0

I'm trying to open and close the osk.exe keyboard from a python script in WIN10. I can open it with:

import os
os.popen("osk.exe")

but when I try to close it with:

import os
os.popen('taskkill /IM osk.exe /F')

I get Access Denied error from the OS.

The same thing appens when I try to execute the same commands on the shell. I think It could be a permissions problem because of osk requires elevate permissions, but I don't know how to avoid it.

Thanks, Federico.

Federico Pinciaroli
  • 153
  • 4
  • 15
  • The mandatory security of Process objects denies both read-up and write-up access to a subject that's at a lower integrity level. However, this leaves execute-up access unfiltered, which, excluding overlap with read and write access, still includes the right to query limited information, wait on, and terminate the Process. The other side of this is what the object's discretionary security (DACL) actually grants. Given the Process is on your Desktop, it should have your logon session SID in its DACL, which should grant these rights, even for an over-the-shoulder (OTS) elevation. – Eryk Sun May 02 '18 at 19:32
  • The problem, however, is that taskkill.exe requests more than the right to query limited information, terminate, and wait on the process. It wants the right to query unlimited information about the process, and thus it fails with access denied. – Eryk Sun May 02 '18 at 19:34
  • You can kill it yourself by using ctypes or PyWin32 to open a handle via `OpenProcess`, with at a minimum the right to terminate the process via `TerminateProcess`. You may also need the right to wait on the process and query limited information if you need to call `WaitForSingleObject` and `GetExitCodeProcess`. – Eryk Sun May 02 '18 at 19:37
  • If you decide to use PyWin32, you may as well skip using `os.popen` or `subprocess.Popen(..., shell=True)` to instead directly call `result = shell.ShellExecuteEx(lpVerb='runas', lpFile='osk.exe', fMask=shellcon.SEE_MASK_NOCLOSEPROCESS)`. With this you'll already have a handle with the required access to call `win32api.TerminateProcess(result['hProcess'], 1)`. – Eryk Sun May 02 '18 at 19:46

0 Answers0