I'm trying various sandboxing solutions on linux. I'm used to running untrusted programs (for example, a web browser, a pdf document reader, etc) inside a selinux sandbox, which I'm quite satisfied with, but there is a problem: it's only supported on rhel/fedora. AFAIK other distributions don't really support selinux (even when they say they do, they don't ship usable policies or documentation), and even when a quasi-working policy is provided, policycoreutils-sandbox is not available (see debian).
What could be a multi-distro sandboxing solution? I'm trying docker/subuser, which allows me to start a docker container running the application of interest and giving it access only to part of the filesystem. For example, I can run 'chrome' in a docker container and let it only access my Downloads directory.
This seems a convenient solution since it's distribution independent and doesn't require me to install the program I'm planning to run and its dependencies on the host.
However, I'm not quite sure about how much security is there in 'subuser-security': https://github.com/subuser-security/subuser
First of all, docker doesn't yet support user namespaces. This means that every 'container' runs as root on my host, even if it's isolated by lxc. this also means that, if I follow subuser's recommendations, I have to add my user to the docker group. since dockerd runs as root, having access to it means that I have full access to the whole host filesystem as root, I can run privileged containers, etc. If this isn't enabling privilege escalation (even if not from 'guest' apps, I hope), I don't know what it is.
furthermore, let's say that I'm running chrome in subuser. Now I have a chrome browser running with its sandbox disabled (one less layer) inside another sandbox under the root user. Is it really a benefit from simply running chrome with its sandbox under an unprivileged user?
I would not be able to limit its access to my home directory, but apart from that, I don't see reasons to prefer subuser/docker.
what other distro independent solutions are left?
I'm starting to think that the least cumbersome solution would be to simply use standard unix users. One user per application, maybe install an app and its dependencies under ~local, ~bin, etc.
which package managers support installing a package, mantaining a package tree, as a user inside a user's home directory? are there any third party package managers for linux that support this?
how would you share files between users? I'm thinking of the possibility of running an unprivileged ftp daemon on localhost, let's say as a 'standard' or 'storage' user and use virtual users to export parts of that home dir (eg, /home/me/apps/webdownloads) to other users, applications, and mount that via fuse.
Is this reasonable?