>>9234
I assume ye be havin' trouble with the stuff about jailin' processes. Let me elaborate.
>Firejail - Linux namespaces sandbox program
Not the most professional security solution, but definitely one of the simpler options. A program jailed usin' firejail be isolated from other processes. It runs in a different namespace, so it will only see itself and its children if it tries to scan the computer. Also, this new namespace doesn't have a superuser, so privilege escalation exploits won't work. On top of that, ye can sandbox it further by givin' it its own home directory, which means it won't have any access whatsoever to yer true home folder (where all yer stuff be on linux). And finally, ye can isolate it even further by givin' it its own network namespace.
So, let's say I use all of the above for a program that contains malware. I launch it and it scans me computer. It will see itself as the only runnin' process. The exploits it relies on most probably won't work from within the jail. Instead of me real home directory, it sees the fake one that contains jack shit and can be easily nuked. This throwaway directory be the only place it has write access to. Plus, there be no network interface on the computer as far as it knows.
All in all, it's pretty neat.