Any program executing under Linux/x86(-64)

This program is written in C, but it can disrupt execution of any program running under Linux/x86 (-32 or -64). You prepend it to the command-line invocation of the program you want to disrupt.

It uses the debugger API to prevent the target program from producing any output. Specifically, all of the system calls that can communicate something to the world outside the process (most obviously write, of course, but also open when creating a file, the bulk of the socket API, kill when applied to another process, ...) will fail as if they were unimplemented. _exit is allowed, but the exit code is overwritten with a zero.

Unlike the previous edition of this answer, many programs can run nearly to completion under these conditions; it's just that all their work is wasted. For instance, if you do ./no-syscalls /bin/ls (assuming GNU coreutils ls) it reads the whole directory and formats it, and then all the write calls to produce output fail. (Anything that needs to open a bidirectional communication channel, though, such as all X11 clients, will fail at that point. I thought about allowing socket but not send, but it seemed too likely to open loopholes.)

There are several command-line options to tweak the behavior;

-a  log allowed system calls
-d  log denied system calls
-e  deny everything, not just output
-S  permit writes to stderr

Dynamically linked programs will not even get out of the dynamic linker in -e mode. -S obviously opens a huge hole in the policy, but it can be entertaining to watch programs moan about nothing working, e.g.

$ ./no-syscalls -daeS /bin/ls
syscall 59...
syscall 59 = 0
syscall 12 (denied) = -38
syscall 21 (denied) = -38
syscall 9 (denied) = -38
syscall 20...
/bin/ls: error while loading shared libraries: cannot create cache for search path: Cannot allocate memory
syscall 20 = 107
syscall 231...
Program exited, status = 0

You have to read log output with /usr/include/asm*/unistd.h open in another window, because this is already quite long enough.

Sadly, the debugger interfaces that this uses are only weakly consistent across Unix implementations, and are intrinsically CPU-specific. It would be relatively straightforward to port it to other CPU architectures (just add appropriate definitions of SYSCALL_*_REG), and it's probably possible to port it to any Unix that has ptrace, but you might need to muck with the syscall whitelist extensively as well as dealing with divergences in ptrace.

#define _GNU_SOURCE 1
#include <stddef.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#if defined __linux__
# define SYS_unimplemented -1L
# if defined __i386__
#  define SYSCALL_NUMBER_REG regs.orig_eax
#  define SYSCALL_ARG1_REG   regs.ebx
#  define SYSCALL_ARG2_REG   regs.ecx
#  define SYSCALL_ARG3_REG   regs.edx
#  define SYSCALL_ARG4_REG   regs.esi
#  define SYSCALL_RESULT_REG regs.eax
# elif defined __x86_64__
#  define SYSCALL_NUMBER_REG regs.orig_rax
#  define SYSCALL_ARG1_REG   regs.rdi
#  define SYSCALL_ARG2_REG   regs.rsi
#  define SYSCALL_ARG3_REG   regs.rdx
#  define SYSCALL_ARG4_REG   regs.r10
#  define SYSCALL_RESULT_REG regs.rax
# else
#  error "Need to know system call convention for this CPU"
# endif
#else
# error "Need to know system call convention for this OS"
#endif

static long
xptrace(int request, pid_t pid, void *addr, void *data)
{
  errno = 0;
  long rv = ptrace(request, pid, addr, data);
  if (rv == -1 && errno) {
    perror("ptrace");
    if (pid != 0) kill(pid, SIGKILL);
    exit(1);
  }
  return rv;
}
#define GET_REG_(pid, x) \
  xptrace(PTRACE_PEEKUSER, pid, (void*)offsetof(struct user, x), 0)
#define GET_REG(pid, x) GET_REG_(pid, SYSCALL_##x##_REG)
#define SET_REG_(pid, x, v) \
  xptrace(PTRACE_POKEUSER, pid, (void*)offsetof(struct user, x), (void*)v)
#define SET_REG(pid, x, v) SET_REG_(pid, SYSCALL_##x##_REG, v)

/* This function defines the system-call policy.  */
static int
deny_syscall(pid_t pid, int scnum, int deny_all, int allow_stderr)
{
  switch (scnum) {
  /* These syscalls are unconditionally allowed (when not in -e mode);
     they perform input, or change only process-local state. */
#ifdef SYS_access
  case SYS_access:
#endif
#ifdef SYS_alarm
  case SYS_alarm:
#endif
#ifdef SYS_arch_prctl
  case SYS_arch_prctl:
#endif
#ifdef SYS_brk
  case SYS_brk:
#endif
#ifdef SYS_capget
  case SYS_capget:
#endif
#ifdef SYS_clock_getres
  case SYS_clock_getres:
#endif
#ifdef SYS_clock_gettime
  case SYS_clock_gettime:
#endif
#ifdef SYS_clock_nanosleep
  case SYS_clock_nanosleep:
#endif
#ifdef SYS_close
  case SYS_close:
#endif
#ifdef SYS_dup
  case SYS_dup:
#endif
#ifdef SYS_dup2
  case SYS_dup2:
#endif
#ifdef SYS_dup3
  case SYS_dup3:
#endif
#ifdef SYS_epoll_create
  case SYS_epoll_create:
#endif
#ifdef SYS_epoll_create1
  case SYS_epoll_create1:
#endif
#ifdef SYS_epoll_ctl
  case SYS_epoll_ctl:
#endif
#ifdef SYS_epoll_ctl_old
  case SYS_epoll_ctl_old:
#endif
#ifdef SYS_epoll_pwait
  case SYS_epoll_pwait:
#endif
#ifdef SYS_epoll_wait
  case SYS_epoll_wait:
#endif
#ifdef SYS_epoll_wait_old
  case SYS_epoll_wait_old:
#endif
#ifdef SYS_eventfd
  case SYS_eventfd:
#endif
#ifdef SYS_eventfd2
  case SYS_eventfd2:
#endif
#ifdef SYS_faccessat
  case SYS_faccessat:
#endif
#ifdef SYS_fadvise64
  case SYS_fadvise64:
#endif
#ifdef SYS_fadvise64_64
  case SYS_fadvise64_64:
#endif
#ifdef SYS_fanotify_init
  case SYS_fanotify_init:
#endif
#ifdef SYS_fanotify_mark
  case SYS_fanotify_mark:
#endif
#ifdef SYS_fgetxattr
  case SYS_fgetxattr:
#endif
#ifdef SYS_flistxattr
  case SYS_flistxattr:
#endif
#ifdef SYS_fstat
  case SYS_fstat:
#endif
#ifdef SYS_fstat64
  case SYS_fstat64:
#endif
#ifdef SYS_fstatat64
  case SYS_fstatat64:
#endif
#ifdef SYS_fstatfs
  case SYS_fstatfs:
#endif
#ifdef SYS_fstatfs64
  case SYS_fstatfs64:
#endif
#ifdef SYS_ftime
  case SYS_ftime:
#endif
#ifdef SYS_futex
  case SYS_futex:
#endif
#ifdef SYS_getcpu
  case SYS_getcpu:
#endif
#ifdef SYS_getcwd
  case SYS_getcwd:
#endif
#ifdef SYS_getdents
  case SYS_getdents:
#endif
#ifdef SYS_getdents64
  case SYS_getdents64:
#endif
#ifdef SYS_getegid
  case SYS_getegid:
#endif
#ifdef SYS_getegid32
  case SYS_getegid32:
#endif
#ifdef SYS_geteuid
  case SYS_geteuid:
#endif
#ifdef SYS_geteuid32
  case SYS_geteuid32:
#endif
#ifdef SYS_getgid
  case SYS_getgid:
#endif
#ifdef SYS_getgid32
  case SYS_getgid32:
#endif
#ifdef SYS_getgroups
  case SYS_getgroups:
#endif
#ifdef SYS_getgroups32
  case SYS_getgroups32:
#endif
#ifdef SYS_getitimer
  case SYS_getitimer:
#endif
#ifdef SYS_get_kernel_syms
  case SYS_get_kernel_syms:
#endif
#ifdef SYS_get_mempolicy
  case SYS_get_mempolicy:
#endif
#ifdef SYS_getpeername
  case SYS_getpeername:
#endif
#ifdef SYS_getpgid
  case SYS_getpgid:
#endif
#ifdef SYS_getpgrp
  case SYS_getpgrp:
#endif
#ifdef SYS_getpid
  case SYS_getpid:
#endif
#ifdef SYS_getpmsg
  case SYS_getpmsg:
#endif
#ifdef SYS_getppid
  case SYS_getppid:
#endif
#ifdef SYS_getpriority
  case SYS_getpriority:
#endif
#ifdef SYS_getrandom
  case SYS_getrandom:
#endif
#ifdef SYS_getresgid
  case SYS_getresgid:
#endif
#ifdef SYS_getresgid32
  case SYS_getresgid32:
#endif
#ifdef SYS_getresuid
  case SYS_getresuid:
#endif
#ifdef SYS_getresuid32
  case SYS_getresuid32:
#endif
#ifdef SYS_getrlimit
  case SYS_getrlimit:
#endif
#ifdef SYS_get_robust_list
  case SYS_get_robust_list:
#endif
#ifdef SYS_getrusage
  case SYS_getrusage:
#endif
#ifdef SYS_getsid
  case SYS_getsid:
#endif
#ifdef SYS_getsockname
  case SYS_getsockname:
#endif
#ifdef SYS_getsockopt
  case SYS_getsockopt:
#endif
#ifdef SYS_get_thread_area
  case SYS_get_thread_area:
#endif
#ifdef SYS_gettid
  case SYS_gettid:
#endif
#ifdef SYS_gettimeofday
  case SYS_gettimeofday:
#endif
#ifdef SYS_getuid
  case SYS_getuid:
#endif
#ifdef SYS_getuid32
  case SYS_getuid32:
#endif
#ifdef SYS_getxattr
  case SYS_getxattr:
#endif
#ifdef SYS_inotify_add_watch
  case SYS_inotify_add_watch:
#endif
#ifdef SYS_inotify_init
  case SYS_inotify_init:
#endif
#ifdef SYS_inotify_init1
  case SYS_inotify_init1:
#endif
#ifdef SYS_inotify_rm_watch
  case SYS_inotify_rm_watch:
#endif
#ifdef SYS_ioprio_get
  case SYS_ioprio_get:
#endif
#ifdef SYS_kcmp
  case SYS_kcmp:
#endif
#ifdef SYS_lgetxattr
  case SYS_lgetxattr:
#endif
#ifdef SYS_listxattr
  case SYS_listxattr:
#endif
#ifdef SYS_llistxattr
  case SYS_llistxattr:
#endif
#ifdef SYS_lookup_dcookie
  case SYS_lookup_dcookie:
#endif
#ifdef SYS_lseek
  case SYS_lseek:
#endif
#ifdef SYS_lstat
  case SYS_lstat:
#endif
#ifdef SYS_lstat64
  case SYS_lstat64:
#endif
#ifdef SYS_madvise
  case SYS_madvise:
#endif
#ifdef SYS_mbind
  case SYS_mbind:
#endif
#ifdef SYS_mincore
  case SYS_mincore:
#endif
#ifdef SYS_mlock
  case SYS_mlock:
#endif
#ifdef SYS_mlockall
  case SYS_mlockall:
#endif
#ifdef SYS_mprotect
  case SYS_mprotect:
#endif
#ifdef SYS_mremap
  case SYS_mremap:
#endif
#ifdef SYS_munlock
  case SYS_munlock:
#endif
#ifdef SYS_munlockall
  case SYS_munlockall:
#endif
#ifdef SYS_munmap
  case SYS_munmap:
#endif
#ifdef SYS_name_to_handle_at
  case SYS_name_to_handle_at:
#endif
#ifdef SYS_nanosleep
  case SYS_nanosleep:
#endif
#ifdef SYS_newfstatat
  case SYS_newfstatat:
#endif
#ifdef SYS_nice
  case SYS_nice:
#endif
#ifdef SYS_oldfstat
  case SYS_oldfstat:
#endif
#ifdef SYS_oldlstat
  case SYS_oldlstat:
#endif
#ifdef SYS_oldolduname
  case SYS_oldolduname:
#endif
#ifdef SYS_oldstat
  case SYS_oldstat:
#endif
#ifdef SYS_olduname
  case SYS_olduname:
#endif
#ifdef SYS_pause
  case SYS_pause:
#endif
#ifdef SYS_perf_event_open
  case SYS_perf_event_open:
#endif
#ifdef SYS_personality
  case SYS_personality:
#endif
#ifdef SYS_pivot_root
  case SYS_pivot_root:
#endif
#ifdef SYS_poll
  case SYS_poll:
#endif
#ifdef SYS_ppoll
  case SYS_ppoll:
#endif
#ifdef SYS_prctl
  case SYS_prctl:
#endif
#ifdef SYS_pread64
  case SYS_pread64:
#endif
#ifdef SYS_preadv
  case SYS_preadv:
#endif
#ifdef SYS_prlimit64
  case SYS_prlimit64:
#endif
#ifdef SYS_pselect6
  case SYS_pselect6:
#endif
#ifdef SYS_query_module
  case SYS_query_module:
#endif
#ifdef SYS_read
  case SYS_read:
#endif
#ifdef SYS_readahead
  case SYS_readahead:
#endif
#ifdef SYS_readdir
  case SYS_readdir:
#endif
#ifdef SYS_readlink
  case SYS_readlink:
#endif
#ifdef SYS_readlinkat
  case SYS_readlinkat:
#endif
#ifdef SYS_readv
  case SYS_readv:
#endif
#ifdef SYS_recvfrom
  case SYS_recvfrom:
#endif
#ifdef SYS_recvmmsg
  case SYS_recvmmsg:
#endif
#ifdef SYS_recvmsg
  case SYS_recvmsg:
#endif
#ifdef SYS_remap_file_pages
  case SYS_remap_file_pages:
#endif
#ifdef SYS_request_key
  case SYS_request_key:
#endif
#ifdef SYS_restart_syscall
  case SYS_restart_syscall:
#endif
#ifdef SYS_rt_sigaction
  case SYS_rt_sigaction:
#endif
#ifdef SYS_rt_sigpending
  case SYS_rt_sigpending:
#endif
#ifdef SYS_rt_sigprocmask
  case SYS_rt_sigprocmask:
#endif
#ifdef SYS_rt_sigreturn
  case SYS_rt_sigreturn:
#endif
#ifdef SYS_rt_sigsuspend
  case SYS_rt_sigsuspend:
#endif
#ifdef SYS_rt_sigtimedwait
  case SYS_rt_sigtimedwait:
#endif
#ifdef SYS_sched_getaffinity
  case SYS_sched_getaffinity:
#endif
#ifdef SYS_sched_getattr
  case SYS_sched_getattr:
#endif
#ifdef SYS_sched_getparam
  case SYS_sched_getparam:
#endif
#ifdef SYS_sched_get_priority_max
  case SYS_sched_get_priority_max:
#endif
#ifdef SYS_sched_get_priority_min
  case SYS_sched_get_priority_min:
#endif
#ifdef SYS_sched_getscheduler
  case SYS_sched_getscheduler:
#endif
#ifdef SYS_sched_rr_get_interval
  case SYS_sched_rr_get_interval:
#endif
#ifdef SYS_sched_setaffinity
  case SYS_sched_setaffinity:
#endif
#ifdef SYS_sched_setattr
  case SYS_sched_setattr:
#endif
#ifdef SYS_sched_setparam
  case SYS_sched_setparam:
#endif
#ifdef SYS_sched_setscheduler
  case SYS_sched_setscheduler:
#endif
#ifdef SYS_sched_yield
  case SYS_sched_yield:
#endif
#ifdef SYS_select
  case SYS_select:
#endif
#ifdef SYS_setfsgid
  case SYS_setfsgid:
#endif
#ifdef SYS_setfsgid32
  case SYS_setfsgid32:
#endif
#ifdef SYS_setfsuid
  case SYS_setfsuid:
#endif
#ifdef SYS_setfsuid32
  case SYS_setfsuid32:
#endif
#ifdef SYS_setgid
  case SYS_setgid:
#endif
#ifdef SYS_setgid32
  case SYS_setgid32:
#endif
#ifdef SYS_setgroups
  case SYS_setgroups:
#endif
#ifdef SYS_setgroups32
  case SYS_setgroups32:
#endif
#ifdef SYS_setitimer
  case SYS_setitimer:
#endif
#ifdef SYS_setns
  case SYS_setns:
#endif
#ifdef SYS_setpgid
  case SYS_setpgid:
#endif
#ifdef SYS_setpriority
  case SYS_setpriority:
#endif
#ifdef SYS_setregid
  case SYS_setregid:
#endif
#ifdef SYS_setregid32
  case SYS_setregid32:
#endif
#ifdef SYS_setresgid
  case SYS_setresgid:
#endif
#ifdef SYS_setresgid32
  case SYS_setresgid32:
#endif
#ifdef SYS_setresuid
  case SYS_setresuid:
#endif
#ifdef SYS_setresuid32
  case SYS_setresuid32:
#endif
#ifdef SYS_setreuid
  case SYS_setreuid:
#endif
#ifdef SYS_setreuid32
  case SYS_setreuid32:
#endif
#ifdef SYS_setrlimit
  case SYS_setrlimit:
#endif
#ifdef SYS_set_robust_list
  case SYS_set_robust_list:
#endif
#ifdef SYS_setsid
  case SYS_setsid:
#endif
#ifdef SYS_set_thread_area
  case SYS_set_thread_area:
#endif
#ifdef SYS_set_tid_address
  case SYS_set_tid_address:
#endif
#ifdef SYS_setuid
  case SYS_setuid:
#endif
#ifdef SYS_setuid32
  case SYS_setuid32:
#endif
#ifdef SYS_sigaction
  case SYS_sigaction:
#endif
#ifdef SYS_sigaltstack
  case SYS_sigaltstack:
#endif
#ifdef SYS_signal
  case SYS_signal:
#endif
#ifdef SYS_signalfd
  case SYS_signalfd:
#endif
#ifdef SYS_signalfd4
  case SYS_signalfd4:
#endif
#ifdef SYS_sigpending
  case SYS_sigpending:
#endif
#ifdef SYS_sigprocmask
  case SYS_sigprocmask:
#endif
#ifdef SYS_sigreturn
  case SYS_sigreturn:
#endif
#ifdef SYS_sigsuspend
  case SYS_sigsuspend:
#endif
#ifdef SYS_socketpair
  case SYS_socketpair:
#endif
#ifdef SYS_stat
  case SYS_stat:
#endif
#ifdef SYS_stat64
  case SYS_stat64:
#endif
#ifdef SYS_statfs
  case SYS_statfs:
#endif
#ifdef SYS_statfs64
  case SYS_statfs64:
#endif
#ifdef SYS_sysfs
  case SYS_sysfs:
#endif
#ifdef SYS_sysinfo
  case SYS_sysinfo:
#endif
#ifdef SYS_time
  case SYS_time:
#endif
#ifdef SYS_timer_create
  case SYS_timer_create:
#endif
#ifdef SYS_timer_delete
  case SYS_timer_delete:
#endif
#ifdef SYS_timerfd_create
  case SYS_timerfd_create:
#endif
#ifdef SYS_timerfd_gettime
  case SYS_timerfd_gettime:
#endif
#ifdef SYS_timerfd_settime
  case SYS_timerfd_settime:
#endif
#ifdef SYS_timer_getoverrun
  case SYS_timer_getoverrun:
#endif
#ifdef SYS_timer_gettime
  case SYS_timer_gettime:
#endif
#ifdef SYS_timer_settime
  case SYS_timer_settime:
#endif
#ifdef SYS_times
  case SYS_times:
#endif
#ifdef SYS_ugetrlimit
  case SYS_ugetrlimit:
#endif
#ifdef SYS_ulimit
  case SYS_ulimit:
#endif
#ifdef SYS_umask
  case SYS_umask:
#endif
#ifdef SYS_uname
  case SYS_uname:
#endif
#ifdef SYS_unshare
  case SYS_unshare:
#endif
#ifdef SYS_uselib
  case SYS_uselib:
#endif
#ifdef SYS_ustat
  case SYS_ustat:
#endif
#ifdef SYS_wait4
  case SYS_wait4:
#endif
#ifdef SYS_waitid
  case SYS_waitid:
#endif
#ifdef SYS_waitpid
  case SYS_waitpid:
#endif
    return deny_all;

#ifdef SYS_exit
  case SYS_exit:
#endif
#ifdef SYS_exit_group
  case SYS_exit_group:
#endif
    /* Special case: exiting is allowed, even in -e mode,
       but the exit status is forced to 0. */
    SET_REG(pid, ARG1, 0);
    return 0;

#ifdef SYS_fcntl
  case SYS_fcntl:
#endif
#ifdef SYS_fcntl64
  case SYS_fcntl64:
#endif
    /* Special case: fcntl is allowed, but only for the *FD and *FL
       operations.  This is a compromise between not allowing it at
       all, which would break some interpreters, and trying to go
       through the dozens of extended ops and figure out which ones
       can affect global state.  */
    {
      int cmd = GET_REG(pid, ARG2);
      if (cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC ||
          cmd == F_GETFD || cmd == F_SETFD || cmd == F_SETFL || cmd == F_GETFL)
        return deny_all;
    }
    return 1;

#ifdef SYS_kill
  case SYS_kill:
#endif
#ifdef SYS_rt_sigqueueinfo
  case SYS_rt_sigqueueinfo:
#endif
#ifdef SYS_rt_tgsigqueueinfo
  case SYS_rt_tgsigqueueinfo:
#endif
#ifdef SYS_tkill
  case SYS_tkill:
#endif
#ifdef SYS_tgkill
  case SYS_tgkill:
#endif
    /* Special case: kill is allowed if and only if directed to the calling
       process. */
    {
      pid_t kpid = GET_REG(pid, ARG1);
      if (kpid == pid)
        return deny_all;
    }
    return 1;

#ifdef SYS_mmap
  case SYS_mmap:
#endif
#ifdef SYS_mmap2
  case SYS_mmap2:
#endif
    /* Special case: mmap is allowed if it is private or read-only.  */
    {
      int prot  = GET_REG(pid, ARG3);
      int flags = GET_REG(pid, ARG4);
      if ((flags & (MAP_SHARED|MAP_PRIVATE)) == MAP_PRIVATE)
        return deny_all;
      if (!(prot & PROT_WRITE))
        return deny_all;
    }
    return 1;

    /* Special case: open() variants are allowed only if read-only and
       not creating. */
#ifdef SYS_open
  case SYS_open:
#endif
#ifdef SYS_openat
  case SYS_openat:
#endif
#ifdef SYS_open_by_handle_at
  case SYS_open_by_handle_at:
#endif
    {
      int flags = ((scnum == SYS_open)
                   ? GET_REG(pid, ARG2)
                   : GET_REG(pid, ARG3));
      if (!(flags & O_CREAT) && ((flags & O_ACCMODE) == O_RDONLY))
        return deny_all;
    }
    return 1;

#ifdef SYS_write
  case SYS_write:
#endif
#ifdef SYS_write64
  case SYS_write64:
#endif
#ifdef SYS_writev
  case SYS_writev:
#endif
#ifdef SYS_pwrite
  case SYS_pwrite:
#endif
#ifdef SYS_pwrite64
  case SYS_pwrite64:
#endif
#ifdef SYS_pwritev
  case SYS_pwritev:
#endif
    /* Special case: optionally, the program is allowed to write to
       stderr.  This opens a gaping hole in the policy, but it can be
       quite entertaining to watch programs moan about how nothing works. */
    if (allow_stderr) {
      int fd = GET_REG(pid, ARG1);
      if (fd == 2)
        return 0;
    }
    return 1;

  default:
    /* All other system calls are unconditionally denied. */
    return 1;
  }
}

static void
usage(char *progname)
{
  fprintf(stderr, "usage: %s [-adeS] program args...\n", progname);
  fputs("\t-a  log allowed system calls\n"
        "\t-d  log denied system calls\n"
        "\t-e  deny everything, not just output\n"
        "\t-S  permit writes to stderr\n", stderr);
  exit(2);
}

int
main(int argc, char **argv)
{
  pid_t pid;
  int   status;
  int   opt;
  long  last_syscall = SYS_unimplemented;
  int   last_allowed = 0;
  int   after_execve = 0;
  int   trace_active = 0;
  int   allow_stderr = 0;
  int   deny_all     = 0;
  int   log_allowed  = 0;
  int   log_denied   = 0;

  while ((opt = getopt(argc, argv, "+adeS")) != -1) {
    switch (opt) {
    case 'a': log_allowed  = 1; break;
    case 'd': log_denied   = 1; break;
    case 'e': deny_all     = 1; break;
    case 'S': allow_stderr = 1; break;
    default:
      usage(argv[0]);
    }
  }
  if (optind == argc) {
    usage(argv[0]);
  }

  setvbuf(stdout, 0, _IOLBF, 0);
  setvbuf(stderr, 0, _IOLBF, 0);

  pid = fork();
  if (pid == -1) {
    perror("fork");
    exit(1);

  } else if (pid == 0) {
    raise(SIGSTOP); /* synch with parent */
    execvp(argv[optind], argv+optind);
    perror("execvp");
    exit(1);
  }

  /* If we get here, we are the parent. */
  for (;;) {
    pid_t rv = waitpid(pid, &status, WUNTRACED);
    if (rv != pid) {
      perror("waitpid");
      kill(pid, SIGKILL);
      exit(1);
    }
    if (!WIFSTOPPED(status)) {
      if (WIFEXITED(status))
        printf("Program exited, status = %d\n", WEXITSTATUS(status));
      else if (WIFSIGNALED(status))
        printf("Program killed by signal %d\n", WTERMSIG(status));
      else {
        printf("Un-decodable status %04x\n", status);
        kill(pid, SIGKILL); /* just in case */
      }
      exit(0);
    }
    if (WSTOPSIG(status) == SIGSTOP && !trace_active) {
      /* This is the raise(SIGSTOP) on the child side of the fork. */
      trace_active = 1;
      xptrace(PTRACE_SEIZE, pid, 0, (void*)PTRACE_O_TRACESYSGOOD);
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    }
    else if (WSTOPSIG(status) == (SIGTRAP|0x80)) {
      if (last_syscall == SYS_unimplemented) {
        last_syscall = GET_REG(pid, NUMBER);
        /* The child process is allowed to execute normally until an
           execve() succeeds.  */
        if (after_execve && deny_syscall(pid, last_syscall,
                                         deny_all, allow_stderr)) {
          last_allowed = 0;
          SET_REG(pid, NUMBER, SYS_unimplemented);
        } else {
          last_allowed = 1;
          if (log_allowed) {
            /* Log this now, we may not get another chance. */
            printf("syscall %ld...\n", last_syscall);
          }
        }
      } else {
        if (last_allowed ? log_allowed : log_denied) {
          long scret = GET_REG(pid, RESULT);
          printf("syscall %ld%s = %ld\n",
                 last_syscall, last_allowed ? "" : " (denied)", scret);
        }
        if (last_allowed && (last_syscall == SYS_execve ||
                             last_syscall == SYS_execveat)) {
          long scret = GET_REG(pid, RESULT);
          if (scret == 0)
            after_execve = 1;
        }
        last_syscall = SYS_unimplemented;
      }
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    }
    else if (WSTOPSIG(status) == SIGTRAP) {
      /* Swallow all SIGTRAPs, they are probably spurious debug events. */
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    } else {
      /* Allow all normal signals to proceed unmolested. */
      if (log_allowed) {
        printf("process received signal %d\n", WSTOPSIG(status));
      }
      xptrace(PTRACE_SYSCALL, pid, 0, (void*)(uintptr_t)WSTOPSIG(status));
    }
  }
}

C

#include <stdio.h>
#define while(...) while(0)
#define for(...) while(0)
#define if(...) if(0)
#define goto if(0) goto
int main() {
    *(volatile int*) stdin = *(volatile int*) stderr = *(volatile int*) stdout = ~0;
    // insert code here
}

Uses macros to make every control flow construct useless, and disables IO so nothing can be printed/inputted.

tinylisp, 20 bytes

((q((c q load) [your code here] ))0()0

Try it online!

This executes the given code in an environment where the builtins c, q and load are redefined to 0 and/or null. q allows creating a literal list/string and c allows prepending an item to a list, so without these it's impossible to construct lists. load is also blocked to disallow loading the stdlib via (load library), which has a few things that could evade this.

Without these, although it's possible to define arbitrary global variables and perform arithmetic, (assuming the given code is syntactically valid and doesn't used unmatched parentheses to escape) it's impossible to have any form of iteration or recursion due to not being able to define functions or lists. It is possible to use d to get a name and then chars to construct a list of numbers, but this is still useless.

One other thing I thought of is that, since tinylisp function arguments are only accessible directly within their caller scope and nothing deeper, you could escape into a new function which has those variables unshadowed... but to do that you'd have to declare a function.

BrainChild

macro (/[^0]+/) {0}; discard _;

Defines a macro that helpfully replaces all lengths of code that aren't 0s with the number constant 0. The final discard is needed as if the macro is followed by an assembly block, it actually evaluates it.

Try It Online!

Python 3.11

import sys
sys.stdout.close()
sys.stderr.close()
def hook(a,b):
   raise RuntimeError()
sys.addaudithook(hook)
for key in list(sys.modules):
    del sys.modules[key]
del sys
del hook

Should prevent any kind of IO. Even suppresses any error messages. No modules can be imported. No files can be opened. Also disables use of eval and exec.

However, just by itself this code runs with no errors and exits with status 0.

[min]mod

[].UNWRAP.SET[].IF.SET[].SET.SET

Try it step by step!

Set all the built-in instructions to empty stacks (noops), making all instructions based on those instructions noops as well, since they only execute noops in different orders :)

JavaScript (browser)

It's hard to test this since it breaks everything. Not sure if this is complete but it's easy to keep adding clear(somebuiltin) to remove more properties

const clear = (obj) => {
  for (const prop in obj) obj[prop] = undefined
}
window.addEventListener("error", () => {})
clear(window);
clear(document);
clear(console);

// code here
console.log(Number(prompt("a")) + Number(prompt("b")))

PostScript

Yes, PostScript is a programming language. Moreover, it's a programming language where all language constructs are system-defined functions, which can be redefined...

/Magic 1000 dict def
systemdict {pop Magic exch {} put} forall
Magic begin

In English:

• Create an empty 1,000-element dictionary and name it Magic.
• For every key in systemdict, add the same key to Magic, with an empty definition ("{}").
• Push Magic onto the top of the dictionary stack.

From this moment on, every PostScript language command is defined to do nothing. AFAIK, it is impossible to escape from this condition.

(Technically, you're not "destroying" the old definitions, you're just shadowing them. If you could still execute end, that would pop Magic off the dictionary stack, un-shadowing all the commands and giving you your life back. But since end itself is also shadowed... it will do nothing now.)

Note that all commands will still execute... it's just that now they are defined to do nothing. You won't get any kind of error, it's just that nothing will happen. (Well, I suppose stack overflow will happen eventually...)

C (gcc), 136 bytes

#include <stdlib.h>
#include <signal.h>
__attribute__((constructor))
void enable_io()
{
    // Make it clear that we are ready for IO
    raise(SIGPOLL);
}

Try it online!

Place it after any C file using libc (or LD_PRELOAD it for dynamically linked programs 😉)

#include <stdio.h>
int main()
{
    puts("hello");
}

(note that the program did not output this, it is the shell):

$ ./a.out
I/O possible

The __attribute__((constructor)) is a feature that allows GCC to inject functions before main() runs, and we exit the program before main() by raising a signal saying that I/O is possible, making I/O impossible.

exit(0) works as well, but this is funnier.

Zsh, 6 bytes

set -n

Try it online!

zsh has an option no_exec or -n which permanently disables all commands. I have absolutely no idea why.

Batch Prompt, 7 bytes

cmd>NUL

Regardless of the command entered, it will disappear into the NUL abyss.

Spice

A couple of ways:

1. ALS

;@
ALS LOD OUT;
ALS ADD SWI;
ALS SUB BRK;
ALS MUL NUL;

New code goes at the end.

Explanation

The first character of a spice program defines the delimiter, in this case ; which is usually followed by all variable definitions before @ denotes the beginning of operations on those variables.

ALS allows aliasing operations to other names, so here we overwrite some builtin operations with other. Because OUT, SWI, BRK and NUL are the only operations that don't require a variable as at least one argument, by aliasing them to pre-existing operations we make it impossible to invoke them, as aliases are resolved first.

2. Poorly defined delimiter

 @

(Note leading space)

Explanation

We define the delimiter as a space, making invoking any operation cause a runtime exception in the interpreter: this is the equivalent of writing code similar to:

;var1;@
ADD;1;2;var

which is nonsensical in Spice.

Rust

macro_rules! toilet{
  ($($_:tt)*)=>{}
}

fn main(){
  toilet!{
    Your code goes here.
  }
}

Try it online!

I defined a toilet macro that causes the compiler to delete any code inside of it. Anything, including the main function, can be deleted in this manner.

use std::alloc::{GlobalAlloc,Layout};
struct EvilAlloc{}
unsafe impl GlobalAlloc for EvilAlloc{
  unsafe fn alloc(&self,_:Layout)->*mut u8{
    std::ptr::null_mut()
  }
  unsafe fn dealloc(&self,_:*mut u8,_:Layout){}
}
#[global_allocator]
static EVIL: EvilAlloc = EvilAlloc{};
//your code here

Try it online!

This one creates and sets a malicious global allocator that will always fail or leak memory.

JavaScript (Node.js), 23 bytes

for(y in this)this[y]=0

Try it online!

This script works almost universally unlike other JS examples here. I think I could probably shorten this using regex matching.

Crystal, 44 bytes

fun main(a : Int32,b : UInt8**) : Int32 0end

Try it online!

Works by overwriting the main function, so that rather than actually running code, it simply returns. Code can be inserted at any point after that, and it will simply be ignored.

Factor

UNUSE: syntax

Try it online!

It's not a joke, you can really unload the "built-in" syntax elements. And then you cannot write anything useful: you can't load any library, you can't define a named function or a lambda, you can't take input from stdin (or anything) or print to stdout (or anything). The engine still tries to parse the source code; it just fails because it forgot everything it needs to know.

There is still one thing that works: pushing number literals (which seems to be built into the engine itself). But you can't do any arithmetic or interesting stuff with them.

HP48 calculator family

OFF

Turns the calculator off.

Ruby 2.2.3

protected_methods = [:instance_methods,:__send__,:remove_method,:include?,:==,:to_s,:call,:pop]
protected_constants = [ObjectSpace, NameError, Exception, Module]
END{exit(0)}
ObjectSpace.each_object(Module) do |mod|
  next if protected_constants.include?(mod)
  im = mod.instance_methods
  while (meth = im.pop)
    next if protected_methods.include? meth
    mod.__send__(:remove_method,meth) rescue NameError
  end
  singleton = (class << mod;self;end)
  singleton_im = singleton.instance_methods
  while (meth = singleton_im.pop) 
    next if protected_methods.include? meth
    singleton.__send__(:remove_method,meth) rescue NameError
  end
end
s = (class << self;self;end)
ms = s.instance_methods
while (m = ms.pop)
  next if protected_methods.include? m
  s.__send__(:remove_method,m)
end

# Your code goes here

Ah, I love ruby. This code iterates through every Module (including classes) and un-defines all the methods, except for the ones in protected_methods. Anything you try to call is undefined, including Object#method_missing which means, due to a ruby quirk, a stackoverflow (technically stack level too deep) error is thrown.

Fun fact: if Exception is not in protected_constants then ruby 2.2.3 segfaults (maybe I should submit a bug report about that /s).

This was surprisingly bigger than I was first expecting, particularly because many things can't be DRY, because that would involve using methods that I need to be undefined.

I am pretty sure this works. I've taken a multi-layered approach in that even if you manage to get something in, you probably won't be able to do anything to it; 5+4 results in undefined method '+' for 5:Fixnum, and good luck getting anything out.

In case anyone needs to debug this, or if I forget, you can output after undefining IO#write if you grab a reference to it beforehand:

debug = STDOUT.method(:write)
class IO;remove_method :write;end
debug.call('foo bar')

Pyth (in safe mode)

D
;Dp;

Just redefines both methods of printing with the wrong arity, any attempt to print will now crash the interpreter, including implicit prints.

QBasic, 29 bytes

FOR i=0TO65535:POKE i,0:NEXT

Overwrites current segment (containing code and important data structures of the interpreter) with zeros.

Similar code may have similar effects on most interpreted BASIC implementations running on bare metal.

Bash, 60 bytes

shopt -s extdebug;f(){ return 1;};declare -rf f;trap f DEBUG

Your code goes afterwards. I abused this answer which uses a debugging feature. The return code of the function determines what to do with the original command.

I had to add the declare -rf f; bit to make the function read-only. This addresses @Gilles workaround.

I think this complies with the rules since code is still being taken in by the interpreter as the next command without infinite loops, crashing, etc.

Let me know if there is another workaround.

Java

I decided to do something little bit nasty and break java, by using little bit less code than here

       public class a {
        
            static {
                final SecurityManager securityManager = new SecurityManager() {
                    @Override
                    public void checkPackageAccess(String pkg) {
                        throw new RuntimeException("broken");
                    }
                };
                java.lang.System.setSecurityManager(securityManager);
        
            }
        
            public static void main(String[] args) throws Exception {
             //and here goes your code...
        
            }
        }

ForceLang

def io nil
def gui nil
def require nil
def goto nil
def gotoex nil
def if nil
def undef nil
def def nil
<your code here>

Uses def to mask a bunch of key stuff, including all of the language's IO and most of the language's control flow. Then uses def to mask undef so you can't undo any of it. Finally, uses def to mask itself just because it can.

TXR Lisp

(set *package* (make-package "X")*package-alist*())

The TXR Lisp dialect has a package system that is inspired by the one in ANSI Common Lisp. TXR Lisp not only has the variable *package*, but also exposes the list of packages themselves as the special variable *package-alist*, which can be assigned, or subject to a dynamic binding.

If we change *package* to a new, empty package, we can still reach functions in the usr package:

1> (set *package* (make-package "empty"))
#<package: empty>
2> (+ 2 2)
** warning: (expr-2:1) unbound function +
** (expr-2:1) + does not name a function or operator
3> (usr:+ 2 2)
4

However, if we also clear the *package-alist*, we will prevent the usr: prefix from being usable:

4> (usr:set usr:*package-alist* usr:nil)
nil
5> (usr:+ 2 2)
expr-5:1: usr:+: package usr not found
** syntax error

Of course, we should do this manipulation first, then clobber *package*, or do it all in one set form:

After this is evaluated, the rest of the code is in an inescapable, empty sandbox.

Mascarpone

0^

Mascarpone is a language that is quite similar in concept to Emmental, but taken to the extreme. Interpreters are first class objects, so you can push interpreters to the stack, modify them, and then use them on program strings.

In this case, the initial interpreter assigns 0 the meaning of "push to the stack an interpreter in which every character is defined to cause an error." ^ is assigned the meaning of "pop an interpreter off the stack and assign it as the new interpreter for subsequent characters in the program." This means that any characters added after this will error.

Alternatively, if this violates the "code must actually execute" rule, there are many other ways to break the language.

v'_>1^

This is similar, but instead of defining every character to be an error, it defines every character to be a no-op. That way, every character of your code is technically executed, but it just has no effect.

Here's another way:

v'_v>'x<^

x should be replaced with a command here. This essentially creates a new version of the current interpreter with x redefined to be a no-op, and then assigns that as the new interpreter.

While disabling commands might seem devastating, Mascarpone actually seems fairly flexible to the removal of individual commands.

• It only really needs [v*:! to simulate the Turing-complete ():^ subset of Underload.
• ' can be used instead of [, so disabling it doesn't kill the language.
• Disabling . (the output instruction) doesn't work, as you can still output via exit code (erroring/not erroring).
• Instead of ! (execute operation), you can have v'_<^_ (assign the operation to a command in a new interpreter, then switch to that interpreter and run that command).

I believe disabling v, *, or : might kill the language, but this is only 3 commands out of 18.

Befunge-96

'~h

The user's code can follow anywhere after this sequence, as long as these are the first three characters in the source.

The ' command (one-shot string mode) pushes the ASCII value of the ~ onto the stack (i.e. 126), and the h command then sets what is known as the Holistic Delta with that value. For those not familiar with Befunge-96, the Holistic Delta is an offset that is added to the value of every command byte that the interpreter encounters.

Once the delta is set to 126, the only valid command that can be generated is ~ (character input), via a null byte in the source. Anything other than a null byte would translate to a value greater than 126, and none of those values would be valid Befunge commands.

I think it's safe to say that this would make it ineligible to qualify as a programming language.

PowerShell

(gv ex* -v|% S*).LanguageMode=2

This doesn't work on TIO (which uses PowerShell core) but it does work on Windows PowerShell. Additional code can (attempt to) be executed directly after this (via ; or newline).

Putting PowerShell into NoLanguage mode makes it effectively useless unless you pre-defined allowable commands to execute.

Staq, elaborated more

{: }{; }{' }{" }{` }{{}}
{: }                    redefine : to NOP
    {; }                redefine ; to NOP
        {' }            redefine ' to NOP
            {" }        redefine " to NOP
                {` }    redefine ` to NOP
                    {{}}redefine { to }

If we didn't use {{}}, {:} can be used for restoring predefined characters.

Staq

{ '}{{}}

which redefines the noop to push entered number to stack. Then { to }.

Python 2

import sys
sys.setrecursionlimit(1)

Sets the maximum recursion depth to 1.
After entering these 2 lines, any subsequent line will yield:

RuntimeError: <exception str() failed>

Edit: They fixed this bug in Python 3.

Python 3

import sys,os,_thread

def poll(id):
    while True:
        sys.stdout = None
        sys.__stdout__ = None
        sys.stderr = None
        sys.__stderr__ = None
        open = None
        os.system = None
        builtins = None

_thread.start_new_thread(poll, (1,))

Print will now output nothing. Any other command that creates output gives:

RuntimeError: lost sys.stdout

Edit: The sys.__stdout__ = None serves to prevent the user from recovering sys.stdout using sys.stdout = sys.__stdout__. Credit to @someone.

Edit: sys.stdout could also be redirected to a file using sys.stdout = open("output.txt","w"). The open = None prevents this. Credit to @someone.

Edit: Added os.system = None because it could also be used to print. Credit to @Jonathan Frech

def print(x):
    os.system("echo {0}".format(x))

Edit: open can be recovered by:

import builtins
open = builtins.open

To prevent this, I made the whole script into a thread.

Edit: Added builtins = None to disable builtins.open. Credit to @Jonathan Frech

Funky

for v in values({math, string, table, io, _G})
    for k in keys(v)
        v[k] = nil

This nukes the math functions, then the string, table, and IO functions, and finally, cleans out the _G table.

The math functions are actually what's called when operators are used, so without them, most functionality is gone. But you can do math with table functions, if you get smart, so they're nuked too.

When the _G table is cleared, all forms of IO are finally also gone, and the getMetaFunc function is also nuked, which causes errors if most things happen.

After this, the language is entirely unusable.

Try it online!

JS (updated, compatible with IE11)

console.error=eval=0

Defines console.error to be eval which is redefined to be 0, which is no function but a number.

Output isn't directly possible.

ForceLang

undef def
undef gui
undef io
undef if
undef goto
undef gotoex
undef require
undef undef

Your code goes after.

Javascript

for(let q in this)delete this[q];

which deletes each property of this.

Or,

eval=0;

assigning 0 to eval, thus any input raises this:

The tab contains a modified eval function. It's possible, the command program diagnostic windows don't work correctly.

thus being irreversible by even restarting developer tools!

Japt

$Japt=undefined$

Test it online!

Taxi, 2354 bytes.

This little program simply runs the taxi in a large joyride through Townsburg, running out of gas. Any code you run after this will quickly error with error: out of gas. And even if you could reach a gas station, which I don't think is possible, you couldn't get any gas, as no money has been collected, since there are no passengers.

Go to Trunkers: west, 1st right, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st left, 1st left, 1st right.

Groovy

java.lang.Class.metaClass = Integer.metaClass
Integer.metaClass.plus = { Integer n ->     return 'a' }
Integer.metaClass.minus = { Integer n ->     return 's' }
Integer.metaClass.multiply = { Integer n ->     return 'd' }
Integer.metaClass.div = { Integer n ->     return 'f' }

I tried (without success) to overwrite the print commands, so I redefined the Object instead :) ​

JS, 11B

delete this

works with IE>8 and Edge (non-strict mode), with only workaround is exiting then reentering console to redefine them.

Common Lisp

(setq *debugger-hook* (lambda (a b) (abort)))

(set-macro-character #\( (lambda (stream char)
                           (read-delimited-list #\) stream)
                           (values)))

Step one is to disable the debugger. I do this by binding the *debugger-hook* (which is called immediately before entering the debugger) to a function which cancels whatever tried to enter the debugger in the first place. Then, I turned ( into a comment character- everything up to its matching close paren is completely ignored.

The result, tested on sbcl at the repl (both line-by-line and #'load ing it from a file), is a repl which completely ignores any meaningful code. Literal values (number, strings, symbols, etc.) work just fine, but anything else is just ignored.

S.I.L.O.S, 1 byte

0

Try it online!

Yes, in SILOS, your code can be made completely useless by editing the first line. With this, you can not store any variavbles (or take any input). Essentially it allocates 0 bytes of memory for the first line.

Operation Flashpoint scripting language

A feature I once discovered accidentally: You can create a variable with a name that's already taken by a command, thus making the command inaccessible. It can be recovered from by deleting the variable, but the command that is used to remove a variable can also be overwritten.

Save the following as init.sqs in the mission folder:

; Overwrite commands that can be used to execute code with variables with the same name.
call = 0
exec = 0
drop = 0
addEventHandler = 0
createDialog = 0

; There are other commands that could do the task, but not without input from the player.
; Any command in the game can be overwritten (except operators whose name doesn't begin
; with a letter, those are not valid variable names), so to be completely sure one could
; overwrite every single command, but these should suffice.

; Even if somehow ("onFlare.sqs", "onPlayerKilled.sqs" or some other scripts that are called
; automatically under specific circumstances) one gets a script running, make it impossible
; to create loops. Recursion is only possible with 'exec' or 'call' (and technically with 'drop').
goto = 0
while = 0
forEach = 0

; Overwrite the 'nil' command so that it cannot be used to recover from the above.
; Without this, "call = nil" would make 'call' work again (or any other overwritten command).
nil = 0

; Your code can be added here at the end of this script or anywhere else in the mission.

Now there is no way to use any kinds of loops or recursion.

Trying to call a piece of code outputting "Hello, World!":

Forth (gforth), 8 bytes

0 >ORDER

Everything you type in after that except an empty line will result in Invalid memory address.

I stumbled upon this by accident just now, I don't know precisely how it works but I guess >ORDER adds a new dictionary to search in for words or something. And it can't read from address 0, the address we told it to search for first, so it throws an error.

Forth (RCOS), 10 bytes

0 LATEST !

Tells the Forth that no words have been defined (latest word is the null pointer). Thus, you can only input numbers, everything else results in an Unknown token error.

Forth (RCOS), 18 bytes

219 ' INTERPRET C!

Writes byte 0xDB (65C02's STP instruction which halts the processor) to the start of the INTERPRET word. Now, everytime that word is called, the processor is halted. What INTERPRET normally does, it takes an area of memory (most likely the line buffer) and executes the words in there in order. It gets called when you press enter to execute the current line. So, with our new behavior, everytime you press enter (aka call INTERPRET) it halts the computer.

Looks like there's many ways to break my RCOS, but what do you expect, it's written in assembly

Bash

exec &> /dev/null

Any code that comes after can execute whatever it wants, but its output is cast into the void of /dev/null.

IBM Mainframe Assembler - 6

la 15,0

On entry to any program, Register 15 contains your base address. Overwrite that value, and expect an 0C4 abend (addressing exception) almost immediately.

Python 3 REPL

def f():
    import gc
    obs = gc.get_objects()
    for ob in obs:
       if isinstance(ob, dict) and ob is not locals() and ob is not __builtins__.__dict__ and ob is not globals():
           ob.clear()
f()
#What can you do now!

Scratch

Here's a pretty simple example that will crash your browser (and, in theory, your computer):

I left this running for about twenty seconds, then lost 2.65 GB of memory to Scratch. Only a moment later and 5 GB were gone.

I highly suggest you have a means to force quit either Adobe Flash or your web browser before running this!

^{I really wanted to make a cool answer like the clear(this) JS one but sadly Scratch doesn't have any ways to do that. Feel free to update this post (or make your own) if you DO find another way to make Scratch unusable though!}

PHP

One can completely kill PHP by setting the memory limit to 1.

It will completely die.

Try this:

<?php
    ini_set('memory_limit',1);

    //code here

This shouldn't even throw any error, since there isn't enough memory for that.

You can read more about the memory_limit directive

If the previous one is invalid, one can use output buffers:

<?php
    ob_start();

    //code here

    ob_clear();

This completely removes any output. Since the output buffer is still open, some other things accidentally left after the code won't be shown as well.

Using @fschmengler's idea:

<?php
    define('OB_START_LEVEL', ob_get_level());
    ob_start(function(){return'';}, -1, PHP_OUTPUT_HANDLER_CLEANABLE);
    //or, for PHP <5.3:
    //ob_start(create_function('','return"";'), -1, PHP_OUTPUT_HANDLER_CLEANABLE);

    //code here

    while(ob_get_level() > OB_START_LEVEL) ob_clear();

This will avoid the problem of deleting the automatically started output buffer, used to catch the output to be compressed.

This also prevents that the output buffer is deleted or flushed (sent to the browser). To re-inforce that, an output handler is added, that always returns an empty string.
Running ob_end_flush(); echo "Hello, world!"; won't produce anything, but would send the output with a plain ob_start();.

Thanks to @LucasTrzesniewski for exposing this issue!

INTERCAL-72

DO ABSTAIN FROM NEXTING+REINSTATING

INTERCAL has a command for globally disabling the ability of other types of commands to run. (Using it in this form is generally considered a bad idea, because it's a global action-at-a-distance which has no way to exactly reverse it; more recent versions of INTERCAL also have ABSTAIN #1 FROM which is exactly reversed by REINSTATE, but that wasn't around in the time of INTERCAL-72, the oldest version of the language.)

ABSTAINING from REINSTATING is an even worse idea, because it then becomes impossible to even approximately reverse the effect of the ABSTAIN; you can't do a global REINSTATE (the crudest way to get the commands working again) if you can't do any sort of REINSTATE. All we have to do, therefore, is to disable enough other commands at the same time that the language becomes impossible to program in. INTERCAL-72 only has one useful control structure (NEXT/RESUME/FORGET), and disabling NEXT by itself is enough to make it impossible to do any sort of loop.

In more modern versions of INTERCAL, there are a ton of other ways to do control flow (COME FROM, WHILE (not the same as C's while!), TRY AGAIN, GO AHEAD, etc.), and even other ways to reinstate lines of code (e.g. AGAIN), so an answer in modern INTERCAL, while it could use the same general idea, would be a lot longer.

///

/\///

The only operation in /// is repeated string substitution, like this: /pattern/replacement/.

This code removes every /, that way you can't use repeated string substitution, so basically everything you write after that will get printed (except for /s).

You can still use \s, but that won't help you much.

Go

I did it! I really finally did it! I've been stewing on this problem for months but I finally have a definitive solution that I challenge anyone to crack!

package main

import (
    . "runtime"
    . "os"
)

func main() {
    const (
        Chmod = iota
        Chtimes
        Create
        Exit
        File
        FindProcess
        Lchown
        Link
        Mkdir
        MkdirAll
        NewFile
        Open
        OpenFile
        Process
        Remove
        RemoveAll
        Rename
        Setenv
        StartProcess
        Symlink
        TempDir
        Truncate
        Unsetenv
    )
    Stdout.Close()
    Stdin.Close()
    Stderr.Close()
    defer func() {
        go func() {
            // User code here
        }()
    }()
    Goexit()
}

My definitive reddit post on this problem for Go.

But now, I have a solution. By forcing the user's code to execute in a goroutine, and then terminating the main goroutine with runtime.Goexit, the user can no longer set the exit code. If they panic the program crashes, yes, but if they don't then it also crashes, per the documentation of Goexit:

Calling Goexit from the main goroutine terminates that goroutine without func main returning. Since func main has not returned, the program continues execution of other goroutines. If all other goroutines exit, the program crashes.

Lua

local write = io.write
local type = type
local pairs = pairs
local setmetatable = setmetatable
local function destroy(g,t)
    t = t or {}
    setmetatable(g, {__index = function() return write end,__newindex = function() return false end})
    for k,v in pairs(g) do
        if(type(v)=="table")then
            local has = false
            for k2, v2 in pairs(t) do
                if v2 == v then
                    has = true
                    break
                end
            end
            if not has then
                t[#t+1]=v
                destroy(v,t)
            end
        elseif(type(v)=="function")then
            g[k] = write
        end
    end
end
destroy(_G)
type = write
pairs = write
setmetatable = nil

A fun one, makes all functions, including string and table constructors, into the io.write function. It doesn't necessarily prevent the language from doing things it was already doing, but it does cripple it from this point onwards. I chose io.write because I thought it interesting to see if I could make trying to run literally anything print. It didn't work so well.

JavaScript Shell

This will make the language completely unusable.

clear(this);

Isn't it nice how JavaScript has such a nice function to destroy itself?

This is pretty simple, the clear function completely empty an object. this refers to the global object clearing out everything including constructors and functions.

Because this clears everything, doing anything, even defining a literal will throw an error, making the language completely useless: _{*REPL environment not required. Uses the SpiderMonkey engine (shell not browser), the original JS engine.}

TeX

\catcode`\\=10

I'm not sure this will actually work, but in theory this should break \ as escape character leaving you no way to fix it. Normally TeX can read and write files, now it can't write anything that depends on logic. Thus the language is now broken as defined by OP.

EDIT: Other kill commands taken from the comments (although both might violate the code-must-be-executed rule):

• \def\fi{}\iffalse by smpl creates an un-closable if branch
• \catcode13=9% by iwillnotexist idonotexist creates a never-ending comment

Hoon

=<  ~
(your code)

Hoon is a odd. It's pretty much entirely unlike other programming languages, not only in syntax but in semantics. Unlike languages like Hexagony, though, it wasn't made to be purposely esoteric.

Hoon compiles to Nock, a minimal combinator based VM. Nock is stupid: the spec can be gzipped to 340 bytes. The only math operation is incrementing. Everything is a noun: an atom (bignum) or a cell (pair of nouns), with the entire memory model arranged in an immutable acyclic binary tree. The only output is the noun that your expression reduces to.

Because of the weird compilation target, Hoon is also weird: it's completely pure. Hoon compiles down to a Nock expression that is evaluated on a "context". The entire kernel and stdlib, along with all variables, are passed implicitly to the program by the context.

To make Hoon unusable we just use =<, which is "evaluate a in the context of b". We are always evaluating ~, which is zero. No matter what b does, it can't change the value it reduces to, and since it can't have side effect it can't do input or output.

Side note: Since you can't actually prompt for input from Hoon (purity!), by the rules it isn't actually a programming language. Input is via function arguments, output via return values (or ~&, which is more of a printf debugging feature and is transparent to the program).

For a program to get input in Urbit, you actually write a program that return a function that accepts input, and the shell asks on your behalf and passes to the callback.

J, online interpreter

f =: f
f 3

This calls f with f with f with... etc. Here's what the page looks like:

Successive attempts at entering things in yields, well, nothing:

Tested on Firefox.

Staq, 20 bytes

{` }{' }{: }{; }{{}}

Redefines all I/0 instructions as NOPs

Standard Staq instructions:

: output the topmost stack value to the console as a number
; output the topmost stack value to the console as a character
' push entered number on stack
` push value of entered character on stack
{ begin function definition
} end function definition

{` }                   define ` as NOP 
    {' }               define ' as NOP
        {: }           define : as NOP
            {; }       define ; as NOP
                {{}}   define { as }

This way, no more functions can be defined, which would be necessary to reset the instructions to their original state. In Staq, all predefined instructions can be reset to their original state by putting them between curly braces without a space. For example, : could be reset by writing {:}. But that’s not possible anymore because the opening { is defined as }, which would result in a useless set of instructions: }:}, which in turn (due to the redefinition of :) means } }.

So, anything that gets executed after this block runs as normal, but is useless because there is neither input nor output possible anymore, and no way to define functions to restore that ability.

Javascript

You can stop any output destroying (most of) the window object.

Also, you can't get rid of document, but you can crush it's content every millisecond.

Here's what I came up with:

(function(window){
    var html = document.getElementsByTagName('html')[0];
    
    setInterval(function(){html.innerHTML='';}, 1);
    window.addEventListener('error', function(){});
    
    for(var k in window)
    {
        if(k!='location')
        {
            window[k]=window;
        }
    }
})(Function('return this')());

This sets every single object inside window (except location, it will reload the page) to be ... the window object!!!

This will mess directly with the real window: Running Function('return this')() will return the this object for that context. Since that is eval'ed code, it will be the ... window object!

This also catches all exceptions by setting an handler on window, before deleting everything.

Also, we go grab the <html> element and set it's innerHTML to an empty string. This means that your output will work for less than a millisecond.

Your code is still executed. It just won't be able to show any output. Maybe you can create a file! If only the API wasn't destroyed...

Warning: This causes huge strain on your CPU and RAM. Run this at your own risk! It may cause overheating on your CPU and abnormal behaviour on your browser. It forces the code to run as many times as the browser can handle, in a second. This may cause a huge queue of functions to be executed, if it takes longer than the minimum time interval (which is 4ms for Firefox and Google Chrome (source provided by @somebody))

To stop the process, either run document.location=document.location or press F5.

I am NOT responsible for ANY hardware or software damage or data loss caused by running this code.

Tcl

foreach x [info commands] {if {$x!="rename"&&$x!="if"} {rename $x ""}}

This removes all keywords from the language except if and rename.

The above code would cause any new code to error out. So it's debatable if the new inserted code actually gets "executed". Below is a version that executes new code but does nothing because it changes all keywords (except if and proc) to a no-operation:

foreach x [info commands] {if {$x!="if"&&$x!="proc"} {
    proc $x args {}
}}

Instead of deleting keywords this code replaces them with a function that does nothing.

(Note: I'm using "keywords" very loosely here because Tcl doesn't have keywords, only functions)

DUP

[]⇒.[]⇒;[]⇒"[]⇒,[]⇒`[]⇒'[]⇒⇒ { your code here }

Redefine the print operators, the string allocation operators, and the input operators all to noop, and then define the definition operator ⇒ as a noop.

Factor

Factor is a concatenative stack-based language, where all operators are words which are defined with :. Here, we kill the builtin print functions by defining them as nothing, and then redfine the macro redefiniton operator.

: stream-write ( -- ) ;
: write ( -- ) ;
: print ( -- ) ;
: . ( -- ) ;
: : ( -- ) ;

! your code here

Mouse-2002

$ ~your code here

In Mouse, $ denotes the end of the program, thus, anything after it will be evaluated and "run" but won't actually do anything. No online interpreter available, unfortunately, but here is a fixed-so-it-compiles-in-gcc version of the interpreter written in C.

NGN/APL

NGN/APL allows redefining primitives, so redefining (←) all primitive functions to ⊢ ("pass through": both ⊢3 and 2⊢3 gives 3) makes the language completely useless:

⍪←-←+←?←⍵←∊←⍴←~←↑←↓←⍳←○←*←⌈←⌊←⍕←⊂←⊃←∩←∪←⊥←⊤←|←<←≤←=←≥←>←≠←∨←∧←×←÷←⍒←⍋←⌽←⍉←⊖←⍟←⍱←⍲←!←⌹←⊣←⍎←⊢

Try it here.

Javascript

Tested in Chrome.

Object.defineProperty(document,"body",{get:function(){return null}});
Object.defineProperty(document,"innerHTML",{set:function(){}});
Object.defineProperty(HTMLElement.prototype,"innerHTML",{set:function(){}});
Object.defineProperty(HTMLElement.prototype,"innerText",{set:function(){}});
HTMLElement.prototype.appendChild=document.createElement=document.getElementsByName=document.getElementsByClassName=document.getElementsByTagName=document.getElementsByTagNameNS=document.getElementById=document.write=document.writeln=console=document.querySelector=document.querySelectorAll=alert=setTimeout=prompt=confirm=open=Array=Array.prototype.constructor=Object=Object.prototype.constructor=Object.prototype.toString=null;
try{var window = {}; with(window){/*code*/} }catch(e){}

Browser javascript is really hard to break.

Perl

Not only will this make perl unusable, but your entire machine will seize up in seconds... Also works well for bash.

while(fork){fork}

Because fork returns the PID of the child process, or zero for the parent, evaluation the first-fork will create two processes. One of those will exit the loop, and continue evaluation. The other will enter the while body, and create one additional new process with the second-fork. These two processes will again hit the first-fork and create and additional two processes, for a total of four. Two of those will exit the while loop, and execute following code a second and third time. The other two will again enter the loop body. Then four processes will be tested in the first-fork, creating 8 processes, four of which execute the following code for a 4th, 5th, 6th and 7th time. And so on.

On any unix system, you run out of PID numbers and the fork begins to fail when you have 32k processes, but at this point, the scheduler is so busy that any interaction with a windowing system or shell is unusably slow.

O

N:+:-:/:*:@:\:[:]:1:2:3:4:5:6:7:8:9:0:{:}:<:>:=:#:%:^:?:d:w:o:p::;

This reassigns mostly everything to a null codeblock, making any code that contains these characters do nothing.

You could add every ASCII character to make sure they can't do anything, but this kills all arithmetic, stack manipulation, codeblock creation, array creation, pushing numbers to the stack, comparing numbers, control flow, outputting, and assigning variables.

Enema

:OQ::!Q:

Code can come any place after this.

This language is similar to Emmental in that it is capable of redefining itself. Essentially, what we're doing here is redefining O (which normally is for output) to do nothing (thus making the language no longer have a transformational model) and then redefine ! (which can be used to reset a word to its default behavior) to do nothing as well.

Befunge 98

 v
v>"PAMI"4("zqzCzOz=z.z,z)zozszM"akMn
>

Redefines the , and . instructions to NOPS to prevent out the standard way, then redifines the = instruction to prevent execution oif an arbirtrary program, then redefines the o instruction to prevent file output and the q instruction to prevent output by exit code, then redefines the C,O,M,and ) instructions to prevent you from undoing its definitions. Insert your code after the > on the third line.

Java

Building upon https://codegolf.stackexchange.com/a/61124/40787's input I saw that there is just too much boilerplate and reflection.

You can insert the code after the comment.

Edit

Saw this wasn't a strict code-golf, so prettied it a bit

import static java.lang.Thread.*;

import java.io.*;
import java.lang.reflect.Proxy;

import sun.misc.*;

public class Jail {

    public static void main(String[] a) {
        //user code here :D
        //Remember, do not do anything funky!
    }

    static {
        // From the original Java submission
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        // Block all access
        SharedSecrets.setJavaIOAccess(b(JavaIOAccess.class));
        SharedSecrets.setJavaLangAccess(b(JavaLangAccess.class));
        SharedSecrets.setJavaSecurityAccess(b(JavaSecurityAccess.class));

        //prevent throw new Error(output to show)
        setDefaultUncaughtExceptionHandler(b(UncaughtExceptionHandler.class));

        // Seal the deal
        System.setSecurityManager(new SecurityManager());
    }

    static <T> T b(Class<T> t) {
        return (T) Proxy.newProxyInstance(null, new Class[]{t}, (p, m, a) -> null);
    }
}

Original

import static java.lang.Thread.*;
import java.io.*;
import java.lang.reflect.*;
import sun.misc.*;

class X {

    static SharedSecrets s;

    public static void main(String[] a) throws IOException {
        // From the original Java submission
        a=null;
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        // Block all access
        s.setJavaIOAccess(b(JavaIOAccess.class));
        s.setJavaLangAccess(b(JavaLangAccess.class));
        s.setJavaSecurityAccess(b(JavaSecurityAccess.class));

        //prevent throw new Error(output to show)
        setDefaultUncaughtExceptionHandler(b(UncaughtExceptionHandler.class));

        // Seal the deal
        System.setSecurityManager(new SecurityManager());

        //user code here :D
        //Remember, do not do anything funky!

    }

    static <T> T b(Class t) {
        return (T) Proxy.newProxyInstance(null, new Class[]{t}, (p, m, a) -> {
            throw null;
        });
    }
}

If you write normal language syntax, it still works (mostly). Also, opening files or trying to reset the streams is frowned upon. Just wanted to get some lower number Java submissions.

Z80 assembler

Two bytes are enough to completely hang any Z80 based system:

di 
halt

aka "Disable interrupts, then halt until an interrupt arrives". Yeah, sure!

EDIT: I had missed the "code that crashes doesn't count" part in the question, so I guess that this does not qualify.

Forth

0 set-order

Basically, tell the interpreter/compiler that there are no dictionaries of known instructions. It can still read numbers (because they're not instructions) and they'll go on the stack if interpreting, but you can not issue any instructions about what to do with them, nor can you restore the search order because that would require issuing an instruction.

GolfScript

"#{def eval(s) end}":+:%:/:,:*:do:while:until

The series of :foo replaces all of the looping operators and addition and concatenation, but that's not sufficient. It's also necessary to prevent deferring the computation to Ruby's string interpolation, which I accomplish by replacing Ruby's eval operator using a string interpolation. String literals which occur later in the source code will be passed through my no-op eval rather than the built-in one.

The reason it's necessary to replace all of the looping operators, even such innocuous ones as ,, is that primality testing doesn't require unbounded looping. E.g. the following uses only , in its three forms (range, filter, len) to do primality testing:

~.,2>{1$\%!},,\;

The reason for replacing + is that jimmy23013 proposed using quining to get a looping construct. The specific implementation he provided doesn't work because by clobbering foo I've also clobbered the (standard) interpreter's way of parsing strings, but I expect it could be reworked using blocks instead of strings so I'm playing it safe.

Common Lisp

(set-macro-character #\( (lambda (x y) ()))

I hope you didn't need those opening parentheses.

This is a reader macro that tells the Lisp Reader to replace each instance of ( with a call to (lambda (x y) ()), a function that takes two arguments and returns nothing. So, for example, it would read (foo) as foo), interpret foo as a variable and then throw an unmatched parenthesis error on 0.

TeX (LaTeX)

\output{\setbox1\vbox{\unvbox255}}}
\let\output\relax

You can still do a lot in a code that starts with this. However, no pages will be ever produced. The output routine that takes care of building up the pages is destroyed, and also its "handle" is destroyed so that you cannot rebuild it. Needless to say, you can still compute a lot of stuff and output them in a file or in the log; you just can't use this crippled TeX to produce any document.

To disable writes, you can simply add:

\let\write\relax

You can't disable the log though.

JavaScript in browser

Well, at least in IE11.

window.addEventListener("error", function(){});
document = document.write = alert = prompt = confirm = console = void(
    (function (window) {
        try {
            //Code goes here
        } catch (e) {}
    })({})
);

Disables writing to the document, writing to the global variable and returning from the function.

Comment if I've missed out an output method!

Scratch

The when [timer v] > (0) will run as soon as the code is initialised, which if you're in the editor is before you even start the code. The when I receive (join[][]) will cause an error to be thrown every time anything is broadcast, pausing code execution if you have Developer version of Flash. The break function will create clones, and trigger the broadcast error. Every single clone will last two seconds then delete itself, putting strain on the stack. And every clone will respond to the when [timer v] > (0), running the break subroutine and resetting the timer, which causes the timer code to be run again. Also, each clone will respond to every broadcast error as well, meaning the number of errors per evaluation of break is the number of clones squared. Did I forget to mention that the break function has run without screen refresh checked, causing the editor to freeze, jolt and lag, as well as the grabbing and allocating memory. And maxing out the CPU.

Any code added anywhere with this running will find itself unable to create clones (300 clone limit surpassed) as well as heating up and crashing the computer running it. And grabbing memory until there is no more to grab, leaving variables misbehaving.

And, after there's too much lag to trigger the when [timer v] > (0) block, it'll still be running break.

Thanks to @towerofnix for reminding me about the when I receive glitch I found a while back, and giving me the idea for run without screen refresh. If you liked this, here's the original: https://codegolf.stackexchange.com/a/61357/43394

Shakespeare Programming Language

Have Fun Mr Parser.

Romeo, a young man of Verona.
Juliet, a young lady of Verona.
Hamlet, another character which causes the crash.

Act I
Scene I The crash.

[Enter Romeo]
[Enter Juliet]
[Exit Hamlet]

In SPL, the built in parser which is downloaded with the program follows very specific rules as to what can happen in the script. One of such rules is that only two characters can be on stage at once. Also, making a character exit the stage who was never on stage will confuse it. The same goes for adding a character to the stage who is already on stage. When the parser receives an error, it will refuse to do ANYTHING else; you literally have to completely shutdown the program and the parser and then start up everything again.

P.S. If you have no idea how this language works, Google it. It's awesome.

x86 machine code in real mode (=> almost any DOS program)

00000000  6a 00 07 b9 00 04 30 c0  31 ff f3 aa              |j.....0.1...|
0000000c

i.e.

push 0
pop es
mov cx,400h
xor al,al
xor di,di
rep stosb

I hope you weren't too attached to your interrupt table.

Java

import java.io.*;
import java.lang.reflect.*;
public class Test2 {
    public static void main(String[] args) throws Exception {
        args = new String[0];
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        Field modifiersField = Field.class.getDeclaredField("modifiers");
        modifiersField.setAccessible(true);

        Class<?> fdClass = java.io.FileDescriptor.class;
        Field outField = fdClass.getDeclaredField("out");
        outField.setAccessible(true);
        modifiersField.setInt(outField, outField.getModifiers() & ~Modifier.FINAL);
        outField.set(null, new FileDescriptor());
        Field errField = fdClass.getDeclaredField("err");
        errField.setAccessible(true);
        modifiersField.setInt(errField, errField.getModifiers() & ~Modifier.FINAL);
        errField.set(null, new FileDescriptor());
        Field inField = fdClass.getDeclaredField("in");
        inField.setAccessible(true);
        modifiersField.setInt(inField, inField.getModifiers() & ~Modifier.FINAL);
        inField.set(null, new FileDescriptor());

        System.setSecurityManager(new SecurityManager(){
            private boolean exitAllowed = false;
            public void checkPermission(java.security.Permission perm) {
                String name = perm.getName();
                if(name.equals("setIO")
                        || name.equals("setSecurityManager")
                        || name.equals("writeFileDescriptor")
                        || name.equals("readFileDescriptor")
                        || name.equals("suppressAccessChecks")
                        || (perm instanceof FilePermission
                            && name.startsWith("/proc/self/fd/"))){
                    throw new SecurityException("Nope");
                }
                if(name.startsWith("exitVM") && !exitAllowed){
                    exitAllowed = true;
                    System.exit(0);
                }
            }
            public void checkExec(String cmd){
                throw new SecurityException("nope");
            }
        });

        // program here
    }
}

Edit: Counter-countermeasures are making this giant :(

Redirects stdin and stdout to null streams and replaces args with an empty array. Also uses enormous amounts of reflection hacks to make sure the standard IO is truly hidden. Finally, it sets a security manager to make sure the standard IO can't be recreated and that makes sure programs can't set the exit code.

Mathematica / Wolfram Language

Mathematica is an interpreted language in which command names are symbols that can be manipulated by the programmer. You can't delete built-in operators, but you can overload them or otherwise modify their function. The following scrambles the "With" command, which is needed for assignment to variables even internally. This change prevents the kernel from holding arguments unevaluated until the assignment is complete, and it kills the language quite dead.

ClearAttributes["With", HoldAll]

If this command is run in an interactive session or within a block of code, Mathematica will not even be able add 1+1 (the resulting error message is about a page long so I won't include it here).

Ruby (29 characters)

class Object;def send;end;end

As 'send' is used internally whenever a method is called within Ruby, and since all objects inherit from the Object class. This should stop any method being run.

Fun Fact: This is perfectly sound in theory. But it appears, for some reason, not to hobble the Ruby language. I have no idea why it's possible to run this code and then still use an open Ruby environment.

Python

#Run the following in Python IDLE (spoiler: don't)
import os, shutil, sys
try:shutil.rmtree(os.path.split(sys.executable))
except:pass
os.system("python")

This functions by deleting most of the Python interpreter. Then it recursively starts itself. Any code you type afterward will fail horrendously.

StackStream

{ new-stream }     'stdinout def
{ drop exec }      'if def
{ drop drop exec } 'elseif def

Basically, this redefines the default symbol 'stdinout' to return an empty stream, which points nowhere. It then defines 'if' and 'elseif' to always run the first branch, so output is always the same.

Haskell

There are a couple of possibilities here.

Boring idea #1: Define main to do nothing. Now no matter what other code you write, it can never execute. (Unless you manually run it from the REPL.)

Boring idea #2: Define a module with no public exports. Now no matter what other code your write, it can never execute.

Interesting idea: Disable all imports.

module Fubar where
import Prelude ()
foo = foo
-- More code here.

Now you can define functions which are visible and can be run... but they can't do anything. All standard Haskell types and functions are now hidden. (With the exception of a few things really deeply hard-wired into the language.)

Most particularly, you cannot perform any I/O whatsoever. You also cannot do machine-precision arithmetic. (Since Int, Double, etc are now undefined.)

You can still write lambda-calculus functions that do perform some real computation though. You just can't get any data into or out of the thing. But you could of course write another, separate module that calls the Fubar module above and does I/O on its behalf (thus proving that the code does execute and does do stuff).

Some subtleties:

• The dummy foo = foo declaration is needed to prevent anybody adding additional imports. (Imports cannot appear after declarations.)

• There are various non-standard Haskell language extensions that would enable you to climb out of this situation. But language extensions have to be switched on with a compiler pragma at the top of the file. (Or with a command-line switch to the compiler. I can't really prevent that one!)

Smalltalk

I'm not sure if this qualifies:

Smalltalk := Nil.

This deletes the entire run-time environment, hanging the object engine. The only way to fix this is to forcibly terminate the process and restart from backup.

For those that don't know, the way [Visual Works] Smalltalk works is slightly weird. It's like a mini-OS. When you start Smalltalk, you load a "memory image" into RAM, and it continues executing from where it left off. The entire Smalltalk IDE is written in Smalltalk and is dynamically modifiable.

In particular, Smalltalk is a dictionary containing all global variables. Most particularly, every time you declare a new class, a global variable with that name is created, pointing to the Class object for your new class. So setting Smalltalk to Nil (basically null) deletes all classes in the entire system. Even the GUI event handlers go poof.

I have no idea why this variable is even writable. Probably because it's a global variable, and therefore exists as an entry inside itself. (Does your head hurt yet? Did I mention that every object has a class, and classes are objects, so every class has a class? The class of a class is called a metaclass, but a metaclass is also an object, which therefore has a class...)

You could probably achieve a similar effect by clearing the dictionary rather than replacing it with null. Indeed, there's any number of things you could code to delete all the classes in the system, leaving you unable to do anything. But since the actual Smalltalk compiler is also a class... anything that breaks the language also kinda breaks the entire IDE, so...

DOS batch (prior to Windows 95 I believe)

CTTY

Issued with no arguments, this disconnects the command line from the terminal. Any further attempts to read input or generate output don't do anything.

In case you wanted to know how to use CTTY correctly:

MODE COM1,8600,8,N,1
CTTY COM1

A slightly more powerful batch file could even answer the modem and connect whatever dialed in to CTTY.

Thue

::=

With a newline at the end

The thue language relies on defining rulesets and a ::= denotes the end of the ruleset. It is impossible to do ANYTHING in thue without defining rules that do it, so regardless of what you put after the ::=, nothing can happen.

Alternative answer

A::=
B::=
C::=
D::=
E::=
F::=
G::=
H::=

(and so on for the every character in all of Unicode including those before the A character and non-printable characters). This requires the command-line option -r.

Lua

_ENV=""

In Lua, _ENV is the environment that all global variables, functions, tables, etc are stored in. Defining it to just be an empty string means you can't define anything new, and all functions and variables are wiped. This means you can not output anything, take in input, or pretty much do anything.

Boo

macro harmless:
    Context.Parameters.Pipeline.Clear()

And then, somewhere else in the project,

harmless

A simple macro with a harmless-sounding name, but an amazingly frustrating effect. The Boo compiler uses a multi-step pipeline that begins with parsing source into an AST and ends with code generation. (Generally. It can be reconfigured for various applications.) Every step in between performs various operations on the AST.

Partway through is the macro expansion stage, in which macros are executed in the context of the compiler. Remember the bit in the last paragraph, about the pipeline being reconfigurable? If, during macro expansion, you invoke a macro that clears the pipeline, no error will be displayed to the user, but all steps after macro expansion (including code generation) are no longer there. So you end up with something that looks like a successful compilation--no error messages displayed--but for some reason there's no binary produced! Guaranteed to drive even the best troubleshooters up the wall, if you hide the macro and the invocation well.

Simplex v.0.5

h]$g$o$s$`$$u1{vbR4Rl<?[{;L}#]{p}u}
h]                                   ~~ define macro 0 as nothing
  $ $ $ $ $                          ~~ grab next character and redefine its function to
                                     ~~ evaluate the current macro number (0)
   g o s ` $                         ~~ redefine output as a string (g), output as number 
                                     ~~ (o), as a character (s), or as a result of
                                     ~~ suppression (`) and also prevents the user from
                                     ~~ redefining them back, if possible
            u1                       ~~ goes up a strip and sets the byte to 1
              {                   }  ~~ repeat inside until a zero byte is met
               v                     ~~ goes down a strip
                b                    ~~ takes input as a string and puts to strip
                 R4Rl<               ~~ right, 4, right, length => length < 4
                      ?[     ]       ~~ perform inside iff byte is not zero
                        {  }         ~~ loop inside until zero byte is met
                         ;L          ~~ pushes the character to the outer program, left
                            #        ~~ stops evaluation (goes to outer program)
                              { }    ~~ loop inside until zero byte is met
                               p     ~~ removes current byte
                                 u   ~~ goes up a strip to meet the 1 byte; essentially
                                     ~~ a while(true){...} loop.

Essentially, destroys the output commands, then takes input from the user as strings, pushing them to the outer program, until a null-length string is encountered, at which point evaluation ceases and the user's input (the outer program) is evaluated. The user cannot output anything nor can they redefine anything. This thus eliminates the criteria of being able to output anything. If you want to eliminate input, simply put a $ in front of each of G, b, and i before the octothorpe (#) 6 characters before the end.

MATLAB

The following piece of code makes the environment completely unusable¹:

builtin = @(varargin)false; clear = @(varargin)false;
%// Insert code after this point

This overrides the builtin function and the clear function with new anonymous function handles that simply return false every time you try and call these functions. The builtin function ensures that if there are any custom functions you write in MATLAB that are the same name as those that are built-in to MATLAB (things like sum, max, min, etc.), you are able to call these unambiguously instead of the overloaded functions. Similarly, clear gives you the ability to clear all variables that are currently declared so you can start anew. By removing these capabilities, there is no way that you can use MATLAB unless you restart the program.

In MATLAB R2015a, I also get the following message:

The Workspace are the variables that are currently declared in the environment so that you can use them for later. This permanently disables the Workspace, so any variables you try and create will not be saved and hence no progress can be made when executing lines of code in MATLAB.

^{1: Credit goes to user Dev-iL who originally discovered the idea.}

PHP

I'm suprised that it actually works, but closing STDOUT and STDERR suppresses all output. To be sure that they will not be opened again, we open /dev/null three times to reassign the file descriptors 0, 1 and 2:

<?php
fclose(STDIN);
fclose(STDOUT);
fclose(STDERR);
fopen('/dev/null','r');
fopen('/dev/null','w');
fopen('/dev/null','w');

// insert program here

More on that: https://stackoverflow.com/questions/937627/how-to-redirect-stdout-to-a-file-in-php

Emmental

;#33!

I know this isn't code golf, but the right tool for the job, you know...

The user's code can be inserted after the !.

Emmental is an interesting esolang which is based on rewriting the interpreter. Every single symbol (including the built-in ones) can be redefined as an arbitrary Emmental program. The language relies on this feature so much that it doesn't provide any looping constructs. Instead, you define recursive commands which appear in their own definitions.

This redefinition happens via !, which reads a character from the stack, and then reads a string from the stack until it encounters a ;. The character is then redefined to mean the program represented by that string.

That means, we can disable Emmental's looping features by redefining ! itself as the empty program. While all other Emmental code still runs perfectly fine, and many of the criteria of a programming language are still fulfilled, it is impossible to redefine any more symbols. Without this feature (and therefore, without being able to loop), Emmental can no longer test whether a number is prime.