I am using TOMOYO to restrict Firefox. It works well. But if I, e.g., do a soft restart of my window manager and restart Firefox, its domain will be different, so it won't be protected. I'd like to restrict it no matter how it happens to be invoked.