Unable to open Job object

Question

Hi, All!
I have one tricky case with Windows Job objects:
First of all, I have one process A, which launches process B, creates job object "Job1", assigns process B to Job1. Purpose of this is to pack all child processes that B might create into a single job, so when it is time to terminate B, I'd call
TerminateJob so it'd close whole process tree - B and its descendants.
However, process A is closed and launched again. It calls OpenProcess to retrieve handle to the B. Now is the tricky part:
I need to access Job1 in order to terminate B and its child processes, as described above. But after process A has been closed, object "Job1" (\BaseNamedObjects\Job1) does no longer exists in Object Manager, since last handle to Job1 was closed.
But internal kernel job structure is still there and it is still bound to the process B! (IsProcessInJob for B reports that + I was able to look at the EPROCESS structure and EJOB linked to it in the windbg; it is same EJOB got assigned after a call to
AssingProcessToJobObject on first run of A).
Now, as conclusion: job object still exists, I can't assign process B to a new job object (logical, as B might have launched child processes while A was not up and running) and I can't access old job object.
My temporary solution is to build tree of B and its descendants manually, cycle through it and call TerminateProcess for each item.
What do you say - is there a way to somehow access Job1?

Answer 1

Thank you for a quick reply!
Unfortunately, I have to support any customers using Windows XP and newer systems.
I guess, you are referring to this line in msdn: If the process is already associated with a job, the job specified by hJob must be empty or... I guess it means, that if I pass hJob=null and valid hProcess, then it associates it back? Interestingly
enough, hJob is not marked as "optional".
Regarding copying handle into B: I was thinking about it. Problem is that B is a third party process (A is kind of governor that runs stuff on regular basis according to a schedule). With DuplicateObject would I need to create B with 'inherit handles' option?
Also, I would then have to pass handle form B to A somehow.
Also, I see there's a function SetHandleInformation. And it can set an option "
HANDLE_FLAG_PROTECT_FROM_CLOSE
0x00000002
If this flag is set, calling the
CloseHandle function will not close the object handle.
I guess that would mean that if process A dies, it wouldn't close handle to Job1 and it would still be in the ObjectManager? Need to try this.