OpenBSD’s heavy use of pledge, unveil, privilege separation, unprivileged processes, chroot, and strong memory protections do an excellent job of keeping attackers from gaining root.