How to limit file permissions of a program

Question

I am a student that wants to design an online judge system.

I have a problem: In order to keep the server safe, I must make the program not have rights to read or write any files The program is what another user submits through the online judge system. It isn't the sever program itself.

The users of the online judge system submit their source code, then the server program compiles and runs it. So the server program must keep the server safe.

My platform is Windows, I use C++ for my programming.

Can anyone give me some suggestions?

Answer 1

You cannot easily prevent what a program itself does and it is not possible to verify that the program is non-malevolent.

What you can do: Run the program as a user with limited (close to non) access-rights. Your server program needs to become that user and execute the program it has compiled. You possibly want to also use that user-account to actually compile the program (in the unlikely case someone knows how to exploit your compiler).

The windows command to execute a program as a different user is: runas.

Answer 2

You can change the permissions of files and directories, and then use CreateProcessAsUser to run the programs submitted by users as a user with limited (close to non) access-rights.