If a fd came from libc doing the __pledge_open(2) system call, do not
allow write(2), chmod(2), chflags(2), chown(2), ftruncate(2), or fdpassing.
pledge_open(2) is an unexported interface that libc will use (soon) to
open 2 devices (null and tty), about 9 files (based upon pledge promises),
and files within the zoneinfo directory. This works because libc only
reads from those fd. Currently those files are openable by non-libc code,
but soon only static libc code will be able to do those opens.
This does not transition libc to using the new system call, yet.
Based upon long discussions with david leadbeater and beck.
switch upstream to codeberg; the git-archive had changed anyway
there is a newer verson but that needs attention from someone who knows
how to use this (note it picks up more libraries if present; libatomic
from gcc, which it shouldn't do for clang archs, and hunspell)
Introduce __pledge_open(2) system call which is pretty much the same as
open(2), except libc will use it to differentiate certain well-controlled
pathnames which follow special rules in pledge and can be accessed even
when "rpath" or unveil(2) don't allow so.
The kernel gets the system call BEFORE libc starts using it; soon there
will be more commits which will require at least this kernel.
Long discusions with david leadbeater and and beck
