I use https://github.com/slingamn/namespaced-openvpn to have a isolated namespace and VPN connection
On X, these two steps would allow me to run a GUI program in the protected namespace. So I could have .e.g an IDE configuration for my main user/personal projects, and another entirely different instance of the same IDE for work because they use different users
sudo xhost '+si:localuser:user'
sudo ip netns exec protected sudo -u user -i
On Wayland, although the protected shell is created fine, GUI programs don't start. E.g fgor Dolphin
error: XDG_RUNTIME_DIR is invalid or not set in the environment.
Failed to create wl_display (No such file or directory)
I've tried to preserve the env without success:
sudo -E ip netns exec protected sudo -u user -i
It seems that I access to the wayland socket is a must for this to work
This discussion has a nuke option - giving 777 access to the dir where the wayland socket is, and another less permissive approach adding the users to a group and giving access to a new location where the wayland socket is created
https://stackoverflow.com/questions/41736528/linux-wayland-display-multiple-user
Is this second approach secure? If not, which other steps could I take to achieve what I did in X?
you install program A, it needs and installs libpotato then later you install program B that depends on libfries, and libfries depends on libpotato, however since you already have libpotato installed, only program B and libfries are installed The intelligence behind this is called a package manager
In windows when you install something, it usually installs itself as a standalone thing and complains/reaks when dependencies are not met - e.g having to install Visual C++ 2005-202x for games, JRE for java programs etc
instead of making you install everything that you need to run something complex, the package manager does this for you and keep tracks of where files are
and each package manager/distribution has an idea of where some files be stored