JobObject.c File Reference

#include "precomp.h"

Include dependency graph for JobObject.c:

Go to the source code of this file.

Macros
#define	JOB_LIMITEDUSER_UI
#define	JOB_LOCKDOWN_UI

Functions
static BOOL	SetRestrictions (_In_ HANDLE hJob, _In_ ULONG Restrictions)
static void	test_RoundTrip (void)
static void	test_InvalidParameters (void)
static void	test_Access (void)
static void	test_SandboxPolicies (void)
	START_TEST (JobObject)

Variables
static const ULONG	SingleRestrictions []

Macro Definition Documentation

JOB_LIMITEDUSER_UI

#define JOB_LIMITEDUSER_UI

Value:

                            (JOB_OBJECT_UILIMIT_DISPLAYSETTINGS | \
                            JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS| \
                            JOB_OBJECT_UILIMIT_DESKTOP         | \
                            JOB_OBJECT_UILIMIT_EXITWINDOWS)

Definition at line 15 of file JobObject.c.

JOB_LOCKDOWN_UI

#define JOB_LOCKDOWN_UI

Value:

                         (JOB_LIMITEDUSER_UI                 | \
                         JOB_OBJECT_UILIMIT_WRITECLIPBOARD  | \
                         JOB_OBJECT_UILIMIT_READCLIPBOARD   | \
                         JOB_OBJECT_UILIMIT_HANDLES         | \
                         JOB_OBJECT_UILIMIT_GLOBALATOMS)

Definition at line 20 of file JobObject.c.

Function Documentation

SetRestrictions()

static BOOL SetRestrictions ( _In_ HANDLE  hJob, _In_ ULONG  Restrictions  )

static

Definition at line 40 of file JobObject.c.

{
    JOBOBJECT_BASIC_UI_RESTRICTIONS Info;
 
    Info.UIRestrictionsClass = Restrictions;
    return SetInformationJobObject(hJob,
                                   JobObjectBasicUIRestrictions,
                                   &Info,
                                   sizeof(Info));
}

Referenced by test_Access(), test_InvalidParameters(), test_RoundTrip(), and test_SandboxPolicies().

START_TEST()

START_TEST

(

JobObject

)

Definition at line 394 of file JobObject.c.

{
    test_RoundTrip();
    test_InvalidParameters();
    test_Access();
    test_SandboxPolicies();
}

test_Access()

static void test_Access ( void  )

static

Definition at line 239 of file JobObject.c.

{
    JOBOBJECT_BASIC_UI_RESTRICTIONS Info;
    HANDLE hJob, hQueryOnly;
    BOOL Success;
 
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    hQueryOnly = NULL;
    Success = DuplicateHandle(GetCurrentProcess(),
                              hJob,
                              GetCurrentProcess(),
                              &hQueryOnly,
                              JOB_OBJECT_QUERY,
                              FALSE,
                              0);
    ok(Success != FALSE, "DuplicateHandle failed with %lu\n", GetLastError());
    if (Success)
    {
        SetLastError(0xDEADBEEF);
        Success = SetRestrictions(hQueryOnly, JOB_OBJECT_UILIMIT_HANDLES);
        ok(Success == FALSE, "Setting restrictions through a query handle succeeded\n");
        ok_err(ERROR_ACCESS_DENIED);
 
        memset(&Info, 0xAA, sizeof(Info));
        Success = QueryInformationJobObject(hQueryOnly,
                                            JobObjectBasicUIRestrictions,
                                            &Info,
                                            sizeof(Info),
                                            NULL);
        ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
        ok_long(Info.UIRestrictionsClass, 0);
 
        CloseHandle(hQueryOnly);
    }
 
    CloseHandle(hJob);
}

Referenced by START_TEST().

test_InvalidParameters()

static void test_InvalidParameters ( void  )

static

Definition at line 164 of file JobObject.c.

{
    JOBOBJECT_BASIC_UI_RESTRICTIONS Info;
    HANDLE hJob;
    DWORD Returned;
    BOOL Success;
 
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    /* Undefined bits must be rejected, and must not be stored */
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, 0xDEAD0000);
    ok(Success == FALSE, "Setting undefined restrictions succeeded\n");
    ok_err(ERROR_INVALID_PARAMETER);
 
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_OBJECT_UILIMIT_ALL | 0x100);
    ok(Success == FALSE, "Setting one undefined bit succeeded\n");
    ok_err(ERROR_INVALID_PARAMETER);
 
    memset(&Info, 0xAA, sizeof(Info));
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        NULL);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, 0);
 
    /* The class is fixed length in both directions */
    Info.UIRestrictionsClass = JOB_OBJECT_UILIMIT_HANDLES;
    SetLastError(0xDEADBEEF);
    Success = SetInformationJobObject(hJob,
                                      JobObjectBasicUIRestrictions,
                                      &Info,
                                      sizeof(Info) - 1);
    ok(Success == FALSE, "SetInformationJobObject with a short buffer succeeded\n");
    ok_err(ERROR_BAD_LENGTH);
 
    SetLastError(0xDEADBEEF);
    Success = SetInformationJobObject(hJob,
                                      JobObjectBasicUIRestrictions,
                                      &Info,
                                      sizeof(Info) + 1);
    ok(Success == FALSE, "SetInformationJobObject with a long buffer succeeded\n");
    ok_err(ERROR_BAD_LENGTH);
 
    Returned = 0;
    SetLastError(0xDEADBEEF);
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info) - 1,
                                        &Returned);
    ok(Success == FALSE, "QueryInformationJobObject with a short buffer succeeded\n");
    ok_err(ERROR_BAD_LENGTH);
 
    /* An inaccessible buffer must be reported, not raised */
    SetLastError(0xDEADBEEF);
    Success = SetInformationJobObject(hJob,
                                      JobObjectBasicUIRestrictions,
                                      NULL,
                                      sizeof(Info));
    ok(Success == FALSE, "SetInformationJobObject with a NULL buffer succeeded\n");
    ok_err(ERROR_NOACCESS);
 
    CloseHandle(hJob);
}

Referenced by START_TEST().

test_RoundTrip()

static void test_RoundTrip ( void  )

static

Definition at line 55 of file JobObject.c.

{
    JOBOBJECT_BASIC_UI_RESTRICTIONS Info;
    HANDLE hJob;
    DWORD Returned;
    BOOL Success;
    ULONG i;
 
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    /* A fresh job restricts nothing */
    memset(&Info, 0xAA, sizeof(Info));
    Returned = 0;
    SetLastError(0xDEADBEEF);
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        &Returned);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, 0);
    ok_long(Returned, sizeof(Info));
 
    /* Every flag on its own, so one mistake cannot hide behind the others */
    for (i = 0; i < _countof(SingleRestrictions); i++)
    {
        SetLastError(0xDEADBEEF);
        Success = SetRestrictions(hJob, SingleRestrictions[i]);
        ok(Success != FALSE, "Setting 0x%lx failed with %lu\n",
           SingleRestrictions[i], GetLastError());
        if (Success == FALSE)
        {
            /* Everything below only means something once it is set */
            skip("0x%lx could not be set\n", SingleRestrictions[i]);
            continue;
        }
 
        memset(&Info, 0xAA, sizeof(Info));
        Returned = 0;
        Success = QueryInformationJobObject(hJob,
                                            JobObjectBasicUIRestrictions,
                                            &Info,
                                            sizeof(Info),
                                            &Returned);
        ok(Success != FALSE, "Querying 0x%lx failed with %lu\n",
           SingleRestrictions[i], GetLastError());
        if (Success == FALSE)
        {
            skip("0x%lx could not be queried\n", SingleRestrictions[i]);
        }
        else
        {
            ok_long(Info.UIRestrictionsClass, SingleRestrictions[i]);
            ok_long(Returned, sizeof(Info));
        }
 
        /* Back to nothing, which drops the per-job state win32k keeps */
        SetLastError(0xDEADBEEF);
        Success = SetRestrictions(hJob, 0);
        ok(Success != FALSE, "Clearing 0x%lx failed with %lu\n",
           SingleRestrictions[i], GetLastError());
        if (Success == FALSE)
        {
            /* The job stays restricted, so the round after this one would be
               starting from the wrong place */
            skip("0x%lx could not be cleared\n", SingleRestrictions[i]);
            continue;
        }
 
        memset(&Info, 0xAA, sizeof(Info));
        Success = QueryInformationJobObject(hJob,
                                            JobObjectBasicUIRestrictions,
                                            &Info,
                                            sizeof(Info),
                                            NULL);
        ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
        if (Success != FALSE)
            ok_long(Info.UIRestrictionsClass, 0);
    }
 
    /* All of them at once */
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_OBJECT_UILIMIT_ALL);
    ok(Success != FALSE, "Setting JOB_OBJECT_UILIMIT_ALL failed with %lu\n", GetLastError());
 
    memset(&Info, 0xAA, sizeof(Info));
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        NULL);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, JOB_OBJECT_UILIMIT_ALL);
 
    /* Setting the same value twice is not an error */
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_OBJECT_UILIMIT_ALL);
    ok(Success != FALSE, "Setting the same restrictions again failed with %lu\n",
       GetLastError());
 
    /* Close it while still restricted, to exercise the delete path */
    CloseHandle(hJob);
}

Referenced by START_TEST().

test_SandboxPolicies()

static void test_SandboxPolicies ( void  )

static

Definition at line 288 of file JobObject.c.

{
    JOBOBJECT_EXTENDED_LIMIT_INFORMATION ExtendedLimit;
    JOBOBJECT_BASIC_UI_RESTRICTIONS Info;
    HANDLE hJob;
    BOOL Success;
 
    /* sandbox::Job::Init(JOB_LOCKDOWN) */
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    memset(&ExtendedLimit, 0, sizeof(ExtendedLimit));
    ExtendedLimit.BasicLimitInformation.LimitFlags =
        JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION |
        JOB_OBJECT_LIMIT_ACTIVE_PROCESS |
        JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
    ExtendedLimit.BasicLimitInformation.ActiveProcessLimit = 1;
 
    SetLastError(0xDEADBEEF);
    Success = SetInformationJobObject(hJob,
                                      JobObjectExtendedLimitInformation,
                                      &ExtendedLimit,
                                      sizeof(ExtendedLimit));
    ok(Success != FALSE, "Setting the lockdown limits failed with %lu\n", GetLastError());
 
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_LOCKDOWN_UI);
    ok(Success != FALSE, "Setting the lockdown restrictions failed with %lu\n",
       GetLastError());
 
    memset(&Info, 0xAA, sizeof(Info));
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        NULL);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, JOB_LOCKDOWN_UI);
 
    CloseHandle(hJob);
 
    /* Job::Init(JobLevel::kLimitedUser), which does not take kLockdown's four */
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    memset(&ExtendedLimit, 0, sizeof(ExtendedLimit));
    ExtendedLimit.BasicLimitInformation.LimitFlags =
        JOB_OBJECT_LIMIT_ACTIVE_PROCESS |
        JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
    ExtendedLimit.BasicLimitInformation.ActiveProcessLimit = 1;
 
    SetLastError(0xDEADBEEF);
    Success = SetInformationJobObject(hJob,
                                      JobObjectExtendedLimitInformation,
                                      &ExtendedLimit,
                                      sizeof(ExtendedLimit));
    ok(Success != FALSE, "Setting the limited user limits failed with %lu\n", GetLastError());
 
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_LIMITEDUSER_UI);
    ok(Success != FALSE, "Setting the limited user restrictions failed with %lu\n",
       GetLastError());
 
    memset(&Info, 0xAA, sizeof(Info));
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        NULL);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, JOB_LIMITEDUSER_UI);
 
    CloseHandle(hJob);
 
    /*
     * job.cc applies the caller's exceptions as
     * jbur.UIRestrictionsClass &= ~ui_exceptions before its single
     * SetInformationJobObject, so a delegate that excepts everything away asks
     * for a mask of zero. That has to be accepted, not refused.
     */
    hJob = CreateJobObjectW(NULL, NULL);
    ok(hJob != NULL, "CreateJobObject failed with %lu\n", GetLastError());
    if (hJob == NULL)
        return;
 
    SetLastError(0xDEADBEEF);
    Success = SetRestrictions(hJob, JOB_LOCKDOWN_UI & ~JOB_OBJECT_UILIMIT_ALL);
    ok(Success != FALSE, "Excepting every restriction away failed with %lu\n",
       GetLastError());
 
    memset(&Info, 0xAA, sizeof(Info));
    Success = QueryInformationJobObject(hJob,
                                        JobObjectBasicUIRestrictions,
                                        &Info,
                                        sizeof(Info),
                                        NULL);
    ok(Success != FALSE, "QueryInformationJobObject failed with %lu\n", GetLastError());
    ok_long(Info.UIRestrictionsClass, 0);
 
    CloseHandle(hJob);
}

Referenced by START_TEST().

Variable Documentation

SingleRestrictions

const ULONG SingleRestrictions[]

static

Initial value:

=
{
    JOB_OBJECT_UILIMIT_HANDLES,
    JOB_OBJECT_UILIMIT_READCLIPBOARD,
    JOB_OBJECT_UILIMIT_WRITECLIPBOARD,
    JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS,
    JOB_OBJECT_UILIMIT_DISPLAYSETTINGS,
    JOB_OBJECT_UILIMIT_GLOBALATOMS,
    JOB_OBJECT_UILIMIT_DESKTOP,
    JOB_OBJECT_UILIMIT_EXITWINDOWS,
}

Definition at line 26 of file JobObject.c.

Referenced by test_RoundTrip().