On Mon, Mar 16, 2026 at 11:01:43AM -0600, Theo de Raadt wrote:
> Stuart Henderson <stu@spacehopper.org> wrote:
> 
> > On 2026/03/16 10:45, Theo de Raadt wrote:
> > > I doubt you need "rx".
> > > 
> > > Does "x" not work?
> > 
> > it does, but / is already unveiled 'r' so using just 'x' for those
> > doesn't seem any better?
> 
> Whoa, I am hearing a big misunderstanding.
> 
> Unveil creates a series of nested enclaves.
> 
> The permissions from a higher level are IRRELEVANT in a nested enclave.

This misunderstanding about unveil() keeps coming up in one form or another:

https://marc.info/?l=openbsd-tech&m=174600467800474