Unverified50% confidenceFactExact time
pledge is used to restrict the categories of system calls a process can invoke, while unveil restricts the file system paths visible to a process.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedLinux的seccomp可以白名单方式限制进程可调用的系统调用集合，例如禁止AI进程使用execve或socket等高危调用69% similarUnverifiedWhen restricted mode is enabled, Claude Code removes all built-in tools capable of executing commands or code, disables WebFetch (unless explicitly specified in --tools), retains only file operation tools within the working directory, rejects bypassPermissions privilege escalation, and ignores user, project, and local settings files.66% similarUnverifiedNo-Code/Low-Code工具存在平台锁定问题，用户被限制在工具自身的逻辑框架内63% similarUnverifiedThe validator allows specific binaries and subcommands, outright rejects write operation verbs, rejects pipes to a shell, and fails closed on anything it does not recognize.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1070406API
curl https://kongchang.com/api/v1/knowledge/claims/1070406MCP
get_claim(id=1070406)