Prevent child process from system calls

I want to create a child process that call another prog开发者_运维问答ram (with C++ in Unix). But I want to restrict the child process not to call system(), fopen(), etc. (if it did, it would be terminated).

How to do that?

---

this might help you. It seems there is a way of handling different things a child process does via ptrace. HTH

---

Assuming your child process uses the C library to do the syscalls, it's a dynamic executable, and your system uses ELF, you could set LD_PRELOAD to a library that intercepts the functions you are interested in.

Failing that, you could do a Valgrind tool.

---

Tricky. If this is Linux or BSD, you might experiment with setrlimit(RLIMIT_NPROC, &lim). This won't terminate the child if it tries to create a process, but it will cause the system call to fork to fail. No clue if there's any more portable answer.