What's left to do?

We can still leak information

How?

unveil("/home/beck/Downloads");
stat("/home/beck/Downloads/../../deraadt/../beck/Downloads");

If that stat works I know "/home/deraadt" exists!

It is allowed because I traverse a path to a permitted place - This
will be corrected in the future.