sandboxing + /tmp/pulse-socket permissions

[mrl5]

I'm sandboxing some applications and I want to have a sound. I did what's written here: https://wiki.gentoo.org/wiki/Simple_sandbox#Configure_Firefox_to_output_sound_to_larry.27s_PulseAudio_daemon

echo -e ".include /etc/pulse/default.pa\nload-module module-native-protocol-unix auth-anonymous=1 socket=/tmp/pulse-socket" > ~larry/.config/pulse/default.pa

but I dont like that /tmp/pulse-socket has 777 (rwxrwxrwx) permissions. 

I found this link: https://gist.github.com/Earnestly/4acc782087c0a9d9db58 created pulseaudio user, added other users to that group and changed `auth-anonymous=1` to `auth-group=pulseaudio` but still I have 777 (rwxrwxrwx) permissions on /tmp/pulse-socket

 

How can I change the permissions to e.g. 770? Is it even a good idea to "sandbox" webrowser or media player like that? (https://bugs.funtoo.org/browse/FL-6453)

[cardinal]

Pulse-socket permissions explained in this closed upstream issue report:

[Security] socket access granted to users outside auth-group