"Standard I/O only" privileges under Windows

Question

I would like to setup an online judge (automated testing software; takes potentially malicious code and runs a couple of tests on it) on Windows, but such software is usually written for *nix systems, because it's much easier to sandbox code there. Currently it looks like I'll have to write it myself.

1. How to compile C++ code in a way to prevent any behaviour except stdin/stdout?
2. How to run an executable in an environment, which allows it to do stdio only?

I've considered deleting some .lib and header files from Visual Studio standard setup, but I'm afraid it's still techincally possible to execute WinAPI calls.

Also, I could create one more OS user, set some rights in Administration control panel, and runas executables from this user to obtain a "secure" environment, but I'm no good in administration, and don't know if it's possible to give the program stdio rights only.

Answer 1

Since this sort of problem will be the target of some rather "bad" code in all sorts of different aspects, I would suggest that ONE possible solution is to use a virtual machine to run the "foreign" code. So, rather than building your server software that does stuff on the real hardware (and potentially messes up or takes over the machine for malicious purposes), you run the code on a virtual machine that has limited resources and strict rules. Once the "result" is complete, you shut down that VM, and start over with a "fresh" VM (created by cloning an previously constructed VM).

And yes, deleting lib's and headers certainly won't stop someone from using calls/functions you don't want to be used. It will make it a tiny bit harder, but only a tiny bit. Most of the "harmful" calls are in the system win32.dll that you also need for system I/O and such things.