A job object is a nameable, securable, shareable kernel object that allows control of one or more processes as a group. A job object's basic function is to allow groups of processes to be managed and manipulated as a unit. A process can be a member of only one job object. By default, its association with the job object can't be broken and all processes created by the process and its descendents are associated with the same job object as well. The job object also records basic accounting information for all processes associated with the job and for all processes that were associated with the job but have since terminated. Table 6-20 lists the Win32 functions to create and manipulate job objects.
Table 6-20 Win32 API Functions for Jobs
|CreateJobObject||Creates a job object (with an optional name)|
|OpenJobObject||Opens an existing job object by name|
|AssignProcessToJobObject||Adds a process to a job|
|TerminateJobObject||Terminates all processes in a job|
|QueryInformationJobObject||Retrieves information about the job, such as CPU time, page fault count, number of processes, list of process IDs, quotas or limits, and security limits|
The following are some of the CPU-related and memory-related limits you can specify for a job:
|Scheduling Class||Quantum Units|
|9||Infinite if real-time; 60 otherwise|
Jobs can also be set to queue an entry to an I/O completion port object, which other threads might be waiting on with the Win32 GetQueuedCompletionStatus function.
You can also place security limits on processes in a job. You can set a job such that each process runs under the same jobwide access token. You can then create a job to restrict processes from impersonating or creating processes that have access tokens that contain the local administrator's group. In addition, you can apply security filters such that when threads in processes contained in a job impersonate client threads, certain privileges and security IDs (SIDs) can be eliminated from the impersonation token.
Finally, you can also place user interface limits on processes in a job. Such limits include being able to restrict processes from opening handles to windows owned by threads outside the job, reading and/or writing to the clipboard, and changing the many user interface system parameters via the Win32 SystemParametersInfo function.
Windows 2000 Datacenter Server has a tool called the Process Control Manager that allows an administrator to define job objects, the various quotas and limits that can be specified for a job, and which processes, if run, should be added to the job. A service component monitors process activity and adds the specified processes to the jobs.
Viewing the Job Object
You can view named job objects with the Performance tool. (See the Job Object and Job Object Details performance objects.) To view unnamed job objects, you must use the kernel debugger !job command. Follow these steps to create and view an unnamed job object:
- From the command prompt, use the runas command to create a process running the command prompt (Cmd.exe). For example, type runas /user:<domain>\< username> cmd. You'll be prompted for your password. Enter your password, and a command prompt window will appear. The service behind the runas command creates an unnamed job to contain all processes (so that it can terminate these processes at logoff time).
- From the kernel debugger (such as LiveKd), display the process list with !process and find the recently created process running Cmd.exe. Then display the process block by using !process <process ID>, find the address of the job object, and finally display the job object with the !job command.
Here's some partial debugger output from the command sequence described in step 2:
kd> !process 0 8 **** NT ACTIVE PROCESS DUMP **** PROCESS 84eab6d0 SessionId: 0 Cid: 0478 Peb: 7ffdf000 ParentCid: 0240 DirBase: 03834000 ObjectTable: 8097ef88 TableSize: 42. Image: livekd.exe PROCESS 857e0d70 SessionId: 0 Cid: 0550 Peb: 7ffdf000 ParentCid: 00dc DirBase: 05337000 ObjectTable: 82273ac8 TableSize: 22. Image: cmd.exe PROCESS 83390710 SessionId: 0 Cid: 0100 Peb: 7ffdf000 ParentCid: 0478 DirBase: 05b3b000 ObjectTable: 81bb7e08 TableSize: 34. Image: i386kd.exe kd> !process 550 Searching for Process with Cid == 550 PROCESS 857e0d70 SessionId: 0 Cid: 0550 Peb: 7ffdf000 ParentCid: 00dc DirBase: 05337000 ObjectTable: 82273ac8 TableSize: 22. Image: cmd.exe Job 85870970 kd> !job 85870970 7 Job at 85870970 TotalPageFaultCount 0 TotalProcesses 1 ActiveProcesses 1 TotalTerminatedProcesses 0 LimitFlags 0 MinimumWorkingSetSize 0 MaximumWorkingSetSize 0 ActiveProcessLimit 0 PriorityClass 0 UIRestrictionsClass 0 SecurityLimitFlags 0 Token 0 Processes assigned to this job: PROCESS 857e0d70 SessionId: 0 Cid: 0550 Peb: 7ffdf000 ParentCid: 00dc DirBase: 05337000 ObjectTable: 82273ac8 TableSize: 22. Image: cmd.exe