沙箱 job

// OJTest.cpp : Defines the entry point for the console application.
//VC6下调试通过，可以限制时间进行程序的关闭。


#include "stdafx.h"
#define   _WIN32_WINNT   0X500
#include   <windows.h> 
#include "stdio.h"
typedef struct MY_JOBOBJECT_BASIC_LIMIT_INFORMATION {
  LARGE_INTEGER PerProcessUserTimeLimit;
  LARGE_INTEGER PerJobUserTimeLimit;
  DWORD LimitFlags;
  SIZE_T MinimumWorkingSetSize;
  SIZE_T MaximumWorkingSetSize;
  DWORD ActiveProcessLimit;
  unsigned long Affinity;
  DWORD PriorityClass;
  DWORD SchedulingClass;
} MY_JOBOBJECT_BASIC_LIMIT_INFORMATION, *MY_PJOBOBJECT_BASIC_LIMIT_INFORMATION;
int   main(int   argc,   char   *argv[]) 
{ 
SetLastError(0);


// Check if we are not already associated with a job.
// If this is the case, there is no way to switch to
// another job.
// Create a job kernel object.
HANDLE hjob = CreateJobObject(NULL,
TEXT("Wintellect_RestrictedProcessJob"));
// Place some restrictions on processes in the job.
// First, set some basic restrictions.
MY_JOBOBJECT_BASIC_LIMIT_INFORMATION jobli = { 0 };

// The process always runs in the idle priority class.
jobli.PriorityClass = IDLE_PRIORITY_CLASS;
// The job cannot use more than 1 second of CPU time.
jobli.PerJobUserTimeLimit.QuadPart = 1000000; // 1 sec in 100-ns intervals
// These are the only 2 restrictions I want placed on the job (process).
jobli.LimitFlags = JOB_OBJECT_LIMIT_PRIORITY_CLASS
| JOB_OBJECT_LIMIT_JOB_TIME;
BOOL bBasicInfo = SetInformationJobObject(hjob, JobObjectBasicLimitInformation, &jobli,
sizeof(jobli));
printf("%d",sizeof(jobli));
if(bBasicInfo)
{
printf("基本信息绑定成功\n");
}
// Second, set some UI restrictions.
JOBOBJECT_BASIC_UI_RESTRICTIONS jobuir;
jobuir.UIRestrictionsClass = JOB_OBJECT_UILIMIT_NONE; // A fancy zero
// The process can't log off the system.
jobuir.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_EXITWINDOWS;
// The process can't access USER objects (such as other windows)
// in the system.
jobuir.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_HANDLES;
BOOL bUIInfo = SetInformationJobObject(hjob, JobObjectBasicUIRestrictions, &jobuir,
sizeof(jobuir));
if(bUIInfo)
{
printf("UI信息设定成功\n");
}
// Spawn the process that is to be in the job.
// Note: You must first spawn the process and then place the process in
// the job. This means that the process’ thread must be initially
// suspended so that it can’t execute any code outside of the job's
// restrictions.
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;

BOOL bResult =
CreateProcess(
NULL, "code.exe", NULL, NULL, FALSE,
CREATE_SUSPENDED , NULL, NULL, &si, &pi);
// Place the process in the job.
// Note: If this process spawns any children, the children are
// automatically part of the same job.
BOOL bAssign = AssignProcessToJobObject(hjob, pi.hProcess);
// Now we can allow the child process' thread to execute code.
if(bAssign)
{
printf("绑定成功");
}
ResumeThread(pi.hThread);
CloseHandle(pi.hThread);

// Wait for the process to terminate or
// for all the job's allotted CPU time to be used.
HANDLE h[2];
h[0] = pi.hProcess;
h[1] = hjob;
DWORD dw = WaitForMultipleObjects(2, h, FALSE, INFINITE);
switch (dw - WAIT_OBJECT_0) {
case 0:
// The process has terminated...
printf("The process has terminated...");
break;
case 1:
// All of the job's allotted CPU time was used...
printf("The process has terminated...");
break;
}

printf("%d",GetLastError());

// Clean up properly.
CloseHandle(pi.hProcess);
CloseHandle(hjob);


return 0;
}