Pledge the "7z" executable

Index: CPP/7zip/UI/Console/Main.cpp
--- CPP/7zip/UI/Console/Main.cpp.orig
+++ CPP/7zip/UI/Console/Main.cpp
@@ -843,6 +843,20 @@ int Main2(
   }
 #endif
 
+  #ifdef Z7_EXTERNAL_CODECS
+  if (pledge("stdio rpath wpath cpath fattr getpw tty prot_exec", NULL) == -1)
+  {
+    perror("pledge");
+    exit(2);
+  }
+  #else
+  if (pledge("stdio rpath wpath cpath fattr getpw tty", NULL) == -1)
+  {
+    perror("pledge");
+    exit(2);
+  }
+  #endif
+
   #ifdef ENV_HAVE_LOCALE
   // printf("\nBefore SetLocale() : %s\n", IsNativeUtf8() ? "NATIVE UTF-8" : "IS NOT NATIVE UTF-8");
   MY_SetLocale();
@@ -1012,6 +1026,53 @@ int Main2(
   codecs->CaseSensitive_Change = options.CaseSensitive_Change;
   codecs->CaseSensitive = options.CaseSensitive;
   ThrowException_if_Error(codecs->Load());
+  switch ((int)options.Command.CommandType)
+  {
+    case NCommandType::kBenchmark:
+    case NCommandType::kInfo:
+      if (pledge("stdio", NULL) == -1)
+      {
+        perror("pledge");
+        exit(2);
+      }
+      break;
+    case NCommandType::kHash:
+    case NCommandType::kList:
+    case NCommandType::kTest:
+      if (pledge("stdio rpath", NULL) == -1)
+      {
+        perror("pledge");
+        exit(2);
+      }
+      break;
+    case NCommandType::kExtract:
+    case NCommandType::kExtractFull:
+      if (options.StdOutMode)
+      {
+        if (pledge("stdio rpath", NULL) == -1)
+        {
+          perror("pledge");
+          exit(2);
+        }
+      }
+      else
+      {
+        if (pledge("stdio rpath wpath cpath fattr", NULL) == -1)
+        {
+          perror("pledge");
+          exit(2);
+        }
+      }
+      break;
+    default:
+      // "7z a -snon archive.tar" needs getpw for YP.
+      if (pledge("stdio rpath wpath cpath getpw", NULL) == -1)
+      {
+        perror("pledge");
+        exit(2);
+      }
+      break;
+  }
   Codecs_AddHashArcHandler(codecs);
 
   #ifdef Z7_EXTERNAL_CODECS
