Using capsicum with sqlite?

From: Marc Coquand <marc_at_coquand.email>
Date: Sat, 15 Nov 2025 14:22:21 UTC
Hey Freebsd community,

I'm trying to make sense of how Capsicum is intended to work. 

I want to create an app that accesses a SQLite database (with WAL), and
nothing else. I figured Capsicum would be a the way to lock down this program.

As I understand Capsicum, you open the file descriptors that you're going
to use and then use cap_enter to lock down the program, and afterward you
can no longer open any new files.

I am curious how I am supposed to use Capsicum together with sqlite, as all
the libraries that I've used for sqlite works by passing a string to the
filepath of the database, and for wal some files are opened dynamically ,so
the file descriptors aren't known. Does that mean it isn't possible to use
Sqlite with Capsicum?

Marc