You are not logged in.
Hi!
A week ago ago, I began spreading applications I'm using over multiple user accounts. For example:
- Steam (mostly because I want it and its installed games to stay the f* out of my f*ing files and folders - even if it's just creating config files and savegame folders all over the place like it did before I locked it out of my main account and especially now with that great new "rm / -r" bug around)
- Chromium (which I'm only using in "incognito" mode for sites that require flash/plugins/scripts that I don't have installed/whitelisted in firefox)
- wine ( mostly for easier killall'ing etc... and because windows is windows )
I'm not doing this to prevent any sort of "sophisticated attack" - I'm more concerned with behaviour that's not generally considered "malicious" when it comes to those applications. Also I like being able to "killall -u" a whole "set of potentially misbehaving applications" without having to look trough everything that's running.
At the moment I'm using "sux" (AUR ) to start those applications from a shell but I don't really like that wrapper. Are there potentially better / more comfortable alternative to do something like that?
Also I am looking for a way to prevent / stop applications run under those users from changing the screen resolution... (I don't mind if that makes the application crash... if it changes the resolution without asking I don't want it to run).
And I switched pulseaudio to system wide daemon mode (systemd AUR pacakge + random fixes I needed to do manually; not sure if it works better than before yet)... it seems to be mostly working at the moment. Can't help but wonder if "jack" would be better suited for a scenario like that (long term)... anyone been using it in such a context for some years already / was it more reliable + resistant to problems than just pulse?
The grsec / apparmor stuff looks sort of interesting, but that's probably overkill & too much of a hassle for my situation (I heavily rely on hibernation and I'm not sure if grsec is even still worth it if I have to compile it manually and remove the features that collide with hibernate)
If someone could throw some good fitting search terms at me that would also be great - if you take a look at this threads subject, you can probably guess already that I don't really know how what I'm trying to do is called. "application isolation hardening stuff"? Did not manage to entice google into giving me much relevant information / examples etc :3
Any general hint on how to manage things? I'm not yet sure where exactly I'm going with this and if I'm doing it wrong - so any experiences from someone who has set up his system in a similar/alternative fashion (to keep misbehaving applications in check / apart somehow yet still "on the same screen") are appreciated!
Offline