Question

Could someone please help me? I’m trying to create a jobobject with JOB_OBJECT_SECURITY_ONLY_TOKEN but SetInformationJobObject always fails with error code 6 ( Invalid handle ).
Here is my code:

HANDLE Job( CreateJobObject( NULL, NULL ) );
if( !Job )
{
    wprintf( L"Could not create job object, error %d\n", GetLastError() );
    return 1;
}

JOBOBJECT_SECURITY_LIMIT_INFORMATION SecLimit = { 0 };
SecLimit.SecurityLimitFlags = JOB_OBJECT_SECURITY_ONLY_TOKEN;

if ( !SetInformationJobObject( Job, JobObjectSecurityLimitInformation, &SecLimit, sizeof( SecLimit ) ) )
{
    wprintf( L"Could not associate job with IO completion port, error %d\n", GetLastError() );
    return 1;
}

I am trying to run this app on XP!
Thanks!

Answer 1

You haven’t set SecLimit.JobToken to a valid handle to a restricted token. That’s why you’re getting an invalid handle error. If you use the JOB_OBJECT_SECURITY_ONLY_TOKEN flag, SecLimit.JobToken is mandatory.

Unless there is some particular reason why you need to force processes in the job to use a restricted token, don’t use the JOB_OBJECT_SECURITY_ONLY_TOKEN flag.

Note that the article you reference does not in fact say that this flag is required. It only says that if you use this flag the process must be created suspended in order to assign it to the job object.