Standard Linux permissions are an all-or-nothing game. After 6 months of testing, I've found Firejail to be the most effective way to sandbox apps and protect sensitive data without the headache of SELinux.