Use pledge(2)

Drop "proc exec" and other promises never needed as early as possible.
More delicate unveil(2) bits come next.

security/web-eid-app/Makefile

@@ -9,7 +9,7 @@ GH_PROJECT =		web-eid-app
 GH_TAGNAME =		v2.3.1
 DISTFILES =		${GH_DISTFILE}
 PKGNAME-main =		${PKGNAME:S/app/native/}
-REVISION-main =		0
+REVISION-main =		1
 PKGNAME-chrome =	${PKGNAME:S/app/chrome/}
 REVISION-chrome =	0
 
@@ -52,6 +52,7 @@ HOMEPAGE =		https://web-eid.eu/
 # -std=gnu++17
 COMPILER =		base-clang ports-gcc
 
+# uses pledge()
 WANTLIB-main +=	${COMPILER_LIBCXX} GL Qt6Core Qt6Gui Qt6Network Qt6Widgets
 WANTLIB-main +=	c crypto m pcsclite
 

security/web-eid-app/patches/patch-src_app_main_cpp

@@ -0,0 +1,39 @@
+Use pledge(2) after QApplication[0] initialisation (uses shmget(2) not
+covered by pledge) and before execution, covering both CLI and GUI mode.
+
+Index: src/app/main.cpp
+--- src/app/main.cpp.orig
++++ src/app/main.cpp
+@@ -24,6 +24,10 @@
+ #include "controller.hpp"
+ #include "logging.hpp"
+
++#ifdef Q_OS_OPENBSD
++#include <unistd.h>
++#endif // Q_OS_OPENBSD
++
+ #include <QTimer>
+
+ int main(int argc, char* argv[])
+@@ -32,6 +36,21 @@ int main(int argc, char* argv[])
+     Q_INIT_RESOURCE(translations);
+
+     Application app(argc, argv, QStringLiteral("web-eid"));
++
++#ifdef Q_OS_OPENBSD
++    // "rpath cpath wpath" Qt owns web-eid's config and log directories
++    // "inet dns"          web-eid talks to the internet
++    // "fattr flock ps"    Qt locks file access, sysctl(2) KERN_PROC_PID from QLockFile
++    // "unix"              web-eid and Qt communicate with PCSC and D-Bus
++    // "prot_exec"         Qt dlopen(3) libqsvg.so
++    //
++    // src/controller/application.cpp Application::isDarkTheme() has code under
++    // '#elif 0' (the only QProcess occurence in web-eid) that would need "proc exec".
++    if (pledge("stdio rpath cpath wpath inet fattr flock unix dns prot_exec ps", NULL) == -1) {
++        std::cerr << "pledge: " << strerror(errno) << std::endl;
++        return -1;
++    }
++#endif // Q_OS_OPENBSD
+
+     try {
+         Controller controller(app.parseArgs());