OpenBSD top utility adds -Q flag to monitor chroot, pledge, and unveil status

OpenBSD has updated its top(1) system monitor utility to include a new -Q flag, enhancing the ability of administrators to observe process security states. This update allows users to see whether running processes are utilizing key OpenBSD security primitives, specifically chroot(2), pledge(2), and unveil(2).

The change is implemented via a recent commit to the OpenBSD source tree and is available in current snapshots. By integrating these security indicators directly into the interactive top interface, the update provides a more ergonomic way to audit system security compared to using ps(1) or watch(1) wrappers.

Technical implementation of the -Q flag

• New Command Flag: The addition of the -Q flag enables the display of security privilege information within the top interface.
• Security Primitive Visibility: The utility now tracks and displays the status of chroot(2) for filesystem isolation, pledge(2) for system call restriction, and unveil(2) for controlled filesystem visibility.
• UI Modifications: Security promises are shown within the COMMAND column, while state letters related to pledge, chroot, and unveil are displayed in the PRIV column instead of the TIME column.
• Source Changes: The update involved modifications to several files within the usr.bin/top directory, including display.c, machine.c, machine.h, and top.c.

Why it matters

This update improves the observability of OpenBSD's unique security sandbox features for system administrators. It allows for faster identification of processes that are or are not adhering to privilege reduction best practices, facilitating better security auditing in real-time.