OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds

Contributed by Peter N. M. Hansteen on 2026-07-07 from the pledge+unveil for much goodness dept.

Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).

The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.

The paper's abstracts concludes,

All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.

The full text of the paper is available too, as PDF, HTML, or TeX source, for your advocacy use and pleasure.

Latest Articles

Wed, Jul 08
- 05:56 OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds (0)
Mon, Jul 06
- 19:01 OpenSSH 10.4/10.4p1 released! (0)
Mon, Jun 29
- 16:57 relayd(8) and httpd(8) TLS settings update. (1)
Tue, Jun 23
- 11:46 OpenBSD/amd64 kernel virtual address space is now 512GB (2)
Fri, Jun 12
- 08:02 syslogd(8) privileged and non-privileged parts now separate binaries (0)
Fri, Jun 05
- 06:41 Random relinking at boot comes to httpd(8) and smtpd(8) (0)
Wed, Jun 03
- 06:58 llvm/clang(1)/lld(1) updated to version 22.1.6 (0)
Wed, May 27
- 05:56 LibreSSL 4.3.2 released (0)
Sat, May 23
- 11:51 Game of Trees 0.126 released (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]