Set-uid root program that runs a program as the user "restrict"
Stay away from variable length arrays. First, they are optional in C11  (in C99 they were mandatory). Second, there is no way to detect allocation failure. A malicious user may invoke the program with a command line long enough to cause stack overflow.
Why sudo? You are root already, so you may set the user and group ID directly.