astrid-runtime/astrid · error

named-pipe DACL omits the current user or Local System

Error message

named-pipe DACL omits the current user or Local System

What it means

The final check in validate_pipe_security requires the DACL to have seen an allow entry for the current user and for Local System (skipped only when the current user IS Local System). This error means a full-control ACE for one of those principals is missing, so the pipe either can't be used by the current user or lacks the expected SYSTEM entry, and the connection is refused rather than proceeding on a non-canonical ACL.

Source

Thrown at crates/astrid-core/src/local_transport/windows.rs:977

            return Err(io::Error::new(
                io::ErrorKind::PermissionDenied,
                "named-pipe DACL contains a non-canonical access entry",
            ));
        }
        if unsafe { EqualSid(sid.as_ptr(), current.as_psid()) } != 0 && !saw_current {
            saw_current = true;
        } else if unsafe { EqualSid(sid.as_ptr(), system.as_psid()) } != 0 && !saw_system {
            saw_system = true;
        } else {
            return Err(io::Error::new(
                io::ErrorKind::PermissionDenied,
                "named-pipe DACL grants an unexpected or duplicate principal",
            ));
        }
    }

    if !saw_current || !saw_system {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "named-pipe DACL omits the current user or Local System",
        ));
    }
    Ok(())
}

fn is_canonical_pipe_full_control(mask: u32) -> bool {
    // The I/O manager maps generic access bits to the file-object-specific
    // mask when attaching a descriptor to a named pipe. Accept the exact SDDL
    // source form and its exact mapped form, but no weaker or augmented mask.
    mask == GENERIC_ALL || mask == FILE_ALL_ACCESS
}

#[cfg(test)]
#[path = "windows/tests.rs"]
mod tests;

View on GitHub (pinned to affd8760f4)

Solutions

  1. Recreate the pipe from the same account the client runs as, using the library's creation API, so both the current-user and SYSTEM ACEs are present.
  2. If running as a service, use the library's canonical SDDL (include both your service SID and Local System) rather than a trimmed custom ACL.
  3. Check for filtered/restricted tokens (AppContainer, restricted service tokens) that make the token user differ from the ACE SID; run unrestricted or use matching SIDs.
  4. Verify with Get-Acl that both principals appear with full control.

Example fix

// before: SDDL missing SYSTEM
"D:P(A;;GA;;;CURRENT_USER)"
// after: include Local System
"D:P(A;;GA;;;CURRENT_USER)(A;;GA;;;SY)"
Defensive patterns

Strategy: validation

Validate before calling

// PowerShell preflight: both current user and SYSTEM must appear with FullControl
// $a=Get-Acl \\.\pipe\myapp; $a.Access.IdentityReference -contains 'NT AUTHORITY\\SYSTEM'

Try / catch

if let Err(e) = connect() {
    if e.to_string().contains("omits the current user or Local System") {
        eprintln!("pipe created by a different/restricted account; recreate under current user");
    } else { return Err(e.into()); }
}

Prevention

When it happens

Trigger: connect()/accept() where the ACE loop completes but saw_current == false (no ACE for the current user SID) or saw_system == false (no ACE for WinLocalSystemSid and current user != SYSTEM).

Common situations: A restricted token or service account (e.g. Network Service) created the pipe so the ACE lists that SID instead of the connecting user's; an admin trimmed the SYSTEM ACE; custom SDDL with only one principal; running under a container or job with a filtered token.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/816292f5df9f4abe. Report an issue: GitHub.