Re:Support of OpenBSD pledge(2) in programming languages
by brynet on Saturday April 09, 2016 @06:05PM
(#11463566)
The entire point of pledge is self-sandboxing, in the case of an exec promise the expectation is the new process will also self-sandbox.
If you think of a shell as an example, it will need to exec programs that do privileged things before they can drop them, but the parent shell itself may never need to say.. create sockets.
If you think of a shell as an example, it will need to exec programs that do privileged things before they can drop them, but the parent shell itself may never need to say.. create sockets.