Follow up: How to write a Linux virus

The user/account "internet" has, like any user on Unix, a directory usually named /home/internet, it can do whatever it wants there (like installing any kind of virus, or doing rm -rf .*). You can set any limit for this untrusted user by ulimit.
The user "internet" has access to the local screen (if the real user didn't do "xhost -"), and the sound card.
The browser downloads an untrusted executable file, keep it executable and set the set-uid bit and owner "internet", and put that on the desktop.
The real user can click on this icon and run it without checks, the worst which can happen is that all "internet" user files will have a virus.
That postcard with sound example can be viewed without problem.

Note that I do not know about downloaded data files, maybe it would be safer to to the same system (owner "internet") and open the viewer under the "internet" account in case the data tries to exploit a security bug of the viewer - but that is not the initial problem we were talking about.