Yes - it's a good point that pledge(2) requires that you modify the application, and, that's too some degree a downside of the model. On the flipside, you can'

Yes - it's a good point that pledge(2) requires that you modify the application, and, that's too some degree a downside of the model. On the flipside, you can't turn off pledge(2) - which has been the default behavior of every (admittedly junior) sysadmin I know who ran into a problem with SELinux that I've seen. The point I was also trying to make (and I'm not sure if I was successful) was that the use of pledge sometimes results in the application being modified to prevent overly permissive behavior (http://www.tedunangst.com/flak/post/going-full-pledge http://www.tedunangst.com/flak/post/going-full-pledge) - whereas in the SELinux "audit" mode, that permissive behavior would be noted, and permitted. I"m just wondering whether tptacek has rethought his comment from 2010 about OpenBSD " its model depends on shipping bug-free distributions " given a lot of success OpenBSD has had in the past several years dodging exploits that resulted from bug-present distribution issues, that its OS compartmentalization approach has successfully avoided.