Earlier quoted context omitted.
Not only sandboxed, but many are pledge(2) 'd now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binar…
> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?
Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge)