We have a Node application as the front end to a C++ sandboxing tool, which compiles code using gcc and outputs the result to the browser.

e.g.

  exec("gcc -o /tmp/test /tmp/test.cpp", 
    function (error, stdout, stderr) {
      if(!stderr) {
        execFile('/tmp/test', function(error, stdout, stderr) {});
}
});

This works fine.

However, as you can imagine this is a security nightmare if it were to be made public - so I was thinking of two options to protect my stack:

1) A CHROOT jail - but this in itself wouldn't be enough to prevent directory traversal / file access.

2) AppArmor ?

So my question is really, how could I protect my stack from any nasties that could come from:

A) Compiling unknown code using gcc

B) Executing the compiled code