You don't need sudo for trace under the same account. You can even attach a debugger and read all app's memory.

Virtualization is another thing entirely. But if you want it that way, then why not simply start a second X for the untrusted app?