1 files changed, 18 insertions, 1 deletions

diff --git a/plugins/check_curl.c b/plugins/check_curl.c
index 1dec8a2a..95e45282 100644
--- a/plugins/check_curl.c
+++ b/plugins/check_curl.c
@@ -120,6 +120,14 @@ mp_state_enum np_net_ssl_check_certificate(X509 *certificate, int days_till_exp_
 #endif /* defined(HAVE_SSL) && defined(USE_OPENSSL) */
 
 int main(int argc, char **argv) {
+#ifdef __OpenBSD__
+        /* - rpath is required to read --extra-opts, CA and/or client certs
+         * - wpath is required to write --cookie-jar (possibly given up later)
+         * - inet is required for sockets
+         * - dns is required for name lookups */
+        pledge("stdio rpath wpath inet dns", NULL);
+#endif // __OpenBSD__
+
         setlocale(LC_ALL, "");
         bindtextdomain(PACKAGE, LOCALEDIR);
         textdomain(PACKAGE);
@@ -135,6 +143,15 @@ int main(int argc, char **argv) {
 
         const check_curl_config config = tmp_config.config;
 
+#ifdef __OpenBSD__
+        if (!config.curl_config.cookie_jar_file) {
+                if (verbose >= 2) {
+                        printf(_("* No \"--cookie-jar\" is used, giving up \"wpath\" pledge(2)\n"));
+                }
+                pledge("stdio rpath inet dns", NULL);
+        }
+#endif // __OpenBSD__
+
         if (config.output_format_is_set) {
                 mp_set_format(config.output_format);
         }
@@ -1248,7 +1265,7 @@ check_curl_config_wrapper process_arguments(int argc, char **argv) {
                         result.config.curl_config.sin_family = AF_INET;
                         break;
                 case '6':
-#if defined(USE_IPV6) && defined(LIBCURL_FEATURE_IPV6)
+#if defined(LIBCURL_FEATURE_IPV6)
                         result.config.curl_config.sin_family = AF_INET6;
 #else
                         usage4(_("IPv6 support not available"));