On 2025/04/29 09:38, Theo de Raadt wrote:
> Are we missing a pledge behaviour that would block opening of
> AF_UNIX sockets?
> 
> Or is gaining access to other AF_UNIX sockets the main reason why
> the browsers are accessing /tmp?
> 
> And of course, the problem with a such a pledge, is that it would affect
> everywhere in the filesystem.  But maybe there is some restriction we can
> impose which blocks this.

They do want to open AF_UNIX sockets in some cases, for example sndio,
dbus, and chromium has the SingletonSocket thing, whatever that is.