在 winapi 中以尽可能低的权限运行进程
我正在写一些类似于 http://ideone.com/ 的内容。目前我正在使用 CreateProcess 调用运行用户进程。如果进程运行的时间超过指定的时间，我会杀死该进程，但我不知道如何拒绝对创建的进程的读/写文件系统权限/创建进程权限等。给定的可执行文件实际上可以是任何东西，我只需要允许标准输入/标准输出。另外，如果我可以设置工作记忆集，那就太好了。
我在msdn上读了很多文章，例如CreateProcessAsUser Function，CreateProcessWithLogonW Function等，但我很快就会感到困惑（可能是因为我的win32知识极其有限）。 仅调用 CreateProcessAsUser 并创建具有这些有限权限的特殊用户（以及如何创建此类用户）是否足够。
我希望我可以在一个函数调用中使用正确的参数来实现这一目标，所以请帮助。
另外，如果您知道一些类似的开源项目，那就太好了。
谢谢。
=================================================== ========
编辑： 再次嗨:) 我仍然坚持这一点。我没有足够的时间来处理这个问题，但我想 snemarch 帖子非常有用。如果有人有开箱即用的解决方案，那就太好了。如果我用 snemarch 的链接做一些事情，我会发帖。
I am writing something similar to the http://ideone.com/. Currently I am running user processes with CreateProcess call. I kill the process if it runs longer then specified amount of time but I don't know how to deny read/write filesystem rights / creating process rights etc. to the created process. The given executable can be literally anything and I need to allow only stdin / stdout. Also it would be great if I could set working memory set.
I read a lot of articles on msdn such as CreateProcessAsUser Function, CreateProcessWithLogonW Function etc. but I get confused very fast (probably because my win32 knowledge is extremely limited).
Is it sufficient just to call CreateProcessAsUser and create special user with those limited privileges (and how to create such user).
I hope I can achieve this in one function call with right parameters so please help.
Also, if you know some similar open source project it would be great.
Thanks.
==========================================================
Edit:
Hi again :)
I am still stuck with this. I didn't have enough time to work on this, but I guess snemarch post is very useful. If someone has out of the box solution it would be great. I will post if I do something with snemarch's links.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
看一下 OpenProcessToken 和 AdjustTokenPrivileges - 这可以让您（在某种程度上）微调进程的权限。您可以使用 SaferCreateLevel 获取某些标准权限例如
SAFER_LEVELID_UNTRUSTED。Take a look at OpenProcessToken and AdjustTokenPrivileges - this lets you fine-tune (to some extent) the permissions of your process. You can use SaferCreateLevel for some standard rights like
SAFER_LEVELID_UNTRUSTED.考虑在作业对象内运行用户进程。用户进程创建的子进程也将最终位于同一作业对象内。您可以对作业可以使用的资源量、它如何与 GUI 交互等应用特定的限制（请参阅 SetInformationJobObject 函数）。您可以一击杀死作业对象内的所有进程。
Consider running user process inside a job object. Child processes created by the user process will end up inside the same job object too. You can apply specific restrictions to how much resources the job can use, how can it interact with GUI etc (see SetInformationJobObject function). You can kill all processes inside a job object with one blow.
我们有一大块代码用于执行此操作，但我无法发布它:(
根据此进程的访问令牌创建一个“受限”访问令牌。然后使用此访问令牌为应用程序创建一个新进程
。使用代码进行注释 - 更多信息可以在名为 “以管理员身份安全地浏览网页和阅读电子邮件”。 然而，像往常一样，微软已经破坏了网页，文章不再存在。
找到了相关搜索“DropMyRights”应用程序链接到链接到本文的博客< /a> 可能会做你想做的事情，提供源代码，但是这些链接在博客页面中又被破坏了，
你可能想查看诸如此类的功能 。
OpenProcessToken获取令牌信息CreateRestrictedToken和诸如
SE_CHANGE_NOTIFY_NAME之类的权限We have a chunk of code for doing this, though I can't post it :(
Create a "restricted" access token based on the access token for this process. Then create a new process for the app with this access token.
Had a comment with the code - More information can be found in the MSDN article called, "Browsing the Web and Reading E-mail safely as an Administrator". However as usual MS has broken the web and the article isn't there any more.
Associated searches found "DropMyRights" app linked on a blog linking to this article which may do what you want, offers up source, but again those links have become broken in the blog page.
you may want to look at functions like
OpenProcessTokenGetTokenInformationCreateRestrictedTokenand privs like
SE_CHANGE_NOTIFY_NAME