Earlier quoted context omitted.
The next step is to isolate the Windows applications: you could use different WINEPREFIX, but I think the better way is to do it like android: one "user" per application. It's not just to prevent applications to read other applications files, but also to firewall each application individually For example, if you don't want the application you've mapped to user id 1001 to have any networking, use iptables with '-m own…
> The next step is to isolate the Windows applications: you could use different WINEPREFIX, In case you're not aware, wine prefixes each use their own settings, but are not isolated from one another. https://gitlab.winehq.org/wine/wine/-/wikis/FAQ#how-good-is-... > but I think the better way is to do it like android: one "user" per application. This would help somewhat, assuming you don't run them all in one user's X…
That's a great point!
I'm aware, which is why recommend instead that wine apps should each be run under a different userid: I don't want any given app to have access to anything that it doesn't absolutely need
> This would help somewhat, assuming you don't run them all in one user's X session
When I start a given wine app, the script starting it allows this user id to render on my Xwayland
It is not as secure as running each on its own X session, but wayland compositors can offer more isolation as needed.