On Tuesday, October 20th, 2026 at 10:18 AM, Stuart Henderson wrote: > It's not a good fit for pledge - that really needs the code that you're > running (as in, the end programs, not the emulator itself) to be > involved in the decision about pledging (which obviously isn't possible) > otherwise the set of pledges is just too wide to be of any real benefit. > In most cases, code has to be reordered so that pledge can do a good > job. Yeah, I was thinking about something like pledge(~"inet"), where we can start wine with inet pledge removed if we pass some option into wine. For now all the pledge() talk is purely aspirational and "academical"
> If unveil can be made to work that woukd be a big help and much more > realistic proposition. Guessing something along the lines of: current > dir and ~/.wine 'rwc', /usr/local/lib /usr/local/share /etc 'r' would be > a good starting point - may also need ~/.cache ~/.config etc, remember > this affects things done by any libraries loaded too (and they may > change in future), not just wine+application itself. Even quite a wide > set is hugely better than 'everything open' and it can be refined later. Yes, also thanks for the unveil list suggestion. I'll take a look later this week.
