syd sandbox的使用

syd --versionsyd 3.51.0 (Crazy Goldberg)这个sanbox感觉还可以。就是命令行之类的极其复杂。最后是AI通过一边看源码一边调试的。比如***表示全部匹配如果是直接bash运行 !那一行要加单引号。比如 -m allow/net/bind127.0.0.1!13337否则!会被展开https://gitlab.exherbo.org/sydbox/sydbox.git下面是带GUI的常见用法exec $SYD -p off \ -m sandbox/pty:on \ -m trace/allow_unsafe_exec_libc:1 \ -m trace/allow_unsafe_shm:1 \ -e DISPLAY -e XAUTHORITY -e XDG_RUNTIME_DIR -e DBUS_SESSION_BUS_ADDRESS \ -m sandbox/net:on \ -m allow/net/bind127.0.0.1!13337 \ -m allow/net/connect/tmp/.X11-unix/X* \ -m allow/net/connectloopback!6000-6099 \ -m trace/allow_unsafe_symlinks:1 \ -m trace/allow_unsafe_create:1 \ -m trace/allow_unsafe_filename:1 \ -m allow/net/connect/run/user/1000/*** \ -m allow/net/bind::1!0 \ -- gui_programname比如进入bash#!/bin/bash SYD/home/ubu/sydbox/target/release/syd if [[ ! -x $SYD ]]; then SYD$(command -v syd) fi exec $SYD -p off \ -m sandbox/pty:on \ -m trace/allow_unsafe_exec_libc:1 \ -m trace/allow_unsafe_shm:1 \ -e DISPLAY -e XAUTHORITY -e XDG_RUNTIME_DIR -e DBUS_SESSION_BUS_ADDRESS \ -m sandbox/net:on \ -m allow/net/bind127.0.0.1!13337 \ -m allow/net/connect/tmp/.X11-unix/X* \ -m allow/net/connectloopback!6000-6099 \ -m trace/allow_unsafe_symlinks:1 \ -m trace/allow_unsafe_create:1 \ -m trace/allow_unsafe_filename:1 \ -- /bin/bash看起来命令行参数使用上太过复杂。最好还是AI根据源码给你写。比如对于本地端口的管理 127.0.0.1 以及匿名的 或者unix socket之类的。参考下面的-m allow/net/bind127.0.0.1!0-65535 \-m allow/net/connect127.0.0.1!0-65535 \-m allow/net/bind!unnamed \-m allow/net/connect!unnamed \-m allow/net/bind/*** \-m allow/net/connect/*** \-m allow/net/bind*** \-m allow/net/connect*** \#!/bin/bash SYD/home/ubu/sydbox/target/release/syd if [[ ! -x $SYD ]]; then SYD$(command -v syd) fi exec $SYD -p off \ -m sandbox/pty:on \ -m trace/allow_unsafe_exec_libc:1 \ -m trace/allow_unsafe_shm:1 \ -e DISPLAY -e XAUTHORITY -e XDG_RUNTIME_DIR -e DBUS_SESSION_BUS_ADDRESS \ -m sandbox/net:on \ -m allow/net/connect/tmp/.X11-unix/X* \ -m allow/net/connectloopback!6000-6099 \ -m trace/allow_unsafe_symlinks:1 \ -m trace/allow_unsafe_create:1 \ -m trace/allow_unsafe_filename:1 \ -m allow/net/bind127.0.0.1!0-65535 \ -m allow/net/connect127.0.0.1!0-65535 \ -m allow/net/connect/run/user/1000/*** \ -m allow/net/bind!unnamed \ -m allow/net/connect!unnamed \ -m allow/net/bind/*** \ -m allow/net/connect/*** \ -m allow/net/bind*** \ -m allow/net/connect*** \ -- /bin/bash -c uv run idalib-mcp --host 127.0.0.1 --port 13337#!/bin/bash SYD/home/ubu/sydbox/target/release/syd if [[ ! -x $SYD ]]; then SYD$(command -v syd) fi if [[ $# -ne 1 ]]; then echo must provide one file exit -1 fi if [ ! -f $1 ]; then echo Error: File $1 does not exist or is not a regular file. exit 1 fi IDB_FILE$1 REMOTE_IP192.168.10.10 exec $SYD -p off \ -m sandbox/pty:on \ -m trace/allow_unsafe_exec_libc:1 \ -m trace/allow_unsafe_shm:1 \ -e DISPLAY -e XAUTHORITY -e XDG_RUNTIME_DIR -e DBUS_SESSION_BUS_ADDRESS \ -m sandbox/net:on \ -m allow/net/connect/tmp/.X11-unix/X* \ -m allow/net/connectloopback!6000-6099 \ -m trace/allow_unsafe_symlinks:1 \ -m trace/allow_unsafe_create:1 \ -m trace/allow_unsafe_filename:1 \ -m allow/net/bind127.0.0.1!0-65535 \ -m allow/net/connect127.0.0.1!0-65535 \ -m allow/net/bind$REMOTE_IP!0-65535 \ -m allow/net/connect$REMOTE_IP!0-65535 \ -m allow/net/connect/run/user/1000/*** \ -m allow/net/bind!unnamed \ -m allow/net/connect!unnamed \ -m allow/net/bind/*** \ -m allow/net/connect/*** \ -m allow/net/bind*** \ -m allow/net/connect*** \ -- /bin/bash -c uv run idalib-mcp --host ${REMOTE_IP} --port 13333 ${IDB_FILE}