A large value of app sandboxes are easy but controlled ways to allow exceptions. E.g.: an app can ask the sandbox for file access, the sandbox then prompts the user to select a file and only that file is then exposed to the app.<p>Or even giving global access to functionality from a manifest file, without having to set up a restricted user&#x2F;environment manually. (I wouldn&#x27;t know without looking it up how to set up a linux user account that can&#x27;t talk to the network. Or even better, only can talk to some part of the network.)