> It's a vulnerability of all modern desktop operating systems
Uhm, OpenBSD would like a word, buddy.
https://man.openbsd.org/unveil
And Linux would like to present you bubblewrap [1][2][3][4] or the infamous SELinux.
[1]: https://github.com/containers/bubblewrap#usage
[2]: https://man.archlinux.org/man/bwrap.1
[3]: https://wiki.archlinux.org/title/Bubblewrap#Usage_examples
[4]: https://wiki.archlinux.org/title/Bubblewrap/Examples#p7zip
That has the caveat that it only works as far as apps opt into it
Chromium and Firefox have unveil on OpenBSD, which is a good start.
And Linux would like to present you bubblewrap [1][2][3][4] or the infamous SELinux.
[1]: https://github.com/containers/bubblewrap#usage
[2]: https://man.archlinux.org/man/bwrap.1
[3]: https://wiki.archlinux.org/title/Bubblewrap#Usage_examples
[4]: https://wiki.archlinux.org/title/Bubblewrap/Examples#p7zip
That has the caveat that it only works as far as apps opt into it
Chromium and Firefox have unveil on OpenBSD, which is a good start.