With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the
-A OUTPUT -m owner --gid-owner 1000 -j DROP
The user "internet" has Internet access, but cannot access the "secure" user's home directory.
This feels secure, but running two X servers simultaneously and switching between them with Ctrl + Alt + F(7/8) isn't exactly ideal. By running:
xhost si:localuser:internet su internet firefox
as "secure", I am able to start a browsing session on the same X server. No need to toggle between two X servers now just to use the Internet. The launched browser also has the limitations of the "internet" user. AKA, no access to the "secure" user's home directory.
But how secure is this? I would think that, because the user "internet" is being run in a terminal window, I have control over exactly what applications are launched by it. In the event that there is a Firefox exploit and Firefox is able to launch other applications in the background, my assumption is that those applications would inherit the "internet" user's limitations.
The only thing I'm completely unsure of is how safe the neighboring programs are. If Firefox is exploited in some way and running as "internet", and "secure" has a document open containing sensitive information on the same X server, is there any way that the exploited Firefox could read the memory of the neighboring application?