M backend.go → backend.go

@@ -73,6 +73,8 @@ }
 	return res.Image, nil
 }
 
+var backendhooks []func()
+
 func backendServer() {
 	log.Printf("backend server running")
 	shrinker := new(Shrinker)
@@ -92,7 +94,7 @@ lis, err := net.Listen("unix", sockname)
 	if err != nil {
 		log.Panicf("unable to register shrinker: %s", err)
 	}
-	for _, h := range preservehooks {
+	for _, h := range backendhooks {
 		h()
 	}
 	srv.Accept(lis)

M unveil.go → unveil.go

@@ -62,4 +62,7 @@ Unveil(dataDir, "rwc")
 		C.unveil(nil, nil)
 		Pledge("stdio rpath wpath cpath flock dns inet unix")
 	})
+	backendhooks = append(backendhooks, func() {
+		Pledge("stdio unix")
+	})
 }