How to prevent the program from accessing files?

Question

I want to run some proprietary software on my Linux machine, skype for example. But I do not trust this program and I want to block for this program access to some folders in my home dir.
I tried to run skype from a different user using gksu, but it is dose not work for me. I find more straightway to make it work. Is there some mechanism to do this.
Thanks, a lot.

Artem S. Tashkinov · Answer

Skype does work under a different user but that requires:

Changing PulseAudio settings to allow two users to access the PA server simultaneously : https://wiki.archlinux.org/index.php/PulseAudio/Examples#Allowing_multiple_users_to_use_PulseAudio_at_the_same_time
Giving the second user the permission to access video devices in case you have a webcam - that depends on your distro

Let's start with the fact that any program which runs in your X.org session can access all other windows and mouse/keyboard input at any time no matter how you run it. Which means to be absolutely secure you must run a potentially bad program using a different X.org instance, e.g. Xorg :1 or use Xephyr: https://wiki.archlinux.org/index.php/firejail#Firejail_with_Xephyr
Ways to isolate applications in Linux:

firejail
A full-fledged VM like kvm, VirtualBox, VMWare Player (free for personal use)
Snap/Flatpak/AppImage which all provide various levels of isolation

Probably something more.
Lastly you can run Skype in Google Chrome https://web.skype.com/ and there's no need to install/run any applications.

How to prevent the program from accessing files?

One Answer

Add your own answers!

Ask a Question