Is it possible to start new process so that it couldn't spawn new ones (untrusted code)?
Also how do I start a process so it couldn't make any input/output to files and in general any devices?
This article on SELinux will give you some idea of how powerful such systems can be, and the tools you need to develop such policies.
Beware, your wish to restrict access to all files is likely to backfire on you. In Unix "everything is a file," so entirely preventing all file access will prevent your program from even starting. A more productive approach will likely be to restrict file writing, either entirely or to only a specific directory, and to whitelist categories of files the program can legitimately read.
Another option is to use chroot or jails. With these OS features, instead of preventing file I/O or program execution, you would simply build a restricted environment where there is nothing sensitive for your untrusted program to read, write or execute. Your program could only operate on the files you put into the "box" with it.
If your system uses
You are specifically looking for
Disclaimer: I never used that myself. (I mean the