{"record":{"id":"a7883d07eeb5b493","repo":"astrid-runtime/astrid","slug":"named-pipe-dacl-control-is-not-explicit-and-protec","errorCode":null,"errorMessage":"named-pipe DACL control is not explicit and protected (control=0x{control:04x})","messagePattern":"named-pipe DACL control is not explicit and protected \\(control=0x(.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/local_transport/windows/acl.rs","lineNumber":42,"sourceCode":"pub(super) unsafe fn validate_descriptor_control(\n    descriptor: PSECURITY_DESCRIPTOR,\n) -> io::Result<()> {\n    let mut control = 0_u16;\n    let mut revision = 0_u32;\n    // SAFETY: the descriptor is the live allocation returned by\n    // GetSecurityInfo and both outputs have the documented types.\n    if unsafe { GetSecurityDescriptorControl(descriptor, &raw mut control, &raw mut revision) } == 0\n    {\n        return Err(super::last_error(\n            \"failed to inspect named-pipe security descriptor control\",\n        ));\n    }\n    let required = SE_DACL_PRESENT | SE_DACL_PROTECTED;\n    let rejected = SE_DACL_DEFAULTED | SE_DACL_AUTO_INHERITED | SE_DACL_AUTO_INHERIT_REQ;\n    if control & required == required && control & rejected == 0 {\n        Ok(())\n    } else {\n        Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\n                \"named-pipe DACL control is not explicit and protected (control=0x{control:04x})\"\n            ),\n        ))\n    }\n}\n\n#[derive(Clone, Copy, Debug)]\npub(super) struct ValidatedSid<'acl> {\n    pointer: PSID,\n    _acl: PhantomData<&'acl ACL>,\n}\n\nimpl ValidatedSid<'_> {\n    pub(super) fn as_ptr(self) -> PSID {\n        self.pointer\n    }","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/local_transport/windows/acl.rs#L24-L60","documentation":"validate_descriptor_control checks the security descriptor's control bits before any ACE inspection: the DACL must be explicitly PRESENT and PROTECTED, and must not be DEFAULTED or auto-inherited. This error (with the actual control bitmask in hex) means the pipe's DACL is inherited or auto-inherited rather than explicit, so its contents could change outside the library's control; connect/accept refuse the pipe.","triggerScenarios":"validate_pipe_security (via connect/accept) on a pipe whose descriptor control bits lack SE_DACL_PRESENT|SE_DACL_PROTECTED or contain SE_DACL_DEFAULTED / SE_DACL_AUTO_INHERITED / SE_DACL_AUTO_INHERIT_REQ.","commonSituations":"The pipe inherits its DACL from a parent directory/object because the creator passed a NULL security descriptor or an unprotected one; hardening/GPO tooling re-applied inherited ACLs; the pipe was created by another library version that did not set SE_DACL_PROTECTED.","solutions":["Recreate the pipe with this library, which builds a descriptor with SE_DACL_PRESENT|SE_DACL_PROTECTED.","If constructing SDDL yourself, prefix the DACL with 'P' (protected): `D:P(A;;GA;;;...)`.","Check for background ACL re-application (GPO, icacls scripts) on the pipe and exclude its path.","Update the component creating the pipe — older versions may not set the protected flag."],"exampleFix":"// before: unprotected SDDL (inherits)\n\"D:(A;;GA;;;CURRENT_USER)(A;;GA;;;SY)\"\n// after: protected DACL\n\"D:P(A;;GA;;;CURRENT_USER)(A;;GA;;;SY)\"","handlingStrategy":"validation","validationCode":"// Preflight: DACL must be protected from inheritance\n// powershell: if (-not (Get-Acl \\\\.\\pipe\\myapp).AreAccessRulesProtected) { 'DACL is inherited/unprotected' }","typeGuard":null,"tryCatchPattern":"match connect() {\n    Err(e) if e.to_string().contains(\"not explicit and protected\") => {\n        eprintln!(\"pipe DACL inherited; recreate with protected SDDL 'D:P(...)' via this library\");\n    }\n    r => r?,\n}","preventionTips":["Always prefix the DACL block with 'P' in SDDL (D:P(...)) when creating pipes yourself","Recreate pipes with the library instead of relying on inherited ACLs","Exclude pipe paths from GPO/icacls ACL-reapplication jobs","Check AreAccessRulesProtected in deployment health checks"],"tags":["windows","named-pipes","acl","security","ipc"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}