[trasz2]

Isn’t pledge(2) trivially easy to escape anymore? This used to be one of the differences compared to eg capsicum(2).

[beachhead]

is pledge easy to escape? can you give some examples?

[trasz2]

For a while you could just execute another binary, it would run without restrictions imposed on the (pledged) parent. This is a stark contrast to Capsicum, where the monotonicity (ie the fact that once you loose the permission to something you'll never ever get it back, unless being explicitly passed it again) is one of the fundamental assumption behind the design.

[saagarjha]

No, not really.

[anthk]

pledge(2) aborts.

[trasz2]

And? How’s that relevant?

[anthk]

man 3p pledge, try escaping it with a simple Perl script.

[trasz2]

In other words you don't know what you're talking about, otherwise you would be able to answer a simple question.