3 ms·

Absolutely, and pledge is amazing. That being said, for example, let’s say pledge or unveil have one line of code that is fd.

• upofadown 8y ago
  You mean as opposed to your container/virtualization having one line of code that is "fd"?
  • rasengan 8y ago
    The point of my statement is you have tens upon thousands of lines of code, systems are complex. You can’t put all your eggs in a basket given the probability that something is fd. Downvoting my statement is fine as long as it’s noobs learning from this script and not someone who is running critical infrastructure. :)
    • yellowapple 8y ago
      "You can’t put all your eggs in a basket given the probability that something is fd." But you'd be doing that no matter what unless you're running each daemon on a different physical machine. That basket's just called "Xen" now instead of "OpenBSD". Worse, if the hypervisor has a bug that can be triggered from unprivileged guest code (i.e. as a non-root user in the guest OS), then any layers added in the guest are moot.