Something like RSBAC/SELinux is a good fit. Not sandboxing in the traditional sense, but pretty bulletproof if setup correctly. The problem is the time it takes

Something like RSBAC/SELinux is a good fit. Not sandboxing in the traditional sense, but pretty bulletproof if setup correctly. The problem is the time it takes to do that.