Regarding the question to root the alien-dalvik/Android part, I've asked it myself in December. The answers were not really helpful (except getting laughter), but this one might help:
The virtual layer by Alien Dalvik controls access to the Jolla hardware demanded by random Android applications .
I am worried that this Alien Dalvik layer acts like an Android OS that automatically says "yes, allow" on every request for data access from an Android application.
For "user convenience" AlienDalvik is trusted by Sailfish to access contact details, phone status, GPS, file system, enable network connection etc...hence the Android programs running on top of it are also trusted by default.
The question is, if XPrivacy running on Alien Dalvik would be aware of the other Android programs running on Alien Dalvik? They might as well be running in a separate "box".
I hope somebody can throw in a technical explanation to prove the contrary and show us that Sailfish is not a data grabbing playground for Android applications on the loose.
Thanks
Something I've tried myself back then, where root is needed, failed:
