unveil
A sandboxing mechanism in OpenBSD used to restrict the file system paths visible to a process, reducing the attack surface.
Timeline (last 90 days)
OpenBSD provides the pledge and unveil mechanisms to restrict the system calls and filesystem paths available to a program at runtime.
Porting Wine to OpenBSD requires resolving conflicts between OpenBSD-specific security mechanisms (such as W^X and pledge/unveil) and the runtime requirements of Wine.
pledge is used to restrict the categories of system calls a process can invoke, while unveil restricts the file system paths visible to a process.
All Facts (3)
OpenBSD provides the pledge and unveil mechanisms to restrict the system calls and filesystem paths available to a program at runtime.
50%UnverifiedPorting Wine to OpenBSD requires resolving conflicts between OpenBSD-specific security mechanisms (such as W^X and pledge/unveil) and the runtime requirements of Wine.
50%Unverifiedpledge is used to restrict the categories of system calls a process can invoke, while unveil restricts the file system paths visible to a process.
50%