I understand that running programs as a non-root user is done in order to restrict the programs from writing system files, which prevents malware from compromising the system security.
But in most cases those programs are still able to read those system files even though they cannot write them (ex. /etc/fstab
) which leaves the system vulnerable to wide range of spyware.
So, is it possible to restrict programs in a more draconian way so that they would not be able to access anything outside a defined environment? For example, I could allow firefox
to use ~/.mozilla
, ~/.cache/mozilla
and ~/Downloads
, but firefox
will never be able to read anything from /etc
or such.
Is there such a feature in Linux?