unveil is like
pledge, but for files: it allows the developer of an
application to provide a whitelist of allowed paths, and to mask the rest of
the filesystem. But contrary to
pledge, it won’t abort the process in case of
a violation, it will simply tell it that the path doesn’t exist, so that the
application can gracefully handle the error and continue its execution.
It’s currently not very used in OpenBSD’s ports, the only big software using it is Chrome, but apparently, the number are steadily increasing:
As of OpenBSD 6.6, released in October 2019, unveil(2) is now used in 77 userland programs to redact filesystem access.
This is a really nice mitigation in my opinion, preventing random compromised software from accessing private parts of the filesystem to grab encryption keys or family pictures: An other example of attack-surface reduction.
It’s a bit similar to what AppArmor is providing on Linux, except that the rules are directly integrated in the program itself, allowing for more granularity, and likely less surprise-breakages.