The formatter operates in “safer” mode by default; to mitigate risks
from untrusted input documents, the pi and sy requests are
disabled. GNU troff’s -U option enables “unsafe
mode”, restoring their function and enabling additional groff
extension requests, open, opena, and pso.
See I/O.