Sandboxing suite for desktop programs

[Patrick]

Seems similar to:

sandbox-app-launcher - Sandboxed Application Launcher

System-wide sandboxing framework - sandbox-app-launcher

We’re currently working on a full system apparmor policy to confine all userspace processes but this has 2 issues: It doesn’t use more restrictive profiles for user applications. A PDF viewer shouldn’t have the same profile as init. It can’t make use of technologies like namespaces and seccomp. Seccomp especially is vital for kernel attack surface reduction. We should automatically sandbox user applications for better confinement with more restrictive rules. I think we should create a …