Using ptrace to write a program supervisor in userspace.

Question

I'll looking for advice/resources to write a program that can intercept system calls from a programm to supervise it's filesystem, network, etc access.

The aim of this is to write an online judge, so that untrusted code can be run safely on a server.

This is on linux, and I would prefer to write C++ or a scripting langauge (ruby, python, etc), and a library would be great!

Thanks.

Answer 1

This looks like a good place to start. http://www.linuxjournal.com/article/6100

Answer 2

You can't safely use ptrace() to sandbox a hostile application.

The application can always use multiple threads with deliberate race conditions to alter syscall arguments passed via pointers (eg. a filename) after you've inspected them but before the kernel looks at them.