Don't call PledgeChild() too early

dnscrypt-proxy/config.go

@@ -193,6 +193,9 @@ func ConfigLoad(proxy *Proxy, svcFlag *string) error {
 
 	flag.Parse()
 
+	if *child {
+		PledgeChild()
+	}
 	if *svcFlag == "stop" || *svcFlag == "uninstall" {
 		return nil
 	}

dnscrypt-proxy/privilege_others.go

@@ -39,7 +39,6 @@ func (proxy *Proxy) dropPrivilege(userStr string, fds []*os.File) {
 	}
 
 	SystemDNotify()
-	PledgeChild()
 
 	args = args[1:]
 	args = append(args, "-child")