D-Bus is a special case because the protocol is not particularly complicated and the proxy can be used by any sandbox to implement various types of filtering on

D-Bus is a special case because the protocol is not particularly complicated and the proxy can be used by any sandbox to implement various types of filtering on any other service that uses D-Bus. That's one of those things where if your application uses D-Bus to communicate with a service, you might just end up getting sandboxing support there "for free." Pulseaudio is not getting much work these days, I believe the work currently is happening in Pipewire, which was built to have a fine-grained permission system that can work with any sandbox and is backwards-compatible with Pulseaudio. I'm not sure how your IRC bouncer would work there, but presumably if you sandboxed that, it only needs to talk to the IRC socket and nothing else. For other obscure servers that have no concept of security, I'm not sure what can be done about that if nobody wants to modify them or replace them. You might just have to accept that they will need to run at elevated privileges and can clobber your system or home directory.