{"record":{"id":"b8d08629c362719a","repo":"rustdesk/rustdesk","slug":"failed-to-build-portable-service-listener-security","errorCode":null,"errorMessage":"failed to build portable service listener security attributes from SDDL '{}': {}","messagePattern":"failed to build portable service listener security attributes from SDDL '(.+?)': (.+?)","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"src/ipc/auth.rs","lineNumber":64,"sourceCode":"    })?;\n    debug_assert!(\n        user_sid.starts_with(\"S-1-\")\n            && user_sid\n                .bytes()\n                .all(|byte| byte.is_ascii_digit() || byte == b'-'),\n        \"current_process_user_sid_string returned a non-SDDL SID: {}\",\n        user_sid\n    );\n    // SDDL:\n    // - `D:P`                => protected DACL (no inherited ACEs)\n    // - `(A;;GA;;;SY)`       => allow GENERIC_ALL to LocalSystem\n    // - `(A;;GA;;;{user_sid})` => allow GENERIC_ALL to current process user SID\n    // References:\n    // - Security Descriptor String Format: https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format\n    // - ACE strings in SDDL: https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings\n    let sddl = format!(\"D:P(A;;GA;;;SY)(A;;GA;;;{user_sid})\");\n    SecurityAttributes::from_sddl(&sddl).map_err(|err| {\n        io::Error::new(\n            io::ErrorKind::Other,\n            format!(\n                \"failed to build portable service listener security attributes from SDDL '{}': {}\",\n                sddl, err\n            ),\n        )\n    })\n}\n\n#[cfg(target_os = \"macos\")]\n#[inline]\nfn macos_service_ipc_allows_gui_and_service_binaries(\n    peer_exe: &Path,\n    current_exe: &Path,\n    postfix: &str,\n) -> bool {\n    if postfix != crate::POSTFIX_SERVICE {\n        return false;","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a29ec16ffef42974377ef11e/src/ipc/auth.rs#L46-L82","documentation":"The DACL SDDL string 'D:P(A;;GA;;;SY)(A;;GA;;;<user_sid>)' (protected DACL; GENERIC_ALL for LocalSystem and the current user) is converted into SECURITY_ATTRIBUTES via SecurityAttributes::from_sddl. This error means that conversion failed, and includes both the SDDL and the underlying error.","triggerScenarios":"The SID string embedded in the SDDL is malformed (non-SDDL characters — the debug_assert above checks 'S-1-...' digits/dashes), or ConvertStringSecurityDescriptorToSecurityDescriptor failed from memory/parameter errors.","commonSituations":"current_process_user_sid_string returning an unexpected format (logon SIDs or placeholder output); downlevel Windows rejecting the SDDL flags; corrupted user account SID.","solutions":["Copy the SDDL from the message and validate it with PowerShell: New-Object System.Security.AccessControl.RawSecurityDescriptor('<sddl>')","Check the appended inner error for the exact Win32 failure","Verify the account's SID is well-formed: whoami /user","If the SID string is malformed, fix current_process_user_sid_string rather than the SDDL template"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Validate the exact SDDL before shipping changes to it (PowerShell)\nNew-Object System.Security.AccessControl.RawSecurityDescriptor `\n  'D:P(A;;GA;;;SY)(A;;GA;;;S-1-5-21-1004336348-1177238915-682003330-512)'","typeGuard":null,"tryCatchPattern":"if let Err(e) = SecurityAttributes::from_sddl(&sddl) {\n    log::error!(\"SDDL rejected: '{sddl}': {e}\");\n    return Err(e); // fail closed — no permissive fallback\n}","preventionTips":["Keep the debug_assert guard that verifies the SID is plain SDDL (S-1-digits-dashes)","Never weaken the DACL on failure — the listener must not start with a NULL security attribute","Re-test whenever the SID source (current_process_user_sid_string) changes"],"tags":["windows","security","sddl","ipc"],"backgroundTag":null,"analyzedSha":"7aa98d43cf1962a7a29ec16ffef42974377ef11e","analyzedAt":"2026-08-16T06:17:34.842Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}