Resolve confusion between kernel-level LSMs and user-space Flatpak sandboxing to apply correct Linux security isolation strategies.