The Yama patchset has been in mainline for the last few years, and disallows non-root processes from reading each others&#x27; memory (except for direct children).<p>The trouble is that it&#x27;s a sort of retrofitted check. It works surprisingly well, but being added to a 20+-year-old OS and a 40+-year-old design, it can&#x27;t guarantee being correct. The traditional, historic process boundary on UNIX has been user accounts &#x2F; UIDs. Desktop Linux needs to figure out a way to do what Android does, and run every application with a separate UID, including the ability to have private files that are unreadable to other applications.<p>The challenge is defining &quot;application&quot;. Android, being a greenfield platform, could define the interaction between applications. On desktop Linux, it&#x27;s obvious that, say, a web browser and a PDF viewer should be different applications. The two processes in a &quot;find | grep&quot; shell pipeline probably should count as the same application. In between, it&#x27;s pretty blurry, because we&#x27;ve had 40 years to develop patterns that don&#x27;t account for this isolation ever happening.