Use stricter pledge promises if possible

1 files changed, 16 insertions, 9 deletions

diff --git a/main_openbsd.go b/main_openbsd.go
index 7d466ee..7bbe995 100644
--- a/main_openbsd.go
+++ b/main_openbsd.go
@@ -10,15 +10,22 @@ import (
 )
 
 func main() {
-	err := unix.PledgePromises("unveil stdio rpath")
-	panicOnErr(err)
-
-	unveil()
-
-	// Drop unveil from promises.
-	err = unix.PledgePromises("stdio rpath")
-	panicOnErr(err)
-
+	// We need less permissions on these conditions.
+	if len(os.Args) == 1 ||
+		os.Args[1] == "version" ||
+		os.Args[1] == "env" {
+		err := unix.PledgePromises("stdio")
+		panicOnErr(err)
+	} else {
+		err := unix.PledgePromises("unveil stdio rpath")
+		panicOnErr(err)
+
+		unveil()
+
+		// Drop unveil from promises.
+		err = unix.PledgePromises("stdio rpath")
+		panicOnErr(err)
+	}
 	grus()
 }