Re: unveil: incomplete unveil_flagmatch semantic

[Theo de Raadt]

+       for (i=0; flags[i].pledge != 0; i++)
+               if (ISSET(pledge_flags, flags[i].pledge)) {
+                       SET(permissions, flags[i].unveil);
+                       CLR(pledge_flags, flags[i].pledge);
+               }

Rather than iterating, can this be done as a direct lookup?

table[PLEDGE_RPATH] = ...
table[PLEDGE_RPATH | PLEDGE_WPATH] = ..

unveil = table[pledge & range_enforcing_mask];