Thread: Limit process privileges

I'm using (well tinkering with) VirtualBox
Currently with Vista as host, and XP as guest.
The snapshot feature is really nice. You could run each test in a new clean VM.


> That's not including any header-file, but causes bad effects on the system if it's succeeding.
DeleteFileA would still show up as unresolved at the link stage.
Do 'nm' on the intermediate .o file, and if there is ANYTHING you don't like, then don't link it and run it.

Comparison of platform virtual machines - Wikipedia, the free encyclopedia
Compare your host/guest matchups for what you want to do.

Another idea is a sandbox
http://en.wikipedia.org/wiki/Sandbox...e_development)

>> http://en.wikipedia.org/wiki/Sandbox...re_development)

Missed the right paren in the link.

>> I'm using (well tinkering with) VirtualBox. Currently with Vista as host, and XP as guest. The snapshot feature is really nice. You could run each test in a new clean VM.

Scratch Virtual PC, VirtualBox looks much better (and it's OpenSource!). I don't have time to set it up at the moment - keep us posted on whether it's any good or not, if you don't mind.

Originally Posted by Salem

> That's not including any header-file, but causes bad effects on the system if it's succeeding.
DeleteFileA would still show up as unresolved at the link stage.
Do 'nm' on the intermediate .o file, and if there is ANYTHING you don't like, then don't link it and run it.

But now we're back to the "You have to have a complete blacklist of anything you don't like" situation, which is what you recommended against earlier, because it is highly likely to be incomplete.

--
Mats

The most common (simple) way to get data to/from a virtual machine is to have a network drive which contains the stuff you want to get in/out of the virtual machine. Since a network drive can be any directory on another machine (such as the host machine), you can quite easily restrict what can be accessed there (and since the drive supposedly only contains THIS students files, there is no benefit/value, even in a sadistic mindset, in destroying that content).

--
Mats

I suppose the SIMPLE version would be: for every submission do:

Code:

copy template_virtual_image %USER%_virtual_image
copy sources somewhere_on_network
copy script somewhere_on_network
start %USER%_virtual_image
wait for result to appear

If the script stores a file somewhere to indicate that the process is complete [compiled and executed or compiler errors], then you can check for that. If no result after X seconds, kill the virtual machine (something obviously went wrong, e.g. infinite loop).

The only problem here is that the template virtual machine would be rather large image (a few gigabytes, probably). So it may be better to only do that if there is evidence that the virtual machine is corrupted.

--
Mats

So basically, my best chances are:

1. run nm on the resulting executable and check for anything suspicious. Assuming I have an exhaustive list, how safe is this? if I remove all the windows.h etc headers, will I be safe if I block everything I don't want to allow that shows up in nm? Also, someone mentioned I can check the fopen arguments. How can I do this?

About getting a list of what I'd WANT to allow, would making a test program that includes all of the C and C++ STL headers and running nm on that and using that as a basis work? What exactly does nm show? All the linked functions?

2. run the exe on a virtual machine. I'm still a bit unclear as to how this would work, exactly, but I'll be looking into it.

Thank you for all your help so far .

>> run nm on the resulting executable and check for anything suspicious. Assuming I have an exhaustive list, how safe is this? if I remove all the windows.h etc headers, will I be safe if I block everything I don't want to allow that shows up in mn? Also, someone mentioned I can check the fopen arguments. How can I do this?

Again, this effectively gives you 0% security.

>> run the exe on a virtual machine. I'm still a bit unclear as to how this would work, exactly, but I'll be looking into it.

That's about as good as it gets.

>> Why would that give me 0% security?

Simply put, under Windows, every single C library function that accesses the OS ultimately calls a function from within some DLL. These DLL's can be accessed without incuding a *single* header (and thus object) file. So, basically, all of your efforts would be completely in vain. To use a simple analogy: it's as if you were to build a very tall electric fence around a flock of birds; it may look quite secure, but is it really?

You can effectively disable system() and any other process creation function for a given process by assigning it to a Job with an active process limit of 1.

Code:

// parent
#include <windows.h>
#include <iostream>
int main()
{
    HANDLE hJob = CreateJobObject(NULL, NULL);
    if(hJob)
    {
        JOBOBJECT_BASIC_LIMIT_INFORMATION jbli = {0};
        jbli.LimitFlags = JOB_OBJECT_LIMIT_ACTIVE_PROCESS;
        jbli.ActiveProcessLimit = 1;
        if(SetInformationJobObject(hJob, JobObjectBasicLimitInformation, &jbli, sizeof(jbli)))
        {
            PROCESS_INFORMATION pi = {0};
            STARTUPINFO si = {sizeof(si), 0};
            if(CreateProcess("child.exe", NULL, NULL, NULL, FALSE, 
                                       CREATE_SUSPENDED, NULL, NULL, &si, &pi))
            {
                if(AssignProcessToJobObject(hJob, pi.hProcess))
                {
                     std::cout << "Proc in job\n";
                     if(ResumeThread(pi.hThread) == MAXDWORD)
                     {
                         std::cout << "But failed to resume\n";
                         TerminateProcess(pi.hProcess, 0);
                     }
                }
                else
                {
                    std::cout << "Job failed - " << GetLastError() << '\n';
                    TerminateProcess(pi.hProcess, 0);
                }
                CloseHandle(pi.hProcess);
                CloseHandle(pi.hThread);
            }
        }
        CloseHandle(hJob);
    }
    return 0;
}

// child
#include <windows.h>
#include <iostream>

int __cdecl main()
{
    PROCESS_INFORMATION pi = {0};
    STARTUPINFO si = {sizeof(si), 0};
    std::cout << "Trying normal: ";
    if(CreateProcess(L"D:\\Windows\\system32\\winver.exe", NULL, 
                              NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
    {
        std::cout << "Created process with pid = " << pi.dwProcessId << '\n';
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    else
    {
        std::cout << "Failed to create process error = " << GetLastError() << '\n';
    }
    std::cout << "Trying breakaway: ";
    if(CreateProcess("D:\\Windows\\system32\\winver.exe", NULL, 
                              NULL, NULL, FALSE, CREATE_BREAKAWAY_FROM_JOB, 
                              NULL, NULL, &si, &pi))
    {
        std::cout << "Created process with pid = " << pi.dwProcessId << '\n';
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    else
    {
        std::cout << "Failed to create process error = " << GetLastError() << '\n';
    }
}

Originally Posted by output

Proc in job
Trying normal: Failed to create process error = 1816 (ERROR_NOT_ENOUGH_QUOTA)
Trying breakaway: Failed to create process error = 5 (ERROR_ACCESS_DENIED)