Solution 1

I had a similar problem in .NET.  I assume you know C# since the link you provided was .NET.  This allowed Users to contact a named pipe server running in a service:

            pipeSecurity = new PipeSecurity();
            var usersPipeAccessRule = new PipeAccessRule(
                new SecurityIdentifier( WellKnownSidType.BuiltinUsersSid, null ),
                PipeAccessRights.ReadWrite | PipeAccessRights.Synchronize,
                AccessControlType.Allow
                );
            pipeSecurity.AddAccessRule(usersPipeAccessRule)

                waitingPipe = new NamedPipeServerStream(
                    PipeName,
                    PipeDirection.InOut,
                    NamedPipeServerStream.MaxAllowedServerInstances,
                    PipeTransmissionMode.Message,
                    PipeOptions.Asynchronous,
                    ServicePipeProcessor.MaxBufferSize,
                    ServicePipeProcessor.MaxBufferSize,
                    pipeSecurity);

I would assume you would want to use functions like CreateWellKnownSid and SetSecurityDescriptotDacl to do the same thing.

Solution 2

SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
PSID everyone_sid = NULL;
AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &everyone_sid);

EXPLICIT_ACCESS ea;
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = SPECIFIC_RIGHTS_ALL | STANDARD_RIGHTS_ALL;
ea.grfAccessMode = SET_ACCESS;
ea.grfInheritance = NO_INHERITANCE;
ea.Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea.Trustee.ptstrName  = (LPWSTR)everyone_sid;

PACL acl = NULL;
SetEntriesInAcl(1, &ea, NULL, &acl);

// HOW DO I ADD A LOW INTEGRITY SACL HERE THAT WILL NOT BE IGNORED ?


PSECURITY_DESCRIPTOR sd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR,SECURITY_DESCRIPTOR_MIN_LENGTH);
InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION);
SetSecurityDescriptorDacl(sd, TRUE, acl, FALSE);

SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = sd;
sa.bInheritHandle = FALSE;

CreateNamedPipe(...,&sa);

Solution 3

Solution 4

Solution 5

I'm not sure if it would be any different, but try something like this:

bool AddWellKnowSid(WELL_KNOWN_SID_TYPE WellKnownSidType, PACL pAcl)
{
    bool returnValue = false;
    DWORD sidSize = SECURITY_MAX_SID_SIZE;
    PSID sid = LocalAlloc(LMEM_FIXED, sidSize);

    if(sid != NULL)
    {    
        if(CreateWellKnownSid(WellKnownSidType, NULL, sid, &sidSize))
        {
            if (AddAccessAllowedAce(pAcl, ACL_REVISION, 0xFFFF, sid))
            {
                returnValue = true;
            }
        }

        LocalFree(sid);
    }

    return returnValue;
}

void Create()
{
    DWORD cbAcl = 256;
    PACL pAcl = (ACL*)LocalAlloc(LPTR, cbAcl);
    if (pAcl == NULL)
        return;

    if (InitializeAcl(pAcl, cbAcl, ACL_REVISION))
    {
        if (AddWellKnowSid(WinAnonymousSid, pAcl) && 
            AddWellKnowSid(WinWorldSid, pAcl))
        {
            PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH); 
            if (InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION))
            {
                if (SetSecurityDescriptorDacl(pSD, TRUE, pAcl, FALSE))
                {
                    SECURITY_ATTRIBUTES sa = {sizeof(SECURITY_ATTRIBUTES), pSD, FALSE};
                    HANDLE hPipe = CreateNamedPipe(_T("\\\\.\\pipe\\namedpipe"),
                        PIPE_ACCESS_DUPLEX,
                        PIPE_TYPE_MESSAGE|PIPE_READMODE_MESSAGE|PIPE_WAIT,
                        PIPE_UNLIMITED_INSTANCES, 512, 512, 0, &sa);
                    if (hPipe != INVALID_HANDLE_VALUE)
                    {
                        CloseHandle(hPipe);
                    }
                }
            }
        }
    }

    LocalFree(pAcl);
}

Solution 6

Solution 7

Solution 8

Solution 9

Solution 10

Hello

You can check out the full named pipe sample in Microsoft All-In-One Code Framework:

http://1code.codeplex.com

See the C# version: CSNamedPipeServer, CSNamedPipeClient
C++ version: CppNamedPipeServer, CppNamedPipeClient
VB.NET version: VBNamedPipeServer, VBNamedPipeClient

These samples have been fully tested in various Windows environments (e.g. high integrity level env, x64, pre-Vista env, etc)

If you have any feedback of the samples, please feel free to email to codefxf@microsoft.com

Solution 11

After 2 days of working on it, I've confirmed that Ignac approach does work correctly.  As he suggested, it seems to be impossible to set the SACL on the pipe after it has been created.

I found this out when I tried to set PipeAccessRule and PipeAuditRule on a Pipe using the NamedPipeServerStream class in System.IO.Pipes.  I'm assuming that behind the scenes the NamedPipeServerStream constructor creates the pipe first and then tries setting the SACL/DACL.  As a result, the constructor fails telling you that you don't have sufficient privileges to perform the action (or something similar)

I developed Ignac's solution using C#, but then once I'd successfully created the pipe with the correct security attributes, I passed the pipe handle into the NamedPipeServerStream constructor.  This seems to be working ok and now I can use NamedPipeServerStream to work with a pipe that can be accessed by Everyone and by low integrity processes as well.

If someone has questions on this issue I'd be happy to help guide you.

David K