>the GTK filepicker would have to return read access to a file, rather than a filepath which a program than asks to open read-only. xdg-desktop-portal [1] does

>the GTK filepicker would have to return read access to a file, rather than a filepath which a program than asks to open read-only. xdg-desktop-portal [1] does something pretty close, and it is how Linux applications shipped as Flatpaks access your files (at least when the Flatpak sandbox is in enforcing mode). Every sandboxed program has its own mount namespace which cannot see your home folder. When you want to open a file in a sandboxed program, you select the file in an out-of-process file chooser, and the portal puts a handle to that file in the program's view of the filesystem. [1] https://github.com/flatpak/xdg-desktop-portal-gtk/ https://github.com/flatpak/xdg-desktop-portal-gtk/