Bryan Steele Dec 26, 2018

robert@ committed a change to further tighten the unveil paths for chromium on #OpenBSD, narrowing access to only the specific subdirectories in ~/.{config,local,cache} required, and also restoring ~/Downloads and /tmp as the path for uploads/downloads.  

https://marc.info/?l=openbsd-ports-cvs&m=154575916929236&w=2

For a brief period, ~/{Documents,Music,Pictures,Videos} were also allowed, but now only ~/Downloads (or /tmp) may be used as a staging area, moving files in and out of externally (shell or file manager).

'CVS: cvs.openbsd.org: ports' - MARC

Show threadBryan Steele Dec 26, 2018

Psst. chrome unveil has been enabled by default in -current for well over a month now, having been in ports since July. 😉

pledge(2) support has been in the #OpenBSD ports tree, and enabled by default, since January ... 201𝟔. 😏

Show threadbitgeistDec 26, 2018
@brynet Is Firefox getting any of the unveil/pledge love?
Show threadBryan Steele 
@bitgeist Not unveil(2), but landry@ has added some pledge(2) patches. However, they are unfortunately quite broad. This is because unlike chromium, Firefox was not designed for privilege separation. Chromium was already split up into different process types, i.e: redender/gpu/plugin and could be locked down tighter.
Dec 26, 2018 at 7:03pmWeb