untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24DlK1w9Vb7zo+dUEjn6kHDMFmKN0stczXVpvq8s60Ijg+vrlweT7QqxTeIXEqDPRzRm/YHpTf9sGuC+iAXZA4wE=

OpenBSD 6.6 errata 009, December 3, 2019:

Environment-provided paths are used for dlopen() in mesa, resulting in
escalation to the auth group in xlock(1).

Apply by doing:
   signify -Vep /etc/signify/openbsd-66-base.pub -x 009_mesaxlock.patch.sig \
       -m - | (cd /usr/xenocara && patch -p0)

And then compile and rebuild Mesa and xlock
   cd /usr/xenocara/lib/mesa
   make -f Makefile.bsd-wrapper obj
   make -f Makefile.bsd-wrapper build
   cd /usr/xenocara/app/xlockmore
   make -f Makefile.bsd-wrapper obj
   make -f Makefile.bsd-wrapper build

Index: lib/mesa/src/loader/loader.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/loader/loader.c,v
diff -u -p -u -r1.7 loader.c
--- lib/mesa/src/loader/loader.c        23 May 2019 05:33:29 -0000      1.7
+++ lib/mesa/src/loader/loader.c        3 Dec 2019 01:03:52 -0000
@@ -445,7 +445,7 @@ loader_get_driver_for_fd(int fd)
    * user's problem, but this allows vc4 simulator to run on an i965 host,
    * and may be useful for some touch testing of i915 on an i965 host.
    */
-   if (geteuid() == getuid()) {
+   if (issetugid() == 0 && geteuid() == getuid()) {
      driver = getenv("MESA_LOADER_DRIVER_OVERRIDE");
      if (driver)
         return strdup(driver);
@@ -533,7 +533,7 @@ loader_open_driver(const char *driver_na
   const struct __DRIextensionRec **(*get_extensions)(void);

   search_paths = NULL;
-   if (geteuid() == getuid() && search_path_vars) {
+   if (issetugid() == 0 && geteuid() == getuid() && search_path_vars) {
      for (int i = 0; search_path_vars[i] != NULL; i++) {
         search_paths = getenv(search_path_vars[i]);
         if (search_paths)
Index: app/xlockmore/Makefile.bsd-wrapper
===================================================================
RCS file: /cvs/xenocara/app/xlockmore/Makefile.bsd-wrapper,v
diff -u -p -u -r1.13 Makefile.bsd-wrapper
--- app/xlockmore/Makefile.bsd-wrapper  7 Mar 2017 21:35:57 -0000       1.13
+++ app/xlockmore/Makefile.bsd-wrapper  3 Dec 2019 01:03:56 -0000
@@ -17,6 +17,7 @@ config.status:
               --enable-appdefaultdir=${X11BASE}/share/X11/app-defaults \
               --enable-syslog --without-motif --without-ttf \
               --without-gtk2 --without-gtk --without-esound \
-               --without-rplay --without-ftgl
+               --without-rplay --without-ftgl \
+               --without-opengl --without-mesa

.include <bsd.xorg.mk>