How to restrict a Linux program's permissions

Question

I'm running a native linux program from PHP using shell_exec. Specifically, calling antiword to extract text from Microsoft Word files users uploaded. However, as I've got no way of assessing anbiword's code quality, and it is being fed unsanatised user input (the Word file), I would like to restrict it's permissions.

It should for example only be allowed to read files and output text on the standard output, but not to write or delete any files.

Is there any known way to "wrap" or otherwise restrict a program's such as antiword when called from PHP or on the command line?

So far I've found AppArmor which seems to be able to provide this functionality, albeit not simply, and not on the fly from the commandline.

Answer 1

This is what the selinux sandbox was built for. Here is the documentation for sandbox. There's also been work on accomplising the same thing with containers or virtualization in the virt-sandbox project.