Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using Ubuntu 11.04 as a Desktop OS, I want to reach "bigger security" with a "jailing" processes:

VirtualBox, Google Chrome, Firefox, VLC, PDF/djvu reader, MP3 player, wine, pidgin, transmission, LibreOffice.

Normally I would create separate users, and put .desktop icons on the "main users" Desktop, with using gksu+/sudoers setting/ in the .desktop files to "passwordlessly" launch the application as different user.

If I understand correctly Qubes OS uses XEN to really separate the applications from each other.

The Question: How could I sandbox/chroot/jail (or however you say it) the above applications so that the main user just has to click on an icon on his Desktop to launch them without the system asking for password?

share|improve this question
up vote 3 down vote accepted

You want Linux Containers: http://lxc.sourceforge.net/

You can both run a single process and a whole OS. It's sort of virtualization without virtualization.

share|improve this answer
Note that LXC isn't enough for everything. For example, if the application has access to an X server, it can do pretty much everything to other applications running on the same X server. See e.g. Is it safe to run a GUI program as another user? and the links in that answer. – Gilles Jun 3 '11 at 11:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.