These are good points. However unlike SELinux / AppArmor, a Debian package maintainer does not need to do make sure things are set up right for pledge- programs

These are good points. However unlike SELinux / AppArmor, a Debian package maintainer does not need to do make sure things are set up right for pledge- programs that aren't pledge'd will run just fine (i.e. all syscalls are allowed by default, not the other way around). So even though adding pledge to the kernel does nothing by itself, can't usermode programs (the ones for which pledge makes since) slowly make themselves more secure? > It's not impossible for Linux, but there would have to be a lot more conditional cases in the Linux kernel to handle all of the various ways that programs would use it. Why would there be a lot more conditional cases in the kernel? I'm just imagining having a bitvector whitelist[] for each task_struct and then in the syscall_trace_enter functions one indexes into current->whitelist if it's __NR_pledge. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/entry/common.c?h=v4.11#n60 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...