From 230f885abb8fb82ae220426f5b5d38dd62a778cf Mon Sep 17 00:00:00 2001
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Date: Fri, 9 Oct 2015 12:20:19 +0000
Subject: this cpp operates file using pledge "stdio rpath wpath cpath"

---
 libexec/tradcpp/main.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'libexec/tradcpp')

diff --git a/libexec/tradcpp/main.c b/libexec/tradcpp/main.c
index eae7f44632d..267c279be5e 100644
--- a/libexec/tradcpp/main.c
+++ b/libexec/tradcpp/main.c
@@ -31,6 +31,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include <string.h>
 #include <errno.h>
 
@@ -1037,6 +1038,11 @@ main(int argc, char *argv[])
 	progname = progname == NULL ? argv[0] : progname + 1;
 	complain_init(progname);
 
+	if (pledge("stdio rpath wpath cpath", NULL) == -1) {
+		fprintf(stderr, "%s: pledge: %s", progname, strerror(errno));
+		exit(1);
+	}
+
 	init();
 
 	for (i=1; i<argc; i++) {
-- 
cgit v1.2.3