You are right, if your webapp requires database connection, the OS has to allow it. That is where application-level security comes in. The OS can not be respons

You are right, if your webapp requires database connection, the OS has to allow it. That is where application-level security comes in. The OS can not be responsible for everything, the application has to be written securely as well. This is complementary (and a bit orthogonal) to pledge().