What are the best practices for running awk scripts with minimal privileges on a shared multi‑user Linux system?

In environments where many users share the same system, executing awk scripts with excessive permissions can pose a security risk, potentially allowing unintended file access or privilege escalation. The aim is to confine awk’s capabilities to the least privilege necessary while still allowing legitimate data‑processing tasks to succeed.

Which confinement mechanisms (e.g., restricted shells, SELinux policies, AppArmor profiles) are effective at limiting awk’s file‑system and network access without breaking typical script functionality? How can awk be invoked via sudo with a tightly scoped command whitelist that preserves needed arguments while forbidding dangerous options? What file‑ownership and permission settings should be applied to awk scripts and their input data to enforce the least‑privilege principle?