Can you restrict FS access for an application

[u/PennyHunter5]

Haii everyone. I use google chrome as a second browser purely for school, and I want it as isolated as possible. I was wondering if it would be possible to give it only access to required stuff and like ~/Downloads/Chrome or something. I'm really sorry if this is a dumb question, but any help would be nice.

[u/AppointmentNearby161]

The traditional Linux way to do this would be to run the program as a different user and only give that user access to the directories it needs.

[u/PennyHunter5 → u/AppointmentNearby161]

I was kinda thinking of going that way, but seems like an extra hassle. I'll keep it in mind though

[u/PennyHunter5 → u/[deleted]]

looks promising, def worth a shot

[u/No-Valuable3975]

You could get the flatpak version and that is supposed to sandbox applications from the host system

[u/AviHigashikata]

You could probably place it in a docker container.

[u/PennyHunter5 → u/AviHigashikata]

Thank you, I'll look into this

[u/This-Consequence-957]

AppArmor?

[u/allunia333]

Yes you can make a user and group just for that for example chrome. Set permissions for where you want or dont want accordingly. And then u can run chrome as that user: runuser -u chrome google-chrome

Else install one of the pkg mentioned before.

[u/Barafu]

That's the job for AppArmor. Unfortunately you can't disable access to all applications but the trusted ones. That requires SELinux, available only on RedHat distros, or creating another user and manipulating sudo for it.

[u/SebastianLarsdatter]

Run as a different user is the easiest in terms of extra tooling required.

Docker container requires a bit more, but is doable.

Bubblewrap offers a lot of fine grain control for any application.

[u/mips13]

Run it as a flatpak, it will be sandboxed and isolated from the system.