commit c4607c91510b7f47b37dc8648085ef7191addea1
from: Alexander Arkhipov <src@mineeyes.cyou>
date: Fri Sep 30 20:11:57 2022 UTC

on OpenBSD: revoke the unveil(2) ability once it's not needed

commit - 33ebb25a0f737b682f207537a7148d976ae65789
commit + c4607c91510b7f47b37dc8648085ef7191addea1
blob - d6eaa6c8f4de5096e2a704a9e135f40610c9ee95
blob + 7c67bf456df611e972e31802d567182e54117b15
--- gpass.c
+++ gpass.c
@@ -127,6 +127,8 @@ main(int argc, char *argv[])
 #ifdef __OpenBSD__
 	if (unveil(dicname, "r") == -1)
 		err(1, "unveil %s", dicname);
+	if (pledge("stdio rpath", NULL) == -1) /* Revoke unveil ability. */
+		err(1, "pledge");
 #endif
 	if (!(dicfp = fopen(dicname, "r")))
 		err(1, "could not open %s", dicname);