How to specify PipeSecurity when using ListenNamedPipe

[CyrilPaulus]

Hi,

I'm creating a prototype Windows service that should communicate with a client application over a named pipe using gRPC.

On the service side, I use the ListenNamedPipe method to bind Kestrel to the named pipe. This works correctly when debugging. However, when I deploy the service and try to connect to it, it fails due to some access rights issues.

I believe I need to configure the PipeSecurity settings first, but I can't find how to do this when using ListenNamedPipe.

Here is the code I have, which doesn't work:

var pipeSecurity = CreateSystemIOPipeSecurity();
builder.WebHost.UseNamedPipes(opts =>
{
    opts.PipeSecurity = pipeSecurity;
    opts.CurrentUserOnly = false;
});

builder.WebHost.ConfigureKestrel(serverOptions =>
{
    serverOptions.ListenNamedPipe("TestManagement", listenOptions =>
    {
        listenOptions.Protocols = HttpProtocols.Http2;
    });
});

Does anyone have any ideas on how I should proceed?

Thanks.

[samsosa]

Can you show the CreateSystemIOPipeSecurity() function?

[CyrilPaulus]

Here it is

PipeSecurity CreateSystemIOPipeSecurity()
{
    PipeSecurity pipeSecurity = new PipeSecurity();

    var id = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
    pipeSecurity.SetAccessRule(new PipeAccessRule(id, PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow));

    return pipeSecurity;
}

[samsosa]

Yes, that doesn't work. I can't remember exactly why, but the WorldSid doesn't help.

The following works fine for me with NamedPipes, you can try it out:

var ps = new PipeSecurity();
// ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow));
try { ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.NetworkSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow)); } catch { }
try { ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.InteractiveSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow)); } catch { }
try { ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow)); } catch { }
try { ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow)); } catch { }
try { ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow)); } catch { }

pipeConfig.PipeSecurity = ps;

[CyrilPaulus]

It works perfectly, thanks !