If you have a number of isolated or 'emulated' desktop applications, do you have a way to launch them on click, preferably without intervention of fully open sudo/doas?
My current setup is that I add my main user to the secondary user's groups so I can have access to the data, but since the other way around is not granted (ofc security), I still have issues when moving a file to scope of the limited account. This problem probably can be resolved with more grained UNIX permissions.
Bigger issue are the Linux chroots. Without any privilege mechanism it requires two su's and one typing of root password to get where I want to be.
So has anyone tackled this with MAC or some other mechanism?
I thought of writing my own suid binary. Simplest, define a group like 'auxusers', binary allows wheel users to impersonate anyone from that group. To cover both cases, it would need to have jail/chroot support too.
My current setup is that I add my main user to the secondary user's groups so I can have access to the data, but since the other way around is not granted (ofc security), I still have issues when moving a file to scope of the limited account. This problem probably can be resolved with more grained UNIX permissions.
Bigger issue are the Linux chroots. Without any privilege mechanism it requires two su's and one typing of root password to get where I want to be.
So has anyone tackled this with MAC or some other mechanism?
I thought of writing my own suid binary. Simplest, define a group like 'auxusers', binary allows wheel users to impersonate anyone from that group. To cover both cases, it would need to have jail/chroot support too.
