Services and Vista

[McKool]

Hello group,

I wrote a Windows-Service using C#. This services creates a NamedPipe which will be used from somes Client-programs. This clients can and can not have Adminstrator rights. At the moment work ONLY when the clients are started having admin-rights. What should I do to allow connections from clients with different right levels?

Thanks in advance.

KW

 

[Nicholas Paldino [.NET/C# MVP]]

McKool,

How are you creating the named pipe?


--
- Nicholas Paldino [.NET/C# MVP]
- (e-mail address removed)

Hello group,

I wrote a Windows-Service using C#. This services creates a NamedPipe which
will be used from somes Client-programs. This clients can and can not have
Adminstrator rights. At the moment work ONLY when the clients are started
having admin-rights. What should I do to allow connections from clients with
different right levels?

Thanks in advance.

KW

 

[McKool]

like this:

hPipe = PipeIOApi.CreateNamedPipe(
"\\\\.\\pipe\\KWSPipe",
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
1024,
1024,
500,
IntPtr.Zero);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern SafeFileHandle CreateNamedPipe(
string name,
uint openMode,
uint pipeMode,
uint maxInstances,
uint outputBufferSize,
uint inputBufferSize,
uint defaultTimeOut,
IntPtr securityDescriptor);

 

[Willy Denoyette [MVP]]

like this:

hPipe = PipeIOApi.CreateNamedPipe(
"\\\\.\\pipe\\KWSPipe",
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
1024,
1024,
500,
IntPtr.Zero);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern SafeFileHandle CreateNamedPipe(
string name,
uint openMode,
uint pipeMode,
uint maxInstances,
uint outputBufferSize,
uint inputBufferSize,
uint defaultTimeOut,
IntPtr securityDescriptor);

McKool,

How are you creating the named pipe?


--
- Nicholas Paldino [.NET/C# MVP]
- (e-mail address removed)

Hello group,

I wrote a Windows-Service using C#. This services creates a NamedPipe which
will be used from somes Client-programs. This clients can and can not have
Adminstrator rights. At the moment work ONLY when the clients are started
having admin-rights. What should I do to allow connections from clients with
different right levels?

Thanks in advance.

KW

You are passing a null pointer as Security Descriptor, this will create a pipe that can only be accessed for reading and writing by "System" , "Administrators" and the "creator" accounts.
You need to pass a pointer to valid SECURITY_ATTRIBUTES structure, for instance here is how to create a NULL DACL.

struct SECURITY_ATTRIBUTES
{
public uint nLength;
public IntPtr lpSecurityDescriptor;
public int bInheritHandle;
};


change your CreateNamedPipe function signature as follows:
....
uint defaultTimeOut,
ref securityDescriptor)


and use it like:
SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
// init the sa with a null DACL, that is set all fields in sa to 0.
CreateNamedPipe(.........., ref sa);

Willy.

 

[McKool]

Hello Willy,

I tried that waht you wrote but without success. Nevertheless you gave me the Key... I found this article and, in this way, it's works:

http://codemortem.blogspot.com/2006/01/creating-null-dacl-in-managed-code..html

thanks a lot for your help.

KW.

like this:

hPipe = PipeIOApi.CreateNamedPipe(
"\\\\.\\pipe\\KWSPipe",
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
1024,
1024,
500,
IntPtr.Zero);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern SafeFileHandle CreateNamedPipe(
string name,
uint openMode,
uint pipeMode,
uint maxInstances,
uint outputBufferSize,
uint inputBufferSize,
uint defaultTimeOut,
IntPtr securityDescriptor);

McKool,

How are you creating the named pipe?


--
- Nicholas Paldino [.NET/C# MVP]
- (e-mail address removed)

Hello group,

I wrote a Windows-Service using C#. This services creates a NamedPipe which
will be used from somes Client-programs. This clients can and can not have
Adminstrator rights. At the moment work ONLY when the clients are started
having admin-rights. What should I do to allow connections from clients with
different right levels?

Thanks in advance.

KW

You are passing a null pointer as Security Descriptor, this will create a pipe that can only be accessed for reading and writing by "System" , "Administrators" and the "creator" accounts.
You need to pass a pointer to valid SECURITY_ATTRIBUTES structure, for instance here is how to create a NULL DACL.

struct SECURITY_ATTRIBUTES
{
public uint nLength;
public IntPtr lpSecurityDescriptor;
public int bInheritHandle;
};


change your CreateNamedPipe function signature as follows:
...
uint defaultTimeOut,
ref securityDescriptor)


and use it like:
SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
// init the sa with a null DACL, that is set all fields in sa to 0.
CreateNamedPipe(.........., ref sa);

Willy.