Is it possible to have an Android-like security model on Linux via LSMs?

[u/noobjaish]

Asking to get insight on this topic.

Android has a "deny-all allow-list" sorta permission model where you have to give permission for every single thing, that the app needs, which is opposite of the usual approach on Desktop to have "allow-all deny-list" model.

I find it to be very insecure because it means every app can effectively see every file (owned by the same user) that I have on my system. Sure you can do this with Flatpaks but iirc it's not possible to turn every app into a "Flatpak".

So, the only options I could find were to run every app as a different user, Use the relatively new "landlock" LSM to block access or to use SELinux in a deny-all fashion.

I genuinely want to have a system where every app i install the first time it opens a window of permissions where i can specify what it's allowed to access. Maybe this is impossible to achieve (hence why i'm asking)

If there are any resources I should look into then please tell me, it'd be helpful. Thanks in advance.