title: Put a process in a sandbox where it can do least harm
body: <p>I'm looking for the concept to <strong>spawn a process</strong> such that:</p>
  
  <ul>
  <li>it has only access to certain libraries/APIs</li>
  <li>it cannot acess the file system or only specific parts</li>
  <li>it can <strong>do least harm should malicious code run in it</strong></li>
  </ul>
  
  <p>This concept is known as sandbox or jail.</p>
  
  <p>It is required to do this <strong>for each major Operating system (Windows, MacOSX and Linux)</strong> and the question is conceptual (as in what to do, <strong>which APIs to use and and what to observe</strong>) rather then language specific.</p>
  
  <h2>answer requirements</h2>
  
  <p>I <strong>really</strong> want to accept an answer and give you 20 points for that. I cannot accept my own answer, and I don't have it yet anyway. So if you <strong>really</strong> want your answer to be accepted, please observe:</p>
  
  <ul>
  <li>The answer has to be specific and complete</li>
  <li>With specific I mean that it is more then a pointer to some resource on the internet. It has to summarize what the resource says about the topic at least.</li>
  <li>It may or may not contain example code, but if it does please write it in C</li>
  <li>I cannot accept an answer that is 2/3 complete even if the 2/3 that are there are perfect.</li>
  </ul>
  
  <h2>this question FAQ</h2>
  
  <ul>
  <li>Is this homework? No.</li>
  <li>Why do you ask this like a homework question? If you ask a specific question and you want to get a specific answer, and you know how that answer should look like, even though you don't know <em>the</em> answer, that's the style of question you get.</li>
  <li>If you know how it should look like, why do you ask? 1) because I don't know all the answer 2) because on the internet there's no single place that contains all the details to this question in one place. Please also read the stackoverflow FAQ</li>
  <li>Why is the main part of your question how to answer this question? Because nobody reads the FAQ.</li>
  </ul>