To me, user accounts have always seemed like the more reasonable approach to sandboxing vs. cloning the universe to run a single program in a container.<p>Most of my systems have a user for myself, and one or two other users like `sketchy` or `test` or something for programs that I trust enough to run, but don't trust enough to not fuck up my home directory in some way (including modifying startup scripts, which IMHO should probably require sudo to edit, even for a normal user).<p>If the program is <i>really</i> sketchy and you're worried about it doing something like exfiltrating ~/Documents/taxes, then private home directories would definitely seem like a good default. You can always have an explicitly shared area like /home/shared/$user that defaults to public.
I wish such announcements would include a reference to the bug tracker where the change was discussed:<p><a href="https://bugs.launchpad.net/ubuntu/+source/adduser/+bug/48734" rel="nofollow">https://bugs.launchpad.net/ubuntu/+source/adduser/+bug/48734</a>
This could be simplified to <a href="https://bugs.launchpad.net/ubuntu/+source/adduser/+bug/48734" rel="nofollow">https://bugs.launchpad.net/ubuntu/+source/adduser/+bug/48734</a> is fixed.
Too bad Red Hat is going the opposite direction with their Toolbox container management project, sharing your entire home dir with every container but not explicitly documenting this:<p><a href="https://github.com/containers/toolbox/issues/183" rel="nofollow">https://github.com/containers/toolbox/issues/183</a>
> This change now means that in the future if an attacker were to exploit some previously unknown vulnerability in a given system service that is running as a separate user, they would then not be able to access the data of any other user (both human or system service) on the system.<p>If the attacker can already access arbitrary files on your box, I don't think simple unix permissions will save you
Ubuntu should develop shadow accounts - the user will log in to a completely different account of the same login depending on password. That is if someone forces you to log in you could use different password and pretend it is your stuff.