Managing Windows Jobs: Grouping Processes and Applying Restrictions

1. Win32 Programming Lesson 8a: Jobs

2. Where are we? • Grouping processes into logical groups: Jobs • However, processes don’t retain a parent-child relationship which can make life difficult… very difficult

3. Jobs • Introduced in Windows 2000 • Based upon the Job Kernel Object • Ability to add restrictions to processes (and groups of processes)

4. CreateJobObject • HANDLE CreateJobObject(     PSECURITY_ATTRIBUTES psa,      PCTSTR pszName);  • Like most calls, we first name our Job Object… can also open an existing object: • HANDLE OpenJobObject(     DWORD dwDesiredAccess,      BOOL bInheritHandle,      PCTSTR pszName); 

5. Placing Restrictions on a Job • Jobs can be restricted in several ways • Resource Limits • UI Limits • Security limits (registry, subkeys, files etc.) • Set by: • BOOL SetInformationJobObject(     HANDLE hJob,    JOBOBJECTINFOCLASS JobObjectInformationClass,    PVOID pJobObjectInformation,     DWORD cbJobObjectInformationLength); 

6. JobObjectInfoClass • Enumerated type setting the limit type • Basic Limit • Extended Basic Limit • Basic UI Restrictions • Security Limit • Defines the type of the 3rd Parameter in the call

7. Basic Limits • typedef struct _JOBOBJECT_BASIC_LIMIT_INFORMATION {     LARGE_INTEGER PerProcessUserTimeLimit;    LARGE_INTEGER PerJobUserTimeLimit;     DWORD         LimitFlags;     DWORD         MinimumWorkingSetSize;     DWORD         MaximumWorkingSetSize;     DWORD         ActiveProcessLimit;     DWORD_PTR     Affinity;     DWORD         PriorityClass;     DWORD         SchedulingClass; } JOBOBJECT_BASIC_LIMIT_INFORMATION, *PJOBOBJECT_BASIC_LIMIT_INFORMATION;

8. Extended Limits • typedef struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION {     JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;     IO_COUNTERS IoInfo;     SIZE_T ProcessMemoryLimit;     SIZE_T JobMemoryLimit;     SIZE_T PeakProcessMemoryUsed;     SIZE_T PeakJobMemoryUsed; } JOBOBJECT_EXTENDED_LIMIT_INFORMATION, *PJOBOBJECT_EXTENDED_LIMIT_INFORMATION;

9. UI Limits • JOB_OBJECT_UILIMIT_EXITWINDOWS Prevents processes from logging off, shutting down, rebooting, or powering off the system via the ExitWindowsEx function • JOB_OBJECT_UILIMIT_READCLIPBOARDPrevents processes from reading the clipboard • JOB_OBJECT_UILIMIT_WRITECLIPBOARDPrevents processes from erasing the clipboard • JOB_OBJECT_UILIMIT_SYSTEMPARAMETERSPrevents processes from changing system parameters via the SystemParametersInfo function • JOB_OBJECT_UILIMIT_DISPLAYSETTINGSPrevents processes from changing the display settings via the ChangeDisplaySettings function • JOB_OBJECT_UILIMIT_GLOBALATOMSGives the job its own global atom table and restricts processes in the job to accessing only the job's table • JOB_OBJECT_UILIMIT_DESKTOPPrevents processes from creating or switching desktops using the CreateDesktop or SwitchDesktop function • JOB_OBJECT_UILIMIT_HANDLESPrevents processes in a job from using USER objects (such as HWNDs) created by processes outside the same job

10. Placing a Process in a Job • BOOL AssignProcessToJobObject(     HANDLE hJob,      HANDLE hProcess);  • Create the job… • Place restrictions on the job… • CreateProcess with CREATE_SUSPENDED • Call AssignProcessToJob • New processes spawned by a job are automatically part of the job

11. Terminating All Processes in A Job • Simple! • BOOL TerminateJobObject(     HANDLE hJob,      UINT uExitCode);

12. Job Accounting • Fairly simple • Uses JOBOBJECT_BASIC_ACCOUNTING_INFORMATION • See http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/isprocessinjob.asp

13. Notifications • It is possible to receive notifications from jobs as they complete, but it’s somewhat complicated • Should be aware of the I/O Completion Port Kernel Object • Example: JobLab example application