Straycall

Linux syscall guard for Ruby

Catch the calls your tests didn't mean to make.

Straycall reports and blocks unintended network, filesystem, and process access from Ruby builds and test suites—then points to the responsible Ruby code.

Get started View on RubyGems
  • Linux 5.5+
  • MRI Ruby 3.1+
  • x86_64 & arm64
$ straycall -- bundle exec rspec

straycall: connect(2) → 192.0.2.1:443
    spec/services/sync_spec.rb:27:in `fetch'
    app/services/sync.rb:14:in `call'

  hint: allow_host "192.0.2.1", ports: [443]

1 example, 1 syscall violation

Guardrails

Three boundaries. One useful report.

Keep accidental side effects out of builds and tests without losing the context needed to fix them.

Network

Control outbound connections, Unix sockets, binds, and listeners by host and port.

deny_network!

Filesystem

Allow writes only below known roots and report reads of sensitive paths.

deny_write_elsewhere!

Processes

Restrict executables to an explicit allow list and see where each launch began.

deny_exec_elsewhere!

Quick start

Install. Wrap. Inspect.

The CLI keeps the supervisor outside the filtered command, so it stays out of your test runner's process handling.

  1. 1

    Add the gem

    # Gemfile
gem "straycall"
  2. 2

    Wrap a command

    straycall --config .straycall.yml -- bundle exec rspec
  3. 3

    Choose the response

    failBlock and exit nonzero

    warnAllow and report

    recordGenerate a reviewable policy

    promptAsk through the terminal

Policy as code

Specific enough to trust.
Small enough to review.

Keep the policy beside the project. Hosts resolve once at load time; paths expand without silently resolving symbolic links.

Read the configuration reference

.straycall.yml

network:
  default: deny
  allow:
    - host: 127.0.0.1
      ports: [5432, 6379]

write:
  default: deny
  allow: [tmp, log, coverage]
  deny_read: [~/.ssh, ~/.aws]

exec:
  default: allow
  deny: [/usr/bin/curl]

on_violation: fail

How it works

Outside the process. Close to the call.

01

Observe

Linux pauses selected syscalls through seccomp user notifications.

02

Decide

An unfiltered supervisor evaluates the target against your policy.

03

Explain

The report joins the syscall target with the responsible Ruby backtrace.

Ready to listen?

Make unintended calls visible.

Install Straycall and wrap your next Ruby build or test run.

Install from RubyGems Explore the source