Post by @rqm

@rqm brb, running syspatch

@prahou@merveilles.town Just come over to -current

@rqm never!

@prahou@merveilles.town Stables are for horses, and we know horses sink

@rqm walked into that one

wow.. well done

@prahou@merveilles.town a horse, an artist, and a priest walk into a swamp...

@rqm go on

@rqm also is it -CURRENT because FISH and WATER? #openbsd

@rqm The first mitigation that comes to mind is that of Capsicum where the capability to invoke shmat() is never granted. Only the mapping of POSIX anonymous shm segments is permitted. Granted, that is FreeBSD specific, but it points towards the incompleteness of the pledge model in OpenBSD. In-kernel mitigation is most likely only possible with PAC/MTE on arm64 or PKS on x86-64 which is neither supported nor adopted.

@rqm Pretty impressive!

I am looking forward to getting this patched on all of my servers, but for my hosts I am hoping for 8.0 as it resolves some issues for me.

I do have direct SSH access on hosts, but it's under a very restricted shell and I'm not sure you can spin up enough processes to pull it off.

```
vmuser:\
:umask=022:\
:datasize=16M:\
:coredumpsize=1024:\
:openfiles=20:\
:maxproc=10:\
:tc=auth-defaults:
```