Question

我在连接＆＃34;写＆＃34;时遇到了同样的问题。管道到正在运行的服务：UnauthorizedAccessException。我尝试了所有解决方案，没有任何东西可以使它成功连接。

该方案是在系统托盘中运行的低完整性C＃/ WPF应用程序，它使用命名管道从Windows服务获取通知，并可以告诉服务取消某些操作或等待更多数据（这就是为什么它需要一个将管道写入服务）。从服务管道读取工作正常，我使用两个管道对象（一个从服务到客户端，另一个从客户端到服务）。

该服务在域用户的帐户下运行，但管道无论在何处运行都无法连接，包括本地系统。

服务器管道的创建方式如下：

PipeSecurity ps = new PipeSecurity();

// Production service runs under current user credentials.
ps.AddAccessRule(new PipeAccessRule(WindowsIdentity.GetCurrent().User, PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow));

// Test service runs under local system credentials.
ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), PipeAccessRights.ReadWrite | PipeAccessRights.CreateNewInstance, AccessControlType.Allow));

// Add world just for the hell of it, still won't work.
ps.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), PipeAccessRights.FullControl, AccessControlType.Allow));

this.readPipe = new NamedPipeServerStream(clientPipeName, PipeDirection.In);
this.writePipe = new NamedPipeServerStream(serverPipeName, PipeDirection.Out, 1, PipeTransmissionMode.Byte, PipeOptions.None, 1024, 1024, ps);

客户端管道的创建方式如下：

this.readPipe = new NamedPipeClientStream(".", serverPipeName, PipeDirection.In);
this.writePipe = new NamedPipeClientStream(".", clientPipeName, PipeDirection.Out);

// This doesn't make a difference.
//this.writePipe = new NamedPipeClientStream(".", clientPipeName, PipeAccessRights.FullControl, PipeOptions.None, TokenImpersonationLevel.None, HandleInheritability.None);

Answer 1

不想让这个开放，因为这已经解决并且代码正在生产中。

服务器管道必须仔细构造ACL列表，以允许来自低完整性客户端管道的连接，只要用户经过身份验证或管理员。请参见CreateNativePipeSecurity（）。

客户端管道照常创建

/// <summary>
/// Creates the client and server pipes.
/// </summary>
private void CreatePipes()
{
    string serverPipeName = string.Format("{0}server", this.pipeName);
    string clientPipeName = string.Format("{0}client", this.pipeName);

    if (this.readPipe != null)
    {
        this.readPipe.Dispose();
    }

    if (this.writePipe != null)
    {
        this.writePipe.Dispose();
    }

    if (this.server)
    {
        // Create a write pipe for sending notifications to client.
        this.writePipe = new NamedPipeServerStream(clientPipeName, PipeDirection.Out);

        // Create a read pipe for receiving notifications from the client.
        // Creating a pipe to high integrity process from low integrity process requires native access list creation (.NET bug).
        NativeMethods.SECURITY_ATTRIBUTES securityAttributes = this.CreateNativePipeSecurity();
        IntPtr securityAttributesPtr = Marshal.AllocHGlobal(Marshal.SizeOf(securityAttributes));
        Marshal.StructureToPtr(securityAttributes, securityAttributesPtr, false);

        string nativePipeName = string.Format(@"\\.\pipe\{0}", serverPipeName);

        SafePipeHandle nativePipe = NativeMethods.CreateNamedPipe(
            nativePipeName,
            NativeMethods.PipeOpenMode.PIPE_ACCESS_INBOUND,
            0,
            NativeMethods.PipeInstances.PIPE_UNLIMITED_INSTANCES,
            0,
            0,
            NativeMethods.PipeWait.NMPWAIT_WAIT_FOREVER,
            securityAttributesPtr);

        int error = Marshal.GetLastWin32Error();

        Marshal.FreeHGlobal(securityAttributesPtr);

        if (nativePipe.IsInvalid)
        {                    
            throw new Win32Exception(error);
        }

        this.readPipe = new NamedPipeServerStream(PipeDirection.In, false, false, nativePipe);
    }
    else
    {
        // Create a read pipe for receiving notifications from server.
        this.readPipe = new NamedPipeClientStream(".", clientPipeName, PipeDirection.In);

        // Create a write pipe for sending notifications to the server.
        this.writePipe = new NamedPipeClientStream(".", serverPipeName, PipeDirection.Out);
    }
}

/// <summary>
/// Generate security attributes to allow low integrity process to connect to high integrity service.
/// </summary>
/// <returns>A structure filled with proper attributes.</returns>
private NativeMethods.SECURITY_ATTRIBUTES CreateNativePipeSecurity()
{
    // Define the SDDL for the security descriptor.
    string sddl = "D:" +        // Discretionary ACL
        "(A;OICI;GRGW;;;AU)" +  // Allow read/write to authenticated users
        "(A;OICI;GA;;;BA)";     // Allow full control to administrators

    IntPtr securityDescriptor = IntPtr.Zero;

    if (NativeMethods.ConvertStringSecurityDescriptorToSecurityDescriptor(
        sddl, 1, out securityDescriptor, IntPtr.Zero) == 0)
    {
        throw new Win32Exception(Marshal.GetLastWin32Error());
    }

    NativeMethods.SECURITY_ATTRIBUTES sa = new NativeMethods.SECURITY_ATTRIBUTES();
    sa.nLength = Marshal.SizeOf(sa);
    sa.lpSecurityDescriptor = securityDescriptor;
    sa.bInheritHandle = 0;

    return sa;
}

NamedPipeClientStream在Connect上抛出UnauthorizedAccessException

1 个答案: