"beck@ modified sys: Fix a collection of covering unveil bugs that prevent unveil's of upper level directories from working when you don't traverse into them starting from /. Most found by brynet@ and a few others. ok brynet@ deraadt@"

https://marc.info/?l=openbsd-cvs&m=154655236614423&w=2

With this change, unveil(2) can become an even more powerful tool that can be used to protect your applications, especially in cases where pledge(2) cannot be used.

#OpenBSD

Retpolines now enabled by default in clang on #OpenBSD amd64.

https://marc.info/?l=openbsd-cvs&m=154621129329314&w=2

(It was previously enabled for the kernel, including handwritten assembly)

https://www.mail-archive.com/source-change[email protected]/msg97849.html
https://marc.info/?l=openbsd-cvs&m=152834458329715&w=2

robert@ committed a change to further tighten the unveil paths for chromium on #OpenBSD, narrowing access to only the specific subdirectories in ~/.{config,local,cache} required, and also restoring ~/Downloads and /tmp as the path for uploads/downloads.  

https://marc.info/?l=openbsd-ports-cvs&m=154575916929236&w=2

For a brief period, ~/{Documents,Music,Pictures,Videos} were also allowed, but now only ~/Downloads (or /tmp) may be used as a staging area, moving files in and out of externally (shell or file manager).