How can I create a user with the smallest possible permissions? Are there any tricks? (does the user only needs to be in his group, and not else?)
Googled a few hours for keywords/tricks that I need to "expand" (mini howto to it) later:
mount /home with nodev, nosuid, noexec AND/OR with read-only option? set high umask for users that are not XY minimal groups needed for user regularly check that the user isn't in the sudoers file no o+rwx on the files in the system or suids **restricted shell for the user?** systrace restrictions? (or doesn't worth it?*) pf limitations - user uid only needs http https ftp dns - no other network needed for any user besides root put the webbrowsing in a qemu vm?? security/limits.conf - ulimit for the user? chroot the xxxterm? xxxterm as shell? (instead of ksh?) only let a few dozen MByte quota for the user or zero? guest session like? - start with a clear QEMU guest or chrome directory at every chrome exit/start? privoxy for filtering chrome traffic? (proxy can be set to anything by the XY user..) can pf limit that what process can use http https ftp dns?
if this howto is completed it could be useful when having a
zombie terminator apocalypse :D