{"record":{"id":"bc58d47ab34a0587","repo":"astrid-runtime/astrid","slug":"windows-named-pipe-endpoint-denied-access","errorCode":null,"errorMessage":"Windows named-pipe endpoint denied access","messagePattern":"Windows named-pipe endpoint denied access","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/local_transport/windows.rs","lineNumber":668,"sourceCode":"        Some(ERROR_FILE_NOT_FOUND) => Ok(EndpointState::Absent),\n        Some(ERROR_PIPE_BUSY | ERROR_SEM_TIMEOUT | ERROR_ACCESS_DENIED) => {\n            Ok(EndpointState::BusyOrDenied)\n        },\n        _ => Err(error),\n    }\n}\n\nfn classify_connect_error(error: io::Error) -> io::Error {\n    match error.raw_os_error().map(i32::cast_unsigned) {\n        Some(ERROR_FILE_NOT_FOUND) => io::Error::new(\n            io::ErrorKind::NotFound,\n            \"Windows named-pipe endpoint is absent\",\n        ),\n        Some(ERROR_PIPE_BUSY) => io::Error::new(\n            io::ErrorKind::WouldBlock,\n            \"Windows named-pipe endpoint is busy\",\n        ),\n        Some(ERROR_ACCESS_DENIED) => io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Windows named-pipe endpoint denied access\",\n        ),\n        _ => error,\n    }\n}\n\nstruct PipeSecurity {\n    _descriptor: LocalAllocation,\n    attributes: SECURITY_ATTRIBUTES,\n}\n\nimpl PipeSecurity {\n    fn for_current_user() -> io::Result<Self> {\n        let user = current_user_sid()?;\n        let system = well_known_sid(WinLocalSystemSid)?;\n        let user_sddl = user.to_sddl()?;\n        let dacl = if user.equals(&system) {","sourceCodeStart":650,"sourceCodeEnd":686,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/local_transport/windows.rs#L650-L686","documentation":"ERROR_ACCESS_DENIED from CreateFile is re-mapped to io::ErrorKind::PermissionDenied with this message: the pipe exists, but the caller is not allowed to open it. Since the library scopes pipe names per user SID, this usually indicates the pipe's security descriptor or the per-user naming rejected the caller's identity.","triggerScenarios":"connect() from a process whose token lacks access to the pipe (different user, low-integrity/AppContainer process, restricted token); connecting to a pipe created by another account whose per-user name coincidentally matches; DACL on the pipe instance denies the client.","commonSituations":"Client running as a service account against a user's pipe; sandboxed (AppContainer/Edge-style) clients; group-policy or AV software restricting named-pipe access.","solutions":["Run the client under the same Windows user account as the server — the pipe name includes the owner's SID, and access is same-user by design.","Check for sandboxing/integrity-level differences (AppContainer, low integrity) that strip pipe access, and run the client unsandboxed.","Verify no security software or policy is blocking named-pipe opens; compare `whoami /user` output on both sides."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// confirm same-user and non-sandboxed context before connecting\n// e.g. compare current_user_sid() to the server account; check integrity level","typeGuard":"fn client_can_open_pipe(current_sid: &Sid, server_sid: &Sid) -> bool {\n    current_sid.equals(server_sid)\n}","tryCatchPattern":"match transport.connect(&path) {\n    Err(e) if e.kind() == io::ErrorKind::PermissionDenied\n        && e.to_string().contains(\"denied access\") => {\n        eprintln!(\"pipe ACL/identity rejected us; check user account and sandboxing\");\n    }\n    other => other?,\n}","preventionTips":["Run client and server under the same Windows user account.","Avoid AppContainer/low-integrity sandboxes for the client.","Check security policies/AV that restrict named-pipe opens in your environment."],"tags":["windows","named-pipes","security","acl","connection"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}