ProcessKit API Reference
WindowsUiRestrictions Type
The Windows Job Object **UI restrictions** a process group can impose on its whole tree
(`JOBOBJECT_BASIC_UI_RESTRICTIONS`) — see `ProcessGroupOptions.WithUiRestrictions`.
These are the desktop-side counterpart of the resource caps: where the rest of `ResourceLimits`
bounds what a contained tree may *consume* (and which cores it may consume it on), these bound what
it may *do to the interactive session it happens to share with you* — read or overwrite the
clipboard, change display or system-wide parameters, create or switch desktops, or log the user
off / shut the machine down. A build plugin or a downloaded tool has no business doing any of that, and unlike a
resource cap there is no way to notice after the fact that it did.
A `[
Record fields
| Record Field |
Description
|
|
Every restriction above at once — the "this child has no business touching the desktop session at all" set, and the sensible starting point for a genuinely untrusted child that is not a GUI application.
|
|
Deny creating or switching desktops (`JOB_OBJECT_UILIMIT_DESKTOP`).
|
|
Deny changing display settings through `ChangeDisplaySettings` (`JOB_OBJECT_UILIMIT_DISPLAYSETTINGS`).
|
|
Deny logging the user off, shutting down, or restarting the machine (`JOB_OBJECT_UILIMIT_EXITWINDOWS`) — an untrusted child taking the host down with it is a real and cheap denial of service.
|
|
Give the job its own atom table instead of the global one (`JOB_OBJECT_UILIMIT_GLOBALATOMS`), so a contained child can neither read nor exhaust the session's global atoms.
|
|
Deny the use of USER handles owned by processes *outside* the job (`JOB_OBJECT_UILIMIT_HANDLES`) — the broadest of the set: it stops a contained child from reaching into another process's windows, menus, or hooks. Also the most likely to break a legitimate GUI child, so opt in deliberately.
|
|
No UI restrictions — the default, and what a Job carries unless one is requested.
|
|
Deny reading the clipboard (`JOB_OBJECT_UILIMIT_READCLIPBOARD`) — a child that cannot read it cannot harvest whatever the user last copied (a password out of a password manager, say).
|
|
Deny changing system-wide parameters through `SystemParametersInfo` (`JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS`) — accessibility, input, and desktop settings.
|
|
Deny writing to the clipboard (`JOB_OBJECT_UILIMIT_WRITECLIPBOARD`).
|