Is it possible to use less broad permissions than --filesystem=host and --device=all

Both are known sandbox escape vectors. I'm sure boxes needs access to some specific directories so i'm wondering if more specific permissions can be used?

What is --device=all for? I'm not sure. If it's for gpu acceleration you can use --device=dri instead.

Start by locating the Flatpak permission configuration that grants --filesystem=host and --device=all, then determine which directories and devices GNOME Boxes actually needs. Compare whether --device=dri covers the relevant GPU access, and consider the work done when the broad permissions are replaced without breaking Boxes' required functionality.

Written by the indexing model from the issue text.