xzMar 22
After sysupgrade -s-ing my semi-production #OpenBSD system, I realized that the upcoming pledge(2) changes in OpenBSD 7.9 can result in downstream breakage when using pledge(2) promises which are implicitly allowing certain files to be accessed, such as the "dns" promise which allowed r/o access to /etc/resolv.conf regardless of any unveil(2) shenanigans. This has changed now, these implicit allows seems to be gone.

Especially when using a programming language deciding not to go through libc for name resolution, this will require a small change. I am looking at you, #Golang.

Now, I have multiple diffs like this one:
- openbsd.PledgePromises("stdio inet dns")
+ openbsd.Unveil("/etc/resolv.conf", "r")
+ openbsd.UnveilBlock()
+ openbsd.PledgePromises("stdio rpath inet dns")
More details are available in this detailed post to ports@, which I missed so far:
https://marc.info/?l=openbsd-ports&m=177389567528083
'Pledge changes in 7.9-beta' - MARC

Show threadxz
As others realized before me, such changes are not necessary when going through libc. However, make sure to use the latest libc version, /usr/lib/libc.so.103.0. Seems like most things still link against version 102.2, check ldd(1).

For one of those, patching with sed(1) worked - might be a stupid idea tho.

sed -i 's/libc.so.102.2/libc.so.103.0/' $BIN_FROM_PORTS
'Re: chromium needs to unveil dns files' - MARC

Mar 22 at 9:00pmWeb