Or even just:

http://danwalsh.livejournal.com/28545.html

...an selinux sandbox without the containers stuff.