如果我创建了一个进程,是否意味着我总能终止它?

If I created a process, does it mean that I will always be able to terminate it?

比如说,如果我使用 CreateProcess or CreateProcessAsUser APIs, does it means that calling TerminateProcess(PROCESS_INFORMATION.hProcess) 创建了一个进程,那么无论我的主机进程处于什么上下文 运行 中(低特权用户,内置客人等)?

我还没有测试过,但根据文档,您应该始终能够使用 PROCESS_INFORMATION 中的句柄 return 成功终止进程。在 Windows 安全模型中,权限通常仅针对正在使用的句柄进行检查,仅此而已。根据 Process Security and Access Rights 上的 MSDN 文档:

The handle returned by the CreateProcess function has PROCESS_ALL_ACCESS access to the process object.

CreateProcessAsUser 的文档支持这一点:

This security descriptor may not allow access for the caller, in which case the process may not be opened again after it is run. The process handle is valid and will continue to have full access rights.

TerminateProcess 文档中给出的唯一权限要求是:

The handle must have the PROCESS_TERMINATE access right.

因此 CreateProcess 和 CreateProcessAsUser 的任何句柄 return 都应该具有必要且足够的访问权限,以允许使用 TerminateProcess 终止新进程。