1. search code for double underscores (to block magic methods)
2. replace `__builtins__` with a whitelisted version
3. hook `__import__` to only allow a whitelist
4. hook `getattr` to reject any key containing double underscores
If they can't do it....
At any rate it is certainly not as simple as that, and not only is it not as simple as that, it is not even close to being that simple.
In fact, I recall warning people off of this exact project many years ago on comp.lang.python.
This seems up-to-date: https://wiki.python.org/moin/Asking%20for%20Help/How%20can%2... It looks like the only even remotely feasible option is PyPy, and this link doesn't look like much fun: https://pypi.python.org/pypi/RestrictedPython/ It looks to me like you'd still have many, many opportunities to end up with holes in the system.
I really, really don't recommend Python for this.
You might find this interesting: http://blog.delroth.net/2013/03/escaping-a-python-sandbox-nd... (And before you go "Oh, I've got that blocked"... read it, like, really really read it, not just skim for "one thing I can do to block that stuff", but to see just how many things there are in Python for this sort of hackery. Personally I'd guess the "I blocked double-underscores" would not have slowed them down much.)
I find things like this absolutely fascinating.
I came across a project called CodeJail, which seems to help configure Python (or other scripting languages) nicely with AppArmor, to help execute untrusted code in a safe(r) manner: https://github.com/edx/codejail