Local System only ACL in Windows

Question

I am using a named pipe for communications between two processes and want to restrict acess to any user on the local system in Windows.

I am building up and ACL for use in the SECURITY_ATTRIBUTES passed to CreateNamedPipe.

I am basing this code on that from Microsoft.

SID_IDENTIFIER_AUTHORITY siaLocal = SECURITY_LOCAL_SID_AUTHORITY;
if( !AllocateAndInitializeSid( &siaLocal, SECURITY_LOCAL_RID,
    0, 0, 0, 0, 0, 0, 0, 0,
    &pSidLocal ) )
{
    break;
}

I then use that sid with AddAccessAllowedAce.

All of this completes successfully and I can create the named pipe however when a client process then tries to connect using CreateFile it fails with access denied.

How do I create an ACL with a SID that allows any user of the local machine to access it?

Answer 1

You don't need an ACL for that. When calling CreateNamedPipe, one of the parameters takes flag values of PIPE_ACCEPT_REMOTE_CLIENTS (the default) or PIPE_REJECT_REMOTE_CLIENTS.

MSDN

Edit: This is a fairly new feature, so if you're developing for anything but new WS2008 servers it won't work. The same page has the alternate answer in this case, however: deny access to the pipe to the NETWORK ACE using AddAccessDeniedAce.

Answer 2

I am afraid this is a cross between RTFM and c's complete lack of strict typing.

The second parameter for AllocateAndInitializeSid is actually a count of the sub authorities not the first sub authority.

So by changing the code to:

SID_IDENTIFIER_AUTHORITY siaLocal = SECURITY_LOCAL_SID_AUTHORITY;
if( !AllocateAndInitializeSid( &siaLocal, 1,
    SECURITY_LOCAL_RID,
    0, 0, 0, 0, 0, 0, 0, 
    &pSidLocal ) )
{
    break;
}

I get the desired results.

I have tested this with different accounts and they can connect and by changing the Authority to SECURITY_NT_AUTHORITY and the sub authority to SECURITY_AUTHENTICATED_USER_RID I was able to connect from another computer to test that this ACL will actually allow and disallow different users.