pledge "stdio proc exec" works.

ok doug

diff --git a/usr.bin/apply/apply.c b/usr.bin/apply/apply.c
index 6218c6c..ee9e481 100644 (file)
--- a/usr.bin/apply/apply.c
+++ b/usr.bin/apply/apply.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: apply.c,v 1.26 2013/11/25 18:03:17 deraadt Exp $      */
+/*     $OpenBSD: apply.c,v 1.27 2015/10/10 17:48:34 deraadt Exp $      */
 /*     $NetBSD: apply.c,v 1.3 1995/03/25 03:38:23 glass Exp $  */
 
 /*-
@@ -54,6 +54,9 @@ main(int argc, char *argv[])
        char *c, *c2, *cmd, *p, *q;
        size_t len;
 
+       if (pledge("stdio proc exec", NULL) == -1)
+               err(1, "pledge");
+
        debug = 0;
        magic = '%';            /* Default magic char is `%'. */
        nargs = -1;