Strategies for effectively blocking process subprocess generation and revoking permissions(Python)
-
Is there any effective way to prevent a process from spawning children and revoke its permissions? I am seeking a robust approach to entirely block a process's ability to generate subprocesses and, if possible, restrict its permissions and terminate it along with its children. Do you have any suggestions or strategies that could be effective for this purpose?
import psutil
import sys
import ctypes
import time<def is_admin():
try:
return ctypes.windll.shell32.IsUserAnAdmin()
except Exception as e:
print(f'Error checking admin privileges: {e}')
return Falsedef run_as_admin():
try:
ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, " ".join(sys.argv), None, 1)
except Exception as e:
print(f'Error restarting as administrator: {e}')
sys.exit(1)def block_child_creation(process_name):
try:
for process in psutil.process_iter(['pid', 'name']):
if process.info['name'].lower() == process_name.lower():
# Suspend the process
process.suspend()
print(f'The process with PID {process.pid} has been suspended.')# Terminate the process and its children for child in process.children(recursive=True): child.kill() psutil.wait\_procs(process.children(), timeout=5) process.kill() process.wait(5) print(f'The process with PID {process.pid} and its children have been terminated.') break # No need to continue searching after blocking the process # Verificar novamente se o processo foi encerrado for process in psutil.process\_iter(\['pid', 'name'\]): if process.info\['name'\].lower() == process\_name.lower(): print(f'The process {process\_name} is still running.') else: print(f'No process with the name {process\_name}.') break except psutil.NoSuchProcess: print(f'No process with the name {process\_name} found.') except Exception as e: print(f'An unexpected error occurred: {e}')
def main():
try:
if not is_admin():
print("Restarting as administrator!")
run_as_admin()global nome\_processo nome\_processo = input("Enter the name of the process you want to block and terminate with child creation: ") block\_child\_creation(nome\_processo)