> Exposing the socket directly to the sandbox is dangerous, e.g. it would let the sandbox record the host's microphone directly.

libpipewire-module-pipe-tunnel

also: <https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_req...>