Comment by PeterWhittaker

Sounds like the school needs to wrap things in a seccomp denylist. Potentially non-trivial, but potentially interesting.