A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System

2026-07-03

AI Summary

This study systematically investigates the real-world adoption of the pledge and unveil system calls in OpenBSD and their impact on application sandboxing. Leveraging a longitudinal dataset spanning 19 OpenBSD releases, the authors employ static analysis, statistical modeling, and trend fitting to quantitatively assess the implementation of the principle of least privilege within core system components—a first of its kind. The findings reveal a steady increase in adoption, with widespread use of these mechanisms across programs in /usr/bin and /usr/sbin. I/O-related permissions are the most frequently requested, and fine-grained capabilities are commonly employed. These results demonstrate that system call minimization is not only feasible in production systems but also effectively challenges the prevailing assumption that sandboxing techniques are inherently difficult to deploy at scale.

Abstract

The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already before their introductions in official releases. The adoption rates have also steadily grown; a linear trend provides a coarse but sensible heuristic. Although particularly programs residing in /usr/bin and /usr/sbin have been modified to use the system calls, the sizes of programs and libraries do not correlate well with the amounts of pledge and unveil system calls invoked. Regarding the pledges made, standard input and output operations have frequently been requested, although the full fine-grained arsenal offered by pledge has generally been utilized in OpenBSD. The same observation is seen in that particularly read operations to given paths have frequently been unveiled. All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.

Problem

• pledge
• unveil
• sandboxing
• system calls
• OpenBSD

Innovation

• pledge
• unveil
• sandboxing
• system call minimization
• longitudinal measurement