Hans-Jörg Höxer <Hans-Joerg_Hoexer@genua.de> wrote:

> Hi,
> 
> On Wed, Aug 28, 2024 at 08:19:49AM -0600, Theo de Raadt wrote:
> > You need all the ioctl values to work with this pledge?
> 
> good point.  Updated diff below limits to those values that will actually
> be used by vmd.

I think those ioctl's should pledge_fail, rather than returning EPERM.
Meaning, crash the program that requested an unpermitted operation.