My current, non-sudo-requiring workaround is to just use firejail by setting the following alias in ~/.bash_aliases:
alias xsane='firejail --noprofile --net=none xsane' and the same thing for the /usr/share/applications/xsane.desktop file. The file gets reset after every upgrade to the xsane package, but since the stable version isn't upgraded that often, it's not a big deal. Cheers, Goran
