pledge "stdio rpath wpath cpath proc exec". creates files throughout

it's lifetime, and often runs a pipe through "cpp"

diff --git a/usr.sbin/crunchgen/crunchgen.c b/usr.sbin/crunchgen/crunchgen.c
index 2da9aca..4213b91 100644 (file)
--- a/usr.sbin/crunchgen/crunchgen.c
+++ b/usr.sbin/crunchgen/crunchgen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crunchgen.c,v 1.14 2015/01/16 06:40:16 deraadt Exp $       */
+/* $OpenBSD: crunchgen.c,v 1.15 2015/10/13 15:11:48 deraadt Exp $       */
 
 /*
  * Copyright (c) 1994 University of Maryland
@@ -118,6 +118,9 @@ main(int argc, char *argv[])
        extern int      optind;
        extern char    *optarg;
 
+       if (pledge("stdio rpath wpath cpath proc exec", NULL) == -1)
+               perror("pledge");
+
        while ((optc = getopt(argc, argv, "hm:c:e:fqD:EL:O:M")) != -1) {
                switch (optc) {
                case 'h':