Jails / sandboxes such as bwrap could be enough in this case by denying access to e.g. HOME files not explicitly whitelisted. Also a Little Snitch-like host-ba

Jails / sandboxes such as bwrap could be enough in this case by denying access to e.g. HOME files not explicitly whitelisted. Also a Little Snitch-like host-based firewall, which would request explicit permission to connect.