How do sites like codepad.org and ideone.com sandbox your program?
codepad.org has something based on geordi, which runs everything in a chroot (i.e restricted to a subtree of the filesystem) with resource restrictions, and uses the ptrace API to restrict the untrusted program’s use of system calls. See http://codepad.org/about . I’ve previously used Systrace, another utility for restricting system calls. If the policy is set … Read more