So my goal on this is to give each user their own "root" by basically making a loop drive with a copy of core files. I know there is stuff like jail shell, and all that fun stuff that makes it a bit easier, BUT you are still accessing the root files of that system and a crafty bastard can tinker enough to drop out of jail.
My theory is to upon user creation a loop drive is spun up with a copy of root, then when a user logs in, something, maybe a chroot is performed, and it pops them in their bubble. I know user permissions and what not keep people honest, but I essentially don't want that person to know that there is anyone else on that device no matter where they look, nothing but their content will show, and if somehow they ran a command and destroyed their root env, it won't touch the actual machine, only burst their bubble. I know we have came a long way with snaps, and other sandboxing tools to keep stuff from touching other stuff, but nothing I have seen on keeping users in their own user environment.
I am throwing around Ideas, and can't think, would that be a docker scenario, A virt machine, where it just pops in upon login, or if it is actually doable with tweaks to the addusr and login parameters.
Like Virt machines, there is a "root user" (let's call him bob) that manages the user accounts, bob can add, delete, modify what not and also manage the machines software and what not.
bob then wants to add sally to the machine, he does the normal adduser, the add user then spins up a a file (dd if=/dev/zero of=/home/sal_drive bs=1000M count=60) spins up a loop device, adds it to fdisk, and then copies some core files in it.
(now this is where I get tripped up) sally is now a user, her home is set to /dev/loop(sally)/home (if that is the proper syntax. OR would that just be left /home/sally and a script would just drop her on the new drive with the environment set?)
sally then is at the login page, punches her login info, and is then dropped in her bubble, with her root and home files.
So the question, Is this doable with just making a few tweaks in the user env in adduser and the login script, and when the user logs in, it chroots to their environment, and Chroots back upon logout. OR would I have to create a virtual instance, and then they login that way. for example, host machine is charles.local, the login page is then loaded to login.charles.local then sally would login to sally.charles.local....