I am often tempted to try out a random github project with: # mkdir random-repo # cd random-repo # git clone http://github.com/random-dude/random-repo . # ./configure && make [...] # emacs hack-on-something.cc # make However that is naive from a security standpoint. Makefile s can do just about everything to your workstation, e.g. steal your e-banking credentials from .config/chrome . So, I want sandboxing. And I want it in a way that fuses nicely with the workflow above. Basing sandbox activation on my shell current working directory seems to work quite nicely. Consider the following: # id -nu clefru # echo $PWD /home/clefru/devel # pwdjail-mkdir random-repo # cd random-repo $ id -nu random-repo $ echo $HOME /home/clefru/devel/random-repo $ git clone http://github.com/random-dude/random-repo . $ ./configure && make [...] $ cd .. # echo $PWD /home/clefru/devel # id -nu clefru # emacs random-repo/src/file.cc [...] Notice: I use pwdjail-mkdir instead of mkdir . En