Child Process Control

The security.childProcessPolicy node controls whether a published application may launch other executables. Locking this down prevents a delivered app from being used as a springboard to a shell, a browser, or admin tools.

Editor Advanced → Security JSON · JSON security.childProcessPolicy

Properties

Property	Type	Default	Notes
`allowChildProcesses`	boolean	false	Master switch. When `false`, the app cannot spawn child processes.
`allowList`	string[]	[]	Permitted child executables, e.g. `msedge.exe`, `chrome.exe`. Use `.` to allow all.
`blockList`	string[]	[]	Blocked executables, e.g. `cmd.exe`, `powershell.exe`. Overrides the allow list on conflict.
`silentBlocking`	boolean	false	Block silently without showing a message box to the user.

The block list takes precedence: an executable on both lists is blocked. At runtime the lists are applied as RD_AllowedProcesses and RD_BlockedProcesses on the session.

Sample

"childProcessPolicy": {
  "allowChildProcesses": false,
  "allowList": [],
  "blockList": ["cmd.exe", "powershell.exe", "regedit.exe", "taskmgr.exe", "mmc.exe", "control.exe"],
  "silentBlocking": true
}

app.config.xml override

This policy node maps to the session's allowed/blocked process settings and policy wins. It is distinct from the app.config.xml <webstreamSettings><appRemoteAppChildAllowList>, which is a separate, app.config-only mechanism consumed by the host child-process monitor — not the same as this policy list.