BUG: JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE

PE interferes with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE limit on unnamed jobs.  It seems to duplicate the job handle so when the parent or the single owner of the job handle dies, the job is not terminated, which then prevents child processes from terminating.  When closing PE, all child process in that job interestingly enough are terminated on the spot.  When PE is not running everything works normally.  Here is some example code that demonstrates the problem:

#define _WIN32_WINNT 0x0500

#include <windows.h>

int _tmain(int argc, _TCHAR* argv[])

{

      HANDLE hJob = CreateJobObject(NULL, NULL);

      JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli = { 0 };

      jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;

      SetInformationJobObject(hJob, JobObjectExtendedLimitInformation, &jeli, sizeof(jeli));

      AssignProcessToJobObject(hJob, GetCurrentProcess());

      PROCESS_INFORMATION pi = { 0 };

      STARTUPINFO         si = { sizeof(si) };

      CreateProcess(TEXT("C:\\Windows\\System32\\Notepad.exe"), NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);

  SleepEx(1000000, false);

      return 0;

}

When PE is not running, closing down the console window will force Notepad.exe to terminate as it should.

When PE is running, closing down the console window does not close down Notepad.exe; instead, you must then close PE itself to get the last handle of the job closed (or at least I’m assuming), so that Notepad.exe is terminated.

This is a real issue as just running PE causes some applications to behave differently.  It took us forever to trace it to PE, as we were using PE to test the JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE limit, as it has some cool properties on Jobs.

James.