Unveil is programmatic so the developer can restrict the software to only perform expected behaviors. Like the earlier pledge(2) call OpenBSD introduced a few v

Unveil is programmatic so the developer can restrict the software to only perform expected behaviors. Like the earlier pledge(2) call OpenBSD introduced a few versions ago. A piece of software may have far more access to the filesystem than is needed. So it can be restricted to the handful of directories or files that it actually needs during execution. And it can progressively relinquish access as it runs and end up in a state where it can't access the filesystem at all.