As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that anything like chroot is far too complicated for me to use, as simplicity=security. I've created a user all these applications will be run as, and ensured only members of my personal account's group, which this user isn't in, can access my documents. Things seem at a surface level like they're working (especially after I added it to the video group), but I thought it prudent to ask what security issues still exist.

  • Can an application steal control of Control-Alt-Fn[1-12]?
    • Can an application read what's happening on another x server run by the other user?
  • Does it matter if my account for proprietary software has a weak password?
  • Since my /home/$USER folder itself gives no permissions to anyone not in my group or me, it doesn't matter what permissions the files in there have, does it? The file names inside can't be read, can they?
  • Wine doesn't do any funky system-level things that would be a vulnerability, does it?
  • Are there any vulnerabilities through the /tmp directory?
  • Are there any other vulnerabilities, that any application running in that account could use to get access to my documents?
  • What are the good practices for this sort of thing?
  • What else can I do to restrict the privileges of this account?

I'm running debian testing. Any advice would be appreciated.


As crazy as this sounds, virtualization may be your ticket. You can install kvm and virt-manager, and then your files are completely safe, regardless of what the programs do on your virtual guest.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.