They're sandboxed with AppArmor, which allows restriction to rwx. Checking an app's permissions profile can tell you what it's allowed to read and write. It's l

They're sandboxed with AppArmor, which allows restriction to rwx. Checking an app's permissions profile can tell you what it's allowed to read and write. It's like SELinux, but instead of capabilities, it's a list of files. (But everything* on linux is a file*, so that's probably good enough?)