{"record":{"id":"072b019cbcbb6d84","repo":"astrid-runtime/astrid","slug":"named-pipe-dacl-contains-a-non-canonical-access-en","errorCode":null,"errorMessage":"named-pipe DACL contains a non-canonical access entry","messagePattern":"named-pipe DACL contains a non-canonical access entry","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/local_transport/windows.rs","lineNumber":953,"sourceCode":"            dacl,\n            &descriptor_allocation,\n            \"named-pipe security descriptor\",\n        )\n    }?;\n    let expected_aces = if current.equals(&system) { 1 } else { 2 };\n    let ace_count = dacl.ace_count();\n    if ace_count != expected_aces {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\"named-pipe DACL has {ace_count} entries; expected exactly {expected_aces}\"),\n        ));\n    }\n\n    let mut saw_current = false;\n    let mut saw_system = current.equals(&system);\n    for index in 0..ace_count {\n        let ValidatedAce::Allow { flags, mask, sid } = dacl.ace(index)? else {\n            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                \"named-pipe DACL contains a non-canonical access entry\",\n            ));\n        };\n        if flags != 0 || !is_canonical_pipe_full_control(mask) {\n            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                \"named-pipe DACL contains a non-canonical access entry\",\n            ));\n        }\n        if unsafe { EqualSid(sid.as_ptr(), current.as_psid()) } != 0 && !saw_current {\n            saw_current = true;\n        } else if unsafe { EqualSid(sid.as_ptr(), system.as_psid()) } != 0 && !saw_system {\n            saw_system = true;\n        } else {\n            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                \"named-pipe DACL grants an unexpected or duplicate principal\",","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/local_transport/windows.rs#L935-L971","documentation":"While walking the pipe's DACL, each ACE must be an ACCESS_ALLOWED_ACE; anything else (deny ACE, audit ACE, unsupported type) fails this check in validate_pipe_security. The library only recognizes a canonical allow-only ACL, so non-allow entries indicate a foreign or tampered ACL and the connection is refused with PermissionDenied.","triggerScenarios":"connect()/accept() where dacl.ace(index) parses an ACE whose type is not access-allowed, e.g. an ACCESS_DENIED_ACE or SYSTEM_AUDIT_ACE present in the pipe DACL.","commonSituations":"Hardening tooling or group policy added deny/audit ACEs to the pipe; an admin explicitly denied another account and added a deny entry; the pipe was created by different software with a richer ACL.","solutions":["Recreate the pipe via this library so its DACL contains only access-allowed ACEs for the current user and Local System.","Remove the deny/audit ACEs from the pipe's ACL (`Get-Acl` / `Set-Acl` or icacls) in the creating process.","Identify the tool injecting extra ACEs (antivirus, EDR, GPO) and exclude the pipe path from that policy.","Choose a fresh pipe name not covered by existing ACL policy."],"exampleFix":"// before: adding a deny ACE for another user\nAddAccessDeniedAceEx(dacl, ..., &other_user_sid);\n// after: keep the DACL allow-only; rely on it granting ONLY current user + SYSTEM\nAddAccessAllowedAceEx(dacl, ..., GENERIC_ALL, &current_user_sid);","handlingStrategy":"validation","validationCode":"// PowerShell preflight: no Deny rules on the pipe\n// if ((Get-Acl \\\\.\\pipe\\myapp).Access | Where-Object AccessControlType -eq 'Deny') { 'non-canonical ACE present' }","typeGuard":null,"tryCatchPattern":"match connect() {\n    Err(e) if e.to_string().contains(\"non-canonical access entry\") => {\n        eprintln!(\"pipe ACL contains deny/audit ACEs; recreate the pipe via this library\");\n    }\n    r => r?,\n}","preventionTips":["Keep the pipe DACL allow-only; never add Deny or audit ACEs","Check antivirus/EDR tools that harden named-pipe ACLs and exclude your pipe path","Recreate the pipe through the library instead of hand-editing ACLs","Validate the ACL with Get-Acl after any security-policy change"],"tags":["windows","named-pipes","acl","security","ipc"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}