A early criticism heard of #OpenBSD pledge(2) was that the kernel contained a small number of hardcoded path checks in order to avoid the broader rpath promise. This meant some paths were implicitly readable by programs in order to satisfy the needs of libc.

https://marc.info/?l=openbsd-cvs&m=177299080909460&w=2

OpenBSD is attempting to solve this by adding a new (non-public/non-exported*) __pledge_open(2) used by libc, which is like read-only open(2) whos file descriptors can not be written to, have attributes changed on them or passed with e.g: SCM_RIGHTS file descriptor passing.

https://marc.info/?l=openbsd-cvs&m=177302697522966&w=2

* Recall that OpenBSD has system call origin verification and no indirect syscall access.

This is still a WIP, some parts remain uncommitted, but an interesting semantic change, which _should_ be mostly transparent for applications using pledge(2) already with rpath, those relying on the implicit paths may need to add filesystem related promises and use unveil(2). ​