A little more info for those not familiar with these terms (I was not): 1. pledge is a system call that a process can make that limits what subsequent system c

A little more info for those not familiar with these terms (I was not): 1. pledge is a system call that a process can make that limits what subsequent system calls that process can execute, e.g. "I pledge to only call X, Y, Z": https://unix.stackexchange.com/questions/410056/what-is-openbsds-pledge-in-short https://unix.stackexchange.com/questions/410056/what-is-open... 2. unveil is the analogous call to restrict filesystem paths: it limits which paths open is allowed to access: https://why-openbsd.rocks/fact/unveil/ https://why-openbsd.rocks/fact/unveil/