NamedPipeServerStream 未授权访问异常

Question

I recieved an Event Viever entry from one of my users saying that Unauthorized Access Exception happened. The process is started from a service as a SYSTEM. I was able to narrow down the error to the part where NamedPipeServerStream is created:

  // <error in this block>
  PipeSecurity pipeSa = new PipeSecurity(); 
  pipeSa.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));
  NamedPipeServerStream np = new NamedPipeServerStream("streamname", PipeDirection.InOut,1,PipeTransmissionMode.Message,PipeOptions.None,16383,1, pipeSa);
  // </error in this block>


  while (true){
     try{
        if (!np.IsConnected)
           np.WaitForConnection();
     }catch(Exception e){

     }
  }

I am pretty sure that the error is in the 3 line block above. It doesn't happen on any of my computers so I can't repeat the error. What in the above code is not considered best practice and can cause errors?

error message image:

Answer 1

The question you asked has very few details. So it will be hard to narrow down what the true cause is. However I'm willing to take a stab at it.

If you look at the documentation for the Unauthorized Access Exception

The exception that is thrown when the operating system denies access because of an I/O error or a specific type of security error.

We can see that your code already swallows all exception. So there for we can probably assume that this is thrown while creating the pipe.

My best guess is that there are times that you cannot access the pipe, because system does not have the proper access to the pipe. After doing some quick research. This question seems to have a lot of good information worth the try. To Paraphrase a few answers:

There are two things which can cause the instantiation of a second or subsequent NamedPipeServerStream on the same pipe to fail:

• the maxNumberOfServerInstances ctor argument must have been set to more than 1 when the first instance of the pipe server was created. If not, the second call will fail unless the first instance has already been closed completely.
• the process calling the ctor must have the access right represented by PipeAccessRights.CreateNewInstance. This is a powerful right which the pipe server should guard jealously, as it allows its possessor the ability to act as a pipe server.

You're probably missing a privilege's you need to add an Access Right perhaps you need to provide control to the system:

pipeSa.AddAccessRule(new PipeAccessRule("SYSTEM", PipeAccessRights.FullControl, AccessControlType.Allow));
pipeSa.AddAccessRule(pa);