PYTHON | stop user killing process

Question

A very cool function was mentioned here:

Prevent user process from being killed with "End Process" from Process Explorer

Does anyone know how to translate this C++ code to Python (or re-edit it so that it at least compiles in C/C++, assuming that is what it is in):

static const bool ProtectProcess()
{
    HANDLE hProcess = GetCurrentProcess();
    EXPLICIT_ACCESS denyAccess = {0};
    DWORD dwAccessPermissions = GENERIC_WRITE|PROCESS_ALL_ACCESS|WRITE_DAC|DELETE|WRITE_OWNER|READ_CONTROL;
    BuildExplicitAccessWithName( &denyAccess, _T("CURRENT_USER"), dwAccessPermissions, DENY_ACCESS, NO_INHERITANCE );
    PACL pTempDacl = NULL;
    DWORD dwErr = 0;
    dwErr = SetEntriesInAcl( 1, &denyAccess, NULL, &pTempDacl );
    // check dwErr...
    dwErr = SetSecurityInfo( hProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pTempDacl, NULL );
    // check dwErr...
    LocalFree( pTempDacl );
    CloseHandle( hProcess );
    return dwErr == ERROR_SUCCESS;
}

Why would you want to make it harder for a user to terminate a process? — David Heffernan, Nov 28 '11 at 13:21
What do you mean by edit it so that it compiles as C++. Does it not compile? Looks like a pretty easy port to Pythin via ctypes. — David Heffernan, Nov 28 '11 at 13:27

score 2 · Answer 1 · answered Nov 28 '11 at 20:23

Here is a rather crude ctypes translation of the code you posted. It even appears to work! Note that I remove the call to CloseHandle which is simply wrong. You should not call CloseHandle on a pseudo-handle, which is what GetCurrentProcess returns.

from ctypes import *
from ctypes.wintypes import *
from win32con import *

class TRUSTEE(Structure):
    pass

TRUSTEE._fields_ = (
    ('pMultipleTrustee', POINTER(TRUSTEE)),
    ('MultipleTrusteeOperation', c_int),
    ('TrusteeForm', c_int),
    ('TrusteeType', c_int),
    ('ptstrName', LPSTR)
)

class EXPLICIT_ACCESS(Structure):
    _fields_ = (
        ('grfAccessPermissions', DWORD),
        ('grfAccessMode', c_int),
        ('grfInheritance', DWORD),
        ('Trustee', TRUSTEE)
    )

GetCurrentProcess = windll.kernel32.GetCurrentProcess
GetCurrentProcess.restype = HANDLE
hProcess = GetCurrentProcess()

denyAccess = EXPLICIT_ACCESS()
dwAccessPermissions = DWORD(GENERIC_WRITE|PROCESS_ALL_ACCESS|WRITE_DAC|DELETE|WRITE_OWNER|READ_CONTROL);

BuildExplicitAccessWithName = windll.advapi32.BuildExplicitAccessWithNameA
BuildExplicitAccessWithName.restype = None
DENY_ACCESS = 3
NO_INHERITANCE = 0
BuildExplicitAccessWithName(byref(denyAccess), 'CURRENT_USER', dwAccessPermissions, DENY_ACCESS, NO_INHERITANCE)

SetEntriesInAcl = windll.advapi32.SetEntriesInAclA
SetEntriesInAcl.restype = DWORD
SetEntriesInAcl.argtypes = (ULONG, POINTER(EXPLICIT_ACCESS), c_voidp, POINTER(c_voidp))
pTempDacl = c_voidp()
dwErr = SetEntriesInAcl(1, byref(denyAccess), None, byref(pTempDacl));

SetSecurityInfo = windll.advapi32.SetSecurityInfo
SetSecurityInfo.restype = DWORD
SetSecurityInfo.argtypes = (HANDLE, c_int, DWORD, c_voidp, c_voidp, c_voidp, c_voidp)
SE_KERNEL_OBJECT = 6
dwErr = SetSecurityInfo(hProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, None, None, pTempDacl, None);

LocalFree = windll.kernel32.LocalFree
LocalFree.restype = c_voidp
LocalFree.argtypes = (c_voidp,)
LocalFree(pTempDacl)

This works perfectly for me by the way, so I would guess that it is a viable translation. — trevorKirkby, Oct 22 '14 at 00:50
Why can I still close the script on Task Manager after this? Does this still work? (Windows 7 x64, Python 3.6.6 x32) — Edw590, May 08 '19 at 16:58

jsalonen · Answer 2 · 2011-11-28T13:37:33.123

1

How about using ctypes? You could also try pywin32. You could also try using IronPython. For ActivePython there is win32api.

Also, I don't know your reasoning behind why you want to achieve that, which means there is potentially some more elegant solution available.

edited Nov 28 '11 at 13:37

answered Nov 28 '11 at 13:18

jsalonen

29,593
15
91
109

It gives you some pointers from where you can start looking from for more information. The question you are asking is in itself non-trivial, which means you will need to do some non-trivial coding to completely solve it :) Alternatively, you could provide us with a rationale why you want to achieve what you are doing and we could suggest some alternative solutions. – jsalonen Nov 28 '11 at 13:24
I am writing a user productivity module for application usage monitoring - managed by admins - no good if it can be killed by users. I can run as a service, but then all win32gui items fail. This seems like a good / simple alternative. – Ian Nov 28 '11 at 13:32
5

Keep the GUI separate and run as a service. That's the *right* solution. – David Heffernan Nov 28 '11 at 13:36
I can run as a service - but key function calls such as win32gui.GetForegroundWindow fail. – Ian Nov 28 '11 at 14:30
1

@Ian You need two processes. One to perform the admin and logging, and one to show GUI. – David Heffernan Nov 28 '11 at 19:34

PYTHON | stop user killing process

2 Answers2