On: Unveil(2) – Unveil parts of a restricted filesystem view

[Ohjohng8]

I assume that is intended as a security feature to prevent TOCTTOU bugs, especially when a process does not use the *at family of syscalls.

I.e. a malicious process can't swap directories under your nose.