For a partial solution, have a look at "sandbox -X" (man 8 sandbox).
Agreed, although be aware that this is only available when you're using SELinux. By default that's Fedora/Centos/RHEL, not Debian/Ubuntu.
depending on your OS of choice, desktop containers using something like docker (e.g. https://blog.jessfraz.com/post/docker-containers-on-the-desk...) can achieve it and are a reasonably straightforward (for a certain value of straightforard) option (linux only unfortunately...)
Re:Container Tabs
by the_why_of_y on Sunday January 22, 2017 @08:22AM
(#13455079)
> The images work by mounting the X11 socket into the container! Yippeeeee!
Well, yippee, now the application can read all keyboard input from that X11 socket, there goes your "sandbox"...
You really need Wayland to get a practical security benefit for GUI applications from containers.
I want to take it all the way to eleven and 'jail' a gui process (in this case, the web browser - any web browser). It gets its own filesystem root and its own IP BUT I don't have to pay the penalties of firing up a full blown virtual machine.
This isn't easy to do in the way that, for instance, jailing a daemon is easy to do ...
Further, even if I did have a workable recipe to jail a chrome process (and all of it's children) it would certainly only be for X. Maybe there's some recipe for that in OSX but it would be profoundly different. OSX doesn't even have the 'jail' command (although it does have chroot ...)