blob: 56dbb4c7921148d64375db15a2a344db378e8a8a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
// Copyright Epic Games, Inc. All Rights Reserved.
#pragma once
#include "localrunner.h"
#if ZEN_WITH_COMPUTE_SERVICES && ZEN_PLATFORM_WINDOWS
# include <zencore/windows.h>
# include <string>
namespace zen::compute {
/** Windows process runner using CreateProcessW for executing worker executables.
Subclasses LocalProcessRunner, reusing sandbox management, worker manifesting,
input/output handling, and monitor thread infrastructure. Overrides only the
platform-specific methods: process spawning, sweep, and cancellation.
When Sandboxed is true, child processes are isolated using a Windows AppContainer:
no network access (AppContainer blocks network by default when no capabilities are
granted) and no filesystem access outside explicitly granted sandbox and worker
directories. This requires no elevation.
*/
class WindowsProcessRunner : public LocalProcessRunner
{
public:
WindowsProcessRunner(ChunkResolver& Resolver,
const std::filesystem::path& BaseDir,
DeferredDirectoryDeleter& Deleter,
WorkerThreadPool& WorkerPool,
bool Sandboxed = false);
~WindowsProcessRunner();
[[nodiscard]] SubmitResult SubmitAction(Ref<RunnerAction> Action) override;
void SweepRunningActions() override;
void CancelRunningActions() override;
private:
void GrantAppContainerAccess(const std::filesystem::path& Path, DWORD AccessMask);
bool m_Sandboxed = false;
PSID m_AppContainerSid = nullptr;
std::wstring m_AppContainerName;
};
} // namespace zen::compute
#endif
|