On Thu, Aug 06, 2026 at 07:56:44AM +0200, Theo Buehler wrote:
>                                           I have added a small patch
> to modify the unveil code to do a single unveil("/", "r") in
> unveil_search_paths() instead of fine-grained iterations over files and
> directories that need to be readable. pkgconf usually runs as a normal
> user with stdio rpath wpath cpath and locked unveil. Only /dev/null and
> an optional log file have "rwc".

This is the patch:

diff --git a/usr.bin/pkgconf/cli/core.c b/usr.bin/pkgconf/cli/core.c
index a24e9ca1eb5..3f70f20d45b 100644
--- a/usr.bin/pkgconf/cli/core.c
+++ b/usr.bin/pkgconf/cli/core.c
@@ -939,20 +939,7 @@ unveil_search_paths(pkgconf_client_t *client, const pkgconf_cross_personality_t
 	pkgconf_node_t *n;
 
 	client->unveil_handler(client, "/dev/null", "rwc");
-
-	PKGCONF_FOREACH_LIST_ENTRY(client->dir_list.head, n)
-	{
-		pkgconf_path_t *pn = n->data;
-
-		client->unveil_handler(client, pn->path, "r");
-	}
-
-	PKGCONF_FOREACH_LIST_ENTRY(personality->dir_list.head, n)
-	{
-		pkgconf_path_t *pn = n->data;
-
-		client->unveil_handler(client, pn->path, "r");
-	}
+	client->unveil_handler(client, "/", "r");
 }
 
 static bool
diff --git a/usr.bin/pkgconf/libpkgconf/pkg.c b/usr.bin/pkgconf/libpkgconf/pkg.c
index a761cdd4ae7..65deb89f03d 100644
--- a/usr.bin/pkgconf/libpkgconf/pkg.c
+++ b/usr.bin/pkgconf/libpkgconf/pkg.c
@@ -1154,17 +1154,11 @@ pkgconf_pkg_find(pkgconf_client_t *client, const char *name)
 	/* name might actually be a filename. */
 	if (str_has_suffix(name, PKG_CONFIG_EXT))
 	{
-		if (client->unveil_handler != NULL)
-			client->unveil_handler(client, name, "r");
-
 		pkg = pkgconf_pkg_new_from_path(client, name, 0);
 		if (pkg != NULL)
 		{
 			PKGCONF_TRACE(client, "%s is a file", name);
 
-			if (client->unveil_handler != NULL)
-				client->unveil_handler(client, pkg->pc_filedir, "r");
-
 			pkgconf_path_add(pkg->pc_filedir, &client->dir_list, true);
 			goto out;
 		}