I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on linux. I've tried using firejail (block all network access and temporary fake filesystem) with Wine but could not get Excel or Word to work.
Personally, I would implement security profile with some MAC for that. If you run Ubuntu, than out of the box you have AppArmor. It has lower entry level comparing to SELinux, so you have less chances for missconfiguration. You can restrict network access and access to filesystem, so that Word will be able to access only documents in dedicated folder.
BTW: from security perspective having Wine in your Linux environment is a bad idea as it makes you vulnerable to some range of Windows malware.
You can run wine inside of docker containers to isolate it from your host system. docker does not support GUI applications on its own, but it is possible.
There is also a ready-to-use wine image at docker hub: x11docker/lxde-wine
Example: wine on dockered LXDE desktop (needs a nested X server like e.g.
x11docker --desktop --home x11docker/lxde-wine
The image contains PlayOnLinux, too. Run Playonlinux with:
x11docker --home x11docker/lxde-wine playonlinux
--home creates a persistant home folder for wine container to preserve installed wine installations.)
Disclaimer: I am the author of x11docker, sorry for advertising
Setup without x11docker to provide an independent answer. It lacks some x11docker security features, but basically it works and is much better than installing wine on host:
Dockerfile to build a wine+PlayOnLinux image:
FROM debian:stretch ENV DEBIAN_FRONTEND noninteractive # contrib for winetricks, stretch-backports for latest wine RUN echo "deb http://deb.debian.org/debian stretch contrib" >> /etc/apt/sources.list && \ echo "deb http://deb.debian.org/debian stretch-backports main" >> /etc/apt/sources.list # Multiarch for wine32, wine, some often needed dependencies: RUN dpkg --add-architecture i386 && apt-get update && \ apt-get -t stretch-backports install -y wine # helpful additions RUN apt-get install -y fonts-wine winetricks ttf-mscorefonts-installer winbind # wine gecko and mono RUN mkdir -p /usr/share/wine/gecko && \ cd /usr/share/wine/gecko && wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86.msi && \ wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86_64.msi && \ mkdir -p /usr/share/wine/mono && \ cd /usr/share/wine/mono && wget https://dl.winehq.org/wine/wine-mono/4.7.1/wine-mono-4.7.1.msi # PlayOnLinux RUN apt-get install -y playonlinux xterm gettext CMD playonlinux
Command to run PlayOnLinux image:
# folder on host to store settings and installations mkdir -p ~/winehome # allow X access for user in container xhost +SI:localuser:$(id -un) docker run --rm \ --env DISPLAY=$DISPLAY \ --user=$(id -u):$(id -g) \ --env USER=$(id -un) \ --volume /tmp/.X11-unix:/tmp/.X11-unix \ --volume ~/winehome:/home/$(id -un) \ --env HOME=/home/$(id -un) \ --ipc=host \ playonlinuximage
You could run the program in a new user account that you don't use for anything else. Then any programs run under that account can only access stuff that can be accessed by that account.