What Linux security measures should I use for untrusted client files?

Do not rely on Linux file permissions alone if everything is being used from one desktop account. Keep separate backups, preferably with at least one copy disconnected from the computer, and use a firewall to avoid exposing services you do not need. Strong account authentication, disabling unnecessary remote access, and using a standard user account for daily work are usually more valuable than aggressive hardening that you cannot maintain.

Ordinary data files are often less dangerous than executable programs, but documents can still exploit vulnerabilities in viewers or contain active content such as macros. Keep document software updated, disable macros unless they are genuinely required, and open especially suspicious files in an isolated environment or a disposable virtual machine. Antivirus scanners such as ClamAV can provide an additional check, but they are not a replacement for cautious handling and sandboxing.

These technologies solve different problems. AppArmor and SELinux restrict what a program is allowed to access; SELinux is generally more comprehensive but can be more complicated to manage. Firejail uses namespaces and profiles to isolate applications, while Bubblewrap provides similar isolation and is commonly used underneath Flatpak. Flatpak can limit an application's filesystem and hardware access, but review its permissions because sandboxing is not automatically perfect.

Start with the basics: keep the system updated, use the distribution's official repositories, and use Flatpak for desktop applications that are not available there. Avoid adding random third-party repositories or running commands and scripts you do not understand. Most everyday compromises still depend on tricking the user into executing something or granting access, so source and behavior matter more than installing every security tool available.

For files from clients, use applications with limited access where practical. A Firejail or Flatpak profile can prevent a media player, document viewer, or other program from reaching sensitive directories such as your SSH keys, password stores, and private documents. A useful policy is to avoid giving an application both broad filesystem access and unnecessary network access. Test profiles carefully so you do not accidentally break normal functionality.