add pledge(2) to mupdf-x11:
  - inet dns : with HAVE_CURL only
  - proc exec : opening an external browser on uri link
  - wpath cpath : epub chapter cache

Index: platform/x11/x11_main.c
--- platform/x11/x11_main.c.orig
+++ platform/x11/x11_main.c
@@ -29,6 +29,7 @@
 #include <X11/keysym.h>
 #include <X11/XF86keysym.h>
 
+#include <errno.h>
 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -771,7 +772,6 @@ static void onselreq(Window requestor, Atom selection,
 void winreloadpage(pdfapp_t *app)
 {
 	XEvent xev;
-	Display *dpy = XOpenDisplay(NULL);
 
 	xev.xclient.type = ClientMessage;
 	xev.xclient.serial = 0;
@@ -782,8 +782,7 @@ void winreloadpage(pdfapp_t *app)
 	xev.xclient.data.l[0] = 0;
 	xev.xclient.data.l[1] = 0;
 	xev.xclient.data.l[2] = 0;
-	XSendEvent(dpy, xwin, 0, 0, &xev);
-	XCloseDisplay(dpy);
+	XSendEvent(xdpy, xwin, 0, 0, &xev);
 }
 
 void winopenuri(pdfapp_t *app, char *buf)
@@ -977,6 +976,16 @@ int main(int argc, char **argv)
 	tmo_at.tv_sec = 0;
 	tmo_at.tv_usec = 0;
 	timeout = NULL;
+
+#ifdef HAVE_CURL
+	if (pledge("stdio rpath wpath cpath inet dns proc exec", NULL) == -1)
+#else
+	if (pledge("stdio rpath wpath cpath proc exec", NULL) == -1)
+#endif
+	{
+		fprintf(stderr, "pledge: %s\n", strerror(errno));
+		exit(1);
+	}
 
 	if (kbps)
 		pdfapp_open_progressive(&gapp, filename, 0, kbps);
