appjail is a tool that runs an application in an isolated environment, or jail. It is designed to be executed by an unprivileged user. When called, it sets up a new IPC, mount and PID namespace. It then unmounts the /home, /var/tmp and /tmp directories and replaces them with private ones. The jail further gets its private POSIX shared memory space (/dev/shm) and private set of pseudo TTYs. Inside the jail, it is impossible to raise privileges using setuid binaries or file capabilities. appjail requires a kernel with the following options enabled: CONFIG_NAMESPACES=y CONFIG_IPC_NS=y CONFIG_PID_NS=y It also needs a file system with support for file capabilities. To compile and install appjail, run the following commands: $ ./autogen.sh $ ./configure $ make Then, as root, run # make install # setcap cap_sys_admin,cap_chown,cap_net_admin=p /usr/local/bin/appjail If you don't need the -N option, run instead # setcap cap_sys_admin,cap_chown=p /usr/local/bin/appjail Usage examples: * Run skype. Create ~/jailhomes/skype and execute $ appjail -X --x11-trusted -H ~/jailhomes/skype -R user --keep-ipc-namespace --keep-shm skype Qt applications like skype needs --keep-ipc-namespace to communicate with the X server via the MIT-SHM extension. Pulseaudio requires --keep-shm to function. * Run steam. Create ~/jaihomes/steam and execute $ appjail -X --x11-trusted -H ~/jailhomes/steam -R user --system-bus --keep-ipc-namespace --keep-shm steam Note that steam crashes without --system-bus. It works without --keep-ipc-namespace, but you lose hardware accelerated GUI rendering and video decoding.