{"record":{"id":"c19262a5e92c71db","repo":"litedb-org/LiteDB","slug":"failed-to-create-security-descriptor-for-shared-mu","errorCode":null,"errorMessage":"Failed to create security descriptor for shared mutex.","messagePattern":"Failed to create security descriptor for shared mutex\\.","errorType":"exception","errorClass":"Win32Exception","httpStatus":null,"severity":"critical","filePath":"LiteDB/Client/Shared/SharedMutexFactory.cs","lineNumber":66,"sourceCode":"        {\n            return RuntimeInformation.IsOSPlatform(OSPlatform.Windows);\n        }\n#endif\n\n        private static class WindowsMutex\n        {\n            private const string WorldAccessSecurityDescriptor = \"D:(A;;GA;;;WD)\";\n            private const uint SddlRevision1 = 1;\n\n            public static Mutex Create(string name)\n            {\n                IntPtr descriptor = IntPtr.Zero;\n\n                try\n                {\n                    if (!NativeMethods.ConvertStringSecurityDescriptorToSecurityDescriptor(WorldAccessSecurityDescriptor, SddlRevision1, out descriptor, out _))\n                    {\n                        throw new Win32Exception(Marshal.GetLastWin32Error(), \"Failed to create security descriptor for shared mutex.\");\n                    }\n\n                    var attributes = new NativeMethods.SECURITY_ATTRIBUTES\n                    {\n                        nLength = (uint)Marshal.SizeOf<NativeMethods.SECURITY_ATTRIBUTES>(),\n                        bInheritHandle = 0,\n                        lpSecurityDescriptor = descriptor\n                    };\n\n                    var handle = NativeMethods.CreateMutexEx(ref attributes, name, 0, NativeMethods.MUTEX_ALL_ACCESS);\n\n                    if (handle == IntPtr.Zero || handle == NativeMethods.InvalidHandleValue)\n                    {\n                        throw new Win32Exception(Marshal.GetLastWin32Error(), \"Failed to create shared mutex with global access.\");\n                    }\n\n                    var mutex = new Mutex();\n                    mutex.SafeWaitHandle = new SafeWaitHandle(handle, ownsHandle: true);","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/litedb-org/LiteDB/blob/f906a5f850678719e39a39a006cb66dcae563cfa/LiteDB/Client/Shared/SharedMutexFactory.cs#L48-L84","documentation":"Thrown inside WindowsMutex.Create when the native ConvertStringSecurityDescriptorToSecurityDescriptor P/Invoke returns false, meaning the SDDL string 'D:(A;;GA;;;WD)' could not be parsed into a SECURITY_DESCRIPTOR. The last Win32 error code (via Marshal.GetLastWin32Error) gives the specific failure reason.","triggerScenarios":"connection=Shared on Windows when the advapi32 function rejects the SDDL descriptor string. Possible causes: ERROR_INVALID_SD (513), ERROR_INVALID_SECURITY_DESCR (1338), or memory/resource exhaustion preventing descriptor allocation.","commonSituations":"Corrupted or modified advapi32.dll. Running under an extremely constrained security context. Very rare; usually indicates a broken Windows installation or a non-standard Windows build that doesn't recognize the SDDL revision 1 format.","solutions":["Switch to Direct mode to avoid the security descriptor creation path entirely.","Repair the Windows installation (sfc /scannow) if the advapi32 SDDL functions are malfunctioning.","Run the process with sufficient privileges to create security descriptors.","Report to LiteDB maintainers if it occurs on a standard, up-to-date Windows installation."],"exampleFix":"// No code fix possible for a native API failure; use Direct mode\nvar cs = new ConnectionString { Connection = ConnectionType.Direct };","handlingStrategy":"try-catch","validationCode":"// No reliable pre-check; probe by attempting mutex creation\ntry\n{\n    var probe = SharedMutexProbe();\n    probe.Dispose();\n}\ncatch { cs.Connection = ConnectionType.Direct; }\n\nMutex SharedMutexProbe()\n{\n    // Attempt the same SDDL-based mutex creation path\n    return new Mutex(false, $\"Global\\\\LiteDB_probe_{Guid.NewGuid():N}\");\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    using var db = new LiteDatabase(cs);\n}\ncatch (Win32Exception ex) when (ex.Message.Contains(\"security descriptor\"))\n{\n    // SDDL conversion failed; use Direct mode\n    cs.Connection = ConnectionType.Direct;\n    using var db = new LiteDatabase(cs);\n}","preventionTips":["Use Direct mode to bypass the SDDL security descriptor creation entirely.","Ensure advapi32.dll is intact (run sfc /scannow if corrupted).","Run with sufficient OS privileges for security descriptor operations."],"tags":["shared-mode","mutex","win32","security-descriptor","sddl","windows"],"backgroundTag":null,"analyzedSha":"f906a5f850678719e39a39a006cb66dcae563cfa","analyzedAt":"2026-08-13T21:56:30.148Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}