sandbox: add OpenBSD pledge/unveil support

pledge is a bit more fine-grained than Capsicum's capability mode,
so the buffer & http ("network") sandboxes are now split up into
two parts.

I applied the same hack as in FreeBSD for overriding the buffer
selector kqueue, because a) I didn't want to request sysctl promise
b) I'm not sure if it would even work and c) if it breaks on OpenBSD,
then it's broken on FreeBSD too, so there's a greater chance of
discovering the bug.

1 files changed, 6 insertions, 0 deletions

diff --git a/src/bindings/pledge.nim b/src/bindings/pledge.nim
new file mode 100644
index 00000000..8d265fe6
--- /dev/null
+++ b/src/bindings/pledge.nim
@@ -0,0 +1,6 @@
+{.push header: "<unistd.h>", importc.}
+
+proc pledge*(promises, execpromises: cstring): cint
+proc unveil*(path, permissions: cstring): cint
+
+{.pop.}