更改名为 Pipe 的 SACL

Question

I have C++ code that change SACL of a folder as it is expected. The things become strange when I want to change SACL of an exsiting Named Pipe, the code executes successful but when I check it via Get-Acl -Path \\.\pipe\lsass -Audit | flGet-Acl -Path \\.\pipe\lsass -Audit | fl it returns error number 87 which is ERROR_INVALID_PARAMETER and SACL does not work. The error may be caused by setting not zero to OVERLAPPED structure according to MS Support Site but it barely helping in setting SACL.

StackOverFlow wants me to add some details, so I will write some water here

Maybe I messed up with some of the rights to provide to SetSecurityInfo and it is specifical to Named Pipes or I need to suspend it before change SACL?

using namespace std;

int main()
{

    SetSecurityPrivilage(TRUE); // Got SeSecurityPrivilage

    //HANDLE hPipe = CreateFile(L"C\:\\Users\\simp\\Desktop\\test", ACCESS_SYSTEM_SECURITY, 0, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL); // Folder SACL testing
    HANDLE hPipe = CreateFile(L"\\\\.\\pipe\\lsass", ACCESS_SYSTEM_SECURITY, 0, NULL, OPEN_EXISTING, NULL, NULL);
    if (hPipe != INVALID_HANDLE_VALUE)
    {

        PACL pOldSACL = NULL;

        if (GetSecurityInfo(hPipe, SE_KERNEL_OBJECT, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, &pOldSACL, NULL) == ERROR_SUCCESS)
        {

            // SACL
            TRUSTEE trusteeSACL[1];
            trusteeSACL[0].TrusteeForm = TRUSTEE_IS_NAME;
            trusteeSACL[0].TrusteeType = TRUSTEE_IS_GROUP;
            trusteeSACL[0].ptstrName = (LPWCH)(L"Everyone");
            trusteeSACL[0].MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
            trusteeSACL[0].pMultipleTrustee = NULL;

            EXPLICIT_ACCESS explicit_access_listSACL[1];
            ZeroMemory(&explicit_access_listSACL[0], sizeof(EXPLICIT_ACCESS));

            explicit_access_listSACL[0].grfAccessMode = SET_AUDIT_SUCCESS;
            //explicit_access_listSACL[0].grfAccessMode = SET_AUDIT_FAILURE;
            explicit_access_listSACL[0].grfAccessPermissions = ACCESS_SYSTEM_SECURITY;
            explicit_access_listSACL[0].grfInheritance = NO_INHERITANCE;
            explicit_access_listSACL[0].Trustee = trusteeSACL[0];

            PACL pNewSACL = NULL;

            if (SetEntriesInAcl(1, explicit_access_listSACL, pOldSACL, &pNewSACL) == ERROR_SUCCESS)
            {

                if (SetSecurityInfo(hPipe, SE_KERNEL_OBJECT, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, pNewSACL) == ERROR_SUCCESS)
                {
                    printf("%s\n", "SACL SetSecurityInfo IS WORKS");
                }
                else
                {
                    //Error handling        
                    printf("%s%d\n", "SetSecurityInfo SACL", GetLastError());
                }
                
              
                LocalFree(pNewSACL);
            }
            else
            {
                //Error handling        
                printf("%s%d\n", "SetEntriesInAcl", GetLastError());
            }
            LocalFree(pOldSACL);
        }
        else
        {
            //Error
            printf("%s%d\n", "GetSecurityInfo SACL", GetLastError());
        }
    }
    else
    {
        //Error handling
        printf("%s%d", "Incorrect handle", GetLastError());
    }
    CloseHandle(hPipe);

Answer 1

Actually, the code is doing it's job. Then you compile and run this, you will change SACL of a pipe as well as a file. My mistake was in this part:

explicit_access_listSACL[0].grfAccessPermissions = ACCESS_SYSTEM_SECURITY;

Which means that logs will be generate only when user will request ACCESS_SYSTEM_SECURITY rights to a pipe, so change it to your needs. However, the reason behind 87 error is still unknown.