@nixCraft@mastodon.social on any debian-based distro, you can prevent any binary from accessing private user files by setting up an apparmor profile that loads the debian-maintained "abstraction" called "private-files-strict" it protects ssh keys, aws credentials and firefox profiles amongst others here (line 20) is an example for "mise", the node version manager that i use: https://codeberg.org/mazerty/hub/src/branch/omega/root/script-mise line 27, the "i" flag ensures that every process spawned by mise inherits the same restrictions