A capability model fixes this: the application launches a file chooser which it does not control, which can then return it an fd or other token giving the application the capability to read from or write to a specific file.
Of course, this would be a considerable effort. But it's probably where we're going.
Of course, this would be a considerable effort. But it's probably where we're going.