overview / faq / The sandbox says no backend — what do I install?
sandbox-exec ships with the OS; if rabadon doctor reports it missing, your environment is unusual.sudo apt install bubblewrap.Without a backend, rabadon exec refuses to run rather than run unprotected. The hook still works.