The unveil() system call first appeared in OpenBSD 6.4.
For stagit it has the following properties now:
- stagit-index: only read-access to the file-system for the specified
directories/repositories.
- stagit: read-access to the specified directory/repository.
read-write and creation access to the current directory for the output files.
read-write and creation access to the specified cache file.
git_libgit2_init();
#ifdef __OpenBSD__
+ for (i = 1; i < argc; i++)
+ if (unveil(argv[i], "r") == -1)
+ err(1, "unveil: %s", argv[i]);
if (pledge("stdio rpath", NULL) == -1)
err(1, "pledge");
#endif
git_libgit2_init();
#ifdef __OpenBSD__
+ if (unveil(repodir, "r") == -1)
+ err(1, "unveil: %s", repodir);
+ if (unveil(".", "rwc") == -1)
+ err(1, "unveil: .");
+ if (cachefile && unveil(cachefile, "rwc") == -1)
+ err(1, "unveil: %s", cachefile);
+
if (cachefile) {
if (pledge("stdio rpath wpath cpath fattr", NULL) == -1)
err(1, "pledge");