>Theo de Raadt wrote: >> So let's just split these cases out. "ioctl"'s number gets reused for >> tape, and a new "bpf" promise is added.. That paves the way for a >> more complex diff coming in a few hours. > >The mention of bpf made me worried that dhclient would be affected, but I >checked and it's not. So this shouldn't cause trouble crossing over.
the "bpf" pledge allows only one tiny minor operation. that is not new. the programs you are thinking of perform all their bpf setup before pledge (or don't pledge at all). after that they simply read/write.
