简易沙箱原理 ——Placing Restrictions on a Job's Processes

分类： C/C++/MFC 2011-10-19 11:15 604人阅读 评论(0) 收藏 举报

attributesnullwindowssecuritydocumentationbasic

Placing Restrictions on a Job's Processes

After creating a job, you will typically want to set up the sandbox (set restrictions) on what processes within the job can do. You can place several different types of restrictions on a job:

• The basic limit and extended basic limit prevent processes within a job from monopolizing the system's resources.

• Basic UI restrictions prevent processes within a job from altering the user interface.

• Security limits prevent processes within a job from accessing secure resources (files, registry subkeys, and so on).

You place restrictions on a job by calling the following:

[cpp] view plaincopy

1. BOOL SetInformationJobObject(  
2.    HANDLE hJob,  
3.    JOBOBJECTINFOCLASS JobObjectInformationClass,  
4.    PVOID pJobObjectInformation,  
5.    DWORD cbJobObjectInformationSize);  

有些操作系统不能直接调用CreateJobObject的，需要从Kernel32.dll中导入：

[cpp] view plaincopy

1. //从动态链接库导出函数 CreateJobObject  
2.         HINSTANCE hInstance = ::LoadLibrary("Kernel32.dll");  //加载动态链接库  
3.     typedef HANDLE (__stdcall* funCreateJobObject)(LPSECURITY_ATTRIBUTES lpJobAttributes,LPCTSTR lpName) ;  
4.     funCreateJobObject CreateJobObject = (funCreateJobObject)GetProcAddress(hInstance,"CreateJobObjectA");  
5.     HANDLE hJob = CreateJobObject(NULL,"ProcessGroup");  
6.        ::FreeLibrary(hInstance);  

或者定义一个宏：
#define  _WIN32_WINNT   0x0500

实例：

[cpp] view plaincopy

1. #define  _WIN32_WINNT   0x0500 // 方法一  
2. #include <windows.h>   
3. #include <winbase.h>  
4. #include <iostream.h>  
5. #pragma  comment(lib, "Kernel32.lib ")   
6.   
7. void main()     
8. {  
9. /*   Windows NT: Requires version 5.0 or later. 
10.      Windows: Unsupported. 
11.      Windows CE: Unsupported. 
12.      CreateJobObject 
13.      [This is preliminary documentation and subject to change.]  
14.      
15.      The CreateJobObject function creates a job object.  
16.        
17.      HANDLE CreateJobObject( 
18.      LPSECURITY_ATTRIBUTES lpJobAttributes, 
19.      LPCTSTR lpName 
20.      ); 
21. 所以要使用 CreateJobObject等函数，必须在Windows NT 5.0或以上， 
22. 但是我们在Windows要想使用，就可以从动态链接库中导出 
23. 或者在开头定义 #define  _WIN32_WINNT   0x0500  
24.          
25. */  
26. //===============================================================================================================  
27. /*  // 方法二   
28.     HANDLE  hJob; 
29.     HINSTANCE hInstance = ::LoadLibrary("Kernel32.dll");  //加载动态链接库 
30.  
31.     //从动态链接库导出函数 CreateJobObject 
32.     typedef HANDLE (__stdcall* funCreateJobObject)(LPSECURITY_ATTRIBUTES lpJobAttributes,LPCTSTR lpName) ; 
33.     funCreateJobObject CreateJobObject = (funCreateJobObject)GetProcAddress(hInstance,"CreateJobObjectA"); 
34.     hJob = CreateJobObject(NULL,"ProcessGroup"); 
35.  
36.     //从动态链接库导出函数 SetInformationJobObject 
37.     typedef BOOL (__stdcall * funSetInformationJobObject)( 
38.         HANDLE hJob,                           // handle to job 
39.         JOBOBJECTINFOCLASS JobObjectInfoClass, // information class 
40.         LPVOID lpJobObjectInfo,                // limit information 
41.         DWORD cbJobObjectInfoLength            // size of limit information 
42.         ); 
43.     funSetInformationJobObject SetInformationJobObject = 
44.       (funSetInformationJobObject)GetProcAddress(hInstance,"SetInformationJobObjectA"); 
45.  
46.     //从动态链接库导出函数 AssignProcessToJobObject 
47.     typedef BOOL (__stdcall *funAssignProcessToJobObject)( 
48.             HANDLE hJob,     // handle to job 
49.             HANDLE hProcess  // handle to process 
50.             ); 
51.     funAssignProcessToJobObject AssignProcessToJobObject =  
52.         (funAssignProcessToJobObject)GetProcAddress(hInstance,"AssignProcessToJobObjectA"); 
53.  
54.     typedef BOOL (__stdcall *funOpenJobObjectToken)( 
55.         HANDLE hJob, 
56.         ACCESS_MASK DesiredAccess, 
57.         HANDLE *phToken 
58.         ); 
59.     funOpenJobObjectToken OpenJobObjectToken=(funOpenJobObjectToken)GetProcAddress(hInstance,"OpenJobObjectTokenA"); 
60.   
61.     ::FreeLibrary(hInstance); 
62. */  
63. //===================================================================================================  
64.     HANDLE hJob=CreateJobObject(NULL,"Global\\My_Job_ago");                
65.     if(hJob==NULL)  
66.     {  
67.         cout<<"CreateJobObject Error !\nError Code is"<<GetLastError()<<endl;  
68.     }  
69.   
70.     JOBOBJECT_SECURITY_LIMIT_INFORMATION jobsec={0};  
71.     jobsec.SecurityLimitFlags =JOB_OBJECT_SECURITY_RESTRICTED_TOKEN;  
72.     jobsec.PrivilegesToDelete=NULL;  
73.     jobsec.RestrictedSids=NULL;  
74.     jobsec.SidsToDisable=NULL;  
75.   
76.     BOOL ret=SetInformationJobObject(hJob,  
77.                         JobObjectSecurityLimitInformation,  \  
78.                          &jobsec,                           \  
79.                         sizeof(JOBOBJECT_SECURITY_LIMIT_INFORMATION));                    \  
80.   
81.   
82. //===============================================================================================================  
83.     STARTUPINFO si={sizeof(STARTUPINFO)};  
84.     PROCESS_INFORMATION pi={0};  
85.   
86.     BOOL bret=CreateProcess(NULL,"notepad test.txt",NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,π);  
87.   
88.     AssignProcessToJobObject(hJob,pi.hProcess);   
89.   
90.     Sleep(1000);  
91.     ResumeThread(pi.hThread);  
92.     CloseHandle(pi.hThread);  
93.     WaitForSingleObject(pi.hProcess,INFINITE);  
94.     CloseHandle(pi.hProcess);  
95.     CloseHandle(hJob);  
96.   
97. }