On: Unveil(2) – Unveil parts of a restricted filesystem view

[imtringued]

If the daemon is going to call unveil on every file access then what purpose does unveil serve?

[ben_bai → imtringued]

The trick is to unveil all the files the server needs to operate on and then lock further unveiling.

This way bugs/exploits of the server can't suddenly go read/write to i.e. /etc/passwd.