nccgroup/windowsjoblockJob Objectsを使用したWindowsプロセスロックダウンツール
ジョブ オブジェクトを使用するMicrosoft Windowsプロセスロックダウンツール
NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.com/
開発者: Ollie Whitehouse (ollie dot whitehouse at nccgroup dot com)
https://github.com/nccgroup/WindowsJobLock
AGPLのもとでリリース。詳細はLICENSEを参照
参照 - http://msdn.microsoft.com/en-us/library/windows/desktop/ms684161(v=vs.85).aspx
Chromeでの使用 - http://src.chromium.org/viewvc/chrome/trunk/src/sandbox/win/src/job.cc
[*] A Microsoft Windows Process Lockdown Tool using Job Objects - https://github.com/nccgroup/WindowsJobLock
[*] NCC Group Plc - http://www.nccgroup.com/
[*] -h for help
i.e. Win.JobLock.exe [-h]
[.General Settings / Options.]
-g - Get process list
-P <name> - Process name to apply the job to
-p <PID> - PID to apply the job to
-n <name> - What the job will be called (optional)
[.Process Limits.]
-l <number> - Limit the number of process to this many
[.Memory.]
-m <bytes> - Limit the total memory in bytes for the entire job
-M <bytes> - Limit the total memory in bytes for each process in the job
[.Process Control.]
-k - Kill all process when the job handle dies
-B - Allow child process to be created with CREATE_BREAKAWAY_FROM_JOB (weak security)
-b - Allow child process which aren't part of the job (weak security)
[.UI Security Controls.]
-d - Prevent processes within the job from switching or creating desktops
-D - Prevent processes within the job from calling the change display setting function
-x - Prevent processes within the job from calling the exit Windows function
-a - Prevent processes within the job from accessing global atoms
-u - Prevent processes within the job from user user handles
-c - Prevent processes within the job from reading the clipboard
-s - Prevent processes within the job from changing system parameters
-C - Prevent processes within the job from writing the clipboard
この例では、メモ帳への貼り付けや、メモ帳が他のプロセスを生成することを防ぎます :)
C:\>Win.JobLock.exe -P notepad.exe -c -l 1
[*] A Microsoft Windows Process Lockdown Tool using Job Objects - https://github.com/nccgroup/WindowsJobLock
[*] NCC Group Plc - http://www.nccgroup.com/
[*] -h for help
[*] Opened process notepad.exe
[i] Process Limit - True - 1
[i] Job Memory Limit - False - 0
[i] Process Memory Limit - False - 0
[i] Kill Process on Job Close - False
[i] Break Away from Job OK - False
[i] Silent Break Away from Job OK - False
[i] Limit Desktop Operations - False
[i] Limit Display Changes - False
[i] Limit Exit Windows - False
[i] Limit Global Atoms - False
[i] Limit User Handles - False
[i] Limit Reading of Clipboard - True
[i] Limit System Parameter Change - False
[i] Limit Writing to Clipboard - False
[i] Final job name - NONAME
[*] Applied job exended limits to job object
[*] Applied UI limits to job object
[*] Applied UI limits to job object
[*] Applied job object to process!
[*] Successfully built and deployed job object to notepad.exe!