unix: require minimum OpenBSD 6.4 for pledge, unveil

OpenBSD 7.3 and 7.4 are the only supported OpenBSD releases.  This change simplifies the version detection and error handling to require at least OpenBSD 6.4 to call the Pledge and Unveil functions.

Updates golang/go#63569.

Change-Id: I6bd0d58807a73a532ddd2d3239687ca19a93db9d
GitHub-Last-Rev: d03d157e76d1d861fa8bd9be179f9dc4fb91f8d2
GitHub-Pull-Request: golang/sys#177
Reviewed-on: https://go-review.googlesource.com/c/sys/+/537355
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Joel Sing <joel@sing.id.au>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Joel Sing <joel@sing.id.au>

unix/unveil_openbsd.go

@@ -5,6 +5,7 @@
 package unix
 
 import (
+	"fmt"
 	"syscall"
 	"unsafe"
 )
@@ -14,6 +15,9 @@ import (
 // Note that the special case of blocking further
 // unveil calls is handled by UnveilBlock.
 func Unveil(path string, flags string) error {
+	if err := supportsUnveil(); err != nil {
+		return err
+	}
 	pathPtr, err := syscall.BytePtrFromString(path)
 	if err != nil {
 		return err
@@ -32,6 +36,9 @@ func Unveil(path string, flags string) error {
 // UnveilBlock blocks future unveil calls.
 // For more information see unveil(2).
 func UnveilBlock() error {
+	if err := supportsUnveil(); err != nil {
+		return err
+	}
 	// Both pointers must be nil.
 	var pathUnsafe, flagsUnsafe unsafe.Pointer
 	_, _, e := syscall.Syscall(SYS_UNVEIL, uintptr(pathUnsafe), uintptr(flagsUnsafe), 0)
@@ -40,3 +47,19 @@ func UnveilBlock() error {
 	}
 	return nil
 }
+
+// supportsUnveil checks for availability of the unveil(2) system call based
+// on the running OpenBSD version.
+func supportsUnveil() error {
+	maj, min, err := majmin()
+	if err != nil {
+		return err
+	}
+
+	// unveil is not available before 6.4
+	if maj < 6 || (maj == 6 && min <= 3) {
+		return fmt.Errorf("cannot call Unveil on OpenBSD %d.%d", maj, min)
+	}
+
+	return nil
+}