bind) commands were
  removed from the `immutable` profile in version 3.35.0 because this
  command has been hardened to fail on non-existing files therefore it
  is hard to provide a portable list of bind-paths.
- Extend the [`mask`](https://man.exherbo.org/syd.2.html#mask) command
  with optional directory overrides. This feature provides a
  non-privileged alternative to the
  [`bind`](https://man.exherbo.org/syd.2.html#bind) command because it
  does not require the creation of a mount namespace. Moreover,
  [`mask`](https://man.exherbo.org/syd.2.html#mask) commands may be
  specified dynamically after startup using the _syd_(2) API allowing
  for fine-tuned and/or incremental confinement.
- Fix a startup conflict in _syd-oci_(1) utility when both
  the _youki_(1) container runtime and the Syd sandbox invokes
  the same _setpgid_(2) call to put the process into a new
  process group in which case the latter attempt fails with
  permission denied and aborts the startup process. This bug
  was first introduced in version 3.35.2.
- Document path unhiding bug using pass-through paths during
  canonicalization in the
  [BUGS](https://man.exherbo.org/syd.1.html#BUGS) section of the
  _syd_(1) manual page.
- Fix an issue with determining the `RLIMIT_NOFILE` hard limit on armv7.
- Add rule `trace/allow_unsafe_nocookie:1` to the `paludis` profile.
- Add new option
  [`trace/allow_unsafe_nocookie`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_nocookie)
  to disable [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies).
- esyd: Fix various POSIX compatibility issues reported by
  _shellcheck_(1).
- esyd: Fix `info` subcommand for non-bash/zsh POSIX shells.
- Fix an off-by-one in argument passing for _truncate64_(2),
  _ftruncate64_(2) and _fallocate_(2) system calls on armv64, ppc64, and
  ppc64le architectures.
- Fix an issue with invoking the _kcmp_(2) system call on armv7.
- Harden _socket_(2), _truncate_(2), _truncate64_(2), _ftruncate_(2),
  and _ftruncate64_(2) system calls in emulator Syd threads by enforcing
  cookies in unused system call arguments. In addition, harden the
  `SECCOMP_IOCTL_NOTIF_SEND` and `SECCOMP_IOCTL_NOTIF_ADDFD` _ioctl_(2)
  requests for Syd emulator threads with cookies to prevent potential
  misuse of the response flag `SECCOMP_USER_NOTIF_FLAG_CONTINUE` which
  cause a system call pass-through to the host Linux kernel or fd
  stealing. See the [Syscall Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.

# 3.35.2

- Create an unconditional, best-effort Landlock scope-only sandbox
  domain for the sandbox process. This adds a layer of isolation
  between the sandbox process and Syd process.
- Harden _memfd_create_(2), _renameat2_(2) and _unlinkat_(2) system
  calls in emulator Syd threads by enforcing cookies in unused system
  call arguments.
- Harden _openat2_(2) system calls in main and emulator Syd threads by
  enforcing cookies in unused system call arguments. See the [Syscall
  Argument
  Cookies](https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies)
  section of the _syd_(7) manual page for more information.
- Move the system calls _sethostname_(2) and _setdomainname_(2) from
  `safe` system call set to the new system call set `uts`. The `uts`
  system call set is only allowed when UTS subnamespace is allowed with
  `trace/allow_unsafe_namespace:uts`. This handling is similar to
  the `mount` system call set and `trace/allow_unsafe_namespace:mount`.
- The system calls _pidfd_getfd_(2) and _process_madvise_(2) have been
  moved from `safe` system call set to the `ptrace` system call set.
  This is consistent with the host kernel check for
  `PTRACE_MODE_READ_FSCREADS`.
- The `kill` action has been enhanced to utilize the
  _process_mrelease_(2) system call to release sandbox process memory to
  the system immediately after sending a `SIGKILL` through the same
  PIDFd using _pidfd_send_signal_(2). This is especially useful with
  [Memory Sandboxing](https://man.exherbo.org/syd.7.html#Memory_Sandboxing).
- The default action for [Memory
  Sandboxing](https://man.exherbo.org/syd.7.html#Memory_Sandboxing) has
  been changed from `deny` to `kill` to be consistent with [PID
  Sandboxing](https://man.exherbo.org/syd.7.html#PID_sandboxing).
  This default may be changed using the command
  [`default/mem`](https://man.exherbo.org/syd.2.html#default/mem).
- Add new builtin profile `firefox` to relax restrictions which are
  needed to make Firefox family browsers work under the sandbox. Use
  `syd-cat -pfirefox` to list the rules. You may refer to the profile
  shortly as just `ff`.
- Add options `trace/allow_unsafe_memory:1`,
  `trace/allow_unsafe_magiclinks:1`, and `trace/allow_unsafe_prctl:1` to
  the `debug` profile to allow _gdb_(1) usage within the sandbox.
- Add option `trace/allow_unsafe_page_cache:1` to the `paludis` profile.
- Add new option
  [`trace/allow_unsafe_page_cache`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_page_cache)
  to allow _cachestat_(2) and _mincore_(2) system calls in the sandbox.
  This is done by default to mitigate page-cache attacks, however this
  system call may be necessary to make direct rendering work with
  Firefox family browsers. See the [`Mitigation against Page Cache
  Attacks`](https://man.exherbo.org/syd.7.html#Mitigation_against_Page_Cache_Attacks)
  section of the _syd_(7) manual page for more information.
- Start denying _cachestat_(2) as it is a scalable version of
  _mincore_(2) which we already deny to mitigate page cache attacks.
- Recursively create parent directories when
  [`bind`](https://man.exherbo.org/syd.2.html#bind) mounting
  into empty mount namespaces with
  [`root:tmpfs`](https://man.exherbo.org/syd.2.html#root).
- Make Syd the leader of a new process group at startup to isolate it from
  the sandbox process and release the controlling terminal for the Syd
  process using the `TIOCNOTTY` _ioctl_(2) request. This ensures a
  compromised Syd process cannot be abused to inject characters into the
  buffer of the controlling terminal.
- Disable Speculative Store Bypass mitigations for _seccomp_(2)
  filters when `trace/allow_unsafe_spec_exec:1` is set.
- Fix file flags and mode validation for _open_(2) family system calls.
- Add new command
  [`trace/force_ro_open`](https://man.exherbo.org/syd.2.html#trace/force_ro_open)
  to reject creating and writing _open_(2) family system calls.
- Add new command
  [`trace/force_rand_fd`](https://man.exherbo.org/syd.2.html#trace/force_rand_fd)
  to return randomized fds rather than lowest available slot at
  _open_(2), _socket_(2), _accept_(2), and _memfd_create_(2) boundaries
  to harden against fd reuse. Read the section [`Force Randomized File
  Descriptors`](https://man.exherbo.org/syd.7.html#Force_Randomized_File_Descriptors)
  of the _syd_(7) manual page for more information. The new environment
  variable `SYD_FORCE_RANDFD` may be used to set this by default which
  is provided as convenience to ease testing.
- Add new command
  [`trace/force_cloexec`](https://man.exherbo.org/syd.2.html#trace/force_cloexec)
  to force `O_CLOEXEC` at _open_(2), _socket_(2), _accept_(2), and
  _memfd_create_(2) boundaries. Read the section [`Force Close-on-Exec File
  Descriptors`](https://man.exherbo.org/syd.7.html#Force_Close-on-Exec_File_Descriptors)
  of the _syd_(7) manual page for more information.
- Add new [`lock:ipc`](https://man.exherbo.org/syd.2.html#lock) mode
  to allow sandbox configuration only through the IPC socket.
- Add new [`ipc`](https://man.exherbo.org/syd.2.html#ipc) command to
  create a UNIX socket for remote configuration of the sandbox.
- The [`root`](https://man.exherbo.org/syd.2.html#root) command now
  recognizes the special keywords _off_ and _none_ to unset a previously
  set root directory. This is useful when stacking profiles.
- _syd_(2) API commands that do not work under _syd-oci_(1) now return
  `EOPNOTSUPP` error at configure time. These commands are documented
  with `oci: no` in _syd_(2) manual page.
- oci: Do not pass-through the capabilities specified by the container
  engine. This is done to adhere the goal to be secure by default. To
  honour the capabilities specified by the container engine, user may
  configure Syd with `trace/allow_unsafe_caps:1`. The recommended way,
  however, is to specify only the minimum needed set of capabilities
  using the various "allow\_unsafe" options such as
  `trace/allow_unsafe_bind:1` to retain `CAP_NET_BIND_SERVICE`,
  `trace/allow_unsafe_socket:1` to retain `CAP_NET_RAW`,
  `trace/allow_unsafe_syslog:1` to retain `CAP_SYSLOG`,
  `trace/allow_unsafe_time:1` to retain `CAP_SYS_TIME`.

# 3.35.1

- [`mask`](https://man.exherbo.org/syd.2.html#mask) add operation now
  accepts an optional, colon-separated mask path to be used instead of
  the default `/dev/null`. This makes the
  [`mask`](https://man.exherbo.org/syd.2.html#mask) command,
  functionally similar to the
  [`bind`](https://man.exherbo.org/syd.2.html#bind) with two advantages:
  Unlike the `bind` command, the `mask` command does not require
  creation of a mount namespace at startup, and `mask` commands
  may be specified dynamically after startup using the _syd_(2) API.
- _syd-run_(1) learned the new namespacing options -c, -i, -m, -n, -p,
  -u, and -U to specify the set of namespaces explicitly rather than
  auto-detecting them which is the default.
- Fix build when the `log` feature is disabled.
- Fix a regression with PID sandboxing, which was introduced by
  mistakenly changing the open mode of the static `/proc` file
  descriptor to `O_PATH`. This made PID calculations return an error,
  which in turn caused Syd to raise an incorrect PID access violation
  before the maximum limit is actually reached.
- Harden the builtin `landlock` profile to remove access to the `/sys`
  directory. Move the rule `allow/lock/read,readdir+/sys` to the
  `paludis` profile for compatibility when stacked with the `landlock`
  profile.

# 3.35.0

- Add information about HMAC-SHA256 kernel support in version output.
- Add information about AES-CTR kernel support in version output.
- Fix `riscv64` build with `musl` libc.
- Harden the `linux` profile, remove access to `/proc/filesystems`,
  `/proc/mounts`, `/proc/stat`, `/proc/sys`, `/proc/self/mounts`,
  `/proc/self/attr`, `/selinux`, `/sys`, `/var/cache`.
- Remove rule `allow/lock/read,write,truncate+/dev/fd` from the
  `landlock` rule for portability.
- Remove rule `allow/lock/read,readdir,write+/selinux/context` from
  the `landlock` profile for portability.
- Remove rule `allow/lock/read,readdir,exec+/snap` from the `landlock`
  profile for portability.
- Teach _syd-lock_(1) the _-C_ option to specify Landlock compatibility
  level. Default level has been changed from "best-effort" to
  "hard-requirement". Make `ENOENT`, aka "No such file or directory"
  errors fatal unless compatibility level is set to "best-effort".
- Add rule `default/lock:warn` to the `paludis` profile to set the
  Landlock compatibility level to "best-effort" when stacked with the
  `landlock` profile.
- Make `ENOENT`, aka "No such file or directory", errors fatal
  for Landlock unless compatibility level has been set to
  "best-effort" using `default/lock:warn`.
- Add new option
  [`default/lock`](https://man.exherbo.org/syd.2.html#default/lock)
  to set [Landlock compatibility
  level](https://landlock.io/rust-landlock/landlock/trait.Compatible.html),
  where `kill` stands for
  [`HardRequirement`](https://landlock.io/rust-landlock/landlock/enum.CompatLevel.html#variant.HardRequirement),
  `deny` stands for
  [`SoftRequirement`](https://landlock.io/rust-landlock/landlock/enum.CompatLevel.html#variant.SoftRequirement),
  and `warn` stands for
  [`BestEffort`](https://landlock.io/rust-landlock/landlock/enum.CompatLevel.html#variant.BestEffort).
  The default level is `kill`. This change promotes the default compatibility level
  from "best-effort" to "hard-requirement and adheres to the
  principle of secure defaults. Users who want the previous behaviour
  may use the rule `default/lock:warn` in their profiles.
- Grant read, stat, chdir and readdir accesses to the directory
  `/etc/ld.so.conf.d` recursively for the `linux` profile.
- Make [`root`](https://man.exherbo.org/syd.2.html#root) command change
  root using _pivot_root_(2). Support the special keyword `tmpfs` as an
  argument to `root` in which case an empty mount namespace may be built
  from scratch under a private, temporary directory which is mounted on
  _tmpfs_(5). [`bind`](https://man.exherbo.org/syd.2.html#bind) command
  has been extended to honour new `root` directory.
- Add new utility [`syd-fd`](https://man.exherbo.org/syd-fd.1.html)
  to interact with remote file descriptors using _pidfd_getfd_(2).
- Give `security.` prefixed extended attributes, such as
  `security.selinux`, `security.smack`, the same protection as the
  `user.syd.` prefix: These prefixes can not be listed or tampered
  by the sandbox process unless the sandbox lock is _off_ for the
  respective process. This access can be permitted to the initial
  sandbox process with `lock:exec` or to all sandbox processes with
  `lock:off`.
- Add new builtin profile `readonly` to deny all write sandbox capabilities
  to the entire root filesystem. You may refer to this profile shortly
  as just `ro`. See the
  [`PROFILES`](https://man.exherbo.org/syd.5.html#PROFILES) section of
  the _syd_(5) manual page for more information on builtin profiles.
- Add new sandbox capability aliases `rdset` and `wrset`, in addition to
  `all`. `rdset` refers to the set of read-only sandbox capabilities,
  whereas `wrset` refers to the set of write sandbox capabilities.
  See the [`SHORTCUTS`](https://man.exherbo.org/syd.2.html#SHORTCUTS)
  section of the _syd_(2) manual page for more information.
- The `user` profile no longer includes the `landlock` and `immutable`
  profiles. This is done for clear separation of core profiles and
  make it easy to stack them for practical sandboxing.
- Stop pre-opening file descriptors to `/dev` and `/sys` directories
  at startup.
- Remove the need to specify `CLONE_FILES` to share the file descriptor
  space with the sandbox process at early startup. This ensures
  hardening against file descriptor leaks.
- Fix file type check by running _statx_(2) directly on the file
  descriptor, rather than using the directory and the base path in safe
  canonicalizer. This is important to guard against TOCTTOU. File
  type is used in sandbox access check and is therefore
  security-critical.
- Add rule `trace/allow_unsafe_nomseal:1` to the `paludis` profile.
- Replace _syd_(2) parsers written using regular expressions with the
  `regex` crate with parsers written using the `nom` crate. The `regex`
  crate dependency has been removed. Notably, the new parser is not only
  more efficient both wrt. binary size and performance, but also much
  stricter than the regular expressions based parser.
- Fix mode and dev argument validation in _mknod_(2) and _mknodat_(2)
  handlers. Previously invalid mode/dev was silently truncated. Found
  by LTP test-suite.
- Fix flags validation in _sendto_(2), _sendmsg_(2) and _sendmmsg_(2)
  handlers. Previously invalid flags were silently truncated. Found by
  LTP test-suite.
- Fix flags validation in _{get,set,list,remove}xattrat_(2) handlers.
  Previously invalid flags were silently truncated. Found by
  LTP test-suite.
- Fix mode validation in _mkdir_(2) and _mkdirat_(2) handlers.
  Previously invalid modes were silently truncated. Found by
  LTP test-suite.
- Fix flags validation in _accept4_(2) handler. Previously
  invalid flags was silently truncated. Found by LTP test-suite.
- Fix `AT_EXECVE_CHECK` flag check at _execveat_(2) boundary.
- Fix various issues with the _fanotify_mark_(2) handler by using the
  new type-safe interface in `nix>=0.30.1`. Found by LTP test-suite.
- Fix file open mode in _inotify_add_watch_(2) handler
  which resulted in incorrect watches.
  Found by LTP test-suite.
- Fix various pid validation issues for signal handling
  system calls. Found by LTP test-suite.
- Fix various syscall argument validation issues for open
  family system calls. Found by LTP test-suite.
- Fix `linux` profile to grant `truncate` access in addition
  to `write` access for the directory `/proc/self/fd` to avoid
  confusion. Found by LTP test-suite.
- Fix stat handlers to return `EFAULT` when an invalid pointer
  was passed as the stat argument. Found by LTP test-suite.
  Note, for magic stat calls of _syd_(2) API, passing `NULL` as stat
  argument is still allowed.
- Fix _access_(2), _faccessat_(2), _faccessat2_(2), _chmod_(2), _fchmod_(2),
  _fchmodat_(2), _fchmodat2_(2), _fchownat_(2), _inotify_add_watch_(2)
  _unlinkat_(2) handlers to return `EINVAL` on invalid, undefined, and unused
  flags and/or mode. Previously these flags were silently truncated. Found by
  LTP test-suite.
- Fix network syscall handlers to return `ENOTSOCK` early when the
  file descriptor argument is not a socket. Found by LTP test-suite.
- Fix _symlink_(2) and _symlinkat_(2) handlers to validate current
  process using seccomp request ID after memory read for the target
  argument. Previously this was only done for the linkpath argument.
- The `readdir` access check is no longer done on _getdents64_(2)
  boundary. This check is now only done at _open_(2) boundary when the
  argument is an existing directory regardless of the `O_DIRECTORY`
  flag.
- Fix _getdents64_(2) handler to correctly return `ENOTDIR` for
  file descriptors that do not refer to a directory. Previously
  this handler incorrectly returned `EBADF` for this case.
- Fix a file descriptor leak in PID file descriptor map.
- Upgrade `nom` crate from `7.1` to `8.0`. `nom` crate is currently used for
  parsing some special procfs files efficiently. We plan to use it for
  configuration parsing as well in future releases.
- Upgrade the vendored `landlock` crate from `0.4.1` to `0.4.2`. Note
  Landlock ABI 6 support of Linux-6.12 had already been implemented as
  of Syd-3.29.0, this upgrade brings in refactors and tests from
  upstream. We continue to maintain our own version of the crate to
  ensure static linking works, however we keep our changes to a minimum
  and we intend to eventually submit our changes upstream.
- Add new utility [`syd-x`](https://man.exherbo.org/syd-x.1.html)
  to check for file executability using the new
  [`AT_EXECVE_CHECK`](https://docs.kernel.org/next/userspace-api/check_exec.html)
  flag.
- Upgrade `crc` crate from `3.2` to `3.3`.
- Harden loop detection in sandbox configuration file includer by taking
  into account the unique mount id of the file in addition to the inode.
- Upgrade `nix` crate from `0.29.0` to `0.30.1`. This version continues
  to improve the API to use I/O-safe types thereby improving I/O safety
  throughout the Syd codebase.
- Use the new `AT_EXECVE_CHECK` flag of _execveat_(2) to check
  for exec access in the exec(3) syscall hooks.
- Add new option
  [`proxy/ext/unix`](https://man.exherbo.org/syd.2.html#proxy/ext/unix)
  to set an external UNIX domain socket for [Proxy
  sandboxing](https://man.exherbo.org/syd.7.html#Proxy_Sandboxing).
  This option may also be set using the new environment variable
  `SYD_PROXY_UNIX` and has precedence over the option
  [`proxy/ext/host`](https://man.exherbo.org/syd.2.html#proxy/ext/host)
- Teach _syd-tor_(1) to support external UNIX domain sockets when
  submitted as an argument in the format of absolute pathname to the
  `-o` option. This can be used coupled with the TOR feature to listen
  on UNIX domain sockets which is supported for client sockets since
  [Tor-0.2.6](https://blog.torproject.org/coming-tor-026/).
- Fix an error case in the path canonicalizer where an `EBADF` error
  would be incorrectly returned in case of the correct `ENOENT`.
- Upgrade `ringbuf` crate from version `0.4.7` to `0.4.8`.
- Update links to point to `exherbo.org` rather than `exherbolinux.org`.

# 3.34.0

- Remove security policy cache for paths and IP addresses in
  consistency with the sealing read-only the sandbox policy using
  _mseal_(2) to mitigate potential cache poisoning attacks for a
  compromised Syd process. The options `cache/capacity/path` and
  `cache/capacity/addr` have been removed. The dependency on the
  `quick_cache` crate has been removed.
- Print _mseal_(2) support information in version output.
- Add option
  [`trace/allow_unsafe_nomseal`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_nomseal)
  to disable memory sealing of sandbox policy regions on sandbox lock.
- Bump MSRV from 1.70 to 1.73.
- Seal most critical sections of the sandbox policy as read-only using
  _mseal_(2) when the sandbox is locked. This raises the bar for an
  attacker who has compromised the Syd process and attempting to edit
  the sandbox policy to access otherwise denylisted resources. In the
  future, the range of the sealed regions is planned to be extended to
  cover more of the sandbox policy. Refer to the ["Memory Sealing of Sandbox
  Policy on
  Lock"](https://man.exherbo.org/syd.7.html#Memory_Sealing_of_Sandbox_Policy_Regions_on_Lock)
  section of the _syd_(7) manual page for more information.
- Document the option
  [`trace/allow_unsafe_namespace`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_namespace)
  in the _syd_(2) manual page.
- Fix panic in _syd-read_(1) by initializing static file descriptors
  using `syd::config::proc_init` which is a new requirement for
  `syd::fs::safe_canonicalize`.

# 3.33.0

- Teach _syd-lock_(1) about the new refined Landlock sandbox categorization
  using the `-l category[,category...]{+|-}path|port[-port]` argument.
  See _syd-lock_(1) and _syd_(7) manual pages for more information.
- When run without arguments _syd-lock_(1) now prints help and exits,
  rather than attempting to execute the default shell in vain.
- Move _kcmp_(2) from safe system calls to ptrace system calls. Among
  with _ptrace_(2), _process_vm_readv_(2), and _process_vm_writev_(2),
  this system call is now always denied unless
  [`trace/allow_unsafe_ptrace:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ptrace)
  is passed at startup. Previously _kcmp_(2) was always allowed. This is
  consistent with the Linux kernel requirement of
  `PTRACE_MODE_READ_REALCREDS` against both pids.
- Extend the `SCM_CREDENTIALS` process ID check to
  check whether the argument pid shares the same
  address space with the _seccomp_(2) request tid.
  This fixes vala's dbus tests, see: #78.
- Check file descriptor argument early in _fallocate_(2),
  _fstatfs_(2) and _ftruncate_(2) handlers. This is
  consistent with the Linux kernel. See #224 for the
  test failure identifying the bug.
- Add rule `allow/lock/readdir+/` to the paludis profile
  to avoid test failures wrt. opening the root directory.
  See #208, #212, and #219 for examples.
- Refine Landlock sandbox categories. Add the new [Lock
  sandboxing](https://man.exherbo.org/syd.7.html#Lock_Sandboxing)
  categories `lock/exec`, `lock/ioctl`, `lock/create`, `lock/delete`,
  `lock/rename`, `lock/symlink`, `lock/truncate`, `lock/readdir`,
  `lock/mkdir`, `lock/rmdir`, `lock/mkdev`, and `lock/mkfifo`. The
  `lock/bind` category has been changed to accept an absolute path
  name to confine UNIX domain socket creation, renames and links.
- Add new sandboxing category `rmdir` to confine directory deletion.
  Previously, this type of access was confined with the `delete` category.
- Teach _syd-ls_(1) to list all the files in current working directory if no set
  name is given. The file names are printed hex-encoded, delimited by newline.
  Use the new stream mode of _syd-hex_(1) with `syd-hex -ds` to decode.
- Teach _syd-ls_(1) the new `ebpf` system call set.
- Teach _syd-hex_(1) to continue in case of stream mode errors with `-C` or
  `--continue-on-failure`.
- Teach _syd-hex_(1) stream mode with `-s` or `--stream`.
- Polish seccomp filter exporting and support the new environment
  variable `SYD_DUMP_SCMP` to export filters. This environment variable
  is equivalent to the `-E mode` command line option.
- Preallocate per Syd syscall handler thread, ie `syd_emu`, directory
  reading buffers to handle _getdents64_(2) system call at thread
  startup to avoid repeated allocation costs.
- Store the salt for key derivation function for
  [Crypt sandboxing](https://man.exherbo.org/syd.7.html#Crypt_Sandboxing)
  in secure memory and clear it once Linux Kernel Cryptography API
  (KCAPI) connection is established.
- Various minor fixes for profiling which uses `gperf` and `tcmalloc`
  via the `prof` build feature.
- Start using the `nix` crate to set _errno_(3),
  and drop the unused `errno` crate dependency.
- Support `features` subcommand for _syd-oci_(1).
  This subcommand was introduced in _runc_(1) by
  https://github.com/opencontainers/runc/pull/3296
  It is documented here:
  https://github.com/opencontainers/runtime-spec/blob/main/features-linux.md
- Add the new syscam call _uretprobe_(2) to the list of eBPF system
  calls. eBPF system calls are only allowed if
  [`trace/allow_unsafe_ebpf:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ebpf)
  is set at startup.
- Add the new system call _map_shadow_stack_(2) to the list of safe
  system calls. Safe system calls are passed directly to the host kernel
  without any filtering.
- Revert back to using upstream `libseccomp` crate now that it
  has support for `libseccomp-2.6`.
- List Linux Security Modules (LSMs) in `syd -V` output using the
  new _lsm_list_modules_(2) system call available in Linux-6.10 and
  newer.

# 3.32.7

- Keep IVs in secure memory for `ALG_SET_IV` control operations in
  _sendmsg_(2) and _sendmmsg_(2) handlers.
- Return `EACCES` rather than no-opping `set_*id` calls which attempt to
  transit to uids/gids below `UID_MIN` or `GID_MIN` respectively. This
  is only fixed in the second layer in the _seccomp_unotify_(2) hook.
  Syd's parent seccomp-bpf filter, which is the first layer, already
  returns `EACCES` in these cases.
- Fix pid check in `SCM_CREDENTIALS` control message handler.
- Protect against unknown errnos from returning a no-op
  in the _seccomp_unotify_(2) handler.
- Add `abort` to the list of actions in _syd_(2).

# 3.32.6

- Report the availability of the `log` feature in `syd -V` output.
- Revert back to using `mimalloc` as the default memory allocator.
- Revert `/proc/uptime` and `/proc/loadavg` randomization
  which was broken due to the conflict with restricting
  the _write_(2) system call in Syd emulator threads.
  The _sysinfo_(2) system call is still randomized and
  the `linux` profile no longer gives access to these
  files. Finally the `paludis` profile has been changed
  to allow access to these files.
- Remove the rule
  [`trace/allow_unsafe_open_cdev:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_open_cdev)
  from the `paludis` profile.
- Document the new API commands for the new `abort` action
  in _syd_(2) manual page.
- Do not drop the Linux capability `CAP_BPF` when
  [`trace/allow_unsafe_ebpf:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ebpf)
  is passed at startup.
- Remove the rule
  [`trace/allow_unsafe_ebpf:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ebpf)
  from the `paludis` profile.
- Add new environment variable `SYD_SKIP_SCMP` to skip _seccomp_(2)
  confinement of per-Syd threads. This is unsafe and should only be used
  for profiling. Syd will warn about this at startup. This was
  previously only done in debug mode.
- Document the new
  [`trace/allow_unsafe_chroot`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_chroot)
  in _syd_(2) manual page.
- Confine _fcntl_(2) operations of Syd emulator threads and the main
  wait thread to `F_GETFD`, `F_SETFD`, `F_GETFL`, `F_SETFL`,
  `F_OFD_SETLK` and `F_OFD_SETLKW` operations. Attempting to run any
  other _fcntl_(2) operation results in an immediate termination of Syd
  and all processes running under it.
- Confine _fcntl_(2) operations of Syd AES threads to `F_GETFD`,
  `F_SETFD` and `F_OFD_SETLKW` operations. Attempting to run any
  other _fcntl_(2) operation results in an immediate termination
  of Syd and all processes running under it.
- Deny _write_(2) and _writev_(2) system calls to the Syd emulator
  threads and the Syd main process using the per-thread _seccomp_(2)
  filter unless `trace/memory_access` has been manually set at startup
  to one of the modes that allow _proc_pid_mem_(5) access in which case
  the _write_(2) system call is necessary. Note, _write_(2) calls to the
  logging file descriptor are an exception to this rule and are allowed
  in case logging is enabled at startup. Denying access to the
  _write_(2) system call by default in Syd emulator threads raises the
  bar for an attacker trying to exploit via BROP.
- Check and print support for `CONFIG_CROSS_MEMORY_ATTACH` option
  in the running host Linux kernel in version output with `syd -V`,
  and warn about the insecurity when the support is lacking.
- Add option `trace/memory_access:0` to the `paludis` profile to
  fallback to _proc_pid_mem_(5) access automatically in case
  `CONFIG_CROSS_MEMORY_ATTACH` is not enabled. The lack of page
  protections is irrelevant in package build context and we care
  more about compatibility across various Linux kernels in this
  profile.
- Add new
  [`trace/memory_access`](https://man.exherbo.org/syd.2.html#trace/memory_access)
  mode `2` which uses cross memory attach unconditionally. This is the
  new secure default which used to be to fall back to _proc_pid_mem_(5)
  if the host Linux kernel is not configured with the
  `CONFIG_CROSS_MEMORY_ATTACH` option. _proc_pid_mem_(5) access is
  dangerous because it does not honour the memory page protections
  of the target process unlike the _process_vm_readv_(2) and
  _process_vm_writev_(2) system calls, therefore Syd can be (ab)used
  as a confused deputy to corrupt/control sandbox process memory in
  this mode of access.
- Fix _proc_pid_mem_(5) write access which was broken in version 3.30.0,
  during procfs hardening part of the new safe canonicalization.

# 3.32.5

- Make Syd's _kill_(2) family system call protector return `EACCES` on
  failures rather than returning 0 to the system call therefore turning
  the system call into a no-op. This is done regardless whether Syd is
  pid=1 in a user-namespace and there's a kernel level _seccomp_(2) bpf
  filter to allow system calls when the dummy signal 0 is specified.
- Detail "FILES" section of _syd-emacs_(1) manual page.
- Avoid an extra allocation during truncation in _getsockname_(2)
  handler for UNIX socket _bind_(2) maps.
- Fix network address and length memory writes in _accept_(2), and
  _accept4_(2) handlers. Without this fix, Syd could write up to
  typically 112 (128 - 16) bytes of potentially user-controlled data,
  which is partly initialized by the return address from the host Linux
  _accept4_(2) system call and partly an undefined memory region into an
  area in the address space of the same sandbox process. This happens in
  unsafe code crossing FFI boundaries, `struct sockaddr_storage` which
  is picked as "large enough to hold any `sockaddr` (except `AF_UNIX`)"
  typically has a size of 128 bytes, meanwhile `struct sockaddr_in`
  typically has a size of 16 bytes, therefore a vulnerable Syd can
  potentially write up to 112 undefined bytes into an area potentially
  out of bounds in sandbox process memory. The commit
  [2cd7dccee](https://gitlab.exherbo.org/sydbox/sydbox/-/commit/2cd7dccee59069d79be1748fb9a6ba6e376c1651),
  fixes the core issue, and
  [b306703b3](https://gitlab.exherbo.org/sydbox/sydbox/-/commit/b306703b396575d1ea8a78190d0f4c4487c87da7)
  further hardens the _accept_(2) and _accept4_(2) system call handlers
  against unsafe behaviour during address truncation. **This is a
  security issue and users are recommended to update asap.** Huge kudos
  to kepstin and mixi for identifying and fixing the bug that originated
  from a ftp test failure part of the test-suite of the
  [`net-misc/wget`](https://summer.exherbo.org/packages/net-misc/wget/index.html)
  [Exherbo Linux](https://www.exherbo.org/) package.
- Allow interrupt threads to run the _sigprocmask_(2) and
  _rt_sigprocmask_(2) system calls.
- Allow interrupt threads to run the _sigaltstack_(2) system call.
- Add option `trace/allow_unsafe_prlimit:1` to the `debug` profile
  to ease generating coredumps.
- Add option `trace/allow_unsafe_prctl:1` to the `paludis` profile
  because perl tests checks setting process name using _prctl_(2)
  `PR_SET_NAME` operation.
- Allow `read` and `stat` access to `/proc/uptime` and `/proc/loadavg`
  files in the `linux` profile to provide the randomized versions of the
  files by default.
- Provide virtualized versions of `/proc/uptime` and `/proc/loadavg`
  files consistent with the _sysinfo_(2) randomizer. This access is
  subject to sandbox policy check and can be disabled with
  `trace/allow_unsafe_sysinfo:1`.
- Improve exit tracing in syscall monitor and emulator threads.
  by proactively closing the seccomp-notify file descriptor.
- Grant `/proc` PID traversals, ie identifying fellow processes by
  _readdir_(2)'ing `/proc`, for the `paludis` profile using the rule
  `allow/stat+/proc/[0-9]*`. This is done because package tests often
  assume they can identify fellow processes by _readdir_(2)'ing the
  `/proc` directory. In contrast, the default secure `linux` profile
  denies this access because it is an information leak.
- Grant `/proc` wide access to the `stat` files for the `paludis`
  profile. This is often useful in package testing when packages
  assume files such as `/proc/1/stat` is accessible.
- Grant `read` and `stat` access to `/proc/self/stat` and
  `/proc/self/task/*/stat` files for the `linux` profile. This is
  consistent with the file `/proc/stat` which is given `read` and `stat`
  access in the `linux` profile.
- Add `trace/allow_unsafe_magiclinks:1` to the `paludis` profile.
- Improve initial core system call emulator thread spawning procedure.
- Add new environment variable `SYD_NPROC_MAX` to define the number of
  maximum number of syscall handler threads. The number must be greater
  than the value of `SYD_NPROC` which defaults to the number of CPUs.
  The default value of `SYD_NPROC_MAX` is currently `usize::MAX`.
- Add `abort` to the list of available actions which causes Syd to deny
  the system call, warn and send the sandbox process a `SIGABRT` signal.
  This action is intended for _pledge_(2) compatibility.

# 3.32.4

- Add `trace/allow_unsafe_sysinfo:1` to the `paludis` profile.
- Add option `trace/allow_unsafe_sysinfo:1` to disable the _sysinfo_(2)
  randomizer.
- Add `trace/allow_unsafe_chroot:1` to the `paludis` profile.
- Add option `trace/allow_unsafe_chroot:1` to turn the _chroot_(2)
  system call into a no-op like it's done by default for the
  _pivot_root_(2) system call.
- Add the new system calls _listmount_(2) and _statmount_(2) to
  the set of the `mount` system calls.
- Add the system calls _lsm_get_self_attr_(2), _lsm_set_self_attr_(2),
  and _lsm_list_modules_(2) to the list of `dead` syscalls. These system
  calls will always error for sandbox processes and Syd.
- The system calls _setxattr_(2) and _setxattrat_(2) now deny access to
  the `user.syd.*` xattr namespace with the errno `EACCES` rather than
  `ENODATA`.
- Add handlers for system calls _getxattrat_(2), _setxattrat_(2),
  _listxattrat_(2), and _removexattrat_(2) which are new in Linux>=6.13.
  _getxattrat_(2) and _listxattrat_(2) are confined as part of `stat`
  sandboxing, meanwhile _setxattrat_(2) and _removexattrat_(2) are
  confined as part of `chattr` sandboxing. Syd's restrictions on
  `user.syd.*` xattr namespace is applied for these system calls as
  well.
- Add the new system call _mseal_(2) to the list of allowed system calls.
- Allow the flag combination `O_PATH|O_NOCTTY` in _open_(2) system call
  handlers. Previously an `EINVAL`, aka "Invalid argument" error was
  returned in this case which notably breaks on Alpine Linux.
- Remove the overly-complex and racy `path->O_PATH-fd` cache and the
  configuration option `cache/capacity/fd`.
- Print the status of the kernel BPF JIT compiler in Syd version output.
- _syd-hex_(1) now refuses to output to standard output in case standard
  output is attached to a TTY when decoding hexadecimal input. The new
  command line flags `-f` and `--force-tty` may be used to
  override this check.
- Mask control characters in pathnames listed in `/proc/pid/maps` for
  logging.
- Set `log/verbose:false` for the `paludis` profile.
- Unmask the file `/proc/version` for the `paludis` profile. This
  file is masked by the `linux` profile for consistency with _uname_(2)
  restrictions.
- Fix adding watches for symbolic links in _inotify_add_watch_(2) handler.
- Fix adding watches for directories in _inotify_add_watch_(2) handler.
- Improve core thread spawn at startup for quicker boot times.
- Harden `syd::pool::ThreadPool` against DOS attacks utilizing blocking
  _open_(2) calls.
- Avoid busy looping in Syd interrupt thread and wait on a condition variable.
- Refine Chroot sandboxing, see
  [sandbox/chroot](https://man.exherbo.org/syd.2.html#sandbox/chroot)
  section of the _syd_(2) manual page for more information.
- Remove the incorrect validation where setting both of the flags
  `AT_SYMLINK_NOFOLLOW` and `AT_EMPTY_PATH` would fail the respective
  system call to fail with `EINVAL`.
- Grant `read` and `stat` access to the file `/etc/man_db.conf` for
  the `linux` profile.
- Grant `read`, `stat`, `chdir` and `readdir` access to the directory
  `/etc/groff` recursively for the `linux` profile.
- Grant `read` and `stat` access to the file `/etc/locale.conf` for
  the `linux` profile.
- Setting the option `log/verbose:0` no longer implies line-oriented
  JSON. Line-oriented JSON is controlled by TTY detection and can be
  explicitly set using the environment variables `SYD_FORCE_TTY` and
  `SYD_QUIET_TTY`.
- Change deny action for _dlopen_(3) on a library with executable stack
  to `EACCES` rather than `kill`.
- Return `EACCES`, aka "Access denied", rather than `ENOENT`, aka "No
  such file or directory" for PID mismatches in hardened procfs checks.
  The old behaviour confused programs such as pipewire which check
  for flatpak support using procfs magic symbolic links.
- Allow passing files of unknown types such as event fds and epoll fds
  as part of the `net/sendfd` category. Notably, pipewire depends on
  this functionality. File descriptors referring to block devices,
  directories and symbolic links are still denied.

# 3.32.3

- Grant `read`, `stat`, `chdir` and `readdir` access to the
  directory `/etc/ca-certificates` recursively for the `linux`
  profile.
- Fix _sysinfo_(2) system call randomizer for musl systems.
- Fix a problem with fd-invalidation of fd-path cache. Notably, this
  makes concurrent programs written in golang work under Syd without any
  issues. Previously running such programs would give `EEXIST`, aka
  "File exists", errors sporadically.
- Fix a race with concurrent exclusive creating _open_(2) calls.
- Refine file type validations in _open_(2) system calls.
- Use OS random number generator for FD randomization to mitigate races.
- Ensure no non-standard file descriptors are leaked into the process
  executed by the command `cmd/exec`.
- Ensure the command executed by `cmd/exec` is correctly daemonized.
- Grant `read` and `stat` access to the files `/proc/{cpu,mem}info` and
  `/proc/crypto` for the `paludis` profile.
- Refine access rights of the `/proc/self/fd` directory for the `linux` profile.
- Return `EISDIR` on attempted write opens on directories.
- Grant `stat`, `read`, `chdir` and `readdir` access to the
  `/proc/sys/fs` directory recursively for the `linux` profile.
  Note `linux` profile already allows `/proc/sys/kernel` and
  `/proc/sys/vm` so this is consistent.
- Fix an issue with `l{get,set,remove}xattr` handlers. Previously these
  system call handlers incorrectly returned `ENOTSUP` for paths whose
  last component is a dot, aka `.`.
- Fix `trace/allow_safe_bind` option to correctly allow UNIX abstract
  sockets and unnamed UNIX sockets.
- Fix an issue with setting open file resource limits. Notably, this
  fixes the `test-dup2` test of gnulib.
- Fix an issue with path canonicalization regarding `procfs` files.
- Fix PID calculation for `procfs` in safe path checker.
- Fix access violation reporting for path hiding.
- Remove the _kill_(2) system call from the list of allowed system calls
  in `syd_emu` emulator threads. Note, the `kill` action already uses
  pidfds and _pidfd_send_signal_(2) for race-free signal delivery hence
  _kill_(2) is not needed.
- vim: highlight the new option
  [`trace/allow_unsafe_ebpf`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_ebpf).

# 3.32.2

- Fix a build regression in `syd-test` on arm, loongarch64 and riscv64
  due to missing _open_(2) syscall.

# 3.32.1

- Handle `EINVAL`, aka "Invalid argument" gracefully when loading
  _seccomp_(2) filters for _syd-elf_(1).
- Remove the (now-defunct) utility _syd-chk_(1).
- Add the option `trace/allow_unsafe_ebpf:1` to the `paludis` profile.
- Add the option `trace/allow_unsafe_cbpf:1` to the `paludis` profile.
- Add option `trace/allow_unsafe_ebpf:1` to allow direct eBPF use.
- Deny _seccomp_(2) system call in per-thread seccomp filters of Syd's
  emulator and encryptor threads to avoid potential confused deputy
  problems.
- Deny sandbox processes from installing additional _seccomp_(2) cbpf
  filters by default. This restriction can be lifted at startup with the
  new option
  [`trace/allow_unsafe_cbpf:1`](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_cbpf)
  **This is a security issue, users are recommended to update asap:**
  Lack of this mitigation potentially allows sandbox processes to
  install more precedent actions than `seccomp-unotify` and thereby
  bypass Syd's own _seccomp_(2) cbpf filters.
- _syd-ls_(1) learned the `futex` set to print the list of _futex_(2)
  family system calls.
- Allow the _swapcontext_(2) system call by default. Syd used to deny
  this PowerPC-only system call unconditionally.
- Allow _futex_requeue_(2), and _futex_wait_(2) system calls by default.
  Note, Syd already allows the system calls _futex_(2),
  _futex_time64_(2), and _futex_waitv_(2) so this is consistent.
- Return `EEXIST` in _mkdir_(2) handler if path exists after access check.
- Avoid raising `mkdir` access violations for paths that already exist.

# 3.32.0

- Add rules `allow/net/bind+!unnamed` and `allow/net/connect+!unnamed`
  to the `linux` profile to grant network access to unnamed UNIX
  sockets.
- Confine network system calls to unnamed UNIX sockets
  using the dummy path "!unnamed" during access check.
  Previously only the `net/sendfd` used this confinement,
  meanwhile `net/bind` and `net/connect` groups always allowed access to
  unnamed UNIX sockets.
- Prefix UNIX abstract sockets with the "@" character
  before access check for clear distinction between
  UNIX domain and abstract sockets.
- Fix build on libseccomp versions older than `2.6`.

# 3.31.0

- Fix an integer overflow in _sysinfo_(2) uptime randomizer.
- Rewrite option parsing to use the `lexopt` crate rather than `argv`
  and `getargs` crates. Make option parsing [POSIXly
  correct](https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html#tag_12_02).
- Set option `trace/allow_unsafe_open_cdev:1` for the `paludis` profile.
- Add new option `trace/allow_unsafe_open_cdev` to access per-process
  character devices, such as `/dev/kfd` of AMD GPUs. See [the
  documentation of this
  option](https://man.exherbo.org/syd.2.html#trace/allow_unsafe_open_cdev)
  in _syd_(2) manual page for the security implications.
- Rename option `trace/allow_unsafe_open` to
  `trace/allow_unsafe_open_path` for clarity.
- Ghost mode can now be entered even if Crypt sandboxing is on.
  Previously the `ghost` command returned `EBUSY` in this case.
- Add the system calls _sched_setattr_(2) and _sched_setparam_(2) to the
  list of nice system calls. See `syd-ls nice` for the complete list.
  These system calls are denied unless `trace/allow_unsafe_nice:1` is
  passed at startup.
- Add `nice` to the list of syscall groups listed by _syd-ls_(1).
- Move the rule `allow/net/sendfd+!unnamed` from the `paludis` profile
  to the `linux` profile which is also included by the `user` profile.
- Change the dummy path to confine sending file descriptors
  to unnamed sockets from "/dev/null" to "!unnamed" for clarity.
- Disallow sending file descriptors referring to block devices,
  directories and symbolic links using the _sendmsg_(2) and
  _sendmmsg_(2) system calls. This is in alignment with OpenBSD
  _pledge_(2) which disallows file descriptors referring to directories
  from being sent.
- Rename sandboxing category `net/send` to `net/sendfd` for clarity.
- Split `node` sandboxing category into two new categories: `mkdev` to
  confine character device creation, and `mkfifo` to confine named pipe
  (FIFO) creation.
- Split `attr` sandboxing category into three new categories: `chmod` to
  confine mode changes on files, `chattr` to confine extended attribute
  changes on files, and `utime` to confine last and modification time
  changes on files.
- Add new sandboxing category `mkdir` to confine directory creation.
  Previously, this type of access was confined with the `create` category.
- Rename sandboxing category `tmpfile` to `mktemp` for clarity.
- Rename sandboxing category `link` to `symlink` for clarity.
- Stop using the `os_rng` feature of the `rand_core` crate which would
  cause Syd to leak a file descriptor to `/dev/random` or `/dev/urandom`
  to the sandbox process in some cases. Instead, use the libc function
  _getentropy_(3) to seed the PRNG. _getentropy_(3) is an OpenBSD
  innovation, and is implemented in recent glibc and musl versions.
- Precompute the main _seccomp_(2) filter before loading it in the
  sandbox process.
- Allow the system calls _atomic_barrier_(2), _atomic_cmpxchg_32_(2),
  and _getpagesize_(2).
- Allow the new system call _set_mempolicy_home_node_(2). Note,
  syd already allows _set_mempolicy_(2) so this is consistent.
- Allow `node` access to `/dev/shm`, `/var/cache`, `/var/tmp` and `/tmp`
  directories for the `linux` profile.
- Grant read access to `/var/db/paludis` for the `paludis` profile.
- Add support for Loongarch64 architecture, 比赛开始了，革命万岁！
- Add support for MIPS architectures.
- Avoid hardcoding _fchmodat2_(2) syscall number in chmod handler.
- Upgrade `rand_hc` crate from `0.3` to `0.4`.
- Upgrade `rand_core` crate from `0.6` to `0.9`.

# 3.30.1

- Fix rootless container detection for _syd-oci_(1).
- Fix _connect_(2) on sockets with `AF_UNSPEC` specified as socket family.
- Fix an IPv6-only DNS-name resolution issue in `syd::dns` module.
- _syd-dns_(1) has been promoted to a core utility and installed without
  the `utils` feature.
- _syd-dns_(1) learned _-R_ to do reverse-DNS lookups using the system's
  DNS resolver.
- Allow _set_mempolicy_(2) system call by default which is used by FF.
- Handle `EINVAL` gracefully for _fdatasync_(2) system call during
  logging. This error indicates the system call was called on a file
  descriptor pointing to a special file (pipe, socket etc.)
- Allow access to `/etc/authselect/nssswitch.conf` file for the `linux`
  profile.
- Allow access to `/etc/GREP_COLORS` file for the `linux` profile.
- Allow access to `/etc/terminfo` directory for the `linux` profile.
- Allow _bind_(2) calls with port zero for Landlock in the `paludis`
  profile.

# 3.30.0

- Prevent repeated successful _bind_(2) calls to the same address
  does from overflowing the sandbox policy with
  `trace/allow_safe_bind:1`.
- Set option `trace/allow_unsafe_nice:1` for the `paludis` profile.
- Reintroduce nice and ionice restrictions. Add option
  `trace/allow_unsafe_nice` to disable.
- oci: Upgrade `youki` and dependencies from to version `0.5`.
- Fix offset and length argument handling of the _fallocate_(2) handler
  on 32-bit systems.
- Add new builtin profile `enforce` to easily set default
  action back to `Deny`, useful in undoing `oci` and `trace`
  profiles.
- The `load` command may now be used to load builtin profiles.
- Add the rule `trace/allow_unsafe_nopie:1` to the `oci` profile.
  This is because most containers ship non-PIE binaries, and
  the `oci` profile is only supposed to be run during container
  learning mode.
- Harden the `user` profile by including the `immutable` profile.
- Set sandbox lock to `exec` for the `oci` profile.
- Make `oci` profile more useful utilizing the `trace` profile
  with `trace/allow_safe_syslog:1`.
- Set `log/level:verbose` for the `user` profile.
- Add `trace/allow_safe_syslog:1` to the `user` profile.
- Add option `trace/allow_safe_syslog:1` to allow access to Syd's
  _syslog_(2) emulation using _dmesg_(8). Without this option
  a process needs access to the sandbox lock to use _dmesg_(8).
  Note, this option has nothing to do with access to the host _syslog_(2)
  which is never allowed.
- Allow read access to system shell initialization files for the `user`
  profile.
- Use CPU pinning for emulator threads to improve performance.
- Replace `parking_lot` crate with stdlib locks.
- Add `trace/allow_unsafe_spec_exec:1` to the `paludis` profile.
- The `silent` profile has been renamed to `quiet`.
- Set `log/verbose` to off for the `trace` profile.
- The new `log/verbose` setting which is on by default may now be used
  to reduce log size.
- The new `log/syslog` setting may now be used in configuration
  to disable logging to host _syslog_(3). This is enabled unless
  `SYD_NO_SYSLOG` is set at startup.
- The new `log/level` setting may now be used in configuration
  to define the log level. Log level defaults to "warn" unless
  `SYD_LOG` environment is set at startup.
- Implement a _syslog_(2) interface to maintain a ring buffer
  of access violations. This allows the sandbox process to
  access these logs using _dmesg_(1) from within the sandbox
  given that the sandbox lock allows it. Above all, this
  provides a practical way to use learning mode for containers
  spawned with _syd-oci_(1).
- The environment variable `SYD_NPROC` can now be used to
  define the number of core syscall handler threads. If unset,
  this defaults to the number of CPUs on the system.
- Add rules `allow/lock/bind+1024-65535` and
  `allow/lock/connect+1024-65535` to the `paludis` profile.
- Fix Landlock _ioctl_(2) request support which is new in Landlock ABI 5
  and newer which requires Linux-6.10 or newer.
- Add option
  [`trace/sync_seccomp`](http://man.exherbo.org/syd.2.html#trace/sync_seccomp)
  to use synchronous mode for seccomp-notify which defaults to false
  unless `SYD_SYNC_SCMP` environment variable is set at startup.
- Change Force sandboxing default action from `kill` to `deny`. Now that
  we hook into entry of _execve_(2) we're able to deny execution before
  it happens.
- Change SegvGuard default action from `kill` to `deny`. Now that we
  hook into entry of _execve_(2) we're able to deny execution before
  it happens.
- Abort with error if a specified configuration file has a symbolic
  link in _any_ of its path components.
- Replace the `rustc-hash` crate with the `ahash` crate for hashmaps and
  hashsets.
  The former is not safe to run on untrusted input.
- Support arbitrarily long path names in syscall file descriptor
  arguments, and sandbox process cwd. Notably, this fixes the
  longstanding failure of gnulib's test-getcwd under Syd.
- Add new utility _syd-asm_(1) to disassamble raw bytes and print them
  as a sequence of JSON lines. The disassembly is done natively for
  architectures *x86*, *x86_64*, *x32*, *arm*, *aarch64*, and *riscv64*
  and falls back to GNU _objdump_(1) for other architectures. There's no
  support for LLVM _objdump_(1) yet.
- Add `trace/allow_unsafe_sigreturn:1` to the `paludis` profile.
- Add a mitigation to effectively [`detect and prevent
  SROP`](http://man.exherbo.org/syd.7.html#Mitigation_Against_Sigreturn_Oriented_Programming_(SROP)).
- Confine _ioctl_(2) operations for Syd emulator threads to a restricted
  set of seccomp operations on the seccomp-notify fd only.
- Confine _epoll_(7) operations for Syd emulator threads and the main thread
  to a restricted set of epoll operations on the epoll fd only.
- Support the `SYD_PID_FN` environment variable to specify path to a pid
  filename into which Syd will write its process ID at startup. The file
  must not exist and is going to be created with user-only read
  permissions.
- Add a pidfd cache to only ever open each pidfd once in its lifetime.
  The file descriptors are retired effectively using _epoll_(7).
- Handle interrupts in blocking _creat_(2), _open_(2), _openat_(2),
  _openat2_(2), _fallocate_(2), _ftruncate_(2), _fstatfs_(2), _accept_(2),
  _connect_(2), _sendto_(2), _sendmsg_(2), and _sendmmsg_(2) system calls.
- Log path hiding with `info` level unless explicitly specified to warn.
- Add new sandboxing categories [`Rename
  Sandboxing`](http://man.exherbo.org/syd.7.html#Create/Delete/Truncate/Rename/Link_Sandboxing)
  and [`Link
  Sandboxing`](http://man.exherbo.org/syd.7.html#Create/Delete/Truncate/Rename/Link_Sandboxing)
  to confine file renames and symlinking. Previously these types of access was
  checked under Create sandboxing.
- Workaround uninterruptible FIFOs by monitoring for signals in
  the sandbox process.
- The option `trace/allow_unsafe_debug` has been replaced with two
  more refined options `trace/allow_unsafe_ptrace` and
  `trace/allow_unsafe_perf`. The meaning of `trace/allow_unsafe_exec`
  has been changed.
- Add new sandboxing categories [`Chdir
  Sandboxing`](http://man.exherbo.org/syd.7.html#Chdir_Sandboxing) and
  [`Readdir
  Sandboxing`](http://man.exherbo.org/syd.7.html#Readdir_Sandboxing)
  to confine directory changes and listings.
- Harden the existing _exec_(3) ptrace hook, do checks
  both at syscall entry and ptrace exec event so that
  both scripts and binaries are covered.
- Implement a safe _chdir_(2) hook based on _ptrace_(2).
- Start hooking into _fchdir_(2) for stat sandboxing again.
- Bring back the `shellexpand` dependency, set
  [`config/expand`](http://man.exherbo.org/syd.2.html#config/expand)
  to zero seconds and use `shellexpand` rather than _wordexp_(3) unless
  a timeout is set. This runs much faster as it does not require
  confinement, however it does not support command substitution and
  recursive environment variable expansion like _wordexp_(3) does.
- Fix `RESOLVE_BENEATH` handling in _openat_(2) handler.
- Start using a cryptographically secure random number generator that
  uses the HC-128 algorithm rather than relying on _getrandom_(2)
  with `GRND_RANDOM` which is slow and overkill.
- Stop hooking into _getrandom_(2) for Read sandboxing. Since
  this system call is soon to be provided by VDSO, there's
  little point.
- Fix a TOCTTOU vector in _mmap_(2) handler.
- Rework path canonicalization making it more efficient and secure
  it against magic symbolic links.
- Rework the `syd::proc` module based on _openat2_(2) system call
  for `/proc` access disabling symbolic link resolution where possible.
- Support the environment variables `SYD_FORCE_TTY` and `SYD_QUIET_TTY`
  to fine tune log format. The former forces pretty-printed JSON,
  whereas the latter disables TTY detection and forces line-oriented
  JSON.

# 3.29.4

- Deny access to the files `/proc/sys/kernel/modprobe` and
  `/sys/kernel/notes` for the `immutable` profile using bind
  mounts. This is consistent with the `linux` profile which
  masks these files.
- Fix bind mound error reporting on non-existent mount-points.

# 3.29.3

- Add new utility _syd-emacs_(1) which is a convenience
  wrapper to run Emacs under Syd.
- Respect magic paths for _access_(2) family system calls.
- Add magic path `/dev/syd.el` to get `syd.el`.
- Add magic path `/dev/syd.sh` to get `esyd` helper function.
- Add CLI option `syd --el` to output `syd.el`.
- Start shipping `syd.el` with Syd rather than libsyd.
- Fix a regression of _stat_(2) handler in handling magic paths.

# 3.29.2

- Fix a regression in unit tests.

# 3.29.1

- Mask the file `/proc/sys/kernel/modprobe` in `linux` profile.
  Modification of this file requires no capabilities (can cause
  arbitrary code to be inserted into the kernel via a replacement
  modprobe). See
  <https://forums.grsecurity.net/viewtopic.php?f=7&t=2522> for more
  information.
- Add `FIBMAP` to the default _ioctl_(2) denylist. Coupled with the
  `CAP_SYS_RAWIO` capability, this _ioctl_(2) operation which would
  potentially allow for exploitation of the kernel via the handling of
  input it doesn't expect from untrusted sources. See
  <http://linux.derkeiler.com/Mailing-Lists/Kernel/2007-11/msg07723.html>
  for the reason for FIBMAP being privileged, and
  <http://linux.derkeiler.com/Mailing-Lists/Kernel/2007-11/msg07723.html>
  for further discussion.
- Add `KDSETKEYCODE` to the default _ioctl_(2) denylist. Coupled with
  the `CAP_SYS_TTY_CONFIG` capability, this _ioctl_(2) operation can be
  used by an attacker to temporarily change the keyboard mapping of an
  administrator's tty to cause a different command to be executed than
  intended. See <https://forums.grsecurity.net/viewtopic.php?f=7&t=2522>
  for more information.

# 3.29.0

- Use TCP Fast Open for _syd-tor_(1).
- Add new utility _syd-pds_(1) to run a command with the parent death
  signal set.
- Sync [`ioctl/allow`](https://man.exherbo.org/syd.2.html#ioctl/allow),
  and [`ioctl/deny`](https://man.exherbo.org/syd.2.html#ioctl/deny)
  defaults with Landlock ABI 5 ioctl device defaults.
- Confine abstract unix socket namespace and signaling with Landlock ABI
  6 and later.
- The command
  [`allow/lock/write`](http://man.exherbo.org/syd.2.html#allow/lock/write)
  now includes _ioctl_(2) operations with Landlock ABI 5 and later.
- Add new command
  [`allow/lock/connect`](http://man.exherbo.org/syd.2.html#allow/lock/connect)
  to confine _connect_(2) ports using Landlock ABI 4 and later.
- Add new command
  [`allow/lock/bind`](http://man.exherbo.org/syd.2.html#allow/lock/bind)
  to confine _bind_(2) ports using Landlock ABI 4 and later.
- Support Landlock ABI v{4..=6}.
- `syd-lock` has been promoted to core tools and is now installed
  regardless of the `utils` feature.
- Compare HMAC for Crypt sandboxing in constant time.
- Compare checksums for binary verification in constant time.
- Remove the unused `pandora` profile.
- Make wordexp proc mount non-fatal to avoid panics within
  presence of SELinux.
- Allow access to `/proc/filesystems`, `/proc/loadavg`, `/proc/stat`
  for the `linux` profile.

# 3.28.5

- Revert allowing _clone3_(2) for the Syd process, as such
  a comprimised Syd process cannot create sub-namespaces,
  and circumvent sandbox policy this way.

# 3.28.4

- Allow _clone3_(2) system call for emulator and aes threads.
- Fix hiding of unsafe filenames for the _getdents64_(2) handler.
- Fix `tmpfile` access for `/tmp` and `/var/tmp` for the `linux` profile.
- Allow access to the `FS_IOC_SETFLAGS` _ioctl_(2) request for
  the `paludis` profile.
- Disallow access to the system console in `landlock` and `linux`
  profiles.
- Harden `/etc` rules of the `linux` profile.
- Allow read access to `/var/lib/sss/mc/{passwd,group}` files for
  `linux` profile. These files are needed for LDAP authentication.
- Log `/proc/self` in place of `/proc/${pid}` as necessary.
- Fix a minor bug with hidden check and `/proc` paths.

# 3.28.3

- Harden `linux` profile using stricter procfs rules utilizing
  `/proc/self`. This means, the sandbox processes are confined
  to access only their own per-process procfs directory.
- The identifier `/proc/self` may now be used in _glob_(3) rules, which
  is dynamically updated to the PID of the sandbox process making the
  system call. This allows for stricter procfs rules by simply using the
  prefix `/proc/self` rather than `/proc/[0-9]*` in _glob_(3) rules.
- Grant access to `/proc/filesystems` file in the `linux` profile.
- Grant access to `/proc/pid/attr` directory in the `linux` profile.
- Move default mask rules to the `linux` profile.
- Filter process name change attempts for the `paludis` profile.
- Allow read and stat access to the files `/proc/pid/m{aps,ounts}` for
  the `linux` profile. These files are masked by the `linux` profile.
- Provide more fields for _syd-stat_(1) using the file `/proc/pid/stat`.

# 3.28.2

- Fix permissions for `/var/tmp` for `landlock` and `linux` profiles.
- Log emulator panics.
- Crypt sandboxing now implies `trace/exit_wait_all:1` so as not
  to leave any impartial encryption processes behind.
- Fix NULL path handling for _utimensat_(2) and _fanotify_mark_(2).
- Fix a concurrency issue with Crypt sandboxing.
- Log failed sandbox queries with the `info` level rather than `warn`.
- Allow file deletion under `/dev/shm` for the `linux` profile.
- Allow the system call _fallocate_(2) for system call handler threads,
  so it can actually be emulated.
- Fix _ftruncate_(2) on encrypted files.
- Align _sysinfo_(2) random memory sizes with powers-of-two.
- Change safe file opener to do a turn of `O_PATH` _open_(2), followed
  by a _statx_(2) and `/proc/self/fd` _open_(2). Previously Syd did a
  single non-blocking _open_(2).

# 3.28.1

- Avoid binary search in _seccomp_(2) filters. Use manually set
  priorities based on _strace_(1) count information.
- Fix a 32-bit compilation issue with the new _sysinfo_(2) handler.
- Fix a compilation issue on aarch64.

# 3.28.0

- Add new tool _syd-info_(1) to print system information.
- Add options `-c` and `-C` to _syd-path_(1) to calculate CRC32 and CRC64
  checksums respectively.
- Add options `-c` and `-C` to _syd-sha_(1) to calculate CRC32 and CRC64
  checksums respectively.
- Add `crc32` and `crc64` to the list of supported checksum algorithms
  for Force sandboxing.
- Change project license from `GPL-3.0-or-later` to `GPL-3.0`.
- Implemented stricter filename validation to deny unsafe or malicious
  filenames based on [Wheeler's Safename
  LSM](https://dwheeler.com/essays/fixing-unix-linux-filenames.html).
- Make `AT_SECURE` setter work regardless of the number of arguments
  passed to exec by the sandbox program. Previously if more arguments
  than a certain threshold were passed to the program the setter would
  fail with `EINVAL` and terminate the exec program.
- Update [Threat
  Model](http://man.exherbo.org/syd.7.html#Threat_Model) section in
  _syd(7)_ manual page to mention the sandbox lock and crypt sandboxing.
- Add new utility _syd-bit_(1) to flip random bits in files. We use this
  tool in our test-suite to verify Crypt sandboxing is safe against
  bit-flip attacks due to HMAC-SHA256 authentication.
- Prevent unsetting the `O_APPEND` flag using _fcntl_(2) `F_SETFL`
  command for append-only files. This could be used to clobber
  files which were marked `append` with Syd. Users are strongly
  recommended to update.
- Add back the utility _syd-key_(1) which can be used to generate
  random keys for Crypt sandboxing.
- Add back the utility _syd-aes_(1) which is an AES-CTR encryption and
  decryption utility which uses the Linux Kernel Cryptography API.
- Add back Crypt sandboxing with a revised implementation that allows
  for read-write and concurrent access. Encrypted files now have a magic
  header to easily identify them. Random per-file IVs are now
  prepended to files rather than stored in extended attributes
  allowing for safe backups. Integrity checking is implemented by
  adding a 32-byte HMAC-SHA256 tag which provides authentication and
  safety against bit-flip attacks.
- Add _syd-sh_(1) which is a simple confined shell.
- Add new utility _syd-rnd_(1) to print `AT_RANDOM` bytes in various
  formats.
- _syd-env_(1) has been promoted to a core tool and is now installed
  even without the `utils` feature. We use _syd-env_(1) in our
  test-suite to test environment expansion and command substitution.
- Implement a confined command substitution interface using
  _wordexp_(3). Both syntaxes `$(cmd)` and ``cmd`` are supported.
  Confinement is done using Landlock, namespaces, and seccomp.
- _syd-env_(1) learned the `-e eval-str` argument to perform environment
  expansion and command substitution on the given string using
  _wordexp_(3). _wordexp_(3) child process is executed in a confined
  environment with a timeout of 3 seconds.
- _syd-hex_(1) learned the `-l limit` argument to exit after limit
  number of characters are read and en/decoded.
- Set parent-death signal to `SIGKILL` as part of the confinement
  procedure of _syd-tor_(1). This is a second layer that ensures
  _syd-tor_(1) does not outlive the parent Syd process. The first layer
  is the pid file descriptor of the Syd process that _syd-tor_(1) holds
  and selects on as part of its epoll process.
- Make syd syscall emulator threads handle panics gracefully and deny
  the syscall in progress to avoid sandbox process hangs. Added new
  action `panic` to test this. This action is of little use outside
  of testing.
- Add `all` keyword as a placeholder to disable all path/glob based
  rules, e.g. `deny/all+${HOME}/.ssh/***` may be used to disallow
  all access to user ssh configuration directory. We plan to add
  this rule and more to the `user` profile for added hardening.
- Add new sandboxing type "tmpfile" to confine _open_(2), _openat_(2),
  and _openat2_(2) calls with the `O_TMPFILE` flag. Previously this
  access was checked under "write" sandboxing.
- Add new sandboxing type "attr" to confine changes to file attributes.
  This includes extended attributes. Previously this access was checked
  under "write" sandboxing.
- Add new sandboxing types "Create", "Delete", "Truncate" and "Node"
  sandboxing.  These types confine regular and special file
  creation/deletion respectively. Previously this access was checked
  under "write" sandboxing.
- Add new sandboxing type "net/send" which is to confine sending file
  descriptors over UNIX sockets.
- Harden path canonicalization against symbolic link attacks.
- Paths in rules can now be specified as hex-encoded strings as well.
- Improve startup process utilizing `CLONE_FILES` avoiding a
  _pidfd_getfd_(2) call.
- Harden the `immutable` profile by mounting the `/dev/shm` and `/tmp`
  tmpfs mounts with the `nosymfollow` option.
- Harden the `linux` profile by deny-listing common sensitive /etc
  paths, such as `/etc/crypttab`, and `/etc/shadow`.
- Support `nosymfollow` in
  [bind](http://man.exherbo.org/syd.2.html#bind) options.
- The restriction to turn the system calls _sync_(2), and _syncfs_(2)
  into no-operations (no-ops) can now be disabled with the new option
  `trace/allow_unsafe_sync:1`. This is useful in scenarios where sync is
  actually expected to work when sandboxing databases.
- Log and deny attempts to set process name with `PR_SET_NAME`
  _prctl_(2) request. To disable logging use `filter/read+!proc/name`,
  to allow setting process name inside the sandbox use
  `trace/allow_unsafe_prctl:1`.
- Improve efficiency of signal protection for Syd tasks by avoiding
  procfs reads during access check. Hook into _rt_sigqueueinfo_(2), and
  _rt_tgsigqueueinfo_(2) for signal protection. These system calls may
  be used to send signals to the Syd process and thereby interfere with
  the workings of the sandbox so we now prevent this.
- Add new tool _syd-cap_(1) to print information on Linux capabilities.
- Mask the files `/proc/meminfo`, `/proc/loadavg` and `/proc/version`,
  and return random data as return to _sysinfo_(2) system call to
  prevent information leaks.
- Applied various minor fixes to path hiding.
- Start to log access violations of the `stat` type, aka path hiding.
- Honour the environment variable `SYD_PROXY_PORT` to override the
  default value of `proxy/ext/port`.
- Honour the environment variable `SYD_PROXY_HOST` to override the
  default value of `proxy/ext/host`.
- The environment variable to pick the default shell has been
  changed from `SYD_SH` to `SYD_SHELL` for clarity.
- `proxy/ext/addr` option has been renamed to `proxy/ext/host` and
  now it supports resolving hostnames using the system DNS resolver.
  A random IP is selected in case of multiple responses.
- Add new utility _syd-dns_(1) to resolve hostnames to IP addresses
  using the system DNS resolver.
- PID sandboxing is now checked at _ptrace_(2)
  `PTRACE_EVENT_FORK|VFORK|CLONE` boundaries rather than at the entry of
  system calls with _seccomp_(2).
- Improve the efficiency of the pid-limiter of PID sandboxing.
- Improve logging to make it more elaborate and readable.
- Enable `preserve_order` feature of the `serde_json` crate for more readable logs.
- Further harden procfs and devfs with various restrictions. See the
  [Hardened procfs and
  devfs](http://man.exherbo.org/syd.7.html#Hardened_procfs_and_devfs)
  section of the _syd_(7) manual page for more information.
- The option `trace/force_cloexec` has been removed.
- Add new option `trace/allow_unsafe_magiclinks` to disable magic
  symbolic link restrictions. By default, Syd does not follow /proc
  magic symbolic links if the path process id does not match the caller
  process id.
- Avoid caching paths with `/proc/$pid` prefix during access check.
- The `:action` part of `force+/path:hashhex:action` may now be omitted
  in force rules in which case the action defaults to `kill`. This
  allows for more readable rules.
- Check both the path `/dev/tty` and the original controlling process
  terminal path for access for _open_(2), _openat_(2), and _openat2_(2)
  handlers. The access check with the more critical action wins.
  Previously only the original path was checked for access.
- Support the _openat2_(2) resolve flags `RESOLVE_BENEATH`,
  `RESOLVE_NO_MAGICLINKS`, `RESOLVE_NO_SYMLINKS`, and `RESOLVE_NO_XDEV`.
  Make flag `RESOLVE_IN_ROOT` return `ENOSYS`. The `RESOLVE_CACHED`
  option remains a no-op.
- Make `AT_SECURE` setter determine the address of stack using the
  less-privileged `/proc/pid/stat` file rather than the
  `/proc/pid/syscall` file whose access requires ptrace rights.
- Make `AT_SECURE` setter more efficient by reading less bytes from
  child memory.

# 3.27.0

- Mask the file `/etc/machine-id` by default.
- The utility `_syd-tick_(1)` has been renamed to `syd-tck` to
  reduce precious user typing time to invoke this utility.
- Enforce `AT_SECURE` in auxiliary vector at process exec. This
  mitigation may be relaxed with the option `trace/allow_unsafe_libc:1`.
- Add new tool _syd-aux_(1) to print auxiliary vector information.
- Remove _pipe2_(2), from the allowed system call list of emulator threads.
- `trace/allow_safe_bind:1` no longer makes Syd skip the IP blocklist
  check at _accept_(2) and _accept4_(2) boundaries.
- Do not check _accept_(2), and _accept4_(2) calls against the connect
  sandboxing acl. These system calls are checked against the IP
  blocklist only.
- Return `EACCES` rather than `ELOOP` error on procfs symlink
  violations. This is in consistency with SELinux and works around
  pipewire's broken flatpak detection logic.
- Add `trace/force_umask:7077` to the `user` profile. This setting has
  been tested for a long time at the CTF server using the CTF profile.
- Ensure _syd-elf_(1) asserts a single path is required as argument
  during option parsing. Previously, more than a single argument would
  pass through but only the first path is parsed either way.
- Pass `CLONE_IO` to syscall emulator micro-threads in addition to
  `CLONE_FILES`, `CLONE_VFORK`, `CLONE_VM`, and `CLONE_SIGHAND`.
- Use shared memory rather than pipes in syscall emulator micro-threads.
- Fix case-insensitivity of the _syd-err_(1) tool.
- Handle POSIX ACLs without reading on parent directory.

# 3.26.1

- Hook _getsockname_(2) and return correct path of UNIX domain sockets.
- Set `name/host` to `localhost` for the `paludis` profile.
- `name/host` and `name/domain` no longer imply `unshare/uts:1`. This
  is going to allow profiles such as the `paludis` profile who don't
  depend on namespaces to set a constant host-name and domain-name
  without having to check whether namespaces are supported. The values
  of these variables are inconsequential to the functioning of Syd
  otherwise.
- Return `ENOTCONN` rather than `ECONNREFUSED` on _sendto_(2),
  _sendmsg_(2), and _sendmmsg_(2) access violations. No changes in
  _bind_(2) which returns `EADDRNOTAVAIL` and _connect_(2) which returns
  `ECONNREFUSED`. Notably, this fixes python's `test_logging` under syd.
- Do not hook into _accept_(2) and _accept4_(2) system calls if the
  option `trace/allow_safe_bind:1` was set at startup.
- Add new tool _syd-net_(1) to aggregate IP networks.
- Add `block` command to configure an IP blocklist range for Connect
  network sandboxing. The range can also be populated by including
  ipset and netset files.
- _syd-cat_(1) learned the `-m magic` argument to run a magic command at
  init, and `-M magic` argument to run a magic command at exit.
- Implement rule de-duplication and aggregation when parsing ipset files.
- Replace the `ipnetwork` crate with the more versatile `ipnet` crate.
- _syd-cat_(1) now prints Syd configuration to standard output on
  success. JSON output format may be used with the new `-j` option, and
  compact JSON output format may be used with the new `-J` option. To
  display rules of profiles the new `-p <name>` option is required.
- _syd-cat_(1) learned to parse multiple paths supplied as
  command line arguments.
- _syd-cat_(1) learned to parse `.ipset` and `.netset` files.
- Added initial support for parsing `.ipset` and `.netset` files, which
  are common formats for IP blocklists. These files may be included
  with the `include` directive from within Syd configuration.
- File extension is now required in `include` paths. Currently,
  the only supported file extension is `.syd-3`.
- The option `trace/allow_safe_bind:1` causes Syd to skip the access
  check at _accept_(2)/_accept4_(2) boundary.
- Hook into _accept_(2) and _accept4_(2) system calls as part
  of connect network sandboxing.
- Avoid micro-thread creation in _connect_(2), _sendto_(2), and
  _sendmsg_(2) handlers.
- Reduce allocations when allocating buffers for paths.

# 3.26.0

- The `mimalloc` feature which was default to on has been removed. The
  choice of allocator is no longer optional. There're two main reasons
  for this: First, if you offer a secure allocator only optionally,
  no-one enables it and this breaks the purpose. Second, supporting
  two allocators introduces variance into test results and we don't
  want to go down the rabbit hole of debugging/profiling an
  allocator every time. We'd rather have a single, simple, efficient
  allocator that we can forget about. `mimalloc` serves that purpose
  well for now. Hiding this option from the user will also allow us to
  change the allocator without too much hassle should the need arise in
  the future.
- Change `mem/vm_max` default from `4GB` to `0`.
- Allow the extended attribute prefix `user.syd.*` for {get,list}xattr.
  Access to `{set,rm}xattr` is still denied. This allows for practical
  use of immutable extended attributes without privilege.
- Add the _ioctl_(2) request `KDSIGACCEPT` to the deny list.
- Add the _ioctl_(2) requests `FIOGETOWN`, `FIOSETOWN`, `SIOCGPGRP`,
  and `SIOCSPGRP` to the allow list.
- Fix portability issues with `i586`, `ppc64le`, `riscv64`, and `s390x`
  architectures. Syd passes tests on all now. We added them to our CI
  and we will provide binary releases for them.
- Remove Crypt sandboxing and the utilities _syd-aes_(1), _syd-key_(1),
  and _syd-cp_(1). Extensive testing over different architectures showed
  various issues with the implementation: It was overly complicated,
  racy, and could not offer full transparent encryption due to its
  inability to handle read-write fds. Moreover, removing this sandboxing
  type allows us to further confine emulator threads. Together with this
  change we took the ability of emulator threads to call the syscalls
  _accept4_(2), and _splice_(2). These system calls were used by
  encryption only.
- Improve _socketcall_(2) handling using a seccomp-bpf filter for
  selective socket subcall filtering.
- Improve _sendto_(2) handling and fix a TOCTTOU issue on architectures
  which have the multiplexed _socketcall_(2) system call such as x86 and
  powerpc.
- Drop `trace/allow_unsafe_kill:1` and allow _tkill_(2). Note,
  this syscall is still subject to signal protections.
- Apply `trace/force_cloexec:1` to socket file descriptors.
- Hook the _socket_(2) syscall on 64-bit.
- Add `append` command to set files append-only.
- Revert the change which removes the syscall hooks `fallocate`,
  `ftruncate`, and `ftruncate64`. Check these system calls for Write
  sandboxing.
- Fix an IPv6 address parsing issue in _syd-tor_(1).
- Add option `proxy/addr` to specify alternative internal address for
  Proxy sandboxing. This must be an IPv4 or IPv6 address and defaults to
  127.0.0.1.
- `syd-cpu`, `syd-hex` and `syd-size` have been promoted to core tools
  and are now installed regardless of the `utils` feature.
- Add new profile `off` as a shorthand to turn all sandboxing off.
- Add seccomp self-confinement to _syd-elf_(1).
- Add the path `/sys/devices/system/cpu/cpu*/cpufreq/scaling_cur_freq`
  to the list of unsafe paths and deny access. See [this
  article](https://arxiv.org/pdf/2404.10715) on how this file can be
  (ab)used for dynamic frequency-based fingerprinting attacks.
- The option `trace/allow_unsafe_debug:1` makes Syd execute `syd-tor`
  without confinement using the `-d` argument. This is useful for
  debugging.
- Stop using the `const-syscall` feature of the libseccomp crate which
  caused problems with new system calls such as _cachestat_(2) and
  _fchmodat2_(2).
- To lock the sandbox, `-mlock` and `-ml` may now be used as aliases for
  `-mlock:on`.
- Apply per-thread seccomp sandboxing to Syd threads post-exec. This is
  an initial basic implementation, yet still it vastly reduces the
  attack surface while being zero-cost user-space. More hardening in
  this area will follow to further confine Syd threads. `syd -Epfc` may
  be used to see the export of new seccomp filters.
- Fix a misaligned pointer dereference issue in getdents handler.
- Make _syd-path_(1) write Integrity Force rules for ELF files only.
  Force Sandboxing is not applicable to scripts anymore as we apply
  it only at `PTRACE_EVENT_EXEC` boundary and not at the seccomp hook
  for _execve_(2).
- Remove `-d` option of _syd-path_(1) and set the default action to
  `kill`. `deny` is not a valid action for Force Sandboxing for some time
  as we apply it only at `PTRACE_EVENT_EXEC` boundary and not at the
  seccomp hook for _execve_(2).
- Set the option `trace/allow_unsafe_dumpable:1` for the `paludis` profile.
- Set process dumpable attribute for Syd to false at startup unless
  the new option `trace/allow_unsafe_dumpable:1` is given.
- Clean consecutive slashes from rule patterns before editing the
  respective access control list. Patterns with consecutive slashes are
  a common case of error as such patterns can _never_ match because
  they're matched against canonicalized path names. Cleaning consecutive
  slashes safely turns such patterns into valid patterns.

# 3.25.1

- Fix **a critical bug** with glob matcher when patterns ending with
  triple-star preceded by globs would not match correctly. Notably, this
  allowed editing of dotfiles for the CTF profile where there rule
  `deny/write+/home/*/.*/***` no longer matched dotfiles as it should.
  The `linux` profile included by the `oci`, `paludis`, and `user`
  profiles also has rules which are affected by this bug. The users are
  recommended to update as soon as possible.

# 3.25.0

- Sync _syd-mdwe_(1) with the hardening of memory-related syscalls.
- Kill rather than deny on executable stack violations at _mmap_(2)
  boundary to be consistent with other memory-related seccomp filters.
- Avoid using lazy loading when loading libraries specified via the
  command line.
- Improve SegvGuard logging.
- Kill process on _execve_(2) calls with NULL argv or envp rather than
  denying with EFAULT. This gives the system administrator higher chance
  to notice potentially malicious activity soon and repeated failures
  are going to trigger SegvGuard.
- Memory protection seccomp filters now kill the process rather than
  returning "EACCES". This gives the system administrator higher chance
  to notice potentially malicious activity soon and repeated failures
  are going to trigger SegvGuard.
- Allow _sched_setparam_(2) system call.
- Allow _sched_rr_get_interval_(2) system call on x86.
- Allow _fadvise64_64_(2) system call on x86.
- Handle the _chown32_(2) system call on x86.
- Allow the _waitpid_(2) system call on x86.
- Fix a panic in parsing control messages during _sendmsg_(2) syscall.
  Spotted by trinity during fuzzing.
- Deny the _mincore_(2) system call by default which is typically not
  needed during a normal run and has been successfully (ab)used for
  [page cache attacks](https://arxiv.org/pdf/1901.01161). Should the
  need arise, we may provide an unsafe option to allow this syscall
  in the future.
- Sync syd-oci with
  [youki-0.4](https://github.com/containers/youki/blob/main/CHANGELOG.md#v040---2024-08-23).
- Upgrade `indexmap` crate from `2.2` to `2.4`.
- Replace the `endorphin` crate used in SegvGuard implementation with
  the `expiringmap` crate. `endorphin` has a lot of unsafe code, is hard
  to audit and does not pass miri tests. In comparison, `expiringmap`
  contains no unsafe code.
- Ensure Crypt sandboxing doesn't run out of memory when the sandbox
  process does many sequential writes of small size (take 2, see 3.24.2
  for take 1. Thanks wikky for the help!).
- Allow the _cachestat_(2) system call which is new in Linux>=6.5 and
  works only on file descriptors and hence is not subject to access
  check.

# 3.24.4

- Stop hooking into the system calls _fstat_(2) and _fstatfs_(2).
  In the operation of Syd, read access implies stat, so this is
  consistent with the general behaviour.
- Stop hooking into _chdir_(2) system call until [kernel bug
  218501](https://bugzilla.kernel.org/show_bug.cgi?id=218501) is fixed.
- Stop hooking into _fchdir_(2) system call which is fd-only.

# 3.24.3

- Continue optimizing the thread pool implementation. Track
  busy threads rather than idle threads. Improve efficiency in
  spawning additional threads.
- Stop setting the CPU affinity of the syscall handler threads,
  which contradicts with MT epoll and hurts performance. Drop
  the `core_affinity` crate dependency.

# 3.24.2

- Continue optimizing the thread pool implementation, and
  fix idle thread tracking. We're mostly at our natural limits
  now as the majority of the overhead stems from kernel-space.
- Opening files marked for encryption by Crypt sandboxing for
  read-write now returns `EINVAL` early on _open_(2).
- Use the flag `SECCOMP_ADDFD_FLAG_SEND` to reduce an _ioctl_(2)
  request on system call handlers returning a file descriptor.
- Ensure Crypt sandboxing doesn't run out of memory when the sandbox
  process does many sequential writes of small size.
- Deny `FS_IOC_SETFLAGS` _ioctl_(2) request by default. This ensures,
  above all, that the "immutable" and "append-only" file flags cannot be
  altered inside the sandbox. Read the [Denying FS\_IOC\_SETFLAGS
  ioctl](https://man.exherbo.org/syd.7.html#Denying_FS_IOC_SETFLAGS_ioctl)
  section of the _syd_(7) manual page for more information.
- Deny _execve_(2) and _execveat_(2) system calls when one of pathname,
  argv or envp arguments is NULL. This ensures POSIX compatibility and
  denies some simple Return-Oriented Programming (ROP) attacks. See
  [Enhanced execve and execveat Syscall
  Validation](https://man.exherbo.org/syd.7.html#Enhanced_execve_and_execveat_Syscall_Validation)
  section of the _syd_(7) manual page for more information.

# 3.24.1

- Track `SIGKILL` as a coredumping signal as part of SegvGuard.
  GrSecurity includes `SIGKILL`, however HardenedBSD does not.
- Read+Write _open_(2) calls are now only checked against the Write
  sandboxing access list for simplicity. Previously these paths were
  checked against both Read and Write access lists.
- The _readlink_(2) and _readlinkat_(2) system calls are no longer
  checked for Stat sandboxing access. For hidden paths, these
  system calls will return what looks like dangling symbolic links
  and this, on its own, is not an information leak.
- Remove symlink restrictions, added as of version 3.12.0 akin to
  `GRKERNSEC_LINK`, and remove the option `trace/allow_unsafe_link:1`.
  This mitigation comes with considerable performance hit without too
  much benefit and e.g. mounting private `tmpfs` over `/tmp`, and
  `/dev/shm` utilizing mount namespaces is a much cheaper and simpler
  way to avoid the same attack vectors which utilize following symlinks
  in world-writable directories. The `immutable` profile already does
  that.
- Raise MSRV from 1.69 to 1.70 to use `PathBuf::as_mut_os_string` for
  efficient path operations.
- Start caching security policy decisions using the `quick_cache` crate.
  There is one cache for path-based decisions and one cache for IP address
  based decisions. The cache sizes can be customized at startup using
  the new options `cache/path/icap:`, `cache/path/wcap:`,
  `cache/addr/icap:`, and `cache/addr/wcap:`. "icap" stands for estimated
  item capacity and is of type `usize`, whereas "wcap" stands for weight
  capacity and is of type `u64`. See the _syd_(2) manual page for the
  default values.
- Add `trace/allow_unsafe_time:1` to the paludis profile.
- Ensure fstatfs calls are compatible with 32-bit land.
- Workaround BTRFS reporting incorrect device IDs, like
  we already do for overlayfs. People should seriously
  stop using these junk.
- User-space SafeSetID filters now return EACCES,
  rather than EPERM for consistency.
- Fix kernel level SafeSetID filters to return EACCES on error.

# 3.24.0

- Change multithreading architecture to use epoll instead of channels
  and drop the `crossbeam-channel` crate dependency.
- Port rsync's glob matcher to rust and start using it instead of the
  `globset` crate.
- Enforce non-executable stack restriction at _mmap_(2) boundary to
  mitigate exploits that change stack to executable by _dlopen_(3)'ing a
  library with executable stack. See
  [CVE-2023-38408](https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt)
  for a recent example.
- Fix ELF parser to detect executable stack correctly when the
  `GNU_STACK` ELF header is missing when the loader defaults to an
  executable stack.

# 3.23.18

- Add `trace/allow_unsafe_msgsnd:1` to the `paludis` profile.
- Deny _msgsnd_(2) system call by default to mitigate kernel heap
  spraying attacks. This restriction may be disabled with the option
  `trace/allow_unsafe_msgsnd:1`. See the [Mitigation Against Heap
  Spraying](http://man.exherbo.org/syd.7.html#Mitigation_Against_Heap_Spraying)
  section of the _syd_(7) manual page for more information.
- Optimize glob matcher to use much less memory and perform more
  efficiently, by using pre-compiled accelerated DFAs rather than using
  hybrid NFA/DFAs with a global cache.
- Ioctl sandboxing is no longer on by default, the _ioctl_(2) request
  allowlist and denylist is processed regardless. Denylist is now
  applied at kernel-level in the parent seccomp-bpf filter such that Syd
  process is also included in the restriction.
- Short profile names may be stacked together as a single argument to
  _syd_(1) `-p`.
- The `user` profile may be shortly referred as `u`.
- The `silent` profile may be shortly referred as `s`.
- The `noipv6` profile may be shortly referred as `4`.
- The `noipv4` profile may be shortly referred as `6`.
- The `landlock` profile may be shortly referred as `l`.
- The `immutable` profile may be shortly referred as `i`.
- The `container` profile may be shortly referred as `c`.
- Provide more accurate timing information in logs.
- Fix a segmentation fault in `syd::log` module.
- Add new profile `core` to practically allow generation of coredumps.
  This profile may shortly be referred as just `C`.
- Add new profile `debug` to practically allow debuggers inside the
  sandbox. This profile may shortly be referred as just `D`.
- Add new profile `noexe` to practically relax _exec_(3) restrictions
  and disable Syd's usage of _ptrace_(1). This profile may shortly be
  referred as just `X`.
- Add new profile `nomem` to practically relax MDWE restrictions. This
  profile may shortly be referred as just `M`.
- Add new profile `nopie` to practically relax PIE restrictions. This
  profile may shortly be referred as just `P`.
- Harden initial self-reexecution using `/proc/self/maps` with file
  metadata verification instead of using `/proc/self/exe`. The former
  method was vulnerable to filesystem TOCTOU.
- Replace the `perf` feature with the `-q` CLI option for _syd_(1), and
  the environment variable `SYD_QUICK_BOOT` for _syd_(1), and
  _syd-oci_(1). This may be used for faster startup times sacrificing
  one layer of defense against some container breaks.
- oci: Honour environment variables passed by the OCI spec.
- oci: Improve Syd supervisor invocation.
- Handle `SIGPIPE` before configuring the allocator.
- Fix system call origin offset calculation.
- Optimize remote path reader utilizing the `memchr` crate for SIMD search.
- Optimize path canonicalizer utilizing the `memchr` crate for SIMD search.
- Optimize path canonicalizer by reducing allocations.

# 3.23.17

- Add chat banners to README to attract hippies and hipsters.
- Add more TOCTOU and execstack tests.

# 3.23.16

- Add `trace/allow_unsafe_stack:1` to the `paludis` profile.
- Require executables with non-executable stack by default. This
  restriction can be relaxed with the option
  `trace/allow_unsafe_stack:1`.
- _syd-path_(1) learned the option `-eX` to list ELF binaries with
  executable stack under PATH.
- _syd-elf_(1) learned the option `-X` to exit with success if the given
  ELF binary has executable stack.
- _syd-elf_(1) learned the option `-x` to exit with success if the given
  executable is a script.
- ELF parser learned to detect executable stack for ELF binaries.
- Fix `getxattr` and `listxattr` system call hooks to correctly handle
  paths with no read access.
- The sandbox process could previously bypass [Device Sidechannel
  Mitigations](http://man.exherbo.org/syd.7.html#Device_Sidechannel_Mitigations),
  by issuing a special _statx_(2) system call with at least one of the
  flags `STATX_TYPE` and `STATX_MODE` unset. This is now fixed.
- Add `trace/allow_unsafe_link:1` to the `paludis` profile.
- Make it possible to disable [symlink
  restrictions](https://man.exherbo.org/syd.7.html#Enhanced_Symbolic_Link_Validation)
  with the option `trace/allow_unsafe_link:1`.
- _syd-elf_(1) now resolves symbolic links in path arguments.
- Optimise remote path reader for small paths which are the common case.
- Set CPU affinity of system call handler threads to reduce cache misses.

# 3.23.15

- Add the rule `allow/read,stat+/run/systemd{,/resolve,/resolve/*.conf}`
  to the `linux` profile which is inherited by `oci`, `paludis` and
  `user` profiles. Systemd may link a file from this directory to
  `/etc/resolv.conf` and this file is already allowlisted by the `linux`
  profile.
- Revert the change to put sandbox process into a new process group.
- Fix an infinite loop which happens at startup when sandbox process
  fails early.
- Fix a startup error which happens under `systemd-run --pipe --pty`.

# 3.23.14

- Drop the `env_logger` crate dependency.
- Reduce MSRV from 1.71 to 1.69.
- Replace const-hex crate with hex-conservative crate.
- Root directory must now be an absolute path, relative paths are no
  longer permitted.
- Bind mount target directory must now be an absolute path, relative
  paths are no longer permitted.
- Symlinks in root directory path are no longer permitted. Path
  traversal using `..` is also not permitted.
- Symlinks in bind mount source and target directory paths are
  no longer permitted. Path traversal using `..` is also not
  permitted.
- Fix a symlink TOCTOU in _open_(2) handler when handling magic
  symlinks.

# 3.23.13

- Revert the change made in 3.23.9, to avoid increasing the _nice_(2)
  value and setting cpu, i/o priority to idle for syscall handler
  threads.
- Use the nix crate for _openat2_(2) system call and drop the `openat2`
  crate dependency.
- Set the process group of the sandbox process the foreground process
  group after putting it into a new process group.

# 3.23.12

- Disable the SROP mitigator when SafeSetID is active. This is needed
  because NPTL uses real-time signals to ensure all threads share the
  same UID/GID.
- Put sandbox process into a new process group with `setpgid(0,0)` at
  startup. Unlike _setsid_(2), this call does not detach the process
  from the controlling terminal.
- Do not check dynamic libraries on _mmap_(2) for exec access if
  `trace/allow_unsafe_exec:1` was specified at startup.
- Fix Force sandboxing on _mmap_(2) for dynamic libraries.

# 3.23.11

- Do not change current working directory to `/` for `cmd/exec`
  programs.
- Disable TPE sandboxing for the `paludis` profile.
- Handle EINTR in _stat_(2) and _statfs_(2) system call handlers.
- Skip executable device ID check on overlayfs which reports incorrect
  device IDs on _stat_(2) and this is a [known
  bug](https://github.com/moby/moby/issues/43512).

# 3.23.10

- Harden exec checks at `PTRACE_EVENT_EXEC` stop by verifying the device
  id and inode of the executable and loader.
- Avoid Force Sandboxing TOCTOU in _mmap_(2) by using _pidfd_getfd_(2)
  to get the remote FD and do verification on that.
- Log the path and offset of the memory mapping from which the system
  call is called on access violations with the `src` key.
- Remove the option `segvguard/filter`.
- Allow read and stat access to `/home` directory in `user` profile.
- Fix valid file descriptor check in _mmap_(2), and _mmap2_(2)
  seccomp-bpf rules.

# 3.23.9

- Fix set-id handlers to handle correctly the `-1` argument.
- Add `trace/allow_unsafe_nopie:1` to the `paludis` profile.
- The option `trace/allow_unsupp_exec` has been removed. Unsupported
  executable formats are always denied. Support for new file formats
  can easily be added to the `syd::elf::ExecutableFile` structure.
- Require PIE executables by default. This restriction can be relaxed
  with the option `trace/allow_unsafe_nopie:1`.
- Enumerate ELF shared library dependencies by reading the
  `/proc/$pid/maps` file on `PTRACE_EVENT_EXEC`. Previously we used the
  [lddtree](https://crates.io/crates/lddtree) crate to read the ELF
  dependency tree which was horribly inefficient in comparison.
- Add a new [minimal ELF
  parser](https://gitlab.exherbo.org/sydbox/sydbox/-/raw/main/src/elf.rs)
  to replace the [Goblin](https://crates.io/crates/goblin) crate
  dependency. Goblin was problematic because it broke static-linking,
  and it is somewhat of an overkill for our limited use case.
- Enable *SafeSetID* by default. Replace the option
  `trace/allow_safe_setid` with the options `trace/allow_safe_setuid`
  and `trace/allow_safe_setgid`.
- Turn unsafe set-id system calls into no-ops rather than denying with
  `EPERM` for compatibility with daemons such as postgres which invokes
  _setgroups_(2) before _setuid_(2) and aborts on failure.
- Mitigate
  [SROP](https://llsoftsec.github.io/llsoftsecbook/#sigreturn-oriented-programming)
  by denying access to the system calls _sigreturn_(2), and
  _rt_sigreturn_(2) for _syd_(1), _syd-oci_(1) and _syd-tor_(1).
  Given the lack of signal handlers, these system calls have no
  legit use.
- Add new `kvm` profile which allowlists KVM _ioctl_(2) requests
  without path check.
- Avoid increasing the _nice_(2) value and setting cpu, i/o priority to
  idle for syscall handler threads.
- Add new `tty` profile which allowlists {T,P}TY _ioctl_(2) requests
  without path check. This profile is included by `oci`, `paludis`,
  and `user` profiles.
- Add `TIOCGETD` to the default allowlisted _ioctl_(2) requests set.
  Note, `TIOCSETD` is already in the default denylisted set.
- Refactor common rules in `oci`, `paludis`, and `user` profiles into
  the new profile `linux`. All three profiles inherit from `linux` now.
- Add `allow/net/link+route` to `oci`, `paludis`, and `user` profiles.
- Add `trace/allow_safe_kcapi:true` to the `oci` profile.
- Add `trace/allow_safe_bind:true` to the `oci` profile.
- Harden the _open_(2) handlers using the `RESOLVE_IN_ROOT` flag.
- Return the original file descriptor on `O_PATH` _open_(2) calls with
  encrypted files as argument for Crypt sandboxing.
- Revert the faulty optimization to increase of `AF_ALG` socket buffer
  sizes for Crypt sandboxing which fixes potential **data corruption**
  under memory-constrained environments. Users of Crypt sandboxing are
  highly recommended to update immediately and run _syd-test_(1) to
  confirm the issue is fixed for them before using Syd.
- Relax xattr name restrictions when the Sandbox lock is off for the
  respective sandbox process.
- Return `ENOTSUP` rather than `EACCES` on _setxattr_(2) family calls
  for `user.syd.` name prefix for stealth. Note, unlike the previous
  mitigation, this one may be easily bypassed by comparing results
  with an allowlisted name prefix.
- Return `ENODATA` rather than `EACCES` on _removexattr_(2) family calls
  for `user.syd.` name prefix for stealth.
- Return `ENODATA` rather than `EACCES` on _getxattr_(2) family calls
  for `user.syd.` name prefix for stealth.
- Add `SIGTRAP` to the list of coredumping signals recorded by
  SegvGuard.

# 3.23.8

- Handle `ENOMEM` gracefully during splicing for Crypt sandboxing which
  fixes potential **data corruption** under memory-constrained
  environments. Users of Crypt sandboxing are highly recommended to
  update immediately and run _syd-test_(1) to confirm the issue is fixed
  for them before using Syd.
- Harden SegvGuard for cases when the sandbox process receives a signal
  with default action `Core` but does not generate a coredump which can
  happen under various circumstances.

# 3.23.7

- Fix an issue with file locking of Crypt sandboxing without which concurrent,
  or near-concurrent writes could cause **data corruption** in certain
  scenarios. Users of Crypt sandboxing are highly recommended to update
  immediately and run _syd-test_(1) to confirm the issue is fixed for them
  before using Syd.
- Fix an issue with _stat_(2) handlers on 32-bit systems.

# 3.23.6

- Revert `oci-spec` crate update which broke `syd-oci`. Kudos goes to
  `oci-spec` developers who broke API with a minor version bump...
- Harden
  [SafeSetID](http://man.exherbo.org/syd.7.html#Changing_UID/GID_and_groups)
  by dropping `CAP_SETUID` after the first successful UID transition,
  and `CAP_SETGID` after the first successful GID transition.

# 3.23.5

- Fix an issue with the _open_(2) handler mishandling flags argument
  when `O_PATH` is included in flags. This bug was introduced in
  v3.19.0.
- Decouple `CAP_CHOWN` from SafeSetID and add the option
  `trace/allow_unsafe_chown:1` to keep this capability.
- Set-id system calls are now allowed in the sandbox process when
  [SafeSetID](http://man.exherbo.org/syd.7.html#Changing_UID/GID_and_groups)
  is not on. In addition, apply a kernel-level _seccomp_(2) filter to
  deny all UID transits to UIDs less than or equal to 11 (aka
  *operator*), and all GID transits to GIDs less than or equal to 14
  (aka *uucp*).
- Make the `cmd/exec` process the leader of a new session.
- Handle the `RENAME_NOREPLACE` flag of _renameat2_(2) system call.
- Enable the `local-dynamic-tls` and `skip-collect-on-exit` features on
  the `mimalloc2-rust` crate.
- Revert back to using `mimalloc` as the default allocator.
- Add `TIOCSETD` request to the list of denylisted _ioctl_(2) requests.
- Add a _ioctl_(2) request allowlist in addition to the denylist. The
  new command
  [`ioctl/allow`](http://man.exherbo.org/syd.2.html#ioctl/allow)
  may be used to interact with the allowlist.
- Reduce extra syscall handler thread keep alive timeout from 90 seconds
  to 250 milliseconds. This can be changed by editing `config.rs` at
  compile-time.
- Handle new syscall handler thread spawn errors gracefully.
- Deny the obsolete _sgetmask_(2), and _ssetmask_(2) system calls.
- Deny _pciconfig_iobase_(2), _pciconfig_read_(2), and
  _pciconfig_write_(2) system calls.
- Deny the deprecated _ustat_(2) system call.
- Deny _oldfstat_(2), _oldlstat_(2), and _oldstat_(2) system calls.
- Deny _vmsplice_(2) by default.
- Replace vmsplice/splice usage in child init with read/write.
- Allow TTY, pipe and socket ioctls for the `oci` profile.

# 3.23.4

- Add `default/ioctl:filter` rule to the `paludis` and `user` profiles.
  This is done to cut down the noise generated by Ioctl sandboxing.
  Users may revert to the previous behaviour with
  `-mdefault/ioctl:deny`.

# 3.23.3

- Stop using the insecure and unmaintained `chrono` dependency
  in _syd-oci_(1). Users of _syd-oci_(1) are recommended to read
  [RUSTSEC-2020-0159](https://rustsec.org/advisories/RUSTSEC-2020-0159.html)
  and update immediately.

# 3.23.2

- Improve memory efficiency of the _getdents_(2) system call handler.
- Improve memory efficiency of transparent decryption.

# 3.23.1

- Add the missing _fsync_(2) during last partial block reencrpytion
  process of Crypt sandboxing without which encrypted file appends could
  cause **data corruption** in certain scenarios. Users of Crypt
  sandboxing are highly recommended to update immediately and run
  _syd-test_(1) to confirm the issue is fixed for them before using Syd.
- Improve the efficiency of _syd-aes_(1) by avoiding _select_(2) calls
  on the kernel crypto socket.
- Fix _syd-cp_(1) build on older Rust.
- Handle broken pipe gracefully in _syd-cp_(1).
- Deny reading the timestamp counter in _syd-tor_(1) as part of the
  confinement procedure.

# 3.23.0

- Upgrade `nix` crate from `0.26` to `0.29`.
- Upgrade `procfs` crate from `0.15` to `0.16`.
- Upgrade `bitflags` crate from `1.3` to `2.6`.
- Add new option `time:<offset>` to set clock monotonic and boottime offset in
  Time namespace. Implies `unshare/time:1`.
- Avoid self reexecution when entering namespaces.
- Support time namespace and add the option `unshare/time:1`. With
  `unshare/time:1`, Syd resets the boot-time clock such that `uptime`
  will report container uptime rather than host uptime.
- Deny access for the creation of namespaces by default, and
  add `trace/allow_unsafe_namespace` to relax the restriction.
  This option accepts a comma-separated list of namespace types
  to allow.
- Add `segvguard/filter` to filter SegvGuard violations by globs.
- Add `default/` options for each sandboxing type and SegvGuard to
  configure default action which typically defaults to Deny or Kill.
- Require absolute paths in globs.
- Extend sandbox actions with `warn`, `stop`, `kill`, and `exit`.
- Remove the option `trace/allow_safe_kvm`.
- Remove the option `trace/allow_unsafe_ioctl`.
- Implement [Ioctl
  sandboxing](https://man.exherbo.org/syd.7.html#Ioctl_Sandboxing).
- Enable the [literal
  separator](https://docs.rs/globset/0.4.14/globset/struct.GlobBuilder.html#method.literal_separator)
  option on glob matching. This means a literal `/` is required to
  match a path separator in globs. `*`, and `?` will not match `/`.
- Add
  [`trace/force_cloexec`](http://man.exherbo.org/syd.2.html#trace/force_cloexec)
  option to enforce the `O_CLOEXEC` flag on all _open_(2), _openat_(2),
  and _openat2_(2) calls. Refer to the [Force
  Close-on-Exec](http://man.exherbo.org/syd.7.html#Force_Close-on-Exec)
  section of the [_syd_(7)](http://man.exherbo.org/syd.7.html)
  manual page for more information.
- Ensure open and socket handlers always opens files with the `O_CLOEXEC` flag.
- Improve _syd-tor_(1)'s socket performance by setting `TCP_NODELAY`,
  `SO_KEEPALIVE`, `TCP_QUICKACK`, and buffer sizes for reduced latency
  and improved data transfer efficiency.
- Ensure no file descriptors leak from the Syd process into the
  _syd-tor_(1) process other than the fds specifically passed.
- Deny syscalls for Memory protection keys by default, and add the
  option
  [`trace/allow_unsafe_pkey`](http://man.exherbo.org/syd.2.html#trace/allow_unsafe_pkey)
  to relax the restriction. Refer to the [Restricting Memory Protection
  Keys System
  Calls](http://man.exherbo.org/syd.7.html#Restricting_Memory_Protection_Keys_System_Calls)
  section of the [_syd_(7)](http://man.exherbo.org/syd.7.html)
  manual page for more information.
- Deny syscalls for Kernel keyring access by default, and add the option
  [`trace/allow_unsafe_keyring`](http://man.exherbo.org/syd.2.html#trace/allow_unsafe_keyring)
  to relax the restriction. Refer to the [Kernel Keyring Access
  Restriction](http://man.exherbo.org/syd.7.html#Kernel_Keyring_Access_Restriction)
  section of the [_syd_(7)](http://man.exherbo.org/syd.7.html)
  manual page for more information.
- Deny syscalls for CPU emulation functionality by default, and add the
  option
  [`trace/allow_unsafe_cpu`](http://man.exherbo.org/syd.2.html#trace/allow_unsafe_cpu)
  to relax the restriction. Refer to the [Restricting CPU Emulation
  Syscalls](http://man.exherbo.org/syd.7.html#Restricting_CPU_Emulation_System_Calls)
  section of the [_syd_(7)](http://man.exherbo.org/syd.7.html)
  manual page for more information.
- Fix a race condition in Crypt sandboxing which causes **data
  corruption** when handling concurrent writes to the same encrypted
  file. Encrypted files affected by the issue have corrupt
  blocks which are in a practically unrecoverable state.
  To reduce the likelihood of the issue reappearing
  in later versions, we have written [82 integration
  tests](https://gitlab.exherbo.org/sydbox/sydbox/-/blob/b332c892c504cef3f1205c386b760d6a8d5e73e9/src/t/test.rs#L337-418)
  to verify correct functioning of Crypt sandboxing. However, users
  should know this is only tested on the architectures "x86\_64",
  "x86", "aarch64", and "armv7". Users running Syd on other architectures
  are _strongly recommended_ to run integration tests using the tool
  [_syd-test_(1)](https://man.exherbo.org/syd-test.1.html)
  before any usage of Syd. In addition, package maintainers are
  _strongly recommended_ to install Syd's installable integration
  tests by installing the two utilities "syd-test" and "syd-test-do"
  along with Syd and advise the user to run the tests with a
  post-install message. This ensures Syd is, to the
  extent possible, verified to work on the target system. These
  utilities come with no additional dependencies and their size
  is negligible taken into account the total size.
- Fix an issue with _utimensat_(2) handler on 32-bit systems.
- Fix an issue with _truncate_(2) handler on 32-bit systems.
- _syd-cp_(1) no longer overwrites the destination file by default.
  The command line argument `-f` can be used to force overwrite.
- _syd-cp_(1) learned to read from standard input when only the
  destination file is passed via command line parameters.
- Make the encryption thread more efficient and drop the _write_(2)
  batching workaround which is no longer necessary.
- Block Crypt readers/writers when a subsequent write is in progress
  rather than failing with `EBUSY`.
- _syd-aes_(1), _syd-cp_(1), and _syd-tor_(1) have been promoted to core
  tools, as such they're installed even with the utils feature disabled.
- _syd-aes_(1) learned `-v` argument to periodically print progress
  report on standard error.
- Ensure files configured for encryption are processed even
  if Read & Write sandboxing is off.
- Increase stack size of encryption threads from 4k to 64k.
- Improve lock usage in `ptrace` exit handler.
- Improve lock usage in `stat` system call handlers.
- The setting `trace/force_umask` no longer applies to
  directory creation for convenience.
- Make `trace/force_umask` override POSIX ACLs during
  _umask_(2) calculation.
- Hook into `fchmod` and `fchown` and check for write access.
  In addition `trace/force_umask` is applied for `fchmod`.
- Add `-b <bufsiz>` argument to _syd-tor_(1) to specify pipe
  buffer size.
- Improve Crypt sandboxing and _syd-tor_(1) throughput by setting pipe
  buffer sizes to the maximum value allowed by the system where errors
  are handled gracefully and reverts to the old default `PIPE_BUF` which
  is typically 4096 bytes.
- Apply the noexec-memfd restriction regardless of the state
  of sandboxing.
- Fix a TOCTOU in socketcall (32-bit) handler when handling
  the _socket_(2) subcall.
- Add Netlink support to Network sandboxing which allows
  the user to filter on netlink family. The new
  [`allow/net/link`](https://man.exherbo.org/syd.2.html#allow/net/link)
  setting can be used to add/remove items to the allowlist.
- Confine _syd-tor_(1) process further utilizing namespaces
  if available and permitted.
- Fix PID recycling issue of clone which happens during
  re-exec when namespaces are enabled.
- Sanitize environment of the _syd-tor_(1) process.
- Make file descriptor tracking of _syd-tor_(1) more efficient.

# 3.22.0

- Implement [Proxy
  sandboxing](https://man.exherbo.org/syd.7.html#Proxy_Sandboxing).
- Add new utility [syd-tor](https://man.exherbo.org/syd-tor.1.html)
  which is a secure and efficient SOCKS proxy forwarder.

# 3.21.4

- Stop using the `inline-more` feature of the vendored `endorphin`
  crate.
- Revert panic strategy back to `abort` for release builds now that we
  don't depend on libunwind.
- Stop using the `std` feature of `anyhow` crate which depends
  on std::backtrace and therefore libunwind.
- Avoid mixing mutexes of `stdlib` with `parking_lot` crate.
- Reduce stack size of syscall handler threads from 2M to 128k.
- Avoid leaking AES Key and IV into insecure memory during random Key/IV
  generation.

# 3.21.3

- Change panic strategy from `abort` to `unwind` for release builds.
- Drop the rule `allow/read,stat+/proc/version` from the `user` profile.
- Randomize the contents of the stack for the initial _clone_(2).
- Use a stack size of 4k instead of 8k for micro-threads spawned during
  system call emulation. This can be changed by editing the
  `THREAD_STACK_SIZE` constant in `config.rs` during compilation.
- Use a stack size of 128k instead of 8k for the initial _clone_(2).
  This can be changed by editing the `FCLONE_STACK_SIZE` constant in
  `config.rs` during compilation.
- Deny `mmap` and `mmap2` calls which create executable anonymous
  memory. This restriction can be relaxed with
  `trace/allow_unsafe_memory:1`.
- Drop the `PROC_BTI|PROC_EXEC` workaround in mprotect filter on arm64,
  which makes the filter weaker and is [no longer
  needed](https://sourceware.org/pipermail/libc-alpha/2020-November/119305.html).
- Check libraries dynamically loaded at runtime via _dlopen_(3) for Exec
  access by hooking into _mmap_(2) and _mmap2_(2) system calls.

# 3.21.2

- Document [uninteruptible
  FIFOs](http://man.exherbo.org/syd.7.html#Uninterruptible_FIFOs)
  under BUGS section of the _syd_(7) manual page.
- Deny `execve` and `execveat` system calls for the Syd process when the
  sandbox is locked during runtime with a kernel-level seccomp filter.
  This was already done when sandbox is locked at startup and the reason
  to skip is to allow the Syd command `cmd/exec`.
- Use the flag `MFD_NOEXEC_SEAL` when opening memfds for transparent
  decryption for Crypt sandboxing to ensure transparent decryption can
  not be abused to bypass Exec, Force and TPE sandboxing. This flag
  requires Linux-6.3 or newer. On older kernels, a backing directory
  must be specified with `crypt/tmp` for transparent decryption to work.
- Handle the CLI arguments `--help`, `--version`, and `--sh` before
  self re-execution for convenience.
- Strip `MFD_EXEC` and add `MFD_NOEXEC_SEAL` to flags of `memfd_create`.
  This ensures memory file descriptors are not executable and cannot be
  made executable. This requires Linux-6.3 or later. The option
  `trace/allow_unsafe_memfd:1` is provided to relax this restriction.
  This option, when enabled, also allows the `memfd_secret` system call.
  See the [Enhanced Security for Memory File
  Descriptors](http://man.exherbo.org/syd.7.html#Enhanced_Security_for_Memory_File_Descriptors)
  section of the _syd_(7) manual page for more information.

# 3.21.1

- Deny `open_by_handle_at` system call. Since we already deny the
  `name_to_handle_at` system call, there is little sense in allowing
  `open_by_handle_at`.
- Start sandboxing `memfd_create` call as part of Read, Write and Exec
  sandboxing. The name argument is prepended with `/memfd:` before
  access check. Use e.g. `deny/read,write,exec+/memfd:*` to deny access
  to memory file descriptors globally.
- Deny `memfd_secret` system call. This system call requires the boot
  option `secretmem.enable=1` and is rarely used. Disabling this system
  call adheres to the goal to be secure by default: Although file I/O is
  not allowed to secret memfds, this still provides an attacker a way to
  execute denylisted code by writing their payload into the memfd and
  mapping it as executable. Should there ever be a legitimate need to
  use this system call inside a Syd sandbox, it is trivial to add a flag
  to allow it on demand.
- Allow read, write and stat access to memfds in the Paludis profile.
- Stop using `mimalloc` as the default allocator. Notably mimalloc
  breaks build with LTO and maintaining the rust crate for mimalloc is
  an additional burden for us.
- Avoid a bug in network system call handlers that caused them to return
  `EBADF` when when `/proc` is mounted with hidepid=2.
- Avoid a bug in fd-only xattr handlers (`fgetxattr`, `fsetxattr`,
  `flistxattr`, and `fremovexattr`) that caused them to return
  `EBADF` when when `/proc` is mounted with hidepid=2.
- Correct file open mode in xattr handlers, use `O_RDONLY` rather than
  `O_PATH` file descriptors as required.
- Fix a DOS in [PID
  sandboxing](http://man.exherbo.org/syd.7.html#PID_sandboxing)
  with `pid/kill:1` when Syd shares the process group with the sandbox
  process. To reproduce do `syd -plib -msandbox/pid:on -mpid/kill:1
  syd-fork` when a vulnerable Syd will kill itself along with the
  sandbox process.

# 3.21.0

- Skip applying umask when the parent directory has POSIX ACLs defined.
- Fix symlink handling in `chown` and `chmod` handlers.
- Add `trace/allow_unsafe_env:1` to the `paludis` profile.
- Mask the paths `/dev/kmsg`, `/proc/kmsg` by default and allow read,
  and stat access to these files in `paludis` and `user` profiles. This
  is done to prevent the _dmesg_(1) tool from falling back to the
  denylisted _syslog_(2) system call which will fail with `ENOSYS`.
- Fix an UB in the utime syscall handlers.
- Ensure the virtual stat API returns `EBUSY` for all settings that must
  be set at startup.
- Align stack pointer to 16 bytes for the clone that spawns the sandox
  process to ensure proper memory alignment.
- Fix PID recycling issues of clones in `l*xattr` and network syscall
  handlers.
- Emulate xattr calls on symbolic links in a safe way and drop the
  setting `trace/allow_unsafe_xattr`.
- Fix a FS TOCTOU in network system call handlers when using UNIX domain
  sockets and mitigate another.
- Upgrade the crate `mimalloc2-rust v0.3.1 -> v0.3.2` which updates
  the vendored `mimalloc` from 2.1.4 to 2.1.7.
- Do not hook into `fchmod`, `fchown` `fallocate`, `ftruncate`, and
  `ftruncate64` anymore. These system calls operate on file descriptors
  only and the file must be opened for write so Write sandboxing checks
  them on open.
- Add `/proc` to the read allowlist of Lock sandboxing by default. Syd
  is included in the Landlock sandbox and Syd requires this directory to
  function.
- Add `/dev/null` to the write allowlist of Lock sandboxing by default.
  Syd is included in the Landlock sandbox and Syd requires this file to
  function.
- Allow read access to `/dev/random` in `paludis` and `user`
  profiles. Read access to `/dev/urandom` was already granted.
- Check for invalid socket descriptors early in network calls.
- Drop `trace/allow_safe_setid:1` from the `paludis` profile.
- Fix symbolic link handling in `stat` handlers.
- Fix symbolic link handling in `utimensat` handler.
- Implement sidechannel mitigation by adjusting timestamps on
  sidechannel devices and stripping access and modify flags
  of _fanotify_(7)/_inotify_(7) calls on such devices.
- Enhance security by denying symlink resolution in insecure writable
  directories.
- Avoid double open in `fchdir`, `fchmod`, `fchown`, `fgetxattr`,
  `fsetxattr`, `flistxattr`, `fremovexattr`, `fstatfs`, `fstatfs64`, and
  `truncate` system call handlers.
- Keep `CAP_CHOWN` when SafeSetID is enabled.
- Make SafeSetID continue system calls when there's no change in {u,g}id.
- Start sandboxing `fanotify_mark` and `inotify_add_watch` system calls
  as part of Stat sandboxing.
- Respect the `AT_EMPTY_PATH` flag in the `faccessat2` handler.
- Avoid double open in `getxattr`, `setxattr`, `listxattr`, and
  `removexattr`.
- Deny `ghost`, `panic`, and `reset` commands when Crypt sandboxing is
  on with `EBUSY` for safety.
- Publish [the CTF
  profile](https://gitlab.exherbo.org/sydbox/sydbox/-/raw/main/data/ctf.syd-3)
  for transparency.
- Enable TPE sandboxing for the `user` profile and set trusted GID to
  sandbox process' current effective GID.
- Enable TPE sandboxing for the `paludis` profile.
- Make the ptrace Exec sandboxing check honour filtered paths to avoid
  reporting access violations.
- Implement [Trusted Path Execution (TPE)
  sandboxing](http://man.exherbo.org/syd.7.html#TPE_sandboxing).
- Remove the setting `exec/kill`.
- Ensure the `lib` profile sets the sandbox lock to `exec` as `exec` is
  not the default anymore since 3.17.0.
- Make the `ghost` command imply `reset` to ensure no run-away exec
  processes after the invocation of the `ghost` command.
- Avoid panic when unsetting `SYD_` environment variables when the
  environment key or value contains invalid UTF-8.
- Fix undefined behaviour when unsetting `SYD_` environment variables in
  the child by moving the unset logic to the parent right before process
  spawn.

# 3.20.1

- vim: add syntax highlighting for Crypt Sandboxing and Ghost mode.
- Require absolute paths for `crypt/tmp` for safety.
- Fix out of memory error on encrypted file descriptor when writing
  with very small batch sizes.

# 3.20.0

- syd-err can now be used to match errno descriptions as well as names.
- _open_(2) calls with mode read-write was only checked for write
  sandboxing and not read sandboxing. This is now fixed.
- Open a memfd rather than a tmpfile for `open(/dev/syd, O_RDONLY)`.
- syd-err now accepts an errno name glob rather than an errno regex.
- syd-sys now accepts a system call name glob rather than a name regex.
- syd-sys learned `-g` argument to enable Ghost mode prior to probing.
- syd-sys learned `-p` argument to probe the matching system calls.
- Implement [Ghost mode](http://man.exherbo.org/syd.7.html#Ghost_mode).
- Close standard input and standard output after we pass the file
  descriptors to the sandbox process.
- Clear all environment variables that start with `SYD_` from the
  environment of the sandbox process, rather than just the specific Syd
  environment variables. This allows the user to safely set an
  environment variable for the Syd process only and can e.g. be used to
  safely set an AES-CTR key with `config/key:${SYD_KEY}` having set the
  environment variable `SYD_KEY` set on Syd invocation.
- Add new utility `syd-key` to generate AES-CTR key and iv using `/dev/random`.
- Add new utility `syd-cp` for efficient file copying using _splice_(2).
- Add new utility `syd-aes` to encrypt/decrypt files akin to openssl-enc.
- Implement [Crypt
  sandboxing](http://man.exherbo.org/syd.7.html#Crypt_Sandboxing) for
  transparent file encryption using AES-CTR.
- oci: Configure tracing when log feature is on, and disable properly when off.
- oci: Honour capabilities specified by the container engine.
- oci: Avoid hitting `UNIX_PATH_MAX` on tenant socket paths.
- oci: Remove unnecessary chdir from init and start which fixes:
  [youki#2772](https://github.com/containers/youki/issues/2772).
- Update: `libcgroups v0.3.2 -> v0.3.3`
- Update: `libcontainer v0.3.2 -> v0.3.3`
- Update: `liboci-cli v0.3.2 -> v0.3.3`

# 3.19.0

- Add new utility `syd-poc` to demonstrate proof of concepts for various
  sandbox break vectors.
- Add `trace/allow_unsafe_debug:1` to the `paludis` profile.
- Add `trace/allow_safe_kvm:1` to allow a predefined set of KVM ioctls.
  This is necessary to run _qemu_(1) under sandbox with hardware
  acceleration. Previously this was only possible with the unsafe
  `trace/allow_unsafe_ioctl:1` which allows the whole ioctl request
  space.
- Make `trace/allow_unsafe_debug:1` imply `trace/allow_unsafe_memory:1`
  in addition to `trace/allow_unsafe_exec:1`. This is necessary to make
  _valgrind_(1) work in the sandbox.
- Unify `trace/allow_unsafe_p{erf,trace}` options into
  `trace/allow_unsafe_debug`. This option is going to be a general way
  to allow debugging and tracing tools such as gdb, perf, strace,
  valgrind in the sandbox. The manual page clearly states they should
  only be used in trusted environments as it allows the sandbox process
  to trivially break from the sandbox.
- Re-add `trace/allow_unsafe_perf` command to allow perf inside the sandbox.
- Re-add `trace/allow_unsafe_ptrace` command to allow ptrace inside the sandbox.
- oci: Do not pass-through the capabilities specified by the container
  engine. This is done to adhere the goal to be secure by default. To
  honour the capabilities specified by the container engine, user may
  configure Syd with `trace/allow_unsafe_caps:1`. The recommended way,
  however, is to specify only the minimum needed set of capabilities
  using the various "allow\_unsafe" options such as
  `trace/allow_unsafe_bind:1` to retain `CAP_NET_BIND_SERVICE`,
  `trace/allow_unsafe_socket:1` to retain `CAP_NET_RAW`,
  `trace/allow_unsafe_syslog:1` to retain `CAP_SYSLOG`,
  `trace/allow_unsafe_time:1` to retain `CAP_SYS_TIME`.
- Add `trace/allow_unsafe_open:1` to the `paludis` profile.
- Mitigate _open_(2) `O_PATH` TOCTOU by turning `O_PATH` into `O_RDONLY`
  by default and add `trace/allow_unsafe_open:1` to disable this. See
  [BUGS](http://man.exherbo.org/syd.7.html#BUGS) for more
  information.
- `trace/allow_unsafe_tkill` has been renamed to
  `trace/allow_unsafe_kill` which is a **breaking change**.
- `trace/allow_unsafe_adjtime` has been renamed to
  `trace/allow_unsafe_time` which is a **breaking change**.
- Extend ptrace detection mitigator seccomp filter to turn all ptrace
  operations into no-ops rather than just `PTRACE_TRACEME`.
- syd-test and syd-test-do learned `-h` CLI argument to list test cases.
- Drop `CAP_CHOWN` even with SafeSetID. `CAP_SET[UG]ID` is still kept
  for SafeSetID.
- Ensure ptrace is not in ambient and inheritable caps before fork.
- test-do: sort tests by name in help output.
- More than one namespace can be turned on/off using the syntax
  `unshare/type,type...:state` and queried using the syntax
  `unshare/type,type...?` now (e.g.: `unshare/user,pid:1`,
  `unshare/mount,net?`).
- More than one sandboxing type can be turned on/off using the syntax
  `sandbox/type,type...:state` and queried using the syntax
  `sandbox/type,type...?` now (e.g: `sandbox/read,stat,write:on`,
  `sandbox/net,lock:off`). This is simple, intuitive and similar to the
  syntax for specifying multiple glob rules with e.g:
  `allow/read,stat,exec+/usr/***`. See the
  [SHORTCUTS](http://man.exherbo.org/syd.2.html#SHORTCUTS) section
  of the [_syd_(2)](http://man.exherbo.org/syd.2.html) manual page
  for more information.

# 3.18.13

- Improve the efficiency of post-exec sandboxing checks.
- Rename option `trace/allow_unsupp_binfmt` to `trace/allow_unsupp_exec`
  and extend it to cover direct shared library execution.
- Deny direct shared library execution by default to prevent the typical
  exec sandbox escape with `/lib/ld-linux.so.1
  /deny/listed/binary`.

# 3.8.12

- The unsafe path check was missed in the `getdents` handler which
  caused it to list unsafe paths. This is now fixed.
- Deny unsafe paths with `ENOENT` rather than `EACCESS` in path canonicaliser for stealth.

# 3.8.11

- Extend signal protections to guard against group signaling the Syd process group.

# 3.18.10

- Add `trace/allow_unsafe_tkill:1` to the `paludis` profile.
- Add `trace/allow_unsafe_xattr:1` to the `paludis` profile.
- Turn the deprecated `tkill` system call into a no-op for safety
  against PID-recycling. The option `trace/allow_unsafe_tkill:1` is
  provided to relax this restriction.
- Deny system calls which work with extended attributes on symbolic
  links by default as they are vulnerable to filesystem TOCTOU. The
  option `trace/allow_unsafe_xattr:1` is provided to relax this
  restriction. See "syd-ls xattr" for the list of system calls in this
  set.
- Protect Syd against signals from the same process group.
- Fix an issue with chmod syscall handler wrt. symbolic links.
- Make syscall path handler TOCTOU-free, see #123 for a list of effected
  system calls.
- Fix an issue with fchmodat handler wrt. symbolic links.

# 3.18.9

- syd-oci no longer honours the environment variables `SYD_OCI` and
  `SYD_OCI_PROFILE`. This ensures sandbox status is invariant once
  container is started (unless lock is off, then sandbox can be
  dynamically edited at runtime).
- vim: Highlight 0 and root in the destination field of set{u,g}id as Error.

# 3.18.8

- Set the sticky bit for /dev/shm and /tmp mounts of the `immutable` profile.

# 3.18.7

- Improve the syd-oci manual page.

# 3.18.6

- Fix the list of io-uring system call list. This list incorrectly
  included the system calls of the POSIX async API before. This means
  the system calls `io_cancel`, `io_destroy`, `io_{p,}getevents`,
  `io_setup` and `io_submit` are now allowed.
- Add `trace/allow_unsafe_filename:1` to the `paludis` profile.
- Add `trace/allow_unsafe_filename:1` to allow creation of files with
  control characters in them.
- Change syd-oci init process name from `youki:INIT` to `syd_init` to avoid confusion.
- Fix an issue with opening the container runtime log file that broke docker.

# 3.18.5

- oci: Do not attempt to log to syslog. Logs go to container runtime log file.
- Log correct UID after user switch.
- Do not truncate the log file if it exists.
- oci: Preserve Syd's log file descriptor inside the container so that access
  violations are correctly sent to the container runtime log file.

# 3.18.4

- oci: Honour log path and debug arguments passed by the container engine.
- Prioritise domain names over host names during configuration parsing for syd-oci.

# 3.18.3

- syd-oci incorrectly tried to keep `CAP_SYS_PTRACE` in rootless
  containers, which resulted in permission denied error on container
  start. This is now fixed.

# 3.18.2

- Update features in version output.
- Do not leak the `SYD_LOG_FD` environment variable to the sandbox process.

# 3.18.0

- Add run subcommand to syd-oci, this completes the set of common subcommands.
- Add exec subcommand to syd-oci.
- Add checkpoint subcommand to syd-oci.
- Add update subcommand to syd-oci.
- Add events subcommand to syd-oci.
- Add pause and resume subcommands to syd-oci.
- Add spec subcommand to syd-oci.
- Add list subcommand to syd-oci.
- Add ps subcommand to syd-oci.
- Add features subcommand to syd-oci.
- Syd configuration files now support the `include_profile` clause to
  include a Syd profile into the configuration. See `syd-cat list` for a
  list of profiles.
- New utility syd-oci which is a container runtime for syd based on yaouki.
  Currently the standard set of subcommands create, start, state, delete,
  and kill are implemented.
- Fix an issue with SegvGuard and realtime signals.

# 3.17.5

- Add `PTRACE_ATTACH` to the kill list of sydbox' own process seccomp
  filter so that a compromised syd process can never attach to another
  process.
- Fix the path control character checker to work with the open syscall
  hook which was missed before.

# 3.17.4

- Deny paths with control characters at the time of sandbox access check.
- Mask control characters when logging paths.

# 3.17.3

- Add initial vim syntax highlighting file for Syd profiles.
- Make configuration parsing more robust by rearranging conditionals.
- Fix handling of paths with spaces in include paths.

# 3.17.2

- Attempt to set the soft limit of the maximum number of open file
  descriptors to the corresponding hard limit on startup for
  convenience.

# 3.17.1

- Add mprotect hardening for the syd process as part of the EEC.
  This helps mitigate ret2mprotect in a compromised syd process.

# 3.17.0

- Add `lock:exec` to the paludis profile for `esandbox`.
- The default of "lock" setting has been changed from "exec" to "unset",
  where unset means lock will be set to on automatically by syd unless
  no lock clause was specified upon process execution allowing prior
  sandbox edits by configuration files, profiles and CLI arguments.
- Improve lock efficiency in SegvGuard crash recorder.
- Fix `trace/exit_wait_all:1` and write integration tests to verify.
- Harden the syd process by denying non-native syscalls. This pertains
  to the syd process only: Non-native syscalls are still supported for
  the sandbox process.
- Harden the syd process by applying a kernel level seccomp-bpf filter
  to deny exec system calls after the successful exec of the
  sandbox process. As such a compromised syd process cannot use these
  system calls.
- Add a parent seccomp filter to restrict socket system call
  based on sandbox flags.
- Reduce locking in open handler.

# 3.16.11

- Work on logging to make log messages consistent.
- Fix regression in sandbox locking causing hang.

# 3.16.10

- Avoid polling the seccomp file descriptor, block on receive ioctl instead.
- Do not allow `PROT_READ|PROT_EXEC` in seccomp mprotect hardener.
- Check for a capability before dropping it.
- Print GNU build id in version output.
- syd-elf learned `-b` to print the GNU build id of a file.
- Improve sandbox lock usage in stat handler.
- syd-elf learned `-v` to print the version of a file.
- syd-elf learned `-t` to print the type of a file.
- syd-elf learned `-r <address>` to resolve the name of the symbol at the given address.
- syd-elf learned `-n <pattern>` to list the addresses and names of all symbols in the file whose name match the given pattern.
- syd-elf learned `-l` to list the addresses and names of all symbols in the file.
- syd-elf root parameter `-r` has been renamed to `-R`.

# 3.16.9

- Fix a syntax issue in syd.7 manual page.

# 3.16.8

- Add `trace/allow_unsupp_binfmt:1` to the `paludis` profile.
- Add `trace/allow_unsafe_exec:1` to the `paludis` profile.
- Handle dangling `/proc/pid/exe` gracefully.
- Remove deny mode from Force sandboxing, only warn and kill are supported.
- Remove `trace/allow_unsafe_binfmt`.
- Exclude scripts from Force sandboxing for performance.
- Make the script interpreter parsing API safe against filesystem attacks such as replacing the script with a FIFO.
- Make the ELF parsing API safe against filesystem attacks such as replacing a library with a FIFO.
- Check for dynamic library injection once post-exec rather than twice pre and post-exec.
  The pre-exec check was broken and did not work at all due to
  `/proc/pid/environ` not being populated at the time (size=0).
- Improve musl detection in `ldd` function and remove excessive globbing.
- Avoid opening the file twice in exec handler.
- Fix an issue with `ldd` causing it to return elf-interpreter paths without canonicalization.
  This affects Exec and Force sandboxing.
- Add `trace/allow_safe_setid:1` to the `paludis` profile.
- Implement SafeSetID. Use `trace/allow_safe_setid:1` to enable,
  `setuid+<user-name|uid>:<user-name|uid>`, and
  `setgid+<group-name|gid>:<group-name|gid>` to define allowed transitions.
- Fix a regex issue in sandbox config parser which caused invalid ops to match.
- Return correct error code for non-executable files in exec handler.
- Handle too short files gracefully when determining script interpreter path.

# 3.16.7

- Implement [Path Masking](http://man.exherbo.org/syd.7.html#Path_Masking).
- Upgrade from mimalloc-2.1.2 to mimalloc-2.1.4.

# 3.16.6

- Fix parsing multiple control messages in 32-bit sendmsg emulation.
- `syd-test` learned to randomize the order of integration tests. The
  default seed can be overridden with `SYD_TEST_SEED` to replicate a
  previous order.
- Add `trace/allow_safe_kcapi:1` to the `user` profile.
- Add `trace/allow_safe_kcapi:1` to the `paludis` profile.
- Implement `trace/allow_safe_kcapi:1` to allow safe access to kernel
  crypto API without having to specify `trace/allow_unsupp_socket:1`.
- Fix `ALG_SET_IV` operation in sendmsg emulation.
- Return an empty file for `/proc/cmdline` rather than denying access to
  it outright for compatibility.
- Drop the `trace/force_restart:1` workaround to inject `SA_RESTART`
  to sigaction flags.
- Mention elf feature in version output.

# 3.16.5

- Allow socket configuration control ioctl getters
  to make libc functions such as `if_indextoname`,
  `if_nametoindex` etc. work.
- Drop perf ioctls from the default ioctl allowlist.
- Fix handling of LDD errors in exec-TOCTOU-mitigator.

# 3.16.4

- Prevent denylisted dynamic library injection using `LD_{AUDIT,PRELOAD}` on exec.
- Prevent denylisted dynamic library injection using `LD_LIBRARY_PATH` on exec.
- Make the ELF parser optional via the `elf` feature which defaults to on.
  Turning this feature off allows linking syd statically.
- Add `-s` flag to syd-elf to exit with success if the given binary is
  statically linked.
- Add `-d` flag to syd-elf to exit with success if the given binary is
  dynamically linked..
- Add `-6` flag to syd-elf to exit with success if the given binary is 64-bit.
- Add `-3` flag to syd-elf to exit with success if the given binary is 32-bit.

# 3.16.3

- Plug a file descriptor leak during init with `unshare/user:0`.
- Prevent ptracer detection via failing `PTRACE_TRACEME` by turning this
  ptrace operation into a no-op.
- Enable `union` feature on the smallvec crate. When the union feature is
  enabled smallvec will track its state (inline or spilled) without the use of
  an enum tag, reducing the size of the smallvec by one machine word. This means
  that there is potentially no space overhead compared to Vec. Note that
  smallvec can still be larger than Vec if the inline buffer is larger than two
  machine words.
- New command `trace/deny_elf_static:1` to deny execution of statically linked binaries.
- New command `trace/deny_elf_dynamic:1` to deny execution of dynamically linked binaries.
- New command `trace/deny_elf32:1` to deny execution of 32-bit binaries.
- New command `trace/deny_script:1` to disable execution of scripts.
- Deny access to non-{elf,script} interpreter paths (e.g. binfmt with
  wine and java) by default. This may be disabled with `trace/allow_unsupp_binfmt:1`.
- Deny access to relative #! interpreter paths and paths with ".." in
  them by default. This may be disabled with `trace/allow_unsafe_binfmt:1`.
- New tool `syd-elf` which is a barebones `ldd(1)` alternative.
- Do not pipe `esyd info` output to PAGER.
- Utilize `lddtree` crate to check dynamic libraries for Exec and Force Sandboxing.
- Implement SegvGuard utilizing `PTRACE_EVENT_EXIT`. The implementation
  is inspired by and closely resembles that of HardenedBSD.
- Fix signal forwarding on ptrace-stops.
- Add `filter/net/connect+/run/systemd/userdb/io.systemd.DynamicUser` to
  the paludis profile to reduce noise during package builds. Note, this
  only prevents the reporting, access to the socket is still denied.
- Apply a seccomp filter to deny mount(2) system call after bind mounts
  such that a compromised syd process cannot call mount.
- Improve error handling in initial re-execution.
- Apply a seccomp filter to the syd process to deny `PTRACE_SEIZE` operation,
  after the only necessary call to attach to the child for exec-TOCTOU
  mitigation. This ensures a compromised syd process cannot attach to other
  processes in the system.

# 3.16.2

- Drop `CAP_SETPCAP` capability by default.
- Drop `CAP_MKNOD` capability by default.
- Drop `CAP_FOWNER` capability by default.
- Drop `CAP_FSETID` capability by default.
- Drop `CAP_CHOWN` capability by default.
- Drop `CAP_AUDIT_WRITE` capability by default.
- Drop `CAP_DAC_OVERRIDE` capability regardless of unshare/user.
  Previously we only dropped this capability when we're entering
  a user namespace.
- Drop `CAP_KILL` capability by default.
- Handle realtime signals gracefully in wait loop.
- Add `trace/allow_unsafe_exec:1` to disable exec-TOCTOU mitigator.
  This allows `strace -f syd` to work.

# 3.16.1

- Bypass libc and call waitid syscall directly to workaround a glibc bug.
- Drop the mount, umount, umount2 hooks and deny these syscalls.
- Add code name to --version output.
- Prefix default NIS/YP domainname with `syd-` for UTS namespace.
- Use `lexis` crate to auto-generate default hostname for UTS namespace.
- Use `lexis` crate to log human-readable names generated from process IDs in logs.

# 3.16.0

- Execute `cmd/exec` commands in a new process group.
- Send SIGKILL to offending process' process group on pid access violations.
- Implement an effective `execve(2)` TOCTOU mitigator utilizing `PTRACE_EVENT_EXEC`.
- Sync get shebang program function with the kernel implementation.
- Enable `trace/force_restart:1` for the paludis profile.
- Add `trace/force_restart:1` to inject `SA_RESTART` to sigaction flags.

# 3.15.8

- Drop `CAP_NET_BIND_SERVICE` by default and add `trace/allow_unsafe_bind` to retain it.
- Implement `trace/allow_unsafe_syslog` command to allow privileged syslog operations.
- Drop /proc/kmsg from the list of unsafe paths (required to sandbox syslogd).
- Set panic=abort for release builds.
- Make MDWE errors non-fatal.
- Fix allowing FIOASYNC ioctl (fixes nginx under syd).

# 3.15.7

- Fix a regression in wait handler that caused syd not to reap zombies properly.

# 3.15.6

- Use `PIDFD_THREAD` flag to save a `/proc/pid/status` read if supported.
- Avoid a process reusing the exec pid through a recycle from taking over the
  sandbox by signaling the pidfd to ensure the correct process is still alive.
- USE `CLONE_PIDFD` on initial spawn to avoid wait races and to spare a
  `pidfd_open` to get the seccomp notify fd.
- Fix handling of deleted proc magic symlinks.
- The file creation mode set by `trace/force_umask` is now honoured by
  _chmod_(2) family system calls for added hardening.
- Guard against CVE-2019-5736 by copying /proc/self/exe to an anonymous file
  descriptor, sealing it and re-executing it. Note due the syd's procfs
  protections this was not exploitable so this feature acts as an extra layer of
  defense.
- Configure release script to compress release tarball with XZ rather than GunZip.

# 3.15.5

- Fix statx alignment on 32bit (ARMv7 compat).
- Fix syscall allow on sandbox/{mem,pid}:off.
- Handle `64` and `_time64` versions of various system calls (ARMv7 compat).
- Handle deleted paths gracefully when resolving /proc/self/fd symlinks.
- Add `PR_SET_VMA` to the list of allowed prctls.
- ldd: do not set default log level to error and do not disable syslogging.

# 3.15.4

- Teach mount handler to handle fd= in mount options.
- Fix mount handler to correctly handle filesystem type argument.
- landlock: fix opening paths with `O_PATH`.
- Pass the correct pid in `SCM_CREDENTIALS` with sendmsg.
- Fix root: to correctly imply unshare/mount:1 and unshare/pid:1.
- Fix signal protector to correctly handle negative pid arguments.

# 3.15.3

- **Milestone**: Exherbo system set builds under syd-3 with tests on.
- Fix symbolic link handling in mknod and mknodat handlers.
- Drop `trace/allow_unsafe_sendmsg` command.
- Start sandboxing _sendmmsg_(2) calls.
- Start sandboxing _sendmsg_(2) calls.

# 3.15.2

- The utility **syd-lock** has learned to run a command under landlock. The
  old check mode is available using the `-c` parameter.
- `trace/deny_dotdot` now handles chdir, fchdir calls as well as open calls.
- Allow the system calls sgetmask, ssetmask, signal, sigaction, sigpending,
  sigprocmask, sigsuspend and sigreturn (X86 compat).

# 3.15.1

- New utility **syd-mdwe** to run a command under Memory-Deny-Write-Execute protections.
- New utility **syd-load** to load a dynamic library like syd for testing.
- New utility **syd-tick** to measure command runtime in hardware ticks.
- Support include directives in config files.
- Support environment variable and tilde expansion in config files.
- Add hardware ticks in log output if available (x86-64 and arm64).
- Allow `PROC_BTI|PROT_EXEC` for mprotect on arm64.
- Logs of level error are now also sent to syslog similar to warn.
- Add `trace/force_umask` to set an umask at startup and make umask(2) a noop.
- Add `trace/deny_dotdot` to deny .. in path resolution for open calls.
- Cover many more tty types in proc ttyname function borrowing code from procps-ng.
- Fix proc ttyname function not to choke when spaces are in arg0.
- Deny access to directories `/sys/kernel/{boot_params,debug,irq,slab,tracing}`.
- Deny access to `/sys/kernel/notes` and `/sys/kernel/vmcoreinfo`.
- Replace hex crate with const-hex crate.
- Deny bind calls with EADDRNOTAVAIL rather than EACCES for syd-1 compat.
- Add `PR_{G,S}ET_MDWE` to the list of allowed prctls.
- Add support to load a dynamic library at startup and execute the function `syd_main` in it.
- Remove `deadlock_detection` feature and enable functionality by default.
  The deadlock detector thread is only spawned if `SYD_LOCK` is set at
  startup.
- Support non-multiplexed network calls on X86.
- Check for execute rights before continue in exec handler to make TOCTOU attacks harder.
- Add a hook to the -1 system call and return API number if the lock allows.
- New tool **syd-cpu** to print the number of CPUs.
- Check shebang program for scripts in force sandboxing.
- Check shebang program for scripts in exec sandboxing.
- Fix git versioning issues breaking paludis interaction.
- Fix the capability drop regression which broke `trace/allow_unsafe_caps:1`.
- Deny executable+shared memory by default, can be relaxed with
  `trace/allow_unsafe_memory:true`.
- Deny /proc/version and add an uname hook to wipe the OS version field.
- Add files /proc/cmdline, /proc/config.gz, /proc/dma, /proc/interrupts,
  /proc/iomem, /proc/ioports, /proc/key-users, /proc/keys, /proc/kmsg,
  /proc/modules, /proc/mtrr, /proc/partitions, /proc/softirqs,
  /proc/sysrq-trigger, /proc/vmallocinfo and directories /proc/fs, /proc/irq,
  and /proc/tty to the list of unsafe paths.
- Revert back to denying PID sandboxing violations with `EACCES` rather than `EAGAIN`.
- Optimize seccomp filter with binary tree sorting.
- Deny access to `/proc/kallsyms` and `/proc/kcore`.
- Deny access to `/dev/mem`, `/dev/kmem`, `/dev/port` and `/dev/cpu/*`.
- Prevent `mmap(NULL, MAP_FIXED)` using a parent seccomp filter.
- syd-path learned `-s` to prefix rules with `/dev/syd/`.
- esyd.sh: Add force sandboxing functions.
- List force sandboxing rules in `/dev/syd/stat` output.
- List force sandboxing rules in `/dev/syd` JSON output.
- Add `arm_fadvise64_64` and `arm_sync_file_range` into the set of safe system calls (ARM compat).
- Add `mq_timedsend_time64` system call into the set of safe system calls (ARM compat).
- Add `send` system call into the set of safe system calls (ARM compat).
- Add `recv` system call into the set of safe system calls (ARM compat).
- Set `SIGPIPE` handler to default at startup for helper tools.
- Implement `syd::fork_fast` for x86 and arm.
- New tool **syd-fork** to fork fast in an infinite loop.

# 3.15.0

- Fix error return when the initial exec fails.
- Fix capability drop when run as root.
- New tool **syd-hex** to hex encode/decode input.
- The new command `force/default` may be used to define the default action for Force sandboxing.
- The new command `sandbox/force` may be used to turn Force sandboxing on or off.
- New tool **syd-path** to write Integrity Force rules for binaries under PATH.
- Implement force sandboxing, which is similar to HardenedBSD's integriforce.
  This sandboxing can be used to verify binaries prior to execution.
- New tool **syd-sha** to calculate md5, sha1, sha3-{256,384,512} checksums.
- Extend the list of unsafe environment variables.
- Allow /sys/bus/cpu for read,stat in paludis profile.
- Start sandboxing `fallocate` system call.

# 3.14.5

- Start sandboxing `statfs`, `statfs64`, `fstatfs` and `fstatfs64` system calls.
- Start sandboxing `ftruncate` and `ftruncate64` system calls.
- New `deadlock_detection` feature to spawn a background thread which polls
  for and reports deadlocks using the API provided by parking\_lot crate.
- Enable `hardware-lock-elision` feature of the parking\_lot crate which
  is supposed to give performance benefits on x86.
- Sync paludis and user profiles with hardened procfs to perform added hardening.
- Deny unconditionally sensitive /proc/pid paths such as "maps" and "mem".
- Drop `trace/allow_unsafe_ptrace` command, ptrace is always denied.
- Drop `trace/allow_unsafe_perf` command, perf is always denied.
- Fix a minor bug in open handler wrt. `O_TMPFILE` flag handling.
- Make magic symlink protection unconditional, previously only readlink
  and open handlers were unconditional.
- Deny PID sandboxing violations with `EAGAIN` rather than `EACCES` for compat.

# 3.14.4

- Fix glibc-2.9 compatibility issues wrt. fchmodat2.
- Deny bad/unknown system calls with `ENOSYS` rather than `EACCES`.
- Enable fchmodat2 handler, skip libseccomp unsupported syscalls gracefully.
- Fix lstat on magic proc symbolic links to work correctly.

# 3.14.3

- Make magic symlink protection of readlink and open handlers unconditional.
  This protection will continue to work even if sandboxing is off.
- Make namespace reexec race less likely by opening an `O_PATH` fd to `/proc/self/exe` at startup.
- Do not search for PATH when reexecuting syd.
- Rework mounts and chroot, syd is reexecuted outside chroot so there is
  no more any requirement to have syd in PATH under the new root
  directory. This makes chrooting much more practical with syd.
- Improve cmd, cmdline and cwd logging.
- Change root directory can now be specified as a relative path.
- Fix return code handling wrt. signal termination when syd is executed in a namespace.
- Process bind mounts after syd reexec for safety and flexibility.

# 3.14.2

- Fix the long standing bug caused by UNIX domain sockets' `UNIX_PATH_MAX` length restriction.

# 3.14.1

- **Milestone**: 15 years of sydbox and version π!
- `trace/private_tmp` has been removed, use `bind+tmpfs:/tmp:nodev,nosuid` instead.
- `trace/private_shm` has been removed, use `bind+tmpfs:/dev/shm:nodev,nosuid,noexec` instead.
- `bind` can now be used to mount special filesystems such as `tmpfs`.
- Report target cpu count in -V/--version output.
- Use `PR_MDWE_NO_INHERIT` flag on `trace/allow_unsafe_memory`. This way
  syd process gets the MDWE protections regardless of the setting.
- Print target persona in `-V/--version` output.
- Print target information in `-V/--version` output.
- Add `trace/lock_personality` to lock `personality(2)` changes.
- Add `trace/allow_unsafe_memory:true` to the Paludis profile.
- Add `trace/allow_unsafe_memory` to bypass MDWE protections.
- Enhance security by applying Memory-Deny-Write-Execute (MDWE) protections.
- Fix mknod handlers to return `EPERM` rather than `EACCESS` on invalid file type for compatibility.
- Drop `trace/allow_unsupp_socket:true` from user profile.
- Drop `trace/allow_unsafe_socket:true` from user profile.
- Denylist `sendmsg` and `sendmmsg` system calls which can be used to circumvent
  network sandboxing. Use `trace/allow_unsafe_sendmsg` to relax this
  restriction.
- Stop sandboxing `recvfrom` calls, this is the same behaviour as syd-1.
- Plug a sandbox break where mkdir/mknod calls' `EEXIST` return value may be
  misused to locate hidden paths.
- Add new profile **privileged** which is a shorthand for `trace/allow_unsafe_caps:1`.
- Check for request validity before sending SIGKILL to process for safety against PID reuse.
- Rework /proc/sys permissions in `immutable` profile.
- Make immutable profile stricter by bind mounting `/var/empty` over `/sys/fs/{bpf,ext4,fuse,pstore,selinux,smackfs}`.
- Return the errno `ECONNREFUSED` rather than `EACCES` for connect/sendto calls.
- Correct IPv6 loopback address to ::1/128 from ::1/8 in network aliases.
- Fix an UB in xattr handlers causing bad data to be used in value field.
- Fix mknod handler to properly treat zero file type as regular file.
- Add `trace/allow_unsafe_setid` config to relax setid restrictions.
- Allow relative pathnames in rules as UNIX socket path matches.
- Fix a bug with umask handling in open handler.
- Optimize current working directory handling in canonicalize function.
- Allow the ioctl operation `FS_IOC_GETFLAGS`.
- Open the /dev/syd virtual `O_TMPFILE` under /tmp rather than current directory.
- Refine handling of CAP_SYS_PTRACE.
- Optimize path component handling in canonicalize function.
- **syd-stat** learned to list blocked, ignored, caught and pending signals.
- Avoid restoring signal masks needlessly in the child process.
- Process bind mounts after chroot.
- Improve the ends with dot check in read path.
- Start using mimalloc with the secure feature as the default allocator.
  The feature flag **mimalloc**, which defaults to on, can be used to turn it off.
- Send seccomp denies to kernel log only if log feature is enabled.
- Various small improvements to the path canonicalizer.
- **syd-mem** now correctly reports errors.
- Ensure config parser gracefully handles binary files.
- **syd-cat** now accepts a path argument to validate the given syd profile.
- Fix tests to run under docker, note `--cap-add CAP_SYS_PTRACE` is
  necessary.

# 3.14.0

- Plug a socket leak bringing loopback device up in net namespace.
- Drop sendfd crate dependency.
- Use a pipe pair rather than a socket pair to transfer seccomp fd.
- Set `trace/allow_unsafe_prlimit:true` for Paludis profile.
- Do not drop `CAP_DAC_OVERRIDE` unless entering a user ns.
- Increase thread pool keep alive timeout from 15 seconds to 90 seconds.
- Drop the capability `CAP_SETFCAP` at startup by default.
- Drop the capability `CAP_DAC_READ_SEARCH` at startup by default.
- Drop the capability `CAP_DAC_OVERRIDE` at startup by default.
- Drop broken /dev/syd handling in getdents handler.
- Detect and handle mapped IPv4 addresses for IPv6 addresses.
- Fix a minor bug with rule parsing for rules with a trailing slash.
- Fix a minor bug with rule parsing for allow/denylists.
- Harden the getdents handler by making an initial access check for the dir before entries.
- Rework network sandboxing, fix recvfrom handler to properly check for source address.
- Do not validate the address length argument network system calls as
  they cannot be fully trusted.
- PID sandboxing can now only be turned on at startup for performance reasons.
- Memory sandboxing can now only be turned on at startup for performance reasons.
- Fix **syd-read** from failing on existing entries.
- Do not do a preliminary normalize pass before canonicalize, breaks
  paths with both symlinks and dots in them.
- The tool **syd-norm** has been removed.
- Trim trailing nul-bytes in UNIX domain sockets before canonicalization.
- Harden landlock profile by allowing /proc read-only rather than read-write.
- Canonicalize paths of UNIX domain sockets.

# 3.13.4

- Revert: Harden `private_tmp` and `private_shm` by bindmounting
  /var/empty over /var/tmp. Breaks Paludis.

# 3.13.3

- Fix mkdir handler to return EEXIST on existing dirs rather than
  raising an access violation.
- Mask kernel filesystems in immutable profile.
- Mount private proc before bind mounts to allow mounting over proc entries.
- Continue execution in case a bindmount fails with ENOENT indicating
  source or target does not exist. This way profiles can provide
  limitations without failing on systems that don't have the respective
  files.
- syd will now fail early if `root:` is specified with one of
  `trace/private_shm` or `trace/private_tmp` as these features
  contradict with each other and do not work together.
- Fix chroot failing in mount namespace due to non-recursive bindmount.
- Harden `private_tmp` and `private_shm` by bindmounting /var/empty over /var/tmp.
- Harden `private_tmp` by mounting private /tmp with nodev and nosuid options.
- Harden `private_shm` by mounting private /dev/shm with nodev, nosuid and noexec options.
- Improve symlink loop detection in path canonicalizer.

# 3.13.2

- Various minor performance improvements to path canonicalizer and normalizer.
- Improve syscall handler lookup, avoid string match on each syscall.
- Fix logging not to create json objects if the log level is disabled.

# 3.13.1

- Fix empty path handling in readlink handlers.

# 3.13.0

- Add handlers for `readlink` and `readlinkat` for stat sandboxing.
- Bump MSRV from 1.70 to 1.71.
- Improve /proc/self, /proc/thread-self magic link handling, fixing a
  known sandbox break, see the integration test
  `procself_escape_symlink` for more information.
- Improve handling of the magic /proc/pid/fd symbolic links, return
  ELOOP if the path does not belong to the current process akin to
  `RESOLVE_NO_MAGICLINKS`. Such fds are often misused to break out of
  containers which makes this an important hardening.
- consolidate error logging in json logs.
- pass `RESOLVE_NO_MAGICLINKS` along with `RESOLVE_NO_SYMLINKS` to the
  openat2 calls in open and stat handlers for added security.
- new tool **syd-open** to lookup open flags by number or name.
- improve the efficiency of the stat handler
- improve open handler and fix handling of dir file descriptors in openat{,2}.
- drop noatime from immutable profile mounts to allow unprivileged mount.
- ldd: fix determining syd path on Exherbo.
- Implement `trace/allow_unsafe_perf` command to allow perf inside the sandbox.
- Implement `trace/allow_unsafe_ptrace` command to allow ptrace inside the sandbox.
- Drop `O_PATH` stat sandbox special casing.
- Add setting `trace/allow_unsafe_caps` to skip dropping Linux capabilities on startup.
- Rename `trace/allow_unsafe_socket_families` `trace/allow_unsafe_socket`.
- Rename `trace/allow_unsupported_socket_families` `trace/allow_unsupp_socket`.
- Rename `trace/allow_successful_bind` `trace/allow_safe_bind`.
- Rename `trace/allow_unsafe_environment` `trace/allow_unsafe_env`.
- Improve getdents handler by skipping dot entries from access check.
- Improve proc umask function.
- Add an improved proc tgid get implementation.
- Start using missing mode handlers for path canonicalization.
- Improve the /proc fd check in path canonicalizer.
- Improve the efficiency of `syd::proc::proc_cmdline` function.
- Verify process using seccomp-id-valid after `pidfd_open` calls.
- Drop excessive seccomp-id-valid calls.
- Avoid a needless `faccessat` in path canonicalizer.
- Improve path sandboxing implementation to reduce the number of syscalls.
- Avoid another needless canonicalize in read path function.
- Keep `CAP_FSETID` capability at startup.
- Keep `CAP_FOWNER` capability at startup.
- Keep `CAP_SETPCAP` capability at startup.
- Keep `CAP_MKNOD` capability at startup.
- Keep `CAP_AUDIT_WRITE` capability at startup.

# 3.12.4

- Avoid needless path canonicalization in getdents handler
- Simplify and improve process read directory function

# 3.12.3

- syd-tty no longer prints the tty of the current process when no pid is given.
- Improve process tty function
- syd-ldd: fix issue determining which syd to execute
- Avoid needlessly determining thread group id once per syscall
- Improve process umask function

# 3.12.2

- Drop `CAP_NET_BROADCAST` capability at startup.
- Do not drop the `CAP_DAC_OVERRIDE` and `CAP_DAC_READ_SEARCH` capabilities
  which may be necessary during path resolution.
- Remove needless, special casing **faccessat** calls for **EEXIST**
  check in **mkdir** and **mknod** handlers.
- Refactor path sandboxing to reduce allocations.
- Improve the path canonicalizer performance by allocating the symlink
  loop detection set only when really necessary.
- Add initial manual page for `syd.7`.

# 3.12.0

- Add initial manual page for `syd-cat`.
- Add initial manual page for `syd-env`.
- Add initial manual page for `syd-err`.
- Add initial manual page for `syd-exec`.
- Add initial manual page for `syd-ldd`.
- Add initial manual page for `syd-lock`.
- Add initial manual page for `syd-log`.
- Add initial manual page for `syd-ls`.
- Add initial manual page for `syd-mem`.
- Add initial manual page for `syd-norm`.
- Add initial manual page for `syd-read`.
- Add initial manual page for `syd-run`.
- Add initial manual page for `syd-size`.
- Add initial manual page for `syd-stat`.
- Add initial manual page for `syd-sys`.
- Add initial manual page for `syd-test`.
- Add initial manual page for `syd-tty`.
- `syd-ls` learned the new sets **setid**, **time**, and **uring**.
- New sandbox command `trace/allow_unsafe_uring` to allow io_uring
  interface.
- Improve symlink loop detection in path canonicalization.
- Consolidate boolean parsing in sandbox commands.
- Add initial `syd.1`, `syd.2`, and `syd.5` manual pages.
- Add initial manual page for `syd-chk`.
- New tool `syd-env` to run a command with the environment of a process.
- Helpers now support `-h` to print help.
- Add sample OpenNTPD profile.
- `syd-ls setid` now lists the setid system calls.
- Add `setgroups` and `setgroups32` to `SETID_SYSCALLS`.
- Add [Known Bugs](#known-bugs) section to the readme.
- Extend the parent seccomp filter, denying many unused system calls.
- Turn `chroot` and `pivot_root` into no-ops rather than denying them with
  `EACCES` for compatibility with daemon which change root into an empty
  directory once all path access is done.
- Include `O_PATH` open requests into access check for stat sandboxing.

# 3.11.4

- Fix a regression caused by the recent `AT_EMPTY_PATH` path fix.
  Notably this makes fstating special files such as pipes and sockets
  work correctly again under syd.

# 3.11.3

- Vendor in the caps crate and avoid using **thiserror** which breaks static
  linking.

# 3.11.2

- Do not resolve symbolic links with `AT_EMPTY_PATH` flag in newfstatat
  and statx handlers. Notably, this fixes tar unpacking symbolic links
  pointing outside tar root.
- Improve path exists check in mkdir, mknod handlers by using access
  instead of stat.
- Fix a symlink TOCTOU in symlink and symlinkat handlers.
- Fix a symlink TOCTOU in open handler.
- Do not prevent access to device special files in open handler. Use
  `bind` with `nodev` for a secure alternative.
- Add sample ntpd profile.
- Drop the `is-terminal` crate dependency.
- Fix an issue with stat handler which caused it to fail with a
  permission error when called with `AT_EMPTY_PATH` in a user namespace
  (but _not_ in a pid namespace), with /proc mounted with the option
  `hidepid=2`.
- Mount private procfs with `hidepid=2` for additional hardening.
- Keep capabilities through user namespaces, this makes `unshare/user:1`
  functionally identical to `unshare -U --keep-caps`.
- Use binary system rather than decimal when parsing human-formatted sizes.
- New tool `syd-mem` to calculate the memory usage of a process.
- Do not drop `CAP_SYS_PTRACE` capability on startup as it is necessary
  to call the system calls `process_vm_readv` and `process_vm_writev`.
- Drop `CAP_CHECKPOINT_RESTORE` capability on startup.
- Drop `CAP_IPC_OWNER` capability on startup.
- Drop `CAP_SYS_TTY_CONFIG` capability on startup.
- Start using the `caps` crate to interact with Linux capabilities.
- New tool `syd-stat` to print detailed statistics about a process in JSON.
- unshare: call `PR_SET_KEEPCAPS` after clone.
- Set `trace/allow_unsafe_socket_families:1` **paludis** and **user**
  profiles.

# 3.11.1

- New sandbox command `trace/allow_unsafe_socket_families` to keep the
  `CAP_NET_RAW` capability. Useful to allow `ping` in the sandbox.
- New sandbox command `trace/allow_unsafe_adjtime` to keep the
  `CAP_SYS_TIME` capability and allow the system calls `adjtimex` and
  `clock_adjtime`. This is mostly useful when sandboxing an ntp daemon.
- `-e var=` may be used to pass-through an unsafe environment variable.
- Clear unsafe environment variables, may be disabled with
  `trace/allow_unsafe_environment:1` on startup.
- New tool `syd-run` to run a program inside a syd container.
- `syd-ldd` now uses the `immutable` profile rather than the `container`
  profile.
- Fix `unshare/pid:1` to properly imply `unshare/mount:1`.
- New tool `syd-tty` to print the controlling terminal of the given PID
  or the current process.
- Simplify symlink loop detection in path canonicalizer.
- Fix a panic in bind config code path.
- Do not send logs to syslog for `-x`.
- Parse user profile on `-f` for login shell compat.

# 3.11.0

- `-f` argument has been renamed to `-P`. `-f` is now ignored for login
  shell compatibility.

# 3.10.2

- Fix a regression with user profile parsing for the login shell.

# 3.10.1

- Clean up temporary tmp and shm directories at exit.
- New sandbox command `trace/private_shm` to mount private /dev/shm in
  the new mount namespace.
- Fix a regular expression issue in **syd-err**, and **syd-sys** helpers.

# 3.10.0

- New sandbox command `trace/private_tmp` to mount private /tmp in the
  new mount namespace.
- Add new profile **immutable** to create immutable containers.
- Command line option `-C` has been renamed to `-f`.
- Simplify command line option parsing and avoid double parsing to
  prioritize CLI options when the user profile is parsed.
- `allowlist/` and `denylist/` prefixes on sandbox commands have been
  changed to `allow/` and `deny/` respectively.
- Move auxiliary functionality into separate binaries:
    - syd-cat profile-name
    - syd-chk
    - syd-err number|name-regex
    - syd-exec
    - syd-lock
    - syd-log
    - syd-ls allow|deny|hook|ioctl|prctl
    - syd-norm path
    - syd-read path
    - syd-size size|human-size
    - syd-sys [-a list|native|x86|x86_64|aarch64...] number|name-regex
- The short form `-v` has been renamed to `-V` for consistency.
- Fix default arg0 for the login shell.
- `SYD_SH` now defaults to `/bin/sh` rather than `/bin/bash`.
- The environment variable `SYD_UNSHARE_MOUNT` is no longer honoured.
- The environment variable `SYD_UNSHARE_UTS` is no longer honoured.
- The environment variable `SYD_UNSHARE_IPC` is no longer honoured.
- The environment variable `SYD_UNSHARE_USER` is no longer honoured.
- The environment variable `SYD_UNSHARE_PID` is no longer honoured.
- The environment variable `SYD_UNSHARE_NET` is no longer honoured.
- The environment variable `SYD_UNSHARE_CGROUP` is no longer honoured.
- `--domainname` has been dropped in favour of the new sandbox command
  `name/domain`.
- `--hostname` has been dropped in favour of the new sandbox command
  `name/host`.
- `--unshare-mount` has been dropped in favour of the sandbox command
  `unshare/mount`.
- `--unshare-uts` has been dropped in favour of the sandbox command
  `unshare/uts`.
- `--unshare-ipc` has been dropped in favour of the sandbox command
  `unshare/ipc`.
- `--unshare-user` has been dropped in favour of the sandbox command
  `unshare/user`.
- `--unshare-pid` has been dropped in favour of the sandbox command
  `unshare/pid`.
- `--unshare-net` has been dropped in favour of the sandbox command
  `unshare/net`.
- `--unshare-cgroup` has been dropped in favour of the sandbox command
  `unshare/cgroup`.
- The long version `--config` has been removed, use `-C`.
- The long version `--magic` has been removed, use `-m`.
- The long version `--arg0` has been removed, `-A` has been renamed to
  `-a`.
- The long version `--env` has been removed, `-E` has been renamed to
  `-e`.
- The `--lock` option has been removed, use the sandbox command
  `lock:on` instead.
- The environment variable `SYD_FAKEROOT` is no longer honoured.
- Change `--root` command line option to `root/fake` sandbox command.
- Change `--map-root` command line option to `root/map` sandbox command.
- Implement `root` sandbox command to change root directory before
  starting the process.
- Implement the `bind` sandbox command to recursively bind mount
  directories on startup.
- Upgrade `smallvec` crate from `1.11` to `1.13`.
- Upgrade `env_logger` crate from `0.10` to `0.11`.
- Drop `trace/allow_unsafe_getrandom` command and make `getrandom`
  system call part of read sandboxing. `getrandom` with the flag
  `GRND_RANDOM` is treated equivalent to calling open on
  `/dev/random`, and without this flag is treated as open on
  `/dev/urandom`.
- Drop the setuid/setgid `chmod` restrictions and remove the sandbox
  command `trace/allow_unsafe_chmod`. Since syd always calls
  `PR_SET_NO_NEW_PRIVS` this restriction did not provide any added
  security and caused issues with e.g. sticky bits on directories.
- `-E` uses the lib profile rather than the Paludis profile now.
- Allow comma delimited list for read, write, exec, stat as capability
  in allow/denylists and filters, see [Command Shortcuts](#command-shortcuts)
  for more information.
- Implement initial trace aka "dry run" mode, activated with `-x`.

# 3.9.14

- Build release binaries with the log feature.
- Add `SYD_LOG_FD` environment variable to override log file descriptor.
- Add --domainname option to set NIS/YP domain name in the UTS namespace.
- Add --hostname option to set host name in the UTS namespace.
- Drop the broken `--chroot` option.
- Add command line option -E to set/unset environment variables.
- Implement sandbox command `trace/deny_tsc` to disable reading timestamp
  counter on x86.

# 3.9.13

- Fix regression causing syd not being able to locate the login shell.
- No longer use nightly rust and `-Zbuild-std` when building release binaries.

# 3.9.12

- Drop `allowlist/lock/write+/dev/std{in,err,out}` from landlock and user
  profiles. This caused landlock to fail on user profile when running
  without a TTY.
- Do not respect `HOME` environment variable when figuring out user home
  directory for added security when used as a login shell.
- Fix user profile parsing on `-c` and `-l`.
- Fix regression causing make not to work under syd due to the
  `setresuid` system call getting denied with the wrong errno.
- Use nightly rust and `-Zbuild-std` when building release binaries.

# 3.9.11

- Fix `--chroot` to work with `--unshare-user` correctly again,
  this was broken by the user subnamespace safety restriction.

# 3.9.10

- When `unshare/user` is active, enter into a sub usernamespace
  after setting the `user.max_user_namespaces` to 1 to ensure
  sandbox process can not do further namespace modification.
  This is similar to bubblewrap's `--disable-userns` option.
- Respect the value of `--arg0` when spawning a login shell.
- Respect `HOME` environment variable when figuring out user home
  directory.
- The user profile is parsed early for login shells now such that
  overriding the configuration using command line parameters is
  possible.
- Fix undefined behaviour when forking into the new pid namespace
  with `unshare/pid:1`.

# 3.9.9

- Errors on disabling of coredumps is no longer fatal.
- Drop the experimental init daemon `syd-init`.
- Relax signal protection such that sending signal 0 (ie check for
  existence) to syd threads are permitted.
- Allowlist `/proc/sys/{fs,kernel,vm}` directories recursively for read
  and stat sandboxing in **paludis** and **user** profiles.
- Fix ioctl allowlisting failing on musl builds.
- Fix an issue with allowlisting TTY devices in **paludis** and **user**
  profiles.

# 3.9.8

- syd now registers itself as a child subreaper unless it is already
  pid1. This fixes issues with background processes getting reparented
  to the actual pid1 after which it is going to require ptrace rights
  to read /proc/pid/mem. With this change, syd works fine as a
  regular user with the sysctl `yama.ptrace_scope` set to 1.

# 3.9.7

- Set CPU scheduling priority to idle for syscall handler threads.
- syd no longer sandboxes **ftruncate** as it is impossible
  to call without bypassing `open()`.

# 3.9.6

- syd now by default disable setting process resource limits for
  sandbox process. Moreover syd also disables coredumps for the
  sandbox process. This may be disabled on startup with the sandbox
  command `trace/allow_unsafe_prlimit:1`.
- Set `SIGPIPE` to default earlier so `--syscall`, `--errno` etc. can
  benefit from it.

# 3.9.5

- Add new sandbox command `mem/kill` which may be set to true to kill
  offending processes in Memory sandboxing.

# 3.9.4

- Add new sandbox command `pid/kill` which may be set to true to kill
  offending processes in PID sandboxing.
- Remove the background interrupt handler thread which is not necessary
  with the `WAIT_KILLABLE_RECV` flag.
- Optimize pid sandboxing such that it's much more resillient
  against rapid PID starvation.
- Enable `unshare/net:1` in **container** profile. Now that syd
  brings the loopback interface up, this is actually useful.

# 3.9.3

- Drop the interrupt workaround in the bind handler which is no longer
  necessary.
- Do not check target argument of **symlink**, and **symlinkat** system
  calls. This is consistent with the original system calls.
- Fix **fchmodat** and **faccessat** handlers failing on proc fd links.
- Use OwnedFd more widely to ensure no FDs are leaked.

# 3.9.2

- Mention Sandboxing Emacs with syd asciicast in README.
- Preserve child pid information on **reset** sandbox command.
- Fix case insensitive matching for `--syscall` and `--errno`.
- Implement -R, --chroot=root to change root directory.
- Allowlist `/sbin` for **landlock** profile.
- Allowlist `/sbin` for **paludis** profile.

# 3.9.1

- Make open handler handle `/dev/syd` when both the sandbox lock and
  read sandboxing is off.
- Make getdents handler list `/dev/syd` when both the sandbox lock and
  stat sandboxing is off.
- Fix a segfault on musl during reading `/dev/syd`.

# 3.9.0

- New profile **lib**, the LibSyd helper profile, turns all sandboxing off.
  Useful to configure syd in the application using LibSyd.
- Upgrade **regex** crate from `1.9` to `1.10`.
- Upgrade **once\_cell** crate from `1.18` to `1.19`.
- Upgrade **nonempty** crate from `0.8` to `0.9`.
- The `access`, `faccessat`, and `faccessat2` are handled as part of **stat**
  sandboxing now. Previously the type of sandboxing depended on the access flags
  `R_OK`, `W_OK`, and `X_OK`.
- new tool **syd-ldd** which is a safe `ldd(1)` wrapper.
- use **smallvec** crate to efficiently handle path operations.
- use **itoa** crate to efficiently convert integers to paths (take 2).

# 3.8.9

- Return `EACCES` rather than `ENOSYS` on block device access.
- Use **itoa** crate to efficiently convert pids and file descriptors to
  paths.
- Avoid canonicalizing the current working directory on network calls
  with UNIX domain sockets. Fixes `ENAMETOOLONG` error in some cases.
- Optimize prioritization of syscall handler threads such that
  it only runs once on thread start.

# 3.8.8

- Make the **sync** and **syncfs** calls no-op under syd for added safety.
- Make the **paludis** profile stricter by refining access to `/`.

# 3.8.7

- Further restrict the parent syd process by disallowing **ptrace**,
  **chroot**, and **pivot\_root**.
- syd now brings the loopback interface up with `unshare/net:1`.
- Implement the **load** sandbox command.
- Implement the **panic** sandbox command.
- Implement the **reset** sandbox command.
- Remove the is-terminal check from error, warn level logs.

# 3.8.6

- Set i/o priority of system call handler threads to idle.
- Set parent-death signal to SIGKILL in syd process rather than the
  child for added safety and security.
- Drop Linux capabilities in syd process rather than the child for
  added security.
- Fix unicode issue in regex builder for `--error` and `--syscall` options.
- Reduce the default threadpool keepalive timeout from one minute to 15
  seconds so that syd becomes more reliable during pid starvation.
- Apply a seccomp filter to the syd process such that all set*id
  system calls return 0 without doing anything. This is an important
  security hardening.

# 3.8.5

- Enable debugging information in release mode to help with profiling.
- Use optimization level `3` rather than `z` in release mode.
- Use `unwind` rather than `abort` for panics in release mode.

# 3.8.4

- Implement virtual memory usage limiting for memory sandboxing, the
  command `mem/vm_max` may be used to configure the limit which defaults
  to 4GB.
- Exit with eldest process by default, add `trace/exit_wait_all` sandbox
  command to change behaviour.

# 3.8.3

- Optimize smaps lookup by stopping at the point the memory limit is reached.

# 3.8.2

- Implement `syd --parse human-size` to parse human-formatted size
  strings into bytes.
- Implement [Memory Sandboxing](#memory-sandboxing).

# 3.8.1

- Include build host information into `--version` output.
- Ignore `EACCES` and `ESRCH` errors in proc task counter, we already ignore
  `ENOENT` and `EPERM` so this is consistent.
- Slightly optimize the task limit check of PID sandboxing.
- Remove the broken **kill** mode for PID sandboxing and rename **deny** to
  **on**.
- Set system call handler threads' nice value to 19 to help prevent CPU
  starvation.

# 3.8.0

- Add new operator `^` to remove all matching elements from an allowlist,
  denylist or a filter.
- New sandboxing type called [PID sandboxing](#pid-sandboxing) to set a limit on
  the maximum number of tasks. This is best coupled with a pid name space.
- Guard the parent process with a tight seccomp filter when using namespaces.
- Use the `sendfd` crate and a safe `UnixStream` based socketpair implementation
  to send/receive the seccomp notification fd rather than the non-portable
  internal alternative.
- Avoid loading landlock twice on startup when namespaces are at play.
- `--arch <name>` may now be specified with `--syscall num|regex` to lookup the
  system call for the specified architecture rather than the native
  architecture. `--arch list` may be used to print the list of supported
  architectures.
- Denylist `/proc/1/***` for read, stat and write sandboxing in **container**
  and user profiles.

# 3.7.3

- Fix build on musl broken by recent 32-bit compat changes

# 3.7.2

- Write a socketcall hook for 32-bit systems.
- Optimize seccomp request preparation slightly by avoiding an ioctl call per
  request.
- Fix 32-bit build
- Allowlist the system call `mmap2` and `ugetrlimit` system calls.
- Fix an issue determining the syscall handler for non-native architectures
  (e.g. 32bit sandbox process with 64bit syd)

# 3.7.1

- Make the busy-wait in the background monitor thread less heavy by inserting a
  wait after each request reap cycle.
- Optimize pidfd handling.
- Optimize the `syd::fs::FileInformation::from_path` function which is used very
  frequently in path canonicalization.

# 3.7.0

- Increase the threadpool keepalive timeout from 7 seconds to a minute.
  Benchmarks have shown 7 seconds is actually too short and we're overloading
  the threadpool.
- Make the background monitor thread wait on a `Condvar` rather than waking up
  every n seconds and looping through the whole list of requests. The handler
  thread notifies the `Condvar` which wakes up the background monitor thread to
  handle interrupts for blocking system calls (e.g. interrupted open on a FIFO)
- Improve seccomp syscall priorities to better match a typical build process.
- Protect syd process and their threads from signals. Hook `kill`, `tkill`,
  `tgkill`, and `pidfd_open` calls and return **EACCES** in case sandbox process
  tries to send a signal to a process id related to syd.

# 3.6.6

- Avoid waiting for threads in Supervisor::wait avoiding hangs in some cases.

# 3.6.5

- New profile **container** to activate Linux namespaces. This is currently
  equivalent to `--unshare-mount,uts,ipc,user,pid,net,cgroup`.

# 3.6.4

- Exit with 128 plus signal value rather than **EFAULT** when the sandbox
  process is killed by a signal.
- syd process is included into the namespace now so that it has identical
  view of /proc.
- Mount /proc inside the mount namespace as necessary.
- Return proper exit codes on early spawn failures.
- Allowlist the directory `/sys/devices/system/node` recursively for read & stat
  sandboxing in **paludis** profile.

# 3.6.3

- Fix an issue with symbolic loop detection in path canonicalizer and make it
  more robust. **Milestone** Paludis' tests pass under syd now.
- Ensure seccomp sender and receiver socketpair is closed properly which avoids
  hangs when there is an error spawning the sandbox process.

# 3.6.2

- New `landlock` profile to make practical use of LandLock.
- Drop the interrupt workaround for kernel misbehaving with
  `WAIT_KILLABLE_RECV` seccomp flag.
- Stat handler incorrectly returned a directory when the sandbox process stats
  one of the magic symlinks `/proc/self`, `/proc/thread-self`, `/dev/fd`,
  `/dev/stdin`, `/dev/stderr` and `/dev/stdout`. This is now fixed. Notably,
  this makes `ps` work under syd.
- Report running kernel version and landlock status in `--version`
- Add `--landlock` which checks if LandLock ABI v3 is fully supported.

# 3.6.1

- The `-` op on magic commands now removes the most recently added matching item
  rather than all matching items for predictability.
- Fix `esyd disable` subcommand.
- Allowlist /dev/stdin for landlock read/write in user profile. /dev/stdout and stderr
  were already allowed.

# 3.6.0

- Stat sandboxing can no longer be bypassed by attempting to read, write or
  execute a denylisted/hidden path.
- Log messages with process IDs are enriched using `/proc/pid/comm` rather than
  `/proc/pid/cwd` and `/proc/pid/cmdline` when the **log** feature is disabled
  (default). This is much lightweight since it avoids filesystem access.
- Implemented various small usability improvements for `syd-test`.
- Ioctl restrictions was not applied correctly when syd was built with musl.
  This is now fixed.
- New feature `log` to include debug logging into the program. By default
  logs of severity debug and trace are compiled out. This was previously
  dependent on debug build mode.
- `esyd enable`, `enabled`, `enable_path`, `enabled_path`, `disable`,
  `disabled`, `disable_path`, and `disabled_path` now works for read, write and
  stat sandboxing rather than just write sandboxing. use the `_write` suffixed
  versions of the subcommands for write-only.
- `esyd deny`, `deny_path`, `nodeny`, and `nodeny_path` now works for read,
  write and stat sandboxing rather than just write sandboxing, use `esyd
  deny_write`, `nodeny_write` to add/remove from the write-only denylist.
- `esyd allow`, `allow_path`, `disallow` and `disallow_path` now works for read,
  write and stat sandboxing rather than just write sandboxing, use `esyd
  allow_write`, `disallow_write` to add/remove from write-only allowlist.
- Allowlist the directory `/proc/sys/vm` for read & stat sandboxing in
  **paludis** and **user** profiles.
- Allowlist files with CPU information under `/sys/devices/system/cpu`
  for read & stat sandboxing in **paludis** profile.
- Allowlist the directory `/proc/pid/attr` for read & stat sandboxing in
  **paludis** and **user** profiles.
- Reduce the severity of sandbox config change logs from **warn** to **info**.
- `sandbox/stat`, aka Stat Sandboxing, defaults to **on** rather than **off**
  now.
- `sandbox/read`, aka Read Sandboxing, defaults to **on** rather than **off**
  now.
- `sandbox/exec`, aka Exec Sandboxing, defaults to **on** rather than **off**
  now.
- `trace/allow_unsupported_socket_families` defaults to **false** rather than
  **true** now.
- `trace/allow_successful_bind` default to **false** rather than **true** now.
- Mention asciicasts in README.

# 3.5.2

- Fix various issues with /proc handling of stat and open handlers.
- Support Linux-specific statx flags in statx handler.

# 3.5.1

- Make mkdir, mkdirat, mknod and mknodat handlers more resillient to interrupts.
- Make connect handler more resillient to interrupts.

# 3.5.0

- Make expensive tests usable (preparation for `src_test_expensive` on Exherbo).
- Rename **local** alias to **local4**, define the new **local** alias an union
  of **local{4,6}**.
- Rename **any** alias to **any4**, define the new **any** alias as an union of
  **any{4,6}**.
- Rename **loopback** alias to **loopback4**, define the new **loopback** alias
  as an union of **loopback{4,6}**.
- Add **linklocal**, **linklocal4**, and **linklocal6** network aliases.
- Network aliases are now case-insensitive.
- Support Plan9 style network addresses such as `1.1.1.1!80`. This is the format
  we're going to use moving forward. `@` is still supported as a split character
  for backwards compatibility.
- Make bind handler more resillient to interrupts.

# 3.4.3

- Fix **allowlist/net/bind-**, **allowlist/net/connect-**,
  **denylist/net/bind-**, **denylist/net/connect-** sandbox commands to
  correctly remove the address when the port is given as a single port rather
  than a port range.
- Fix a bug with seccomp request tracking of the background syd::m☮☮n thread
  causing spurious signals to be sent to system call handler threads.

# 3.4.2

- Start making binary releases

# 3.4.1

- Replace `threadpool` crate with the `rusty_poll` crate

# 3.4.0

- Teach syd::m☮☮n thread the ability to resize the syscall handler threadpool
  size upon investigating the current active, queued and maximum count of
  the threadpool. This makes syd automatically adapt when there's a sudden
  burst of blocking system calls (e.g. opening a FIFO, or binding a socket)
  and avoid deadlocks. When the burst is gone, syd::m☮☮n kicks in again and
  decreases the pool size back to a normal state. Since the handling is
  completely automatic, the environment variable `SYD_NPROC` to set the size of
  the system call handler thread pool is no longer supported. The value defaults
  to the number of CPUs on startup and is adapted automatically according to the
  needs of the sandbox process.
- Fix various issues with UNIX domain socket handling.
- Honour process umask properly in bind handler.
- Make the bind syscall handler much more resillient to quickly restarting
  interrupted syscalls.
- Improve interrupt handling by spawning a background thread called syd::m☮☮n,
  to reap invalidated seccomp requests and interrupt respective syscall handler
  threads.

# 3.3.4

- Fix a bug in symlink loop handling of path canonicalization and make it more
  efficient.
- Simplify FIFO handling using a thread rather than forking. Credit goes to
  **Johannes Nixdorf** for coming up with the idea and testing a POC.

# 3.3.3

- Fix handling of unix domain socket connections with relative paths.
- Drop the umask lock and support input/output to FIFOs.

# 3.3.2

- Handle the virtual paths **/dev/stdin**, **/dev/stdout**, and **/dev/stderr**
  specially during syscall emulation.
- Fix fgetxattr handler to correctly determine the path to the file descriptor.
- Fix an issue with fgetxattr handler where the handler would erroneously return
  EFAULT on some valid fgetxattr calls.
- Fix an issue emulating newfstatat calls with `AT_EMPTH_PATH` flag.

# 3.3.1

- Fix another bug with ends with dot check in path canonicalizer which
  caused some paths to erroneously return ENOENT rather than EEXIST.
- Fix the ends with dot check in path canonicalizer which caused
  creating/removing directories with a dot in the name fail with EINVAL.
- Improve handling of the special paths `/dev/fd/$fd` and `/proc/$pid/fd/$fd`.
- Improve path canonicalizer by avoiding double stat on symlinks.
- Allow **TIOCSCTTY** ioctl by default.
- Rather than disallowing access to `/dev/tty` with **ENXIO** unconditionally,
  try to determine sandbox process' controlling terminal and use it.
- New command `syd-init` which is a simple init system to run under syd.
- Switch fuzzer to use afl++ rather than libfuzzer
- Document **-c** and **-l** options correctly. Ignore **--login** as well for
  login shell compatibility.
- Add a CTF guide section in the README

# 3.3.0

- `-r` short option of `--root` has been removed for consistency.
- `-l` option is a no-op now rather than being a short option for `--lock` for
  login shell compatibility.
- `-c` short option has been changed to `-C` for **--config**. **-c** causes
  command to be executed under a shell for login shell compatibility

# 3.2.11

- Announce the CTF game in the README.
- Move the system calls **getxattr**, **lgetxattr**, **fgetxattr**,
  **listxattr**, **flistxattr**, and **llistxattr** from read sandboxing to stat
  sandboxing for consistency with **stat** calls.
- Do not replace `/proc/self` with `/proc/pid` on stat with nofollow. This fixes
  `ps` to work under syd above all.

# 3.2.10

- `syd --read` now works with relative paths as well as absolute paths.
- New profile `silent` to silence all access violations.
- Fix a bug with path normalization where double dots at root position were
  erroneously removed resulting in path not found errors during syscall
  handling.

# 3.2.9

- Drop trailing slash from paths before matching.
- Update bpftrace scripts
- Fix /dev/pts glob in `paludis` and `user` profiles.

# 3.2.8

- Disallow access to `/dev/tty` with `ENXIO` as syd cannot safely emulate
  access to the controlling terminal.
- Implement `syd --syscall number|name-regex` to search for syscall numbers and
  names.
- Fix stat handler from erroneously returning ELOOP on symbolic links with a
  trailing slash.
- Fix a bug with symbolic link loop detection in remote path canonicalization.
- Properly exit with EBUSY when seccomp filter cannot be loaded on startup.
- Print libsecc☮mp version, api version and native architecture in `syd --help`
  output.
- Print libsecc☮mp native architecture in `syd --version` output.
- Implement `syd --arch` to print the name of the native libsecc☮mp
  architecture.
- Implement `syd --errno number|name-regex` to search for errno numbers and
  names.

# 3.2.7

- Move esyd.sh from data/ to src/ as another attempt to fix `cargo install`.
- Use openat2 with `RESOLVE_NO_SYMLINKS` when stating in fs::canonicalize
  function removing another potential TOCTOU vector.

# 3.2.6

- Do not call `include_str!` with a relative path which breaks `cargo install`.
  Use cargo build environment variables instead.
- Always deny access violations with EACCES. Previously syd would deny
  silently with ENOENT if the path does not exist. This was a feature to ease
  test/dev cycle in early stages of syd-3 but it creates confusion, so it is now
  removed.

# 3.2.5

- Fix a file descriptor leak in stat handler. Credit goes to **Johannes
  Nixdorf** for identifying the bug.
- Report libsecc☮mp API in `syd --version`
- `syd-test` now lists known failures at the end of the test run.
- Ensure restarted open system calls with `O_EXCL` flags succeed. With this fix
  `git clone` works under syd.
- Fix parsing of LOCAL and LOCAL6 network aliases.

# 3.2.4

- Fix tests

# 3.2.3

- Ensure opening directories in write mode fails with EISDIR in open handler.
- Deny mknod for fifos and block devices with ENOSYS rather than ENOPERM
  correctly signaling the sandbox process the lack of support for named pipes.
- Do not follow symbolic links in chmod handler.
- Preserve `O_CLOEXEC` flag as necessary in the added fd for open system call
  handlers.
- Ensure system call emulators fail with ENOTDIR when fd argument is a regular
  file and the path argument is a dot.
- Avoid updating file access times during remote path canonicalization which may
  break expectations of sandbox processes.
- open handlers now return ENOENT when the path argument is an empty string.
- unlink, unlinkat, rename, renameat, and renameat2 handlers now return EINVAL
  when the last path of the component is a dot.
- Fix a regression in recvfrom remote socket address writing. This caused UDP
  connections, such as DNS to fail under syd.
- Handle task death between seccomp notify poll event receive and seccomp
  request receive gracefully.

# 3.2.2

- Add statistics about the file in reports for path access violations.
- Access violation returns EACCES if file exists and the errno if the file does
  not exist. Previously it would always return ENOENT in the latter case.
- Do not follow symbolic links in mkdir and mkdirat handlers.
- Lift chmod and getrandom restrictions for the paludis profile.
- `trace/allow_unsafe_getrandom` sandbox command may be used to lift getrandom
  restrictions and allow the use of `GRND_RANDOM` flag with getrandom which
  accesses `/dev/random` under the hood.
- `trace/allow_unsafe_chmod` sandbox command may be used to lift chmod
  restrictions and allow the creation of setuid/setgid files.
- Return correct errno on open errors due to remote path canonicalization
  failures.
- System call handlers properly return EBADF on invalid fd arguments now.
- Fix symbolic link handling in open syscall handlers.
- Fix symlink loop detection in remote path canonicalization.
- We issue continue syscall for connection-mode sockets in recvfrom/sendto
  system calls. Since the pointer argument is NULL in these cases we're safe
  from TOCTOU.
- Do not follow symbolic links in rename, renameat, and renameat2 handlers.
- Return correct errno on failures from statx and newfstatat handlers.
- Use original target argument in symlink, symlinkat handlers so that creation
  of relative symbolic links is now possible under syd.
- Honor sandbox process umask in link and linkat system calls.
- Honor sandbox process umask when creating UNIX sockets.
- Honor sandbox process umask in mkdir, mkdirat, mknod, and mknodat syscall handlers.
- Trailing slash handling has been improved across all system call handlers.
- link, and linkat handlers no longer follow symbolic links in newpath as
  mandated by POSIX.
- linkat now honours `AT_SYMLINK_FOLLOW` correctly when following symlinks.
- link no longer follows symbolic links on its first argument as it should.
- open, and openat with `O_CREAT` now properly returns ENOENT on paths ending
  with a trailing slash.
- Handle mkdir, mkdirat, rmdir, and unlinkat correctly and return EINVAL when
  the last component is a dot.
- Fix a path canonicalization bug to follow symbolic links in the last component
  in case the component ends with a slash, ie if it has to be a directory.
- Simplify stat handling.
- Various fixes for xattr related system call handlers, above all handle value
  argument being NULL gracefully.
- Avoid resolving target path in **symlink** and **symlinkat** emulators.

# 3.2.1

- Fix handling of `lchown{,32}` emulators where we mistakenly followed symbolic
  links before.
- Use use a fd with `O_PATH+RESOLVE_NO_SYMLINKS` during syscall emulation for
  safety against symlink attacks, we hard require Linux-5.6 or newer with this.
- Sandbox **ftruncate**, **fgetxattr** and **lgetxattr**.
- Call renameat2 directly as a syscall as musl libc is lacking this function at
  the moment and their usage breaks musl builds.

# 3.2.0

- Numerous minor fixes to path normalization and canonicalization.
- Emulate all sandboxing calls but **exec**, and **chdir**.
- Handle symbolic links and the `AT_SYMLINK_NOFOLLOW` flag correctly.
- Handle empty paths and the `AT_EMPTY_PATH` flag correctly in system calls.
- `trace/allow_successful_bind` is now fixed to correctly allow successful bind
  calls.
- syd now emulates all the respective system calls for network sandboxing
  **making network sandboxing completely TOCTOU-free.**
- syd no longer allows the opening of existing device special files or named pipes.
- syd no longer allows the creation of device special files or named pipes.

# 3.1.11

- Fix an issue with network address filtering causing some filters to match
  regardless of their port restrictions.
- Fix an issue with network address matching causing some rules to match
  regardless of their port restrictions.

# 3.1.10

- Add sample user configuration file under `data/user.syd-3`.
- Use `/etc/user.syd-3` rather than `/etc/rc.syd-3` which is more consistent.
- syd now properly spawns the underlying shell as a login shell when syd
  itself is invoked as a login shell.
- Add sandbox commands **unshare/{mount,uts,ipc,user,pid,net,cgroup}** which are
  equivalent to the command line options
  `--unshare-{mount,uts,ipc,user,pid,net,cgroup}`. In addition they may be
  queried using the stat interface during runtime, e.g. `test -e
  /dev/syd/unshare/user?'
- Implement `trace/allow_unsafe_{io,pr}ctl` sandbox commands which may be
  used to lift the restrictions on the respective system calls.
- The function `syd::proc::proc_cmdline` now trims overly long command lines.
- Simplify capabilities handling. Drop `CAP_BPF`.

# 3.1.9

- The lock is honoured during initial configuration updates so e.g.
  setting the sandbox lock in the file `/etc/rc.syd-3` will prevent
  `~/.user.syd-3` from loading. This is useful to enforce site-wide
  configuration.
- **user** profile now parser `/etc/rc.syd-3` before `~/.user.syd-3`.
- syd now honours the environment variables
  `SYD_UNSHARE_{MOUNT,UTS,IPC,USER,PID,NET,CGROUP}` to create namespaces.
- You may now use syd as your login shell by adding it to `/etc/shells`. The
  actual shell to execute under syd defaults to `/bin/bash` and can be
  changed on runtime via `SYD_SHELL` environment variable or during compile time
  by changing the variable `SYD_SH` in `src/config.rs`.
- Fix a bug with path normalization to handle double dots at root position
  correctly.
- The set-id family calls are now no-ops under syd.
- The `/dev/syd` may be read to get syd state in JSON in case sandbox is
  unlocked.
- Better ZSH compatibility for the `data/esyd.sh` script which is also available
  via `esyd --sh`.

# 3.1.8

- Fix linkat, renameat, and renameat2 system call handlers' argument handling.
- Fix dropping of capabilities with `--map-root`.
- Listing `/dev` now lists `/dev/syd` in case the sandbox lock is off.
- Simplify handling of the special paths `/proc/self` and `/dev/fd`.
- syd now properly returns `ENAMETOOLONG` for too long paths.
- Ensure the validity of the sandbox process is checked using
  `SECCOMP_IOCTL_NOTIF_ID_VALID` after every interaction with the sandbox
  process memory.
- syd now allows **ioctl** requests for **PTY** handling.
- syd now properly closes the seccomp notify file descriptor after poll
  errors.
- syd now sets the **no\_new\_privs** attribute for the syd process as
  well as the sandbox process. Previously we only set this in the child process.
- Fix a bug in path canonicalization function preventing an infinite loop,
  when following certain symbolic links.

# 3.1.7

- Vendor in the caps crate and avoid using **thiserror** which breaks static
  linking.

# 3.1.6

- Stop using the **thiserror** crate which breaks static linking.

# 3.1.5

- Stop using the `derive` feature of the **serde** crate which breaks static
  linking.

# 3.1.4

- Allow the system calls **setgid**, **setgriups**, **setregid**, **setresgid**,
  **setresuid**, **setreuid**, **setuid** inside the sandbox. Since we drop the
  capabilities `CAP_SETUID` and `CAP_SETGID` on startup this is safe.
- Vendor in the landlock create, use bitflags rather than enumflags2 which
  depends on emumflags2\_derive crate and that used to break both static linking
  and address sanitizer.
- Reading from files under `/dev/syd` succeeds with the lock off. This is to
  provide consistency with the stat interface. The open system call handler just
  opens `/dev/null` instead under the hood.
- Handle pipes under `/proc/pid/task/fd` directories correctly.
- `syd-test` now honours the **SYD\_TEST\_VALGRIND** environment variable to run
  syd under valgrind during integration tests.
- syd now logs the current user id with the log messages.
- The stack size of the syd execve child has been increased from 4k to 128k.
- Block **getrandom** calls with **GRND\_RANDOM** flag. Sandbox processes are
  not allowed to access **/dev/random**. Access to **/dev/urandom** is fine.
- Fix environment clearing code which fixes the broken functionality of
  `SYD_NO_SYSLOG` and `SYD_NO_CROSS_MEMORY_ATTACH` environment variables.
- The **stat** system call handler now properly handles symbolic links.
- **paludis** and **user** profiles allow access to files `/proc/version` and
  `/proc/pid/map`.
- Fix and document **ioctl**, **prctl** restrictions.
- syd now writes "deny" to `/proc/pid/setgroups` before writing the `gid_map`
  file. This way `setgroups(2)` is permanently disabled in user namespace and
  writing to the gid map file can succeed without having the `CAP_SETGID`
  capability.

# 3.1.3

- syd restricts prctl usage with a list of allowlisted prctls. This prevents
  potentially dangerous prctls such as **PR_SET_MM** which can create
  self-modifying executables. The list of allowlisted prctls can be listed using
  `syd --list prctl`.
- syd restricts ioctl usage with a list of allowlisted ioctls. This prevents
  sandbox escapes such as utilizing **TIOCSTI** to write to the controlling
  terminal. The list of allowlisted ioctls can be listed using `syd --list
  ioctl`.
- Use the errno **EACCES** rather than **EPERM** on access violations.
- **paludis** profile disables read access to `/dev/random`. stat access to this
  file is granted. Read access to `/dev/urandom` works too.

# 3.1.2

- The stat system call handler now handles deleted files correctly and fstats on
  the fd rathet than the dangling /proc symlink
- The stat system call handler now handles special files such as sockets or poll
  file descriptors correctly and fstats on the fd rather than the dangling
  /proc symbolic link.
- **paludis** and **user** profiles allow read/stat access to `/proc/stat` now
  so that `ps` works correctly in the sandbox.
- Add `--sh` option which makes syd drop a shell script to standard output
  which defines **esyd** the sandbbox helper.

# 3.1.1

- CGroups support has been dropped, use other means to create CGroups and then
  spawn syd inside.
- The *paludis* and *user* profiles now allow read/stat access to
  the files `/proc/sys/kernel/osrelease` and `/proc/uptime`.
- Fix a panic trying to log paths with non UTF-8 pathnames.

# 3.1.0

- The **stat** system call emulator no longer fails to fstat on pipes.
  The solution is **TOCTOU-free**, when we hit on a pipe fd, we get the
  file descriptor, fstat it and close it, then return the stat buffer.
- Add support for CGroups via `--limit-{cpu,io,mem,pid}`. The command-line
  arguments have conservative defaults. RTFM for more information.
- Disallow the system calls **bpf**, **ioperm**, **iopl**, **setgid**,
  **setgroups**, **setregid**, **setresgid**, **setresuid**, setreuid**, and
  **vhangup** inside the sandbox to improve security.
- Improve architecture-dependent code, improve support for ARM and S390.
- Edit **paludis** and **user** profiles to have a "deny-by-default and
  allowlist known goods" strategy for the directories `/dev` and `/proc`. This
  brings added safety as it adds read restrictions and hides many sensitive
  paths such as `/dev/kmem` or `/proc/pid/mem`.
- The **memfd_secret** system call is now allowed in the sandbox.
- The **act** and **syslog** system calls are no longer allowed in the sandbox.
- syd drops some capabilities on startup which provides added safety to the
  sandbox. The list of dropped capabilities are listed under
  [Security](#security).
- Implement **--map-root** command line flag to map current user to root in the
  sandbox. This implies **--unshare-user**.
- Fix the prevention of **setuid**/**setgid** files to be created in the
  sandbox.

# 3.0.16

- syd now allows the system calls **setdomainname**, **sethostname**,
  **syslog**, and **signalfd4** system calls inside the sandbox.
- The **stat** family system calls are no fully emulated and do not suffer from
  **TOCTOU** issues.
- syd no longer allows the `TIOCSTI` **ioctl** call which can be used to
  write to the controlling terminal for added security.
- When syd is invoked with `--unshare-user` option to create a new user
  namespace, the creation of new user namespaces inside the sandbox is no longer
  allowed for added security.
- syd now allows the system calls **pidfd\_open** and **unshare**.
- syd no longer allows the system calls **mbind**, **migrate\_pages**,
  **move\_pages**, **perf\_event\_open**, **set\_mempolicy**, and
  **userfaultfd** inside the sandbox for added security.
- syd no longer allows setuid/setgid files to be created inside the sandbox.
- **fchmod**, and **fchown** system calls are now sandboxed.

# 3.0.15

- Turn on the [empty
  alternates](https://docs.rs/globset/latest/globset/struct.GlobBuilder.html#method.empty_alternates)
  building Globs such that `foo{,txt}` in a pattern will match both `foo` and
  `foo.txt`.
- Take advantage of **globset** crate's ability to match a set of patterns at
  once. This way regardless of how many rules are present in a glob pattern
  list, such as allowlist/read, denylist/stat, syd does a single pattern
  match during access control. This increase performance considerably,
  especially for very long rulesets.
- replace **glob-match** crate with **globset** crate. **globset** can work
  directly on `Path`s and requires no `String` conversion.
- Use `Path`/`PathBuf` rather than `&str`/`String` in many places where we
  handle path names. This ensures path names with invalid UTF-8 in their names
  are handled correctly.

# 3.0.14

- syd now uses Landlock ABI version 3 rather than version 1. A Linux kernel
  running version 6.2 or newer is required to get the most out of it. However
  older versions also work quite well. See [this
  table](https://man.archlinux.org/man/landlock.7.en#VERSIONS) for an overview
  on Landlock features and the corresponding kernel version when they were
  implemented.

# 3.0.13

- **esyd check** now utilizes `syd --check` rather than stating the file
  `/dev/syd`. This way it can still detect if the process is running under
  syd despite the sandbox lock being on.
- **esyd exec** subcommand has been fixed.
- The **user** profile added `/dev/tty` to the list of read-write allowed paths
  for LandLock sandboxing.
- The **user** profile now allows read access to **/var/log/journal** for
  systemd journal access.
- **esyd dump** subcommand now forwards it command line arguments and pipes its
  output to **jq** if it's available.
- **Security**: Start emulating **creat** system call which prevents the
  `TOCTOU` scenario where an attacker can create a denylisted file by
  editing the dereferenced pointer argument after the access control but
  before the system call actually happens. We have an integration test,
  called **ptrmod_toctou_creat** which confirms the fix.
- The **esyd** helper saw some fixes, fixing `deny*` subcommands.

# 3.0.12

- syd now logs sandbox command attempts so as to better couple with **esyd**.
- Many improvements, fixes and documentation for the **esyd** helper.

# 3.0.11

- Added new network aliases `ANY` and `ANY6` which match the whole Ipv4 and Ipv6
  address spaces respectively.
- **Security**: Add `NULL` guards to all system call hooks which prevents
  potential crashes if one of the pointer arguments is 0, one of which was
  discovered by trinity on the getdents handler here:
  https://builds.sr.ht/~alip/job/1077263
- **Security**: Fix a crash in getdents handler discovered by trinity fuzzer in
  this build: https://builds.sr.ht/~alip/job/1077263
- Support compatible system call ABIs as necessary, e.g. on `x86-64`, we now
  support `x86`, and `x32` ABIs, on `aarch64` we support `arm` too etc. With
  this out of the way, the default bad architecture action has been changed to
  "kill process".
- Added helper script `data/esyd.bash` which when sourced into a bash
  environment, defines the convenience function `esyd` to interact with syd
  sandbox commands.
- Stat'ing the magic path `/dev/syd/stat` prints the syd status on standard
  error.
- Reading from the magic path `/dev/syd/dump` returns the current syd
  state as JSON. This is only available when the sandbox is not locked, or
  it's only available to the syd execve child via `lock:exec`.
- `syd --read path` may be used to canonicalize a path.
- Log messages with process ID information are now enriched with the current
  working directory of the process.
- **lchown**, and **lgetxattr** system calls are now sandboxed.
- Implement `--list set` to display the list of system calls in the given set.
  The supported sets are **allow**, **deny**, and **hook**.
- Fix BusyBox compatibility issues in integration tests.

# 3.0.10

- Fix unit tests

# 3.0.9

- Fix yet another case where a path with invalid UTF-8 would make syd panic.
- **Security**: syd now normalizes the **path** argument of the emulated
  **open** system call which prevents some jail breaks, the simplest being to
  invoke `cat /proc/./self/status` inside syd which erroneously opens the
  proc directory of syd rather then that of the process. We have added about
  80 integration tests which test various relative paths to break the sandbox
  and syd passes all these tests after this fix.
- Use the **paludis** profile rather than the **user** in tests to improve
  reproducibility. Since the **user** profile parsers `~/.user.syd-3` this could
  cause random test failures.
- Calling a system call in an inaccessible directory would fail with `EACCES`
  even if the path argument is an absolute path. This is now fixed.

# 3.0.8

- Fix a panic in open system call hook for invalid UTF-8 paths.
- Add `/home` to the list of read-only directories for Landlock for `user`
  profile.
- `SYD_NPROC` environment variable can be used to configure the number of system
  call handler threads.
- Command options are now pretty printed in `test -e /dev/syd/dump` output.
- Reduce the duration of write lock contention in open system call handlers.
- Consider open calls with the flag `O_CREAT` for write sandboxing regardless of
  access mode.

# 3.0.7

- Use `epoll` rather than `poll` in the syd poll thread.
- Ensure the syd process supervisor does not leak the seccomp file descriptor
  on error conditions.
- syd's thread group id determiner function which reads `/proc/pid/status`
  would hang forever in case the process exits after we open the file but before
  we're finished with reading. This is now fixed.
- The --print-profile CLI option has been renamed to --print.
- Added `syd --check` to check if the process is running under syd.

# 3.0.6

- syd now honors the umask of the environment rather than setting a strict
  umask.
- Fix the open emulator to properly handle open calls with `O_TMPFILE` flag.

# 3.0.5

- Handle **AT\_EMPTY\_PATH** flag properly in **execveat**, **fchownat**,
  **linkat**, **statx**, **newfstatat**, and **utimensat** syscall hooks.

# 3.0.4

- The system call hook of **open** family system calls now properly sets umask
  to that of the process before emulating open so the umasks in sandbox are now
  properly honoured.
- Properly handle system calls with a file descriptor and an empty path as
  argument.
- Follow symbolic links in path resolution regardless of the system call.
- New command line option **--print-profile** to print the rules of the given
  sandbox profile.
- The sandbox profiles **paludis** and **user** have been hardened by utilizing
  [Read Sandboxing](#read-sandboxing) and [Stat Sandboxing](#stat-sandboxing).
  Many sensitive paths such as **/proc/pid/mem**, **/dev/mem** are both hidden
  and denylisted for read.
- **Landlock** errors are no longer fatal.
- **syd** has now basic support for UID/GID mapping inside user namespaces,
  where by default the current user is mapped with the same UID/GID inside the
  container.
- **syd-test** now changes its current working directory to a temporary
  directory before running integration tests. There is also a new validation in
  place when **syd-test** will refuse to run as root. This is due to the fact
  that the integration tests will fail randomly when run with elevated
  privileges.
- Use **SECCOMP_IOCTL_NOTIF_ADDFD** in **open**, **openat** and **openat2**
  calls to close the **TOCTOU** window, providing security. Once POC for
  **open** system call which utilizes pointer modification to break out of jail
  has been included in the test suite and is fixed with this change.

# 3.0.3

- **Security**: syd did not check the target argument of **symlink** and
  **symlinkat** system calls which makes a jail break possible through a symlink
  attack. Two POCs, one for each system call respectively, are included in the
  test suite. With syd checking the target argument these breaks no longer
  work.
- `syd -t`, and `syd-test` now accept many of either a name regex, a test index,
  or a test index range as arguments to filter which integration tests to run.

# 3.0.2

- `-H, --hostname name`, `-D, --domainname name` added to set host, domain name
  of sandboxed process. This requires `--unshare-uts`.
- `-u name, --uid=name` and `-g name, --gid=name` options have been added to run
  the sandboxed process as another user.
- `-A alias, --arg0=alias` has been added to set an alias for the sandbox
  process.
- `-W dir, --work-dir=dir` option has been added to change into a directory before
  executing sandbox process.
- `-C dir, --chroot=dir` option has been added to chroot into a directory before
  executing sandbox process.
- `--unshare-pid,net,mount,uts,ipc,user` command line arguments have been added
  for namespaces support.
- `--export pfc` now has detailed information about the seccomp rules, and lists
  of allowed and notified system calls.
- The old and unused **_sysctl** system call is no longer allowed by syd.
- syd now reports libsecc☮mp version in `--version` output.
- Remove read beneath /home for landlock in user profile.
- Clean syd related environment variables from the environment of the
  sandboxed process.

# 3.0.1

- New sandboxing type [Lock Sandboxing](#lock-sandboxing) to utilize
  [Landlock](https://landlock.io/)
  [LSM](https://en.wikipedia.org/wiki/Linux_Security_Modules).
- syd no longer sets umask to 077 for the sandbox process.
- Disable **setuid** system call in the sandbox for added security. Since this
  system call normally requires an environment with new privileges, this is not
  possible under syd as the sandbox has "no new privileges" flag set.

# 3.0.0

- **Milestone**: Paludis builds under syd with recommended tests using this
  [MR](https://gitlab.exherbo.org/paludis/paludis/-/merge_requests/86).
- Sandbox command lock now defaults to **exec** rather than **off** for added
  security.
- `allowlist/successful_bind` was broken by a recent change. This is now fixed.
- The `trace/memory_access` command is fixed, `strace -c` confirms the results

# 3.0.0-beta.15

- Test suite now properly recognizes that it is running under syd and skips
  the integration tests.
- syd now properly exits with the exit code of the sandbox process and exit
  codes for error conditions are documented in `--help`.
- Fix an issue with triple star extension in path glob matches.

# 3.0.0-beta.14

- Fix an issue with /proc/pid/cmdline reader.
- `symlink` and `symlinkat` system call interceptors no longer check the target
  for access.
- Skip running integration tests when running under syd.
- `lock:exec` no longer waits for the initial **exec** call to lock the sandbox
  for all processes except the syd exec child.

# 3.0.0-beta.13

- Drop the `built` crate dependency.
- Drop the `procfs` crate dependency.
- Use the `built` crate without the `git2` feature.
- Don't use `snmalloc` as the global allocator anymore. This fixes issues with
  static linking on Gentoo.

# 3.0.0-beta.12

- Fix an issue of **stat** sandboxing with path hiding.
- The environment variable **SYD\_NO\_CROSS\_MEMORY\_ATTACH** may be set to
  disable using cross memory attach and fallback to `/proc/pid/mem`.
- The environment variable **SYD\_NO\_SYSLOG** may be set to disable logging to **syslog**.
- Canonicalize UNIX socket addresses before sandbox access check.
- Add common system directories to the allowlist in **user** profile to make
  usage more practical.
- Add `--export` argument to export secure computing rules in binary **Berkeley
  Packet Filter** format and textual **Pseudo Filter Code** formats.
- System call hooks now use system call name and arguments to determine whether
  remote path canonicalization should resolve symbolic links.
- bump MSRV from `1.69` to `1.70`.
- `error` and `warn` level logs are not written to standard error unless
  standard error is a terminal. Since logs of these levels also go to **syslog**
  this is no loss for the user. This is merely to provide convenience when
  running terminal user interfaces under syd.
- `user` profile now enables `stat` sandboxing with the user home directory
  allowlisted.

# 3.0.0-beta.11

- Added `stat` sandboxing which can be used to hide files and directories from
  the sandboxed process.
- The sandbox command `denylist/network` has been renamed to `denylist/net`.
- The sandbox command `allowlist/network` has been renamed to `allowlist/net`.
- The sandbox command `filter/network` has been renamed to `filter/net`.
- The sandbox command `sandbox/network` has been renamed to `sandbox/net`.
- `user` profile now properly allowlists screen and tmux connections.

# 3.0.0-beta.10

- When debug mode is enabled with `SYD_LOG=debug`, syd now logs all system
  calls with seccomp action other than `Allow` to the kernel log. This is useful
  in tackling problems with build failures.
- System calls with bad architecture know return `ENOSYS` rather than syd
  killing the thread.
- Disallowed system calls are now denied with `EACCES` rather than `ENOSYS`.
- syd now sets seccomp system call priority of hotter system calls to a
  higher value to improve performance.
- Fix a potential panic with `/proc/self` -> `/proc/pid` handling in remote
  paths.

# 3.0.0-beta.9

- Fix an issue with remote path canonicalization.

# 3.0.0-beta.8

- Consolidate error handling, making it faster and more robust.
- Various fixes and improvements for the remote path canonicalization code which
  makes it faster and more robust with regards to error handling.

# 3.0.0-beta.7

- syd now ignores the signals `SIGHUP`, `SIGTSTP`, `SIGTTOU`, and `SIGTTIN`
  for uninterrupted tracing.
- The **user** profile now sets the environment variable
  `GIT_CEILING_DIRECTORIES` to `HOME` to save the user from some useless and
  annoying access violations.

# 3.0.0-beta.6

- Make the **user** profile Exherbo friendly.

# 3.0.0-beta.5

- The `user` profile now has **read** and **exec** sandboxing enabled as well as
  **write** and **network** sandboxing.
- The **triple star** extension is applied to glob patterns, ie `/dev/***`
  matches both `/dev` and any file recursively under `/dev`.
- When run without arguments, the home directory of the current user is now
  looked up from `passwd(5)` data rather than using the `HOME`
  environment variable.
- The clause **last matching rule wins** was not honored at all times. This is
  now fixed.

# 3.0.0-beta.4

- The `user` profile now also parses the file `~/.user.syd-3` if it exists.
  Note, syd uses this profile when invoked without arguments. This provides an
  easy way to spawn a working shell under sandbox.
- Fix UDP network sandboxing which was broken due to invalid error handling for
  connection-mode sockets.
- Some glob patterns in sandbox profiles `paludis`, and `user` have been fixed.

# 3.0.0-beta.3

- Run tests as integration tests, drop the `test-bin` development dependency.

# 3.0.0-beta.2

- Added the new `user` sandbox profile which allows access to user-specific
  directories such as `HOME`, and connections such as `X`, `screen`, `tmux` etc.
  When invoked without arguments, `syd` now drops to a shell with this profile.
- Replace `regex` crate with the more lightweight and performant `regex-lite`
  crate.
- Implement the `cmd/exec` sandbox command and the `syd exec` subcommand.
- Switch from `glob` crate to the `glob-match` crate for matching glob patterns.
- Fallback to `/proc/$pid/mem` if cross memory attach is not enabled in the
  kernel. Use `SYD_PROC_MEM` environment variable or the sandbox command
  `trace/memory_access:1` to force `/proc` fallback.
- `exec/kill_if_match` has been renamed to `exec/kill` which is a **breaking
  change**.
- Set `panic = abort` in release builds for reduced binary size.
- Name the polling thread `syd-poll`.
- Better error handling, and cleaner code.
- Use `parking_lot` crate for `Mutex`, and `RwLock`.
- The default magic virtual device path has been updated from `/dev/syd` to
  `/dev/syd` saving three letters on each typing!! This is a **breaking
  change**.
- The `core/` prefix has been removed from the configuration items
  `core/sandbox`, e.g use `sandbox/exec:on` rather than `core/sandbox/exec:on`.
  `allowlist/successful_bind` has been renamed to `trace/allow_successful_bind`,
  and `allowlist/unsupported_socket_families` has been renamed to
  `trace/allow_unsupported_socket_families`. Moreover the config item
  `core/trace/magic_lock` has been renamed to simply `lock`. This is a
  **breaking change**.
- The prefixes `unix:`, `unix-abstract:`, `inet:`, `inet6:` are no longer used
  in network addresses. Instead the pattern is treated as a UNIX shell style
  pattern if it starts with `/`, and as an IP address otherwise. There is no
  distinction between unix sockets and abstract unix sockets anymore. This is a
  **breaking change**. Check the `data/` subdirectory for a `syd.bash` for
  use with `Paludis`.
- Fix a bug with remote path canonicalization.
- Access violations are logged to syslog now. Use, e.g. `journalctl
  SYSLOG_IDENTIFIER=syd` to view them.

# 3.0.0-alpha.2

- When run without arguments, `syd` now drops into user's current running
  shell allowlisting the `HOME` directory.
- Document the CLI option `-p`, `--profile` and add `noipv4` and `noipv6`
  profiles in addition the `paludis` profile. These profiles may be stacked by
  specifying more than one `-p` arguments.
- Use a Seccomp `BPF` filter rather than a `Notify` filter for fakeroot mode.
- Improve logging to achieve consistency. We have a very simple Logger which logs
  to standard error in format `JSON` lines. There are some common keys `id` is
  always `syd`, `l` gives the `Log::Level` as an integer whereby the lower the
  value of the integer the more severe is the log condition. `t` gives a UNIX
  time stamp in seconds, and `ctx` has short context on the log entry. Errors are
  represented with the `err` key, and system call names are given with the `sys`
  key.
- The `--profile <profile-name>` and `--config @<profile-name>` is now
  supported. `Paludis` uses the former so it is important for compatibility.
  The profile file is **no longer** installed under `${sharedir}/syd` where
  `{sharedir}` is usually `/usr/share` and is kept as a static array in the
  program itself. In the future when `syd-3` has an exheres we can improve on
  this but for now this gets us going.
- The `setuid` system call is now allowed in the sandbox.
- Use `snmalloc` as the global allocator for improved performance.

# 3.0.0-alpha.1

- **New**: Added `core/allowlist/successful_bind`.
  - Utilizes `getsockname` hook, `pidfd_getfd`, and `process_vm_writev` for complete emulation.
  - Features a `TTL` of 3 mins for tracking addresses to manage zero port arguments in `bind()` system calls.

- **Improved**: Refined read, write, network/{bind,connect} sandboxing.
  - Simpler implementation, yet compatible with `Paludis` via `esandbox`.
  - No per-process sandboxing or process tree tracking; uses `/proc/$pid/cwd` when required.
  - Single set of sandbox rules with configurations pushed upfront.
  - **API Change**: Replaced `allow`, `deny` modes with simpler `on/off` toggle.
  - `core/sandbox/network` can be set to `bind` or `connect` for selective sandboxing.
  - Rule matching favors the latest rule for configuration stacking.
  - Streamlined `core/trace/magic_lock:exec` due to lack of parent/child tracking.

- **New**: Introduced `seccomp` process supervision.
  - Implemented primarily in `syd::hook` and `syd::remote`.
  - Derived from the `greenhook` crate, but with a deny-by-default `seccomp` policy.
  - Allowlisted system calls maintained in `syd::config` (currently immutable by users).
  - Notable system calls like `ptrace`, `process_vm_writev`, and `io-uring` are disabled to counteract `TOCTOU` vulnerabilities.

<!-- vim: set spell spelllang=en tw=80 : -->
