Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Using Ubuntu 11.04 as a Desktop OS, I want to reach "bigger security" with a "jailing" processes:

VirtualBox, Google Chrome, Firefox, VLC, PDF/djvu reader, MP3 player, wine, pidgin, transmission, LibreOffice.

Normally I would create separate users, and put .desktop icons on the "main users" Desktop, with using gksu+/sudoers setting/ in the .desktop files to "passwordlessly" launch the application as different user.

If I understand correctly Qubes OS uses XEN to really separate the applications from each other.

The Question: How could I sandbox/chroot/jail (or however you say it) the above applications so that the main user just has to click on an icon on his Desktop to launch them without the system asking for password?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You want Linux Containers: http://lxc.sourceforge.net/

You can both run a single process and a whole OS. It's sort of virtualization without virtualization.

share|improve this answer
1  
Note that LXC isn't enough for everything. For example, if the application has access to an X server, it can do pretty much everything to other applications running on the same X server. See e.g. Is it safe to run a GUI program as another user? and the links in that answer. –  Gilles Jun 3 '11 at 11:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.