You don't need sudo for trace under the same account. You can even attach a debugger and read all app's memory. Virtualization is another thing entirely. But i

You don't need sudo for trace under the same account. You can even attach a debugger and read all app's memory. Virtualization is another thing entirely. But if you want it that way, then why not simply start a second X for the untrusted app?