That isn't my impression of how it works? https://man.openbsd.org/unveil https://man.openbsd.org/unveil describes a system call that a program uses at runtime,

That isn't my impression of how it works? https://man.openbsd.org/unveil https://man.openbsd.org/unveil describes a system call that a program uses at runtime, so it should be easy for Firefox to start up and then use unveil() to limit itself to paths it knows it will need (but it can pick those paths dynamically when it starts)