From 0106c3821743e0772ea08958a56b7505d1fb1e33 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Mon, 2 Mar 2026 16:41:06 +0000
Subject: util/nvmutil: unveil /dev/urandom much earlier

Signed-off-by: Leah Rowe <leah@libreboot.org>
---
 util/nvmutil/nvmutil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c
index ecd104be..7a8c02f0 100644
--- a/util/nvmutil/nvmutil.c
+++ b/util/nvmutil/nvmutil.c
@@ -81,6 +81,7 @@ main(int argc, char *argv[])
 {
 #ifdef __OpenBSD__
 	err_if(pledge("stdio rpath wpath unveil", NULL) == -1);
+	err_if(unveil("/dev/urandom", "r") == -1);
 #endif
 	if (argc < 2)
 		usage(argv[0]);
@@ -90,7 +91,6 @@ main(int argc, char *argv[])
 	checkdir("/dev/urandom");
 	checkdir(fname);
 #ifdef __OpenBSD__
-	err_if(unveil("/dev/urandom", "r") == -1);
 	block_unveil();
 #endif
 	xopen(rfd, "/dev/urandom", O_RDONLY);
-- 
cgit v1.2.1