Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to

Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to use denylists vs. allowlists. Firejail is a setuid binary with tons of attack surface and has had a number of privescs itself[1], unlike something like the lower-level Bubblewrap tool. I'm glad it exists, though - it's the only mature solution other than Flatpak that has proper dbus filtering, among other things. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-16191/Firejail-Project.html https://www.cvedetails.com/vulnerability-list/vendor_id-1619...