Bryan Steele Dec 26, 2018

robert@ committed a change to further tighten the unveil paths for chromium on #OpenBSD, narrowing access to only the specific subdirectories in ~/.{config,local,cache} required, and also restoring ~/Downloads and /tmp as the path for uploads/downloads.  

https://marc.info/?l=openbsd-ports-cvs&m=154575916929236&w=2

For a brief period, ~/{Documents,Music,Pictures,Videos} were also allowed, but now only ~/Downloads (or /tmp) may be used as a staging area, moving files in and out of externally (shell or file manager).

'CVS: cvs.openbsd.org: ports' - MARC

Show threadBryan Steele Dec 26, 2018

Psst. chrome unveil has been enabled by default in -current for well over a month now, having been in ports since July. 😉

pledge(2) support has been in the #OpenBSD ports tree, and enabled by default, since January ... 201𝟔. 😏

Show threadbitgeistDec 26, 2018
@brynet Is Firefox getting any of the unveil/pledge love?
Show threadirlDec 26, 2018
@bitgeist @brynet Especially with the uplifting of anti-fingerprinting patches from Tor Browser by Mozilla, adding unveil/pledge to Firefox would be cool.
Show threadBryan Steele Dec 26, 2018
@irl @bitgeist Unfortunately, even with recent work on multi-process, Firefox is still quite architected as a monolithic behemoth, which makes taking advantage of pledge/unveil more difficult..
Show threadirl
@brynet @bitgeist But recent work is going in the right direction? (:
Dec 26, 2018 at 7:19pmWeb
Show threadBryan Steele Dec 26, 2018
@irl @bitgeist I dunno, I use chromium.