Totally agree with the answer from @user1401452. Some more tips about libsandbox,
- The binary executable to be sandboxed is better linked statically, because loading shared libraries involves system calls, like SYS_open(), that are forbidden by default.
- To write a C/C++ program directly invoking the core sandbox library (i.e. libsandbox) is also viable -- though a bit more complex than using the Pythonic wrapper (i.e. pysandbox). An ANSI C equivalent (i.e. sample2.c) of the sample python script is now available at libsandbox's homepage.
- The sample programs only demonstrate some essentials of libsandbox. Practical sandboxing solutions typically requires customized sandbox policies with more complex rules.
DISCLAIMER: I am the author of libsandbox