> if someone has hacked in to the point that they can even run such query commands, surely I'm already pwn'd I believe the idea is that by adding security meas

> if someone has hacked in to the point that they can even run such query commands, surely I'm already pwn'd I believe the idea is that by adding security measures in the graphical server, you can limit it better. So yes, if there's no other protections then the graphical server is the least of your problems, but if you run a program in a container then the graphical server becomes the weakest link so we'd like to protect it. (I don't know why other protections - https://wiki.archlinux.org/title/Firejail#Firejail_with_Xorg https://wiki.archlinux.org/title/Firejail#Firejail_with_Xorg or XACE - weren't good enough, but there is an argument for something there)