commit - 3d132b283345475921bf9cf1e8d77e56ede2edf3
commit + be52e954c1d54f80485c643663db8e2ffc27510f
blob - 6ee6d9b5289b01e31f6648c6a1f47fe13ecf9813
blob + 074bc3ff74313c623bcbeded58af0f771ad6e82c
--- README.md
+++ README.md
@@ -169,12 +169,13 @@ to reload the configuration and spawn a new generation
 process.  The logger processes gather the logs and prints 'em to
 stderr or syslog (for the time being.)  The listener process is the
 only one that needs internet access and is sandboxed by default.  The
-executor process exists only to fork and execute CGI scripts.
+executor process exists only to fork and execute CGI scripts, and
+optionally to connect to FastCGI applications.
 
 On OpenBSD, the listener runs with the `stdio recvfd rpath inet`
-pledges, while the executor has `stdio sendfd proc exec`; both have
-unveiled only the served directories.  The logger process has pledge
-`stdio`.
+pledges, while the executor has `stdio sendfd proc exec dns inet
+unix`; both have unveiled only the served directories.  The logger
+process has pledge `stdio recvfd`.
 
 On FreeBSD, the listener and logger process are sandboxed with `capsicum(4)`.