Patch to use pledge on OpenBSD.
locale is needed for idn2.

Index: bin/dig/host.c
--- bin/dig/host.c.orig
+++ bin/dig/host.c
@@ -18,6 +18,7 @@
 #include <locale.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <unistd.h>
 
 #include <isc/attributes.h>
 #include <isc/commandline.h>
@@ -914,12 +915,36 @@ main(int argc, char **argv) {
 	progname = argv[0];
 	pre_parse_args(argc, argv);
 	setup_libs();
+
+	/*
+	 * unix: needed for startup check, isc_net_probeunix.
+	 * (unix sockets used in controlconf).
+	 */
+	if (pledge("stdio rpath inet unix dns unveil", NULL) == -1) {
+		perror("pledge");
+		exit(1);
+	}
+
 	setup_system(ipv4only, ipv6only);
 	parse_args(false, argc, argv);
 	if (keyfile[0] != 0) {
 		setup_file_key();
 	} else if (keysecret[0] != 0) {
 		setup_text_key();
+	}
+
+	if (unveil("/usr/share/locale", "r") == -1) {
+		perror("unveil /usr/share/locale");
+		exit(1);
+	}
+	/*
+	 * dns:   resolv.conf, also allows port 53 sockets
+	 * inet:  needed if we query on port != 53
+	 * rpath: locale
+	 */
+	if (pledge("stdio rpath inet dns", NULL) == -1) {
+		perror("pledge");
+		exit(1);
 	}
 
 	isc_loopmgr_setup(loopmgr, run_loop, NULL);
