Question: I'm not entirely sure if this is the right site for this, but I'll give it a shot.

Basically, I'm looking into different ways of setting up a single sign-on service for an existing corporate environment. Within this environment, there's anything from old legacy systems to new web services, all running on different platforms.

I'm not really looking for specific solutions, as much as high-level approaches/strategies. I found a [great writeup here](http://www.tml.tkk.fi/Opinnot/Tik-110.501/1997/single_sign-on.html#modcommon), but it's from 1997, so it's not exactly up-to-date. If you know of a similar, but newer, paper, please post a link to it. If not, I would be eternally grateful if you were able to contribute with information on more modern models that haven't yet been brought up. If you have implemented such a system in a similar environment, I would be very interested to hear how you went about it, and why you chose that specific strategy.

If this question would fit better on another site, please leave a comment and I'll post it there instead.

Thanks!

Answer: 
What you are describing sounds a lot like Google's [NaCl](https://developers.google.com/native-client/). Google designed this as a safe way to run native x86 code in the web browser, but they have a sample that runs standalone with no browser. They include a GCC compiler that outputs NaCl-x86 rather than standard x86.
Have you thought of using chroot?
<https://help.ubuntu.com/community/BasicChroot>

It's more freebsd'y but it will work. Seccomp takes care of syscalls, just removing the system libraries won't actually work since people can just add their syscalls. But chroot is another level of making sure they don't break out and another level of safety. You can dynamically create a chroot'd jail then compile fairly easily and have each process run inside of it without worry of two peoples interacting,