pledge(2) - SerenityOS man pages


pledge - reduce process capabilities


#include <unistd.h>

int pledge(const char* promises, const char* execpromises);


pledge() makes a promise to the kernel that from this moment on, the calling process will only use a subset of system functionality.

Functionality is divided into a curated set of promises (described below), which can be combined to cover the program's needs. Both arguments are space-separated lists of promises.

Note that pledge() can be called repeatedly to remove previously-pledged promises, but it can never regain capabilities once lost.

promises are applied to the current process, and will also be inherited by children created by fork(2).

execpromises are applied if/when a new process image is created with exec(2).

If promises or execpromises is null, the corresponding value is unchanged.

If the process later attempts to use any system functionality it has previously promised not to use, the process is instantly terminated. Note that a process that has not ever called pledge() is considered to not have made any promises, and is allowed use any system functionality (subject to regular permission checks).

pledge() is intended to be used in programs that want to sandbox themselves, either to limit the impact of a possible vulnerability exploitation, or before intentionally executing untrusted code.


Promises marked with an asterisk (*) are SerenityOS specific extensions not supported by the original OpenBSD pledge().



The pledge() system call was first introduced by OpenBSD. The implementation in SerenityOS differs in many ways and is by no means final.

See also