I am seemkng for a sandbox for Linux secure enough to run malware in it securely. It should allow
create different sandboxes
run different programs in them, including the ones requiring admin privileges (in this case sandbox must give them simulated admin, indistinguishable from real admin if low level access to OS internals and hardware is not needed).
restrict their access to different APIs, for example restrict internet access to non-whitelisted processes, driver installation, access to different folders, launching processes except the ones from whitelist, low level media access, etc ... The restrictions must be configurable.
each sandbox should have its own folder/fs where modified files are stored, copy-on-write should be used to allow the sandboxed processes to write
sandboxed processes within the same sandbox should be able interact with each other, but shouldn't with the rest of the processes (unless allowed).
all the changes made in the main system should be available in sandbox
You should be able transfer files from sandbox to the main OS easily
You should be able to run apps utilizing GPU in it.
The example of such a sandbox for Windows is SandboxIE. Sometimes I had to run malware in the sandbox, the malware hasn't infiltrated the main system. There is even a malware analisys solution (bsa.isoftware.nl) based on SandboxIE.
Is there any solution for Linux which gives comparable security without virtualizing the whole OS in KVM/Xen? Is it possible to achieve this effect combining SELinux with LXC and some copy-on-write file system? Is there a solution which does this?