C++ – Local System only ACL in Windows

cmfcwindows

I am using a named pipe for communications between two processes and want to restrict acess to any user on the local system in Windows.

I am building up and ACL for use in the SECURITY_ATTRIBUTES passed to CreateNamedPipe.

I am basing this code on that from Microsoft.

SID_IDENTIFIER_AUTHORITY siaLocal = SECURITY_LOCAL_SID_AUTHORITY;
if( !AllocateAndInitializeSid( &siaLocal, SECURITY_LOCAL_RID,
    0, 0, 0, 0, 0, 0, 0, 0,
    &pSidLocal ) )
{
    break;
}

I then use that sid with AddAccessAllowedAce.

All of this completes successfully and I can create the named pipe however when a client process then tries to connect using CreateFile it fails with access denied.

How do I create an ACL with a SID that allows any user of the local machine to access it?

Best Answer

You don't need an ACL for that. When calling CreateNamedPipe, one of the parameters takes flag values of PIPE_ACCEPT_REMOTE_CLIENTS (the default) or PIPE_REJECT_REMOTE_CLIENTS.

MSDN

Edit: This is a fairly new feature, so if you're developing for anything but new WS2008 servers it won't work. The same page has the alternate answer in this case, however: deny access to the pipe to the NETWORK ACE using AddAccessDeniedAce.

Related Topic