Index: src/OFApplication.m ================================================================== --- src/OFApplication.m +++ src/OFApplication.m @@ -595,22 +595,32 @@ # ifdef OF_HAVE_PLEDGE void *pool = objc_autoreleasePoolPush(); of_string_encoding_t encoding = [OFLocale encoding]; const char *promises = [[sandbox pledgeString] cStringWithEncoding: encoding]; + OFArray OF_GENERIC(of_sandbox_unveil_path_t) *unveiledPaths; + size_t unveiledPathsCount; OFSandbox *oldSandbox; - for (of_sandbox_unveil_path_t unveiledPath in [sandbox unveiledPaths]) { + unveiledPaths = [sandbox unveiledPaths]; + unveiledPathsCount = [unveiledPaths count]; + + for (size_t i = sandbox->_unveiledPathsIndex; + i < unveiledPathsCount; i++) { + of_sandbox_unveil_path_t unveiledPath = + [unveiledPaths objectAtIndex: i]; OFString *path = [unveiledPath firstObject]; OFString *permissions = [unveiledPath secondObject]; if (path == nil || permissions == nil) @throw [OFInvalidArgumentException exception]; unveil([path cStringWithEncoding: encoding], [permissions cStringWithEncoding: encoding]); } + + sandbox->_unveiledPathsIndex = unveiledPathsCount; if (pledge(promises, NULL) != 0) @throw [OFSandboxActivationFailedException exceptionWithSandbox: sandbox errNo: errno]; Index: src/OFSandbox.h ================================================================== --- src/OFSandbox.h +++ src/OFSandbox.h @@ -67,10 +67,12 @@ unsigned int _allowsAudio: 1; unsigned int _allowsBPF: 1; unsigned int _allowsUnveil: 1; unsigned int _returnsErrors: 1; OFMutableArray OF_GENERIC(of_sandbox_unveil_path_t) *_unveiledPaths; +@public + size_t _unveiledPathsIndex; } /*! * @brief Allows IO operations on previously allocated file descriptors. */