I have not seen *ANY SAFE WAY TO USE THIS* with execpromises:
error Rather than killing the process upon violation, indicate
error with ENOSYS.
Also when pledge() is called with higher promises or
execpromises, those changes will be ignored and return
success. This is useful when a parent enforces
execpromises but an execve'd child has a different idea.
The combination is trash. It is a serious delusion that arbitrary
programs will fail cleanly. What actually happens is the invariant
failures become attack surface.
