Not all applications we run come from trusted repos. Sometimes we get a package .deb, .rpm, .tar, etc. that contains an application we do not trust completely trust. I'm talking slight distrust, not full-flown paranoia.

Without going into a big debate about whether to run them or not, how would I go about running an untrusted GUI application with the basic criteria being:

  • it does not have access to my important files
  • isn't able to listen to keyboard or mouse input when it's not focused

Possibilities I know of

another, restricted user on another or the same system

The problem I have here is X. Sure you can run xhost +local:restricteduser or maybe gksudo -u restricter thatapplication, but would they fullfill the basic criteria listed above? Is it secure?
I doesn't seem so as I tested this with JDownloader, which ran in a VM I sshed into with X access and it had access to my clipboard...

other machine/system (could be virtual)

This seems pretty safe as they could trash that other system and yours would still be ok, but spinning up a VM every time you the application seems like overkill (you must really, really distrust the application).


I heard of an operation system under development that IIRC would create a new virtual machine per user. Can't remember the name...

closed as too broad by countermode, techraf, GAD3R, HalosGhost, Eric Renouf Nov 11 '16 at 15:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


If the threat model is focused on files and X access, files should be handled by creating a new user/group, and making sure file permissions are restrictive enough this user/group cannot access anything important.

Restrictions to X can be handled by starting a virtual X server (e.g. vnc4server) where you can control (e.g. via xvnc4viewer) that this server only sees mouse or keyboard activity when you explicitely focus the viewer window etc.

Of course nothing keeps you from using read-make sandboxes like firejail or others.

Not the answer you're looking for? Browse other questions tagged or ask your own question.