Skip to content

Update nf-winenclaveapi-enclaverestrictcontainingprocessaccess.md #2059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alvinashcraft merged 2 commits into from
Jul 31, 2025
Merged

Update nf-winenclaveapi-enclaverestrictcontainingprocessaccess.md #2059

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ded5174
Update nf-winenclaveapi-enclaverestrictcontainingprocessaccess.md
ericlaw1979 Jul 30, 2025
acd82cb
Update nf-winenclaveapi-enclaverestrictcontainingprocessaccess.md
ericlaw1979 Jul 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ontent/winenclaveapi/nf-winenclaveapi-enclaverestrictcontainingprocessaccess.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ An `HRESULT` value that indicates the success or failure of the operation.

## -remarks

Note that the [EnclaveCopyOutOfEnclave](nf-winenclaveapi-enclavecopyoutofenclave.md) and [EnclaveCopyIntoEnclave](nf-winenclaveapi-enclavecopyintoenclave.md) APIs will still continue to work (and access the address space of the containing process) even when access is restricted using **EnclaveRestrictContainingProcessAccess**.
When access is restricted, attempting to access the address space of the containing process from the enclave will result in an access violation. However, even when access is restricted, the [EnclaveCopyOutOfEnclave](nf-winenclaveapi-enclavecopyoutofenclave.md) and [EnclaveCopyIntoEnclave](nf-winenclaveapi-enclavecopyintoenclave.md) APIs continue to permit access to the address space of the containing process.

Access to the containing process's address space can also be restricted by setting the [IMAGE_ENCLAVE_POLICY_STRICT_MEMORY](../winnt/ns-winnt-image_enclave_config64.md#-field-enclaveflags) flag in the enclave's image configuration. The **EnclaveRestrictContainingProcessAccess** API can be used to change this policy at runtime.

Expand Down