gistfile1.c

#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <stdio.h>
#include <sched.h>
#include <errno.h>

#define CHILD_STACK_SIZE 1024 * 1024 * 5 // 5 MB
#define CHILD_TIME_LIMIT 5

pid_t child_pid;

void killclock (int signal) {
	if (signal == SIGALRM) {
		if (kill (child_pid, SIGKILL) < 0 && errno != ESRCH) {
			exit (EXIT_FAILURE);
		}
	}
}

int child (void *args) {

	char *exec_path = "/bin/sleep";
	char *exec_args[3] = {exec_path, "10", NULL};

	/*
	* setrlimit
	* suid + chroot
	* cgroups
	* seccomp_filter
	*/

	if (execv (exec_path, exec_args) < 0)
		exit (EXIT_FAILURE);
}

int main(int argc, char **argv, char **envp) {

	int child_status;
	char *child_stack;
	struct rusage child_usage;

	if ((child_stack = malloc (CHILD_STACK_SIZE)) == NULL)
		return 1;

	child_pid = clone (child, child_stack + CHILD_STACK_SIZE, SIGCHLD | CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWNET, NULL);

	if (child_pid == -1)
		return 1;

	if (signal (SIGALRM, killclock) == SIG_ERR || alarm (CHILD_TIME_LIMIT) != 0)
		exit (EXIT_FAILURE);

	while (wait4 (child_pid, &child_status, 0, &child_usage) != -1);

	return 0;
}