Well, you can use some general security system to ensure safe code execution like AppArmor or SELinux.
It works not only for java, python, etc. applications, but also for bash-scripts, binary executables and so on.
Haven't worked at all with SELinux, but this is a simple example of AppArmor security profile which does everything you mentioned except "running more than X seconds" - this can be done by
timeout mechanism (I'm a new user, so cannon post a second link here O_o..)
#include <tunables/global>
/path/to/executable {
#include <abstractions/base>
# http://linux.die.net/man/2/setrlimit
# limit memory (address space)
set rlimit as <= 150M,
# limit core dump file http://linux.die.net/man/5/core
set rlimit core <= 2M,
# allow to create files only this size at max
set rlimit fsize <= 1M,
# limits number of threads (fork bomb won't go! :))
set rlimit nproc <= 10,
# program will have access to stuff defined in abstractions/base and
# to the file defined below. Nothing else.
/path/to/file.txt rw,
}
What about putting each script in a sandbox - you can create several identical profiles for script1, script2 etc. This is also the way if you want different permissions for different excercises people will solve on your site.
And this is an example of using timeout:
$sudo apt-get install timeout
$timeout 3 ./binary #limits execution of ./binary to 3 seconds
I also want to recommend you limit compilation time for compiled proramming languages if you have any.
For example, in C++ someone can write a tricky template or
#include </dev/urandom>
That will cause cpu-intensive work at compile-time.
