linux launcher: by default, protect all but already-encrypted services