如何在Windows中赋予进程特定的权限
我正在编写一些测试软件，它接收一些源代码，在服务器上编译它，执行它，转发来自数据库的输入，捕获输出并将其与数据库中的输出进行比较，看看它是否正确。问题是源代码可以是任何东西（它是用 c/c++ 编写并用 Visual Studio cl 编译的），所以我需要以某种方式防止恶意用户。如果这些进程运行的时间超过一段时间，或者使用的内存超过允许的数量，我会自动终止它们。
问题是，我是否可以只允许这些进程仅从标准输入/输出流中写入和读取，并拒绝 Windows 上的任何其他访问权限。
请原谅我的英语。
先感谢您。
I am writing some testing software that receives some source code, compiles it on the server, executes it, forward input from the database, catches output and compares it with one in the database to see if it is correct. The problem is that source code can be anything (it is written in c/c++ and compiled with visual studio cl), so I need to prevent somehow malicious users. I am automatically killing those processes if they run longer than some time, or use more memory than allowed.
The question is, can I only allow those processes only to write and read from standard in/out streams and to deny any other access rights on windows.
Please excuse my English.
Thank you in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
也许作业对象可以帮助您（请参阅http://msdn.microsoft.com/en-us/library/ms684161(VS.85).aspx)。这个非常强大的功能并不为人所知。
处理工作非常容易。您可以根据
CreateJobObject创建作业并设置许多不同的限制，例如时间、内存和一些限制。然后您可以创建一个带有挂起标志的进程，将进程分配给作业并恢复该进程。然后，您将获得对所创建的进程以及该进程可以创建的所有子进程树的完全控制权。作业功能自 Windows 2000 起就存在。另一种现代方法是用户界面权限隔离 (UIPI)（请参阅http://msdn.microsoft.com/en-us/library/bb625963.aspx）或Vista引入的低完整性进程的使用方式。请参阅 http://msdn.microsoft.com/en-us/library/Bb250462 #dse_stlip 如何创建低完整性进程。
Probably Job Objects can help you (see http://msdn.microsoft.com/en-us/library/ms684161(VS.85).aspx). This very powerful feature is not good known.
Working with jobs is very easy. You can create a job with respect of
CreateJobObjectand set a lot of different restrictions like time, memory and some restrictions. Then You can create a process with suspended flag, assign process to the job and resume the process. Then you receive full control under the created process and all tree of child processes, which the process can create. Job feature exist since Windows 2000.Another modern way is User Interface Privilege Isolation (UIPI) (see http://msdn.microsoft.com/en-us/library/bb625963.aspx) or the way of usage Low Integrity Processes introduced by Vista. See http://msdn.microsoft.com/en-us/library/Bb250462#dse_stlip how to create a process with Low Integrity.