How to restrict proccess to create new processes?

Question

How to restrict proccess to create new processes?

Answer 1

On Windows, there isn't a way to stop a processing from spawning other processes. Nor is there on any operating system I know of.

The CreateProcess() system call is available to all processes, thus any process can create a child process.

You could run the process in a sandbox which restricts process creation, but the overhead for this is probably more than you want.

Can I ask why you want to do such a thing?

Answer 2

Use NT Job objects

JOBOBJECT_BASIC_LIMIT_INFORMATION can limit the number of active processes, or use JOBOBJECT_ASSOCIATE_COMPLETION_PORT and kill the new process (If you only need to kill a subset of all new processes)

Answer 3

You could assign the process to a job object. Use SetInformationJobObject with the JOB_OBJECT_LIMIT_ACTIVE_PROCESS flag to limit the number of processes in that job object to one. Do NOT set the JOB_OBJECT_LIMIT_BREAKAWAY_OK (which would allow the process to create processes that were not part of the job object).

The process could still work around that, such as by starting a new process via the task scheduler or WMI. If you're trying to do something like create a sandbox to run code you really don't trust, this won't adequate. If you have a program that you trust, but just want to place a few limits on what it does, this should be more than adequate.

To put that slightly differently, this is equivalent to locking your car. Somebody can break in (or out, in this case), but at least they have to do a bit more than just walk in unhindered.