{"record":{"id":"816292f5df9f4abe","repo":"astrid-runtime/astrid","slug":"named-pipe-dacl-omits-the-current-user-or-local-sy","errorCode":null,"errorMessage":"named-pipe DACL omits the current user or Local System","messagePattern":"named-pipe DACL omits the current user or Local System","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/local_transport/windows.rs","lineNumber":977,"sourceCode":"            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                \"named-pipe DACL contains a non-canonical access entry\",\n            ));\n        }\n        if unsafe { EqualSid(sid.as_ptr(), current.as_psid()) } != 0 && !saw_current {\n            saw_current = true;\n        } else if unsafe { EqualSid(sid.as_ptr(), system.as_psid()) } != 0 && !saw_system {\n            saw_system = true;\n        } else {\n            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                \"named-pipe DACL grants an unexpected or duplicate principal\",\n            ));\n        }\n    }\n\n    if !saw_current || !saw_system {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"named-pipe DACL omits the current user or Local System\",\n        ));\n    }\n    Ok(())\n}\n\nfn is_canonical_pipe_full_control(mask: u32) -> bool {\n    // The I/O manager maps generic access bits to the file-object-specific\n    // mask when attaching a descriptor to a named pipe. Accept the exact SDDL\n    // source form and its exact mapped form, but no weaker or augmented mask.\n    mask == GENERIC_ALL || mask == FILE_ALL_ACCESS\n}\n\n#[cfg(test)]\n#[path = \"windows/tests.rs\"]\nmod tests;\n","sourceCodeStart":959,"sourceCodeEnd":995,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/local_transport/windows.rs#L959-L995","documentation":"The final check in validate_pipe_security requires the DACL to have seen an allow entry for the current user and for Local System (skipped only when the current user IS Local System). This error means a full-control ACE for one of those principals is missing, so the pipe either can't be used by the current user or lacks the expected SYSTEM entry, and the connection is refused rather than proceeding on a non-canonical ACL.","triggerScenarios":"connect()/accept() where the ACE loop completes but saw_current == false (no ACE for the current user SID) or saw_system == false (no ACE for WinLocalSystemSid and current user != SYSTEM).","commonSituations":"A restricted token or service account (e.g. Network Service) created the pipe so the ACE lists that SID instead of the connecting user's; an admin trimmed the SYSTEM ACE; custom SDDL with only one principal; running under a container or job with a filtered token.","solutions":["Recreate the pipe from the same account the client runs as, using the library's creation API, so both the current-user and SYSTEM ACEs are present.","If running as a service, use the library's canonical SDDL (include both your service SID and Local System) rather than a trimmed custom ACL.","Check for filtered/restricted tokens (AppContainer, restricted service tokens) that make the token user differ from the ACE SID; run unrestricted or use matching SIDs.","Verify with Get-Acl that both principals appear with full control."],"exampleFix":"// before: SDDL missing SYSTEM\n\"D:P(A;;GA;;;CURRENT_USER)\"\n// after: include Local System\n\"D:P(A;;GA;;;CURRENT_USER)(A;;GA;;;SY)\"","handlingStrategy":"validation","validationCode":"// PowerShell preflight: both current user and SYSTEM must appear with FullControl\n// $a=Get-Acl \\\\.\\pipe\\myapp; $a.Access.IdentityReference -contains 'NT AUTHORITY\\\\SYSTEM'","typeGuard":null,"tryCatchPattern":"if let Err(e) = connect() {\n    if e.to_string().contains(\"omits the current user or Local System\") {\n        eprintln!(\"pipe created by a different/restricted account; recreate under current user\");\n    } else { return Err(e.into()); }\n}","preventionTips":["Create the pipe under the same account the client authenticates as","Include both the service SID and Local System (SY) in custom SDDL for services","Watch for filtered tokens (AppContainer, restricted service tokens) that change the effective SID","Verify the full ACL with Get-Acl before connecting in service deployments"],"tags":["windows","named-pipes","acl","security","ipc"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}