@JTskulk There is firehall, systemd-nspawn, se-linux, ... and a lot more that can enable similar things.

They all involve more.work on my side though:-) At least I found flatpak the most convenient: Install flatseal from flathub, select the "global" option to tune and block whatever you think relevant.

Then go to the individual apps, check the permissions there and tighten them further as needed.

@JTskulk @woelkchen Because I can easily limit which files are seen by applications in a flatpak.

I love being certain that my browsers can not access my ssh keys or actually anything outside the Downloads folder.

@woelkchen it's not just the Qt company doing that... there are so many wrappers for browser engines out that are similarly poorly maintained. Basically every tiny browser project comes with a poorly maintained browser engine.

I especially like those projects that patch major features like e.g. the extension system back into bigger browsers after the much bigger upstream project replaced that for something else, stating that they do not have the resources to keep the old system secure and maintained.

@Yora @woelkchen most people do not look beyond the UI. Unfortunately writing a pretty UI is the easy part of writing a browser. Maintaining some browser engine is much harder.

So make sure to use a browser with an engine backed by as big an open source project as possible and one where the browser engine has as few downstream patches as possible.

Wrapping the entire engine in a new set of APIs not available upstream involves way too many downstream patches for my taste.