The author explains well that pledge(2) is all-or-nothing and that this design is intentional. Indeed, as more cap-safe APIs are designed, this sort of edge wil

The author explains well that pledge(2) is all-or-nothing and that this design is intentional. Indeed, as more cap-safe APIs are designed, this sort of edge will only become sharper. Cap-safe languages can do even better fine-grained restriction of capabilities, but require a total rewrite instead of just an extra syscall.