How to restrict process abilities?

Question

I'm writing a kind of a generic contester system for ACM solutions (like TopCoder, Timus and others). When user sends his solution using web-service, i need to run/compile it. And i want to set restrictions to it in order to run them safe (no access to outer files, no ability to get system time, cannot change working directory etc) There're two kinds of user solutions:

• solutions, that can be compiled (aka c/c++/pascal), also jit-ed and bytecode solution (c#, java)

• interpreted solutions (lisp/ruby/python/php)

Contester system is written in C# for .NET 3.5. Contester can run in Linux on Mono and in Windows on .NET.

What's the best way to do it? If there's ability to restrict compiled solutions (using PermissionAttributes), but i have no idea how to restrict interpreted solutions.

Answer 1

Easiest (seeing you probably need full trust) is to run under a very limited user account. IIRC the guest account cannot be used for this.

Edit:

A clean VM might ideal.