My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or accessing files that it shouldn't?
Basically, even if steam has a zero day exploit and an attacker can get code execution in my machine inside the steam process via for example sending a message, i want it to not be able to do anything malicious. Is this possible?
I already installed AppArmor, but at least with the default configuration it only stops simple scenarios and doesn't restrict a specific app?
EDIT: I am not saying everything else is secure, but right now i am only focused on restricting Steam and that's it, so for now lets just assume that everything else is OK and we just want to try to constraint Steam (or any other process) in case of successful exploit. And again, obviously we cannot secure ourselves against 100% of situations, but at least we can try to reach it..
I can easily do this in windows by writing a driver and restricting steam's process and its drivers(obviously 1% of attacks will still go through because of its driver, but i can block 99%), how can i achieve it in Linux?