add pledge(2) to "mutool show":
  - rpath : dropped after opening
  - no need of wpath cpath for -o, as the open is already done at this place

Index: source/tools/pdfshow.c
--- source/tools/pdfshow.c.orig
+++ source/tools/pdfshow.c
@@ -27,6 +27,9 @@
 #include "mupdf/fitz.h"
 #include "mupdf/pdf.h"
 
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -627,10 +630,23 @@ int pdfshow_main(int argc, char **argv)
 	else
 		out = fz_stdout(ctx);
 
+	if (pledge("stdio rpath", NULL) == -1)
+	{
+		fprintf(stderr, "pledge: %s\n", strerror(errno));
+		exit(1);
+	}
+
 	fz_var(doc);
 	fz_try(ctx)
 	{
 		doc = pdf_open_document(ctx, filename);
+
+		if (pledge("stdio", NULL) == -1)
+		{
+			fprintf(stderr, "pledge: %s\n", strerror(errno));
+			exit(1);
+		}
+
 		if (pdf_needs_password(ctx, doc))
 			if (!pdf_authenticate_password(ctx, doc, password))
 				fz_warn(ctx, "cannot authenticate password: %s", filename);