Sounds similar to OpenBSD&#x27;s `pledge`, a system call that a process can use to tell the system which minimum privileges it needs, so that a buffer overflow exploit has less of a chance of running amok (depending on the program).  It&#x27;s new in 5.9 and most of the base system and a bunch of ports (including Chromium) have been updated to make use of it.<p>Of course, it doesn&#x27;t completely prevent someone from doing something nasty, but it <i>does</i> force them to be much more targeted in which programs they can attack.  Every little thing helps a little bit, and it all adds up.