As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that anything like chroot is far too complicated for me to use, as simplicity=security. I've created a user all these applications will be run as, and ensured only members of my personal account's group, which this user isn't in, can access my documents. Things seem at a surface level like they're working (especially after I added it to the video group), but I thought it prudent to ask what security issues still exist.

  • Can an application steal control of Control-Alt-Fn[1-12]?
    • Can an application read what's happening on another x server run by the other user?
  • Does it matter if my account for proprietary software has a weak password?
  • Since my /home/$USER folder itself gives no permissions to anyone not in my group or me, it doesn't matter what permissions the files in there have, does it? The file names inside can't be read, can they?
  • Wine doesn't do any funky system-level things that would be a vulnerability, does it?
  • Are there any vulnerabilities through the /tmp directory?
  • Are there any other vulnerabilities, that any application running in that account could use to get access to my documents?
  • What are the good practices for this sort of thing?
  • What else can I do to restrict the privileges of this account?

I'm running debian testing. Any advice would be appreciated.

closed as too localized by Michael Mrozek Aug 13 '11 at 0:08

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Please do not cross-post. Your off-topic question on Stack Overflow was migrated to Security Stack Exchange, where it is on-topic. This question is on-topic here too, but you should pick one site and stick to it (making answerers duplicate their efforts is rude). You should register your SO account, then create one on Information Security, so that you can take ownership of the migrated question. – Gilles Aug 12 '11 at 22:46

As crazy as this sounds, virtualization may be your ticket. You can install kvm and virt-manager, and then your files are completely safe, regardless of what the programs do on your virtual guest.

Not the answer you're looking for? Browse other questions tagged or ask your own question.