Add a sandbox for Python interpreter

Switch to user "nobody" and set additional limits.

1 files changed, 11 insertions, 0 deletions

diff --git a/readme.md b/readme.md
index a15b4f0..789fc95 100644
--- a/readme.md
+++ b/readme.md
@@ -49,6 +49,17 @@ nodejs
 Run "npm install" inside the codeq-server/web directory to install all
 dependencies (they will be installed inside the web directory)
 
+sandbox
+-------
+
+Go to directory codeq-server/python/runner and run the following commands to
+build the sandbox and set appropriate permissions:
+
+    make sandbox
+    mate terminator
+    sudo setcap cap_setuid,cap_setgid+ep sandbox
+    sudo setcap cap_setuid,cap_setgid+ep terminator
+
 Settings
 ========