I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students are trying to do anything "fun" first).
Most of the assignments should only read their input and produce output. Some might read files on the system. Then I only want it to be able to read world readable files on the system.
sandbox assignment.py works fine in some respects, where sandbox is from policycoreutils-python in SElinux sandbox in CentOS 7. Then assignment.py can't write files, access the net, and some other bad things. But it can still read my files.
Actually it can read local files, but not NFS mounted files. With
sandbox -t sandbox_min_t I can access NFS mounted files as well (which I want), but the problem is still that the tested program has access to all my files. How can I tell it to only have access to world readable files, or to files only readable by a named user?
(I'm open to using another sandbox available on CentOS, if it's easier to achieve this in some other sandbox.)
(I'd prefer not having to make a new user account just for testing programs. I would prefer not, partly because this might be needed for several teachers/assistants and I want accounts to be personal, and not the user name space being cluttered with lots of these.)