I have a Linux installation with a default user and an admin user (and root). On startup, the default user is automatically logged in and a particular application is launched. My intention is to prevent the default user from performing any actions that aren't part of the running application. One of the applications actions is to allow some administrative functions which I am thinking would be performed via sudo-ing or ssh-ing as the admin user.
Is it possible to limit the default user the way that I'm describing? I've already setup groups to allow the default user some write access to a database and I've limited their access to the terminal. I've researched chroot-ing and sudo based permissions but I'm not sure which (if any) is the more correct method of permission management or if either is even necessary. Regarding sudo versus ssh for admin access, which is better (or is something else better)? I know there is a lot of Linux permission information out there but I'm having trouble collating it all into a solution that fits this particular problem.