What are the methods to protect home folder files from other applications runing as the same user

I think it is a security issue, because that "Aside from the potential of my non-root user account being compromised" can be rather large.

But there are other increased risks beyond that. For example, you've now opened yourself up to a theoretical exploit which allows one to change permissions in the screen socket dir (/var/run/screen on my system, but sometimes /tmp is used). That exploit now has an path to getting root, which it might not otherwise.

sudo has other advantages, if you can train yourself to use it for each command rather than doing sudo su -. It logs actions (which, unless you're logging remotely, doesn't meaningfully increase security, but does give you a trail of what you've done). And it helps prevent accidents by requiring intentional escalation for each command, rather than switching to an entirely-privileged session.

Because the management of access would require a lot of work arounds on the local host we decided just to create a group in Active Directory and restrict logins to users in that group.

This can be done by editing the /etc/security/pam_winbind.conf file with the following field with the SIDs of the groups or users we want to restrict access to (comma separated).

require_membership_of=

We then will filter our chroot restrictions to that group (or put the users to a local group) to restrict their sftp access to their own home directories. This will also allow us to add the oddjobs mkhomedir back to pam and then to allow access to the server we just have to add the user to that group. They can then log in and their home dir will be created automatically.

Thanks everyone for the help/ideas but it looks like AD groups will be the easiest to manage after all.