Windows 服务器应用程序的 fork/chroot 等效项

fork/chroot equivalent for Windows server application

提问by codebox

I have written a small custom web server application in C running on Linux. When the application receives a request it calls fork() and handles the request in a separate process, which is chrooted into a specific directory containing the files I want to make available.

我用 C 语言编写了一个在 Linux 上运行的小型自定义 Web 服务器应用程序。当应用程序收到请求时，它会调用 fork() 并在一个单独的进程中处理该请求，该进程被 chroot 到包含我想要提供的文件的特定目录中。

I want to port the application to Windows, but neither fork() nor chroot() are available on this platform, and there don't seem to be any direct equivalents. Can you point me to a simple (and preferably well written) example of code that will provide this functionality in Windows? My C isn't all that good, so the simpler the better.

我想将应用程序移植到 Windows，但是在这个平台上 fork() 和 chroot() 都不可用，而且似乎没有任何直接的等价物。您能否指出一个将在 Windows 中提供此功能的简单（并且最好编写得很好）的代码示例？我的 C 不是那么好，所以越简单越好。

回答by Michael Dillon

First of all, the Windows equivalent of chrootis RUNASwhich is documented here. If you need to do this from a program, then studying this C++ source codeshould help you understand how to use the Windows API. It is not precisely the same as chroot()but Windows folk use it to create something like a chroot jail by creating a user with extremely limited permissions and only giving that user read permission on the application folder, and write permission on one folder for data.

首先，Windows 等价物chrootis RUNASwhich is used here。如果您需要从程序中执行此操作，那么研究此 C++ 源代码应该可以帮助您了解如何使用 Windows API。它并不完全相同，chroot()但 Windows 用户使用它来创建类似 chroot jail 的东西，方法是创建一个权限极其有限的用户，并且只授予该用户对应用程序文件夹的读取权限，以及对一个文件夹的数据写入权限。

You probably don't want to exactly emulate fork()on Windows because it doesn't sound like you need to go that far. To understand the Windows API for creating processes and how it differs from fork(), check Mr. Peabody Explains fork(). The actual current source code for Cygwin's fork implementationshows you the current state of the art.

您可能不想fork()在 Windows上完全模拟，因为听起来您不需要走那么远。要了解用于创建进程的 Windows API 以及它与 的区别fork()，请查看皮博迪先生解释 fork()。Cygwin 的 fork 实现的实际当前源代码向您展示了当前的技术状态。

The Microsoft documentation for CreateProcess()and CreateThread()are the place to look for more info on the differences between them.

Microsoft 文档CreateProcess()和CreateThread()是查找有关它们之间差异的更多信息的地方。

And finally, if you don't want to learn all the nitty-gritty platform details, just write portable programs that work on Windows and Unix, why not just use the Apache Portable Runtime libraryitself. Here are some docs on process creation with some sample code, in C, to create a new process.

最后，如果您不想了解所有基本的平台细节，只需编写可在 Windows 和 Unix 上运行的可移植程序，为什么不直接使用Apache Portable Runtime 库本身。这里有一些关于进程创建的文档，其中包含一些示例代码，用 C编写，用于创建新进程。

回答by sharptooth

There's no such thing as fork()on Windows. You need to call CreateProcess()- this will start a separate process (mostly equivalent to calling fork()and then immediately exec()for the spawned process) and pass the parameters to it somehow. Since you seem to have all the data to process in a dedicated directory you can make use of lpCurrentDirectoryparameter of CreateProcess()- just pass the directory path you previously used with chroot()there.

fork()在 Windows上没有这样的东西。您需要调用CreateProcess()- 这将启动一个单独的进程（主要相当于调用fork()然后立即exec()为生成的进程调用）并以某种方式将参数传递给它。由于您似乎在专用目录中拥有要处理的所有数据，因此您可以使用lpCurrentDirectory参数 of CreateProcess()- 只需传递您之前在chroot()那里使用的目录路径即可。

回答by Prof. Falken contract breached

The absolutely simplest way of doing it is using Cygwin, the free Unix emulation layer for Windows. Download it and install a complete development environment. (Choose in the installer.) If you are lucky, you will be able to compile your program as is, no changes at all.

最简单的方法是使用Cygwin，这是Windows 的免费 Unix 仿真层。下载并安装完整的开发环境。（在安装程序中选择。）如果幸运的话，您将能够按原样编译程序，无需任何更改。

Of course there are downsides and some might consider this "cheating" but you asked for the simplest solution.

当然有缺点，有些人可能会认为这是“作弊”，但您要求最简单的解决方案。

回答by Chris J

Without using a compatibility framework (Interix, Cygwin, ...) you're looking at using the Windows paradigm for this sort of thing.

在不使用兼容性框架（Interix、Cygwin 等）的情况下，您正在考虑使用 Windows 范式来处理此类事情。

fork/vfork is a cheap operation on UNIXes, which is why it's used often compared to multi-threading. the Windows equivalent - CreateProcess()- is by comparison an expensive operation, and for this reason you should look at using threads instead, creating them with CreateThread(). There's a lot of example code out there for CreateThread().

fork/vfork 在 UNIX 上是一种廉价的操作，这就是与多线程相比它经常被使用的原因。与 Windows 等效 -CreateProcess()相比之下，这是一项昂贵的操作，因此您应该考虑使用线程，并使用CreateThread(). 有很多示例代码可以用于CreateThread().

In terms of chroot(), Windows doesn't have this concept. There's libraries out there that claim to emulate what you need. However it depends why you want to chroot in the first place.

就 而言chroot()，Windows 没有这个概念。有一些图书馆声称可以模拟你需要的东西。但是，这取决于您首先要 chroot 的原因。

Reading comments, if it's simply to stop people going up the tree with ../../../../(etc), chroot would do the job, but it's no substitue for parsing input in the first place and making sure it's sane: i.e., if too many parents are specified, lock the user into a known root directory. Apache almost certainly does this as I've never had to create a chroot() environment for Apache to work...

阅读评论，如果只是为了阻止人们用../../../../（等）爬上树，chroot 可以完成这项工作，但它不能替代首先解析输入并确保它是理智的：即，如果指定了太多的父母，将用户锁定在已知的根目录中。Apache 几乎可以肯定会这样做，因为我从未需要为 Apache 创建一个 chroot() 环境才能工作......

回答by JesperE

Using fork/chroot is simply not how things are done on Windows. If you are concerned about security in subprocesses, maybe some form of virtualization or sandboxing is what you want to use. Passing complex information to the subprocess can be done by some form of RPC-solution.

使用 fork/chroot 根本不是 Windows 上的工作方式。如果您担心子进程中的安全性，也许您想要使用某种形式的虚拟化或沙箱。可以通过某种形式的 RPC 解决方案将复杂信息传递给子流程。

It sounds to me as if you have designed your application in the Unix way, and now you want to run in on Windows without having to change anything. In that case, you may want to consider using Cygwin, but I'm not sure if/how Cygwin emulates chroot.

在我看来，您的应用程序似乎是以 Unix 方式设计的，现在您想在 Windows 上运行而无需更改任何内容。在这种情况下，您可能需要考虑使用Cygwin，但我不确定 Cygwin 是否/如何模拟chroot.

回答by Sanjaya R

Consider SUA ( aka Windows Services for Unix ). It has nearly everything you need to port applications.

考虑 SUA（也就是 Unix 的 Windows 服务）。它几乎拥有移植应用程序所需的一切。

man chroot(interix)

人 chroot(interix)