Add the CurrentUserOnly and CurrentSessionOnly options for named Mutex, Semaphore, and EventWaitHandle (#112213)

- In `Mutex`, `Semaphore`, and `EventWaitHandle`, added overloads for methods with a `name` argument to also include a `NamedWaitHandleOptions options` argument. The `CurrentUserOnly` option indicates whether the object should be limited in access to the current user. The `CurrentSessionOnly` option indicates whether the object object is intended to be used only within the current session (an alternative to the name prefixes, such as `Global\`). The default value for `NamedWaitHandleOptions` has `CurrentUserOnly=true` and `CurrentSessionOnly=true`.
- On Unixes, named semaphores and events are not supported. Named mutexes are have a functional implementation on Unixes in CoreCLR. NativeAOT and Mono on Unixes use an incomplete/temporary implementation where named mutexes are just process-local mutexes stored in a dictionary keyed by the name and can't be used to synchronize between processes. This change only briefly extends the NativeAOT/Mono implementation to add another prefix to the name when `CurrentUserOnly=true`. Sharing the CoreCLR Unix named mutex implementation with NativeAOT/Mono is left to a separate change. Most of what is described below when `CurrentUserOnly=true` on Unixes refers to the CoreCLR implementation.
- The plan is to also deprecate the APIs with a `name` argument but without an `options` argument in a separate change
- API review: #102682 (comment)

### Windows with `CurrentUserOnly=true`

When creating a named mutex, a security descriptor is created and assigned to the object.

- The owner and group are set to the current user
- The DACL has two ACEs:
  - One ACE allows the current user the relevant access rights
  - Another ACE allows the `BUILTIN\Administrators` group the `READ_CONTROL` access right to enable reading the security info for diagnostic purposes
- The SACL has a mandatory label ACE
  - The access policy prevents principals with an integrity level lower than the object from opening the object
  - The integrity level assigned to the object is the same as what would be assigned by the system by default
- When opening a named mutex, the owner and DACL are verified to see if they are as expected, and if not, a `WaitHandleCannotBeOpenedException` is thrown
- Access controls are set when creating an object and checked when opening an object. Once a handle to the object is obtained, typical synchronization operations may not do further access checks. It's up to the caller to be careful about how the handle to the object is passed around.

### Unixes with `CurrentUserOnly=true`

- Files relevant to named mutexes (shared memory and lock files) go under `/tmp/.dotnet-uidN/` where `N` is the effective user ID
  - `/tmp/` (or equivalent) was chosen mainly for the automatic cleanup, as the number of files can add up in cases where mutexes are not disposed, particularly when randomly generated names are used upon each invocation of a process. Due to the use of a global location `/tmp/` or equivalent, it would be possible for a user to deny access to the `.dotnet-uidN` directory of a different user if the directory hadn't been created yet. An alternative considered was to use the home directory and introduce some kind of periodic cleanup strategy, but there are also other tradeoffs.
- `/tmp/` or equivalent must either have the sticky bit, or it must be owned by the current user and without write access for any other user. Otherwise, an exception is thrown.
- Permissions of the `/tmp/.dotnet-uidN/` directory and files/directories under it are limited in access to the current user
- When opening a named mutex, the owner and permissions of relevant files/directories are verified to see if they are as expected, and if not, an exception is thrown
- Access controls are set when creating an object and checked when opening an object. Once a handle to the object is obtained, typical synchronization operations may not do further access checks. It's up to the caller to be careful about how the handle to the object is passed around.

### Namespaces

  - On Windows, there is no namespace for kernel objects for each user. `CurrentSessionOnly=true` is close, but it is possible for multiple users to be running code simultaneously in the same session. There is a global namespace, and a namespace per session. When `CurrentUserOnly=true`, callers may need to ensure that the name used is distinguished for different users.
  - On Unixes, a different directory tree is used when `CurrentUserOnly=true`, so each user has a separate namespace for objects, including for session-scoped and session-unscoped objects.

Author: kouvel

src/coreclr/System.Private.CoreLib/src/System/Threading/Mutex.CoreCLR.Unix.cs

@@ -14,9 +14,40 @@ namespace System.Threading
     /// </summary>
     public sealed partial class Mutex : WaitHandle
     {
-        private void CreateMutexCore(bool initiallyOwned, string? name, out bool createdNew)
+        private unsafe void CreateMutexCore(bool initiallyOwned)
         {
-            SafeWaitHandle mutexHandle = CreateMutexCore(initiallyOwned, name, out int errorCode, out string? errorDetails);
+            SafeWaitHandle handle =
+                CreateMutex(
+                    initiallyOwned,
+                    name: null,
+                    currentUserOnly: false,
+                    systemCallErrors: null,
+                    systemCallErrorsBufferSize: 0);
+            if (handle.IsInvalid)
+            {
+                int errorCode = Marshal.GetLastPInvokeError();
+                handle.SetHandleAsInvalid();
+                throw Win32Marshal.GetExceptionForWin32Error(errorCode);
+            }
+
+            SafeWaitHandle = handle;
+        }
+
+        private void CreateMutexCore(
+            bool initiallyOwned,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
+        {
+            bool currentUserOnly = false;
+            if (!string.IsNullOrEmpty(name) && options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+                currentUserOnly = options.CurrentUserOnly;
+            }
+
+            SafeWaitHandle mutexHandle =
+                CreateMutexCore(initiallyOwned, name, currentUserOnly, out int errorCode, out string? errorDetails);
             if (mutexHandle.IsInvalid)
             {
                 mutexHandle.SetHandleAsInvalid();
@@ -33,16 +64,26 @@ private void CreateMutexCore(bool initiallyOwned, string? name, out bool created
             SafeWaitHandle = mutexHandle;
         }
 
-        private static OpenExistingResult OpenExistingWorker(string name, out Mutex? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out Mutex? result)
         {
             ArgumentException.ThrowIfNullOrEmpty(name);
 
+            bool currentUserOnly = false;
+            if (options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+                currentUserOnly = options.CurrentUserOnly;
+            }
+
             result = null;
             // To allow users to view & edit the ACL's, call OpenMutex
             // with parameters to allow us to view & edit the ACL.  This will
             // fail if we don't have permission to view or edit the ACL's.
             // If that happens, ask for less permissions.
-            SafeWaitHandle myHandle = OpenMutexCore(name, out int errorCode, out string? errorDetails);
+            SafeWaitHandle myHandle = OpenMutexCore(name, currentUserOnly, out int errorCode, out string? errorDetails);
 
             if (myHandle.IsInvalid)
             {
@@ -86,11 +127,13 @@ public void ReleaseMutex()
         private static unsafe SafeWaitHandle CreateMutexCore(
             bool initialOwner,
             string? name,
+            bool currentUserOnly,
             out int errorCode,
             out string? errorDetails)
         {
             byte* systemCallErrors = stackalloc byte[SystemCallErrorsBufferSize];
-            SafeWaitHandle mutexHandle = CreateMutex(initialOwner, name, systemCallErrors, SystemCallErrorsBufferSize);
+            SafeWaitHandle mutexHandle =
+                CreateMutex(initialOwner, name, currentUserOnly, systemCallErrors, SystemCallErrorsBufferSize);
 
             // Get the error code even if the handle is valid, as it could be ERROR_ALREADY_EXISTS, indicating that the mutex
             // already exists and was opened
@@ -100,10 +143,10 @@ private static unsafe SafeWaitHandle CreateMutexCore(
             return mutexHandle;
         }
 
-        private static unsafe SafeWaitHandle OpenMutexCore(string name, out int errorCode, out string? errorDetails)
+        private static unsafe SafeWaitHandle OpenMutexCore(string name, bool currentUserOnly, out int errorCode, out string? errorDetails)
         {
             byte* systemCallErrors = stackalloc byte[SystemCallErrorsBufferSize];
-            SafeWaitHandle mutexHandle = OpenMutex(name, systemCallErrors, SystemCallErrorsBufferSize);
+            SafeWaitHandle mutexHandle = OpenMutex(name, currentUserOnly, systemCallErrors, SystemCallErrorsBufferSize);
             errorCode = mutexHandle.IsInvalid ? Marshal.GetLastPInvokeError() : Interop.Errors.ERROR_SUCCESS;
             errorDetails = mutexHandle.IsInvalid ? GetErrorDetails(systemCallErrors) : null;
             return mutexHandle;
@@ -127,9 +170,9 @@ private static unsafe SafeWaitHandle OpenMutexCore(string name, out int errorCod
         }
 
         [LibraryImport(RuntimeHelpers.QCall, EntryPoint = "PAL_CreateMutexW", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
-        private static unsafe partial SafeWaitHandle CreateMutex([MarshalAs(UnmanagedType.Bool)] bool initialOwner, string? name, byte* systemCallErrors, uint systemCallErrorsBufferSize);
+        private static unsafe partial SafeWaitHandle CreateMutex([MarshalAs(UnmanagedType.Bool)] bool initialOwner, string? name, [MarshalAs(UnmanagedType.Bool)] bool currentUserOnly, byte* systemCallErrors, uint systemCallErrorsBufferSize);
 
         [LibraryImport(RuntimeHelpers.QCall, EntryPoint = "PAL_OpenMutexW", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
-        private static unsafe partial SafeWaitHandle OpenMutex(string name, byte* systemCallErrors, uint systemCallErrorsBufferSize);
+        private static unsafe partial SafeWaitHandle OpenMutex(string name, [MarshalAs(UnmanagedType.Bool)] bool currentUserOnly, byte* systemCallErrors, uint systemCallErrorsBufferSize);
     }
 }

src/coreclr/pal/inc/pal.h

@@ -854,6 +854,7 @@ PALAPI
 PAL_CreateMutexW(
     IN BOOL bInitialOwner,
     IN LPCWSTR lpName,
+    IN BOOL bCurrentUserOnly,
     IN LPSTR lpSystemCallErrors,
     IN DWORD dwSystemCallErrorsBufferSize);
 
@@ -875,6 +876,7 @@ HANDLE
 PALAPI
 PAL_OpenMutexW(
        IN LPCWSTR lpName,
+       IN BOOL bCurrentUserOnly,
        IN LPSTR lpSystemCallErrors,
        IN DWORD dwSystemCallErrorsBufferSize);
 

src/coreclr/pal/inc/pal_error.h

@@ -147,7 +147,6 @@
 #define ERROR_PALINIT_TLS 65295L
 #define ERROR_PALINIT_ENV 65296L
 #define ERROR_PALINIT_DBG_CHANNELS 65297L
-#define ERROR_PALINIT_SHARED_MEMORY_MANAGER 65298L
 #define ERROR_PALINIT_SHM 65299L
 #define ERROR_PALINIT_MODULE_MANAGER 65300L
 

src/coreclr/pal/src/include/pal/mutex.hpp

@@ -37,6 +37,7 @@ namespace CorUnix
         LPSECURITY_ATTRIBUTES lpMutexAttributes,
         BOOL bInitialOwner,
         LPCSTR lpName,
+        BOOL bCurrentUserOnly,
         HANDLE *phMutex
         );
 
@@ -51,6 +52,7 @@ namespace CorUnix
         SharedMemorySystemCallErrors *errors,
         CPalThread *pThread,
         LPCSTR lpName,
+        BOOL bCurrentUserOnly,
         HANDLE *phMutex
         );
 
@@ -216,10 +218,10 @@ class NamedMutexProcessData : public SharedMemoryProcessDataBase
     bool m_hasRefFromLockOwnerThread;
 
 public:
-    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, bool acquireLockIfCreated, bool *createdRef);
-    static SharedMemoryProcessDataHeader *Open(SharedMemorySystemCallErrors *errors, LPCSTR name);
+    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, bool isUserScope, bool acquireLockIfCreated, bool *createdRef);
+    static SharedMemoryProcessDataHeader *Open(SharedMemorySystemCallErrors *errors, LPCSTR name, bool isUserScope);
 private:
-    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, bool createIfNotExist, bool acquireLockIfCreated, bool *createdRef);
+    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, bool isUserScope, bool createIfNotExist, bool acquireLockIfCreated, bool *createdRef);
 
 public:
     NamedMutexProcessData(

src/coreclr/pal/src/include/pal/sharedmemory.h

@@ -27,27 +27,26 @@
 #define SHARED_MEMORY_MAX_FILE_NAME_CHAR_COUNT (_MAX_FNAME - 1)
 #define SHARED_MEMORY_MAX_NAME_CHAR_COUNT (STRING_LENGTH("Global\\") + SHARED_MEMORY_MAX_FILE_NAME_CHAR_COUNT)
 
-#define SHARED_MEMORY_RUNTIME_TEMP_DIRECTORY_NAME ".dotnet"
-#define SHARED_MEMORY_SHARED_MEMORY_DIRECTORY_NAME ".dotnet/shm"
-#define SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME ".dotnet/lockfiles"
-static_assert_no_msg(ARRAY_SIZE(SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME) >= ARRAY_SIZE(SHARED_MEMORY_SHARED_MEMORY_DIRECTORY_NAME));
+#define SHARED_MEMORY_USER_UNSCOPED_RUNTIME_TEMP_DIRECTORY_NAME ".dotnet"
+#define SHARED_MEMORY_USER_SCOPED_RUNTIME_TEMP_DIRECTORY_NAME_PREFIX ".dotnet-uid"
+#define SHARED_MEMORY_SHARED_MEMORY_DIRECTORY_NAME "shm"
+#define SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME "lockfiles"
+static_assert_no_msg(STRING_LENGTH(SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME) >= STRING_LENGTH(SHARED_MEMORY_SHARED_MEMORY_DIRECTORY_NAME));
 
 #define SHARED_MEMORY_GLOBAL_DIRECTORY_NAME "global"
 #define SHARED_MEMORY_SESSION_DIRECTORY_NAME_PREFIX "session"
-static_assert_no_msg(ARRAY_SIZE(SHARED_MEMORY_SESSION_DIRECTORY_NAME_PREFIX) >= ARRAY_SIZE(SHARED_MEMORY_GLOBAL_DIRECTORY_NAME));
 
-#define SHARED_MEMORY_UNIQUE_TEMP_NAME_TEMPLATE ".coreclr.XXXXXX"
-
-#define SHARED_MEMORY_MAX_SESSION_ID_CHAR_COUNT (10)
+#define SHARED_MEMORY_UNIQUE_TEMP_NAME_TEMPLATE ".dotnet.XXXXXX"
 
 // Note that this Max size does not include the prefix folder path size which is unknown (in the case of sandbox) until runtime
 #define SHARED_MEMORY_MAX_FILE_PATH_CHAR_COUNT \
     ( \
+        STRING_LENGTH(SHARED_MEMORY_USER_SCOPED_RUNTIME_TEMP_DIRECTORY_NAME_PREFIX) + \
+        11 /* user ID, path separator */ + \
         STRING_LENGTH(SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME) + \
         1 /* path separator */ + \
         STRING_LENGTH(SHARED_MEMORY_SESSION_DIRECTORY_NAME_PREFIX) + \
-        SHARED_MEMORY_MAX_SESSION_ID_CHAR_COUNT + \
-        1 /* path separator */ + \
+        11 /* session ID, path separator */ + \
         SHARED_MEMORY_MAX_FILE_NAME_CHAR_COUNT \
     )
 
@@ -98,12 +97,17 @@ class SharedMemorySystemCallErrors
     void Append(LPCSTR format, ...);
 };
 
+class SharedMemoryId;
+
 class SharedMemoryHelpers
 {
 private:
-    static const mode_t PermissionsMask_CurrentUser_ReadWriteExecute;
+    static const mode_t PermissionsMask_OwnerUser_ReadWrite;
+    static const mode_t PermissionsMask_OwnerUser_ReadWriteExecute;
+    static const mode_t PermissionsMask_NonOwnerUsers_Write;
     static const mode_t PermissionsMask_AllUsers_ReadWrite;
     static const mode_t PermissionsMask_AllUsers_ReadWriteExecute;
+    static const mode_t PermissionsMask_Sticky;
 public:
     static const UINT32 InvalidProcessId;
     static const SIZE_T InvalidThreadId;
@@ -114,17 +118,14 @@ class SharedMemoryHelpers
     static SIZE_T AlignUp(SIZE_T value, SIZE_T alignment);
 
     static void *Alloc(SIZE_T byteCount);
-
-    template<SIZE_T SuffixByteCount> static void BuildSharedFilesPath(PathCharString& destination, const char (&suffix)[SuffixByteCount]);
-    static void BuildSharedFilesPath(PathCharString& destination, const char *suffix, int suffixByteCount);
     static bool AppendUInt32String(PathCharString& destination, UINT32 value);
 
-    static bool EnsureDirectoryExists(SharedMemorySystemCallErrors *errors, const char *path, bool isGlobalLockAcquired, bool createIfNotExist = true, bool isSystemDirectory = false);
+    static bool EnsureDirectoryExists(SharedMemorySystemCallErrors *errors, const char *path, const SharedMemoryId *id, bool isGlobalLockAcquired, bool createIfNotExist = true, bool isSystemDirectory = false);
 private:
     static int Open(SharedMemorySystemCallErrors *errors, LPCSTR path, int flags, mode_t mode = static_cast<mode_t>(0));
 public:
     static int OpenDirectory(SharedMemorySystemCallErrors *errors, LPCSTR path);
-    static int CreateOrOpenFile(SharedMemorySystemCallErrors *errors, LPCSTR path, bool createIfNotExist = true, bool *createdRef = nullptr);
+    static int CreateOrOpenFile(SharedMemorySystemCallErrors *errors, LPCSTR path, const SharedMemoryId *id, bool createIfNotExist = true, bool *createdRef = nullptr);
     static void CloseFile(int fileDescriptor);
 
     static int ChangeMode(LPCSTR path, mode_t mode);
@@ -150,19 +151,24 @@ class SharedMemoryId
     LPCSTR m_name;
     SIZE_T m_nameCharCount;
     bool m_isSessionScope; // false indicates global scope
+    bool m_isUserScope;
+    uid_t m_userScopeUid;
 
 public:
     SharedMemoryId();
-    SharedMemoryId(LPCSTR name, SIZE_T nameCharCount, bool isSessionScope);
-    SharedMemoryId(LPCSTR name);
+    SharedMemoryId(LPCSTR name, bool isUserScope);
 
 public:
     LPCSTR GetName() const;
     SIZE_T GetNameCharCount() const;
+    void ReplaceNamePtr(LPCSTR name);
     bool IsSessionScope() const;
-    bool Equals(SharedMemoryId *other) const;
+    bool IsUserScope() const;
+    uid_t GetUserScopeUid() const;
+    bool Equals(const SharedMemoryId *other) const;
 
 public:
+    bool AppendRuntimeTempDirectoryName(PathCharString& path) const;
     bool AppendSessionDirectoryName(PathCharString& path) const;
 };
 
@@ -222,22 +228,22 @@ class SharedMemoryProcessDataHeader
     SharedMemoryProcessDataHeader *m_nextInProcessDataHeaderList;
 
 public:
-    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, SharedMemorySharedDataHeader requiredSharedDataHeader, SIZE_T sharedDataByteCount, bool createIfNotExist, bool *createdRef);
+    static SharedMemoryProcessDataHeader *CreateOrOpen(SharedMemorySystemCallErrors *errors, LPCSTR name, bool isUserScope, SharedMemorySharedDataHeader requiredSharedDataHeader, SIZE_T sharedDataByteCount, bool createIfNotExist, bool *createdRef);
 
 public:
     static SharedMemoryProcessDataHeader *PalObject_GetProcessDataHeader(CorUnix::IPalObject *object);
     static void PalObject_SetProcessDataHeader(CorUnix::IPalObject *object, SharedMemoryProcessDataHeader *processDataHeader);
     static void PalObject_Close(CorUnix::CPalThread *thread, CorUnix::IPalObject *object, bool isShuttingDown);
 
 private:
-    SharedMemoryProcessDataHeader(SharedMemoryId *id, int fileDescriptor, SharedMemorySharedDataHeader *sharedDataHeader, SIZE_T sharedDataTotalByteCount);
+    SharedMemoryProcessDataHeader(const SharedMemoryId *id, int fileDescriptor, SharedMemorySharedDataHeader *sharedDataHeader, SIZE_T sharedDataTotalByteCount);
 public:
-    static SharedMemoryProcessDataHeader *New(SharedMemoryId *id, int fileDescriptor, SharedMemorySharedDataHeader *sharedDataHeader, SIZE_T sharedDataTotalByteCount);
+    static SharedMemoryProcessDataHeader *New(const SharedMemoryId *id, int fileDescriptor, SharedMemorySharedDataHeader *sharedDataHeader, SIZE_T sharedDataTotalByteCount);
     ~SharedMemoryProcessDataHeader();
     void Close();
 
 public:
-    SharedMemoryId *GetId();
+    const SharedMemoryId *GetId() const;
     SharedMemoryProcessDataBase *GetData() const;
     void SetData(SharedMemoryProcessDataBase *data);
     SharedMemorySharedDataHeader *GetSharedDataHeader() const;
@@ -256,8 +262,24 @@ class SharedMemoryManager
     static CRITICAL_SECTION s_creationDeletionProcessLock;
     static int s_creationDeletionLockFileDescriptor;
 
-    static PathCharString* s_runtimeTempDirectoryPath;
-    static PathCharString* s_sharedMemoryDirectoryPath;
+    struct UserScopeUidAndFileDescriptor
+    {
+        uid_t userScopeUid;
+        int fileDescriptor;
+
+        UserScopeUidAndFileDescriptor() : userScopeUid((uid_t)0), fileDescriptor(-1)
+        {
+        }
+
+        UserScopeUidAndFileDescriptor(uid_t userScopeUid, int fileDescriptor)
+            : userScopeUid(userScopeUid), fileDescriptor(fileDescriptor)
+        {
+        }
+    };
+
+    static UserScopeUidAndFileDescriptor *s_userScopeUidToCreationDeletionLockFDs;
+    static int s_userScopeUidToCreationDeletionLockFDsCount;
+    static int s_userScopeUidToCreationDeletionLockFDsCapacity;
 
 private:
     static SharedMemoryProcessDataHeader *s_processDataHeaderListHead;
@@ -269,17 +291,16 @@ class SharedMemoryManager
 #endif // _DEBUG
 
 public:
-    static bool StaticInitialize();
+    static void StaticInitialize();
     static void StaticClose();
 
 public:
     static void AcquireCreationDeletionProcessLock();
     static void ReleaseCreationDeletionProcessLock();
-    static void AcquireCreationDeletionFileLock(SharedMemorySystemCallErrors *errors);
-    static void ReleaseCreationDeletionFileLock();
-
-public:
-    static bool CopySharedMemoryBasePath(PathCharString& destination);
+    static void AcquireCreationDeletionFileLock(SharedMemorySystemCallErrors *errors, const SharedMemoryId *id);
+    static void ReleaseCreationDeletionFileLock(const SharedMemoryId *id);
+    static void AddUserScopeUidCreationDeletionLockFD(uid_t userScopeUid, int creationDeletionLockFD);
+    static int FindUserScopeCreationDeletionLockFD(uid_t userScopeUid);
 
 #ifdef _DEBUG
 public:
@@ -290,7 +311,7 @@ class SharedMemoryManager
 public:
     static void AddProcessDataHeader(SharedMemoryProcessDataHeader *processDataHeader);
     static void RemoveProcessDataHeader(SharedMemoryProcessDataHeader *processDataHeader);
-    static SharedMemoryProcessDataHeader *FindProcessDataHeader(SharedMemoryId *id);
+    static SharedMemoryProcessDataHeader *FindProcessDataHeader(const SharedMemoryId *id);
 };
 
 #endif // !_PAL_SHARED_MEMORY_H_

src/coreclr/pal/src/include/pal/sharedmemory.inl

@@ -410,12 +410,7 @@ Initialize(
             // we use large numbers of threads or have many open files.
         }
 
-        if (!SharedMemoryManager::StaticInitialize())
-        {
-            ERROR("Shared memory static initialization failed!\n");
-            palError = ERROR_PALINIT_SHARED_MEMORY_MANAGER;
-            goto CLEANUP1;
-        }
+        SharedMemoryManager::StaticInitialize();
 
         //
         // Initialize global process data

src/coreclr/pal/src/init/pal.cpp

@@ -34,8 +34,6 @@ SET_DEFAULT_DEBUG_CHANNEL(SYNC); // some headers have code with asserts, so do t
 #include <time.h>
 #include <unistd.h>
 
-#include "pal/sharedmemory.inl"
-
 using namespace CorUnix;
 
 /* ------------------- Definitions ------------------------------*/
@@ -89,7 +87,7 @@ CreateMutexW(
     IN BOOL bInitialOwner,
     IN LPCWSTR lpName)
 {
-    return PAL_CreateMutexW(bInitialOwner, lpName, nullptr, 0);
+    return PAL_CreateMutexW(bInitialOwner, lpName, false /* bCurrentUserOnly */, nullptr, 0);
 }
 
 /*++
@@ -113,6 +111,7 @@ PALAPI
 PAL_CreateMutexW(
     IN BOOL bInitialOwner,
     IN LPCWSTR lpName,
+    IN BOOL bCurrentUserOnly,
     IN LPSTR lpSystemCallErrors,
     IN DWORD dwSystemCallErrorsBufferSize)
 {
@@ -171,6 +170,7 @@ PAL_CreateMutexW(
             nullptr,
             bInitialOwner,
             lpName == nullptr ? nullptr : utf8Name,
+            bCurrentUserOnly,
             &hMutex
             );
     }
@@ -238,6 +238,7 @@ CorUnix::InternalCreateMutex(
     LPSECURITY_ATTRIBUTES lpMutexAttributes,
     BOOL bInitialOwner,
     LPCSTR lpName,
+    BOOL bCurrentUserOnly,
     HANDLE *phMutex
     )
 {
@@ -317,7 +318,8 @@ CorUnix::InternalCreateMutex(
         SharedMemoryProcessDataHeader *processDataHeader;
         try
         {
-            processDataHeader = NamedMutexProcessData::CreateOrOpen(errors, lpName, !!bInitialOwner, &createdNamedMutex);
+            processDataHeader =
+                NamedMutexProcessData::CreateOrOpen(errors, lpName, !!bCurrentUserOnly, !!bInitialOwner, &createdNamedMutex);
         }
         catch (SharedMemoryException ex)
         {
@@ -543,7 +545,7 @@ OpenMutexA (
         goto OpenMutexAExit;
     }
 
-    palError = InternalOpenMutex(nullptr, pthr, lpName, &hMutex);
+    palError = InternalOpenMutex(nullptr, pthr, lpName, false /* bCurrentUserOnly */, &hMutex);
 
 OpenMutexAExit:
     if (NO_ERROR != palError)
@@ -571,7 +573,7 @@ OpenMutexW(
        IN BOOL bInheritHandle,
        IN LPCWSTR lpName)
 {
-    return PAL_OpenMutexW(lpName, nullptr, 0);
+    return PAL_OpenMutexW(lpName, false /* bCurrentUserOnly */, nullptr, 0);
 }
 
 /*++
@@ -593,6 +595,7 @@ HANDLE
 PALAPI
 PAL_OpenMutexW(
        IN LPCWSTR lpName,
+       IN BOOL bCurrentUserOnly,
        IN LPSTR lpSystemCallErrors,
        IN DWORD dwSystemCallErrorsBufferSize)
 {
@@ -612,10 +615,11 @@ PAL_OpenMutexW(
 
     /* validate parameters */
     if (lpName == nullptr ||
+        lpName[0] == W('\0') ||
         (int)dwSystemCallErrorsBufferSize < 0 ||
         (lpSystemCallErrors == nullptr) != (dwSystemCallErrorsBufferSize == 0))
     {
-        ERROR("name is NULL or other parameters are invalid\n");
+        ERROR("One or more parameters are invalid\n");
         palError = ERROR_INVALID_PARAMETER;
         goto OpenMutexWExit;
     }
@@ -643,7 +647,7 @@ PAL_OpenMutexW(
         }
 
         SharedMemorySystemCallErrors errors(lpSystemCallErrors, (int)dwSystemCallErrorsBufferSize);
-        palError = InternalOpenMutex(&errors, pthr, lpName == nullptr ? nullptr : utf8Name, &hMutex);
+        palError = InternalOpenMutex(&errors, pthr, lpName == nullptr ? nullptr : utf8Name, bCurrentUserOnly, &hMutex);
     }
 
 OpenMutexWExit:
@@ -675,6 +679,7 @@ CorUnix::InternalOpenMutex(
     SharedMemorySystemCallErrors *errors,
     CPalThread *pthr,
     LPCSTR lpName,
+    BOOL bCurrentUserOnly,
     HANDLE *phMutex
     )
 {
@@ -711,7 +716,7 @@ CorUnix::InternalOpenMutex(
         SharedMemoryProcessDataHeader *processDataHeader;
         try
         {
-            processDataHeader = NamedMutexProcessData::Open(errors, lpName);
+            processDataHeader = NamedMutexProcessData::Open(errors, lpName, bCurrentUserOnly);
         }
         catch (SharedMemoryException ex)
         {
@@ -1074,20 +1079,29 @@ const DWORD NamedMutexProcessData::PollLoopMaximumSleepMilliseconds = 100;
 SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
     SharedMemorySystemCallErrors *errors,
     LPCSTR name,
+    bool isUserScope,
     bool acquireLockIfCreated,
     bool *createdRef)
 {
-    return CreateOrOpen(errors, name, true /* createIfNotExist */, acquireLockIfCreated, createdRef);
+    return CreateOrOpen(errors, name, isUserScope, true /* createIfNotExist */, acquireLockIfCreated, createdRef);
 }
 
-SharedMemoryProcessDataHeader *NamedMutexProcessData::Open(SharedMemorySystemCallErrors *errors, LPCSTR name)
+SharedMemoryProcessDataHeader *NamedMutexProcessData::Open(SharedMemorySystemCallErrors *errors, LPCSTR name, bool isUserScope)
 {
-    return CreateOrOpen(errors, name, false /* createIfNotExist */, false /* acquireLockIfCreated */, nullptr /* createdRef */);
+    return
+        CreateOrOpen(
+            errors,
+            name,
+            isUserScope,
+            false /* createIfNotExist */,
+            false /* acquireLockIfCreated */,
+            nullptr /* createdRef */);
 }
 
 SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
     SharedMemorySystemCallErrors *errors,
     LPCSTR name,
+    bool isUserScope,
     bool createIfNotExist,
     bool acquireLockIfCreated,
     bool *createdRef)
@@ -1153,7 +1167,8 @@ SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
 
             if (m_acquiredCreationDeletionFileLock)
             {
-                SharedMemoryManager::ReleaseCreationDeletionFileLock();
+                _ASSERTE(m_processDataHeader != nullptr);
+                SharedMemoryManager::ReleaseCreationDeletionFileLock(m_processDataHeader->GetId());
             }
 
             if (!m_cancel && m_processDataHeader != nullptr)
@@ -1178,6 +1193,7 @@ SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
         SharedMemoryProcessDataHeader::CreateOrOpen(
             errors,
             name,
+            isUserScope,
             SharedMemorySharedDataHeader(SharedMemoryType::Mutex, SyncSystemVersion),
             sizeof(NamedMutexSharedData),
             createIfNotExist,
@@ -1186,18 +1202,19 @@ SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
     {
         *createdRef = created;
     }
+    if (processDataHeader == nullptr)
+    {
+        _ASSERTE(!created);
+        _ASSERTE(!createIfNotExist);
+        return nullptr;
+    }
     if (created)
     {
         // If the shared memory file was created, the creation/deletion file lock would have been acquired so that we can
         // initialize the shared data
         _ASSERTE(SharedMemoryManager::IsCreationDeletionFileLockAcquired());
         autoCleanup.m_acquiredCreationDeletionFileLock = true;
     }
-    if (processDataHeader == nullptr)
-    {
-        _ASSERTE(!createIfNotExist);
-        return nullptr;
-    }
     autoCleanup.m_processDataHeader = processDataHeader;
 
     if (created)
@@ -1210,27 +1227,29 @@ SharedMemoryProcessDataHeader *NamedMutexProcessData::CreateOrOpen(
     {
     #if !NAMED_MUTEX_USE_PTHREAD_MUTEX
         // Create the lock files directory
-        SharedMemoryHelpers::BuildSharedFilesPath(lockFilePath, SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME);
+        const SharedMemoryId *id = processDataHeader->GetId();
+        SharedMemoryHelpers::VerifyStringOperation(
+            lockFilePath.Set(*gSharedFilesPath) &&
+            id->AppendRuntimeTempDirectoryName(lockFilePath) &&
+            lockFilePath.Append('/') && lockFilePath.Append(SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME));
         if (created)
         {
-            SharedMemoryHelpers::EnsureDirectoryExists(errors, lockFilePath, true /* isGlobalLockAcquired */);
+            SharedMemoryHelpers::EnsureDirectoryExists(errors, lockFilePath, id, true /* isGlobalLockAcquired */);
         }
 
         // Create the session directory
-        SharedMemoryId *id = processDataHeader->GetId();
-        SharedMemoryHelpers::VerifyStringOperation(lockFilePath.Append('/'));
-        SharedMemoryHelpers::VerifyStringOperation(id->AppendSessionDirectoryName(lockFilePath));
+        SharedMemoryHelpers::VerifyStringOperation(lockFilePath.Append('/') && id->AppendSessionDirectoryName(lockFilePath));
         if (created)
         {
-            SharedMemoryHelpers::EnsureDirectoryExists(errors, lockFilePath, true /* isGlobalLockAcquired */);
+            SharedMemoryHelpers::EnsureDirectoryExists(errors, lockFilePath, id, true /* isGlobalLockAcquired */);
             autoCleanup.m_lockFilePath = &lockFilePath;
             autoCleanup.m_sessionDirectoryPathCharCount = lockFilePath.GetCount();
         }
 
         // Create or open the lock file
-        SharedMemoryHelpers::VerifyStringOperation(lockFilePath.Append('/'));
-        SharedMemoryHelpers::VerifyStringOperation(lockFilePath.Append(id->GetName(), id->GetNameCharCount()));
-        int lockFileDescriptor = SharedMemoryHelpers::CreateOrOpenFile(errors, lockFilePath, created);
+        SharedMemoryHelpers::VerifyStringOperation(
+            lockFilePath.Append('/') && lockFilePath.Append(id->GetName(), id->GetNameCharCount()));
+        int lockFileDescriptor = SharedMemoryHelpers::CreateOrOpenFile(errors, lockFilePath, id, created);
         if (lockFileDescriptor == -1)
         {
             _ASSERTE(!created);
@@ -1394,11 +1413,13 @@ void NamedMutexProcessData::Close(bool isAbruptShutdown, bool releaseSharedData)
     {
         // Delete the lock file, and the session directory if it's not empty
         PathCharString path;
-        SharedMemoryHelpers::BuildSharedFilesPath(path, SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME);
-        SharedMemoryId *id = m_processDataHeader->GetId();
-        SharedMemoryHelpers::VerifyStringOperation(path.Append('/'));
-        SharedMemoryHelpers::VerifyStringOperation(id->AppendSessionDirectoryName(path));
-        SharedMemoryHelpers::VerifyStringOperation(path.Append('/'));
+        const SharedMemoryId *id = m_processDataHeader->GetId();
+        SharedMemoryHelpers::VerifyStringOperation(
+            path.Set(*gSharedFilesPath) &&
+            id->AppendRuntimeTempDirectoryName(path) &&
+            path.Append('/') && path.Append(SHARED_MEMORY_LOCK_FILES_DIRECTORY_NAME) &&
+            path.Append('/') && id->AppendSessionDirectoryName(path) &&
+            path.Append('/'));
         SIZE_T sessionDirectoryPathCharCount = path.GetCount();
         SharedMemoryHelpers::VerifyStringOperation(path.Append(id->GetName(), id->GetNameCharCount()));
         unlink(path);

src/coreclr/pal/src/sharedmemory/sharedmemory.cpp

@@ -7,6 +7,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
+#include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
@@ -27,6 +28,16 @@ unsigned int test_getpid()
     return getpid();
 }
 
+unsigned int test_getsid()
+{
+    return getsid(0);
+}
+
+unsigned int test_geteuid()
+{
+    return geteuid();
+}
+
 int test_kill(unsigned int pid)
 {
     return kill(pid, SIGKILL);
@@ -41,11 +52,24 @@ bool TestFileExists(const char *path)
     return true;
 }
 
-bool WriteHeaderInfo(const char *path, char sharedMemoryType, char version, int *fdRef)
+bool WriteHeaderInfo(const char *path, bool currentUserOnly, char sharedMemoryType, char version, int *fdRef)
 {
     int fd = open(path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
     if (fd == -1)
         return false;
+
+    if (currentUserOnly)
+    {
+        int chmodResult;
+        do
+        {
+            chmodResult = chmod(path, S_IRUSR | S_IWUSR);
+        } while (chmodResult != 0 && errno == EINTR);
+
+        if (chmodResult != 0)
+            return false;
+    }
+
     *fdRef = fd;
     if (ftruncate(fd, getpagesize()) != 0)
         return false;

src/coreclr/pal/src/synchobj/mutex.cpp

@@ -0,0 +1,130 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+internal static partial class Interop
+{
+    internal static partial class Advapi32
+    {
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool InitializeAcl(nint pAcl, int nAclLength, int dwAclRevision);
+
+        [LibraryImport(Libraries.Advapi32, EntryPoint = "SetEntriesInAclW", SetLastError = true)]
+        internal static unsafe partial int SetEntriesInAcl(
+            int cCountOfExplicitEntries,
+            EXPLICIT_ACCESS* pListOfExplicitEntries,
+            nint OldAcl,
+            out SafeLocalAllocHandle NewAcl);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static unsafe partial bool GetAce(ACL* pAcl, int dwAceIndex, out ACE* pAce);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool AddMandatoryAce(
+            nint pAcl,
+            int dwAceRevision,
+            int AceFlags,
+            int MandatoryPolicy,
+            nint pLabelSid);
+
+        internal const int ACL_REVISION = 2;
+
+        // Values for ACE_HEADER.AceType
+        internal const byte ACCESS_ALLOWED_ACE_TYPE = 0x0;
+
+        // Values for MandatoryPolicy in AddMandatoryAce()
+        internal const int SYSTEM_MANDATORY_LABEL_NO_WRITE_UP = 0x1;
+        internal const int SYSTEM_MANDATORY_LABEL_NO_READ_UP = 0x2;
+
+        // Values for the RID portion of a mandatory label SID, which indicates the integrity level
+        internal const uint SECURITY_MANDATORY_MEDIUM_RID = 0x2000;
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct ACL
+        {
+            public byte AclRevision;
+            public byte Sbz1;
+            public ushort AclSize;
+            public ushort AceCount;
+            public ushort Sbz2;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct ACE
+        {
+            public ACE_HEADER Header;
+            public uint Mask;
+            public uint SidStart;
+
+            public static int SizeOfSidPortionInAce => sizeof(uint);
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct ACE_HEADER
+        {
+            public byte AceType;
+            public byte AceFlags;
+            public ushort AceSize;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct EXPLICIT_ACCESS
+        {
+            public int grfAccessPermissions;
+            public ACCESS_MODE grfAccessMode;
+            public int grfInheritance;
+            public TRUSTEE Trustee;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct TRUSTEE
+        {
+            public nint pMultipleTrustee;
+            public int MultipleTrusteeOperation;
+            public TRUSTEE_FORM TrusteeForm;
+            public TRUSTEE_TYPE TrusteeType;
+            public nint ptstrName;
+        }
+
+        internal enum ACCESS_MODE
+        {
+            NOT_USED_ACCESS,
+            GRANT_ACCESS,
+            SET_ACCESS,
+            DENY_ACCESS,
+            REVOKE_ACCESS,
+            SET_AUDIT_SUCCESS,
+            SET_AUDIT_FAILURE
+        }
+
+        // Constants for EXPLICIT_ACCESS.grfInheritance
+        internal const int EXPLICIT_ACCESS_NO_INHERITANCE = 0;
+
+        internal enum TRUSTEE_FORM
+        {
+            TRUSTEE_IS_SID,
+            TRUSTEE_IS_NAME,
+            TRUSTEE_BAD_FORM,
+            TRUSTEE_IS_OBJECTS_AND_SID,
+            TRUSTEE_IS_OBJECTS_AND_NAME
+        }
+
+        internal enum TRUSTEE_TYPE
+        {
+            TRUSTEE_IS_UNKNOWN,
+            TRUSTEE_IS_USER,
+            TRUSTEE_IS_GROUP,
+            TRUSTEE_IS_DOMAIN,
+            TRUSTEE_IS_ALIAS,
+            TRUSTEE_IS_WELL_KNOWN_GROUP,
+            TRUSTEE_IS_DELETED,
+            TRUSTEE_IS_INVALID,
+            TRUSTEE_IS_COMPUTER
+        }
+    }
+}

src/coreclr/pal/tests/palsuite/threading/NamedMutex/test1/namedmutex.cpp

@@ -8,11 +8,29 @@ internal static partial class Interop
 {
     internal static partial class Advapi32
     {
-        [LibraryImport(Interop.Libraries.Advapi32, EntryPoint = "CreateWellKnownSid", SetLastError = true)]
+        private const int SID_MAX_SUB_AUTHORITIES = 15;
+        internal const int SECURITY_MAX_SID_SIZE =
+            12 /* sizeof(SID) */ - 4 /* sizeof(DWORD) */ + SID_MAX_SUB_AUTHORITIES * 4 /* sizeof(DWORD) */;
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
         internal static partial int CreateWellKnownSid(
             int sidType,
             byte[]? domainSid,
             byte[] resultSid,
             ref uint resultSidLength);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool CreateWellKnownSid(
+            int sidType,
+            nint domainSid,
+            nint resultSid,
+            ref uint resultSidLength);
+
+        internal enum WELL_KNOWN_SID_TYPE
+        {
+            WinBuiltinAdministratorsSid = 26,
+            WinMediumLabelSid = 67
+        }
     }
 }

src/coreclr/pal/tests/palsuite/threading/NamedMutex/test1/nopal.cpp

@@ -0,0 +1,15 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Runtime.InteropServices;
+
+internal static partial class Interop
+{
+    internal static partial class Advapi32
+    {
+        [LibraryImport(Interop.Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool EqualSid(nint pSid1, nint pSid2);
+    }
+}

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.AccessControlLists.cs

@@ -18,5 +18,28 @@ internal static unsafe partial uint GetSecurityInfoByHandle(
             IntPtr* dacl,
             IntPtr* sacl,
             IntPtr* securityDescriptor);
+
+        // Values for objectType
+        internal enum SE_OBJECT_TYPE
+        {
+            SE_UNKNOWN_OBJECT_TYPE,
+            SE_FILE_OBJECT,
+            SE_SERVICE,
+            SE_PRINTER,
+            SE_REGISTRY_KEY,
+            SE_LMSHARE,
+            SE_KERNEL_OBJECT,
+            SE_WINDOW_OBJECT,
+            SE_DS_OBJECT,
+            SE_DS_OBJECT_ALL,
+            SE_PROVIDER_DEFINED_OBJECT,
+            SE_WMIGUID_OBJECT,
+            SE_REGISTRY_WOW64_32KEY,
+            SE_REGISTRY_WOW64_64KEY
+        }
+
+        // Values for securityInformation
+        internal const uint OWNER_SECURITY_INFORMATION = 0x1;
+        internal const uint DACL_SECURITY_INFORMATION = 0x4;
     }
 }

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.CreateWellKnownSid.cs

@@ -1,41 +1,19 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System;
 using System.Runtime.InteropServices;
-using System.Security.Principal;
 using Microsoft.Win32.SafeHandles;
 
 internal static partial class Interop
 {
     internal static partial class Advapi32
     {
-        [LibraryImport(Interop.Libraries.Advapi32, SetLastError = true)]
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
         [return: MarshalAs(UnmanagedType.Bool)]
-        private static partial bool OpenThreadToken(
-            IntPtr ThreadHandle,
-            TokenAccessLevels dwDesiredAccess,
-            [MarshalAs(UnmanagedType.Bool)] bool bOpenAsSelf,
-            out SafeAccessTokenHandle phThreadToken);
-
-        internal static bool OpenThreadToken(TokenAccessLevels desiredAccess, WinSecurityContext openAs, out SafeAccessTokenHandle tokenHandle)
-        {
-            bool openAsSelf = true;
-            if (openAs == WinSecurityContext.Thread)
-                openAsSelf = false;
-
-            if (OpenThreadToken(Kernel32.GetCurrentThread(), desiredAccess, openAsSelf, out tokenHandle))
-                return true;
-
-            if (openAs == WinSecurityContext.Both)
-            {
-                openAsSelf = false;
-                tokenHandle.Dispose();
-                if (OpenThreadToken(Kernel32.GetCurrentThread(), desiredAccess, openAsSelf, out tokenHandle))
-                    return true;
-            }
-
-            return false;
-        }
+        internal static partial bool OpenThreadToken(
+            nint ThreadHandle,
+            int DesiredAccess,
+            [MarshalAs(UnmanagedType.Bool)] bool OpenAsSelf,
+            out SafeTokenHandle TokenHandle);
     }
 }

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.EqualSid.cs

@@ -0,0 +1,41 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using Microsoft.Win32.SafeHandles;
+
+internal static partial class Interop
+{
+    internal static partial class Advapi32
+    {
+        [LibraryImport(Interop.Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static partial bool OpenThreadToken(
+            IntPtr ThreadHandle,
+            TokenAccessLevels dwDesiredAccess,
+            [MarshalAs(UnmanagedType.Bool)] bool bOpenAsSelf,
+            out SafeAccessTokenHandle phThreadToken);
+
+        internal static bool OpenThreadToken(TokenAccessLevels desiredAccess, WinSecurityContext openAs, out SafeAccessTokenHandle tokenHandle)
+        {
+            bool openAsSelf = true;
+            if (openAs == WinSecurityContext.Thread)
+                openAsSelf = false;
+
+            if (OpenThreadToken(Kernel32.GetCurrentThread(), desiredAccess, openAsSelf, out tokenHandle))
+                return true;
+
+            if (openAs == WinSecurityContext.Both)
+            {
+                openAsSelf = false;
+                tokenHandle.Dispose();
+                if (OpenThreadToken(Kernel32.GetCurrentThread(), desiredAccess, openAsSelf, out tokenHandle))
+                    return true;
+            }
+
+            return false;
+        }
+    }
+}

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.GetSecurityInfoByHandle.cs

@@ -0,0 +1,53 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.InteropServices;
+
+internal static partial class Interop
+{
+    internal static partial class Advapi32
+    {
+        internal const int SECURITY_DESCRIPTOR_MIN_LENGTH = // AlignUp(4, sizeof(nint)) + 4 * sizeof(nint)
+#if TARGET_64BIT
+            40;
+#else
+            20;
+#endif
+
+        internal const int SECURITY_DESCRIPTOR_REVISION = 1;
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool InitializeSecurityDescriptor(nint pSecurityDescriptor, int dwRevision);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool SetSecurityDescriptorOwner(
+            nint pSecurityDescriptor,
+            nint pOwner,
+            [MarshalAs(UnmanagedType.Bool)] bool bOwnerDefaulted);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool SetSecurityDescriptorGroup(
+            nint pSecurityDescriptor,
+            nint pGroup,
+            [MarshalAs(UnmanagedType.Bool)] bool bGroupDefaulted);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool SetSecurityDescriptorDacl(
+            nint pSecurityDescriptor,
+            [MarshalAs(UnmanagedType.Bool)] bool bDaclPresent,
+            nint pDacl,
+            [MarshalAs(UnmanagedType.Bool)] bool bDaclDefaulted);
+
+        [LibraryImport(Libraries.Advapi32, SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        internal static partial bool SetSecurityDescriptorSacl(
+            nint pSecurityDescriptor,
+            [MarshalAs(UnmanagedType.Bool)] bool bSaclPresent,
+            nint pSacl,
+            [MarshalAs(UnmanagedType.Bool)] bool bSaclDefaulted);
+    }
+}

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.OpenThreadToken.cs

@@ -38,6 +38,7 @@ internal static partial class Errors
         internal const int ERROR_INVALID_NAME = 0x7B;
         internal const int ERROR_INVALID_LEVEL = 0x7C;
         internal const int ERROR_MOD_NOT_FOUND = 0x7E;
+        internal const int ERROR_PROC_NOT_FOUND = 0x7F;
         internal const int ERROR_NEGATIVE_SEEK = 0x83;
         internal const int ERROR_DIR_NOT_EMPTY = 0x91;
         internal const int ERROR_BAD_PATHNAME = 0xA1;

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.OpenThreadToken_SafeAccessTokenHandle.cs

@@ -10,6 +10,10 @@ internal static partial class Kernel32
         internal const int WAIT_ABANDONED = 0x00000080;
 
         internal const int MAXIMUM_ALLOWED = 0x02000000;
+        internal const int STANDARD_RIGHTS_REQUIRED = 0x000F0000;
+        internal const int READ_CONTROL = 0x00020000;
+        internal const int WRITE_DAC = 0x00040000;
+        internal const int WRITE_OWNER = 0x00080000;
         internal const int SYNCHRONIZE = 0x00100000;
         internal const int MUTEX_MODIFY_STATE = 0x00000001;
         internal const int SEMAPHORE_MODIFY_STATE = 0x00000002;

src/libraries/Common/src/Interop/Windows/Advapi32/Interop.SecurityDescriptors.cs

@@ -12,6 +12,7 @@ internal enum OpenExistingResult
         Success,
         NameNotFound,
         PathNotFound,
-        NameInvalid
+        NameInvalid,
+        ObjectIncompatibleWithCurrentUserOnly
     }
 }

src/libraries/Common/src/Interop/Windows/Interop.Errors.cs

@@ -3476,6 +3476,12 @@
   <data name="Lock_Exit_SynchronizationLockException" xml:space="preserve">
     <value>The calling thread does not hold the lock.</value>
   </data>
+  <data name="NamedWaitHandles_IncompatibleNamePrefix" xml:space="preserve">
+    <value>The specified name '{0}' has a prefix that is not compatible with the specified option 'CurrentSessionOnly'.</value>
+  </data>
+  <data name="NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly" xml:space="preserve">
+    <value>An object with the specified name '{0}' exists and can't be opened because it's not compatible with the specified option 'CurrentUserOnly = true'.</value>
+  </data>
   <data name="SpinLock_IsHeldByCurrentThread" xml:space="preserve">
     <value>Thread tracking is disabled.</value>
   </data>

src/libraries/Common/src/Interop/Windows/Kernel32/Interop.Constants.cs

@@ -1241,6 +1241,7 @@
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\ManualResetEventSlim.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\Monitor.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\Mutex.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)System\Threading\NamedWaitHandleOptions.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\NativeOverlapped.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\Overlapped.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)System\Threading\ParameterizedThreadStart.cs" />
@@ -1604,9 +1605,18 @@
     <Compile Include="$(MSBuildThisFileDirectory)System\Runtime\CompilerServices\QCallHandles.cs" Condition="'$(FeatureNativeAot)' != 'true'" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetsWindows)' == 'true'">
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.AccessControlLists.cs">
+      <Link>Common\Interop\Windows\Advapi32\Interop.AccessControlLists.cs</Link>
+    </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.CreateWellKnownSid.cs">
+      <Link>Common\Interop\Windows\Advapi32\Interop.CreateWellKnownSid.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.EncryptDecrypt.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.EncryptDecrypt.cs</Link>
     </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.EqualSid.cs">
+      <Link>Interop\Windows\Advapi32\Interop.EqualSid.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.EventActivityIdControl.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.EventActivityIdControl.cs</Link>
     </Compile>
@@ -1628,6 +1638,18 @@
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.EventWriteTransfer.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.EventWriteTransfer.cs</Link>
     </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.GetLengthSid.cs">
+      <Link>Common\Interop\Windows\Advapi32\Interop.GetLengthSid.cs</Link>
+    </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.GetSecurityInfoByHandle.cs">
+      <Link>Interop\Windows\Advapi32\Interop.GetSecurityInfoByHandle.cs</Link>
+    </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.GetSidIdentifierAuthority.cs">
+      <Link>Interop\Windows\Advapi32\Interop.GetSidIdentifierAuthority.cs</Link>
+    </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.GetTokenInformation.cs">
+      <Link>Interop\Windows\Advapi32\Interop.GetTokenInformation.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.GetTokenInformation_void.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.GetTokenInformation_void.cs</Link>
     </Compile>
@@ -1637,6 +1659,9 @@
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.OpenProcessToken.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.OpenProcessToken.cs</Link>
     </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.OpenThreadToken.cs">
+      <Link>Common\Interop\Windows\Advapi32\Interop.OpenThreadToken.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.RegCloseKey.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.RegCloseKey.cs</Link>
     </Compile>
@@ -1670,6 +1695,9 @@
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.RegSetValueEx.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.RegSetValueEx.cs</Link>
     </Compile>
+    <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.SecurityDescriptors.cs">
+      <Link>Common\Interop\Windows\Advapi32\Interop.SecurityDescriptors.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Interop\Windows\Advapi32\Interop.TOKEN_ACCESS_LEVELS.cs">
       <Link>Common\Interop\Windows\Advapi32\Interop.TOKEN_ACCESS_LEVELS.cs</Link>
     </Compile>
@@ -2144,6 +2172,9 @@
     <Compile Include="$(CommonPath)\Interop\Windows\Kernel32\Interop.Sleep.cs">
       <Link>Common\Interop\Windows\Kernel32\Interop.Sleep.cs</Link>
     </Compile>
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeLocalAllocHandle.cs">
+      <Link>Common\Microsoft\Win32\SafeHandles\SafeLocalAllocHandle.cs</Link>
+    </Compile>
     <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeTokenHandle.cs">
       <Link>Common\Microsoft\Win32\SafeHandles\SafeTokenHandle.cs</Link>
     </Compile>

src/libraries/Common/src/System/Threading/OpenExistingResult.cs

@@ -10,16 +10,36 @@ namespace System.Threading
 {
     public partial class EventWaitHandle
     {
-        private void CreateEventCore(bool initialState, EventResetMode mode, string? name, out bool createdNew)
+        private void CreateEventCore(bool initialState, EventResetMode mode)
         {
+            ValidateMode(mode);
+            SafeWaitHandle = WaitSubsystem.NewEvent(initialState, mode);
+        }
+
+#pragma warning disable IDE0060 // Unused parameter
+        private void CreateEventCore(
+            bool initialState,
+            EventResetMode mode,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
+        {
+            ValidateMode(mode);
+
             if (name != null)
+            {
                 throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
+            }
 
             SafeWaitHandle = WaitSubsystem.NewEvent(initialState, mode);
             createdNew = true;
         }
+#pragma warning restore IDE0060
 
-        private static OpenExistingResult OpenExistingWorker(string name, out EventWaitHandle? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out EventWaitHandle? result)
         {
             throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
         }

src/libraries/System.Private.CoreLib/src/Resources/Strings.resx

@@ -11,46 +11,131 @@ public partial class EventWaitHandle
     {
         private const uint AccessRights = (uint)Interop.Kernel32.MAXIMUM_ALLOWED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.EVENT_MODIFY_STATE;
 
+#if TARGET_WINDOWS
+        // Can't use MAXIMUM_ALLOWED in an access control entry (ACE)
+        private const int CurrentUserOnlyAceRights =
+            Interop.Kernel32.STANDARD_RIGHTS_REQUIRED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.EVENT_MODIFY_STATE;
+#endif
+
         private EventWaitHandle(SafeWaitHandle handle)
         {
             SafeWaitHandle = handle;
         }
 
-        private void CreateEventCore(bool initialState, EventResetMode mode, string? name, out bool createdNew)
+        private unsafe void CreateEventCore(bool initialState, EventResetMode mode)
+        {
+            ValidateMode(mode);
+
+            uint flags = initialState ? Interop.Kernel32.CREATE_EVENT_INITIAL_SET : 0;
+            if (mode == EventResetMode.ManualReset)
+                flags |= Interop.Kernel32.CREATE_EVENT_MANUAL_RESET;
+            SafeWaitHandle handle = Interop.Kernel32.CreateEventEx(lpSecurityAttributes: 0, name: null, flags, AccessRights);
+            if (handle.IsInvalid)
+            {
+                int errorCode = Marshal.GetLastPInvokeError();
+                handle.SetHandleAsInvalid();
+                throw Win32Marshal.GetExceptionForWin32Error(errorCode);
+            }
+
+            SafeWaitHandle = handle;
+        }
+
+        private unsafe void CreateEventCore(
+            bool initialState,
+            EventResetMode mode,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
         {
-#if TARGET_UNIX || TARGET_BROWSER || TARGET_WASI
+            ValidateMode(mode);
+
+#if !TARGET_WINDOWS
             if (name != null)
+            {
                 throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
+            }
 #endif
-            uint eventFlags = initialState ? Interop.Kernel32.CREATE_EVENT_INITIAL_SET : 0;
-            if (mode == EventResetMode.ManualReset)
-                eventFlags |= (uint)Interop.Kernel32.CREATE_EVENT_MANUAL_RESET;
 
-            SafeWaitHandle handle = Interop.Kernel32.CreateEventEx(IntPtr.Zero, name, eventFlags, AccessRights);
+            void* securityAttributesPtr = null;
+            SafeWaitHandle handle;
+            int errorCode;
+#if TARGET_WINDOWS
+            Thread.CurrentUserSecurityDescriptorInfo securityDescriptorInfo = default;
+            Interop.Kernel32.SECURITY_ATTRIBUTES securityAttributes = default;
+            if (!string.IsNullOrEmpty(name) && options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+                if (options.CurrentUserOnly)
+                {
+                    securityDescriptorInfo = new(CurrentUserOnlyAceRights);
+                    securityAttributes.nLength = (uint)sizeof(Interop.Kernel32.SECURITY_ATTRIBUTES);
+                    securityAttributes.lpSecurityDescriptor = (void*)securityDescriptorInfo.SecurityDescriptor;
+                    securityAttributesPtr = &securityAttributes;
+                }
+            }
 
-            int errorCode = Marshal.GetLastPInvokeError();
-            if (handle.IsInvalid)
+            using (securityDescriptorInfo)
             {
-                handle.SetHandleAsInvalid();
-                if (!string.IsNullOrEmpty(name) && errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
-                    throw new WaitHandleCannotBeOpenedException(SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+#endif
+                uint eventFlags = initialState ? Interop.Kernel32.CREATE_EVENT_INITIAL_SET : 0;
+                if (mode == EventResetMode.ManualReset)
+                    eventFlags |= Interop.Kernel32.CREATE_EVENT_MANUAL_RESET;
+                handle = Interop.Kernel32.CreateEventEx((nint)securityAttributesPtr, name, eventFlags, AccessRights);
+                errorCode = Marshal.GetLastPInvokeError();
+
+                if (handle.IsInvalid)
+                {
+                    handle.SetHandleAsInvalid();
+                    if (!string.IsNullOrEmpty(name) && errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
+                        throw new WaitHandleCannotBeOpenedException(SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+
+                    throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
+                }
+#if TARGET_WINDOWS
 
-                throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
+                if (errorCode == Interop.Errors.ERROR_ALREADY_EXISTS && securityAttributesPtr != null)
+                {
+                    try
+                    {
+                        if (!Thread.CurrentUserSecurityDescriptorInfo.IsSecurityDescriptorCompatible(
+                                securityDescriptorInfo.TokenUser,
+                                handle,
+                                Interop.Kernel32.EVENT_MODIFY_STATE))
+                        {
+                            throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
+                        }
+                    }
+                    catch
+                    {
+                        handle.Dispose();
+                        throw;
+                    }
+                }
             }
+#endif
+
             createdNew = errorCode != Interop.Errors.ERROR_ALREADY_EXISTS;
             SafeWaitHandle = handle;
         }
 
-        private static OpenExistingResult OpenExistingWorker(string name, out EventWaitHandle? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out EventWaitHandle? result)
         {
 #if TARGET_WINDOWS
             ArgumentException.ThrowIfNullOrEmpty(name);
 
-            result = null;
+            if (options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+            }
+
             SafeWaitHandle myHandle = Interop.Kernel32.OpenEvent(AccessRights, false, name);
 
             if (myHandle.IsInvalid)
             {
+                result = null;
                 int errorCode = Marshal.GetLastPInvokeError();
 
                 myHandle.Dispose();
@@ -64,6 +149,27 @@ private static OpenExistingResult OpenExistingWorker(string name, out EventWaitH
 
                 throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
             }
+
+            if (options.WasSpecified && options.CurrentUserOnly)
+            {
+                try
+                {
+                    if (!Thread.CurrentUserSecurityDescriptorInfo.IsValidSecurityDescriptor(
+                            myHandle,
+                            Interop.Kernel32.EVENT_MODIFY_STATE))
+                    {
+                        myHandle.Dispose();
+                        result = null;
+                        return OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly;
+                    }
+                }
+                catch
+                {
+                    myHandle.Dispose();
+                    throw;
+                }
+            }
+
             result = new EventWaitHandle(myHandle);
             return OpenExistingResult.Success;
 #else

src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems

@@ -10,28 +10,110 @@ namespace System.Threading
 {
     public partial class EventWaitHandle : WaitHandle
     {
-        public EventWaitHandle(bool initialState, EventResetMode mode) :
-            this(initialState, mode, null, out _)
+        public EventWaitHandle(bool initialState, EventResetMode mode)
         {
+            CreateEventCore(initialState, mode);
         }
 
-        public EventWaitHandle(bool initialState, EventResetMode mode, string? name) :
-            this(initialState, mode, name, out _)
+        /// <summary>
+        /// Creates a named or unnamed event, or opens a named event if a event with the name already exists.
+        /// </summary>
+        /// <param name="initialState">True to initially set the event to a signaled state; false otherwise.</param>
+        /// <param name="mode">Indicates whether the event resets automatically or manually.</param>
+        /// <param name="name">
+        /// The name, if the event is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named event. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying event object.
+        /// </param>
+        public EventWaitHandle(bool initialState, EventResetMode mode, string? name, NamedWaitHandleOptions options)
         {
+            CreateEventCore(initialState, mode, name, new(options), out _);
+        }
+
+        public EventWaitHandle(bool initialState, EventResetMode mode, string? name)
+        {
+            CreateEventCore(initialState, mode, name, options: default, out _);
+        }
+
+        /// <summary>
+        /// Creates a named or unnamed event, or opens a named event if a event with the name already exists.
+        /// </summary>
+        /// <param name="initialState">True to initially set the event to a signaled state; false otherwise.</param>
+        /// <param name="mode">Indicates whether the event resets automatically or manually.</param>
+        /// <param name="name">
+        /// The name, if the event is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named event. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying event object.
+        /// </param>
+        /// <param name="createdNew">
+        /// True if the event was created; false if an existing named event was opened.
+        /// </param>
+        public EventWaitHandle(bool initialState, EventResetMode mode, string? name, NamedWaitHandleOptions options, out bool createdNew)
+        {
+            CreateEventCore(initialState, mode, name, new(options), out createdNew);
         }
 
         public EventWaitHandle(bool initialState, EventResetMode mode, string? name, out bool createdNew)
+        {
+            CreateEventCore(initialState, mode, name, options: default, out createdNew);
+        }
+
+        private static void ValidateMode(EventResetMode mode)
         {
             if (mode != EventResetMode.AutoReset && mode != EventResetMode.ManualReset)
+            {
                 throw new ArgumentException(SR.Argument_InvalidFlag, nameof(mode));
+            }
+        }
+
+        /// <summary>
+        /// Opens an existing named event.
+        /// </summary>
+        /// <param name="name">The name of the event to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named event. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying event object.
+        /// </param>
+        /// <returns>An object that represents the named event.</returns>
+        [SupportedOSPlatform("windows")]
+        public static EventWaitHandle OpenExisting(string name, NamedWaitHandleOptions options)
+        {
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, new(options), out EventWaitHandle? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
 
-            CreateEventCore(initialState, mode, name, out createdNew);
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
         }
 
         [SupportedOSPlatform("windows")]
         public static EventWaitHandle OpenExisting(string name)
         {
-            switch (OpenExistingWorker(name, out EventWaitHandle? result))
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, options: default, out EventWaitHandle? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
+
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
+        }
+
+        [DoesNotReturn]
+        private static void ThrowForOpenExistingFailure(OpenExistingResult openExistingResult, string name)
+        {
+            Debug.Assert(openExistingResult != OpenExistingResult.Success);
+
+            switch (openExistingResult)
             {
                 case OpenExistingResult.NameNotFound:
                     throw new WaitHandleCannotBeOpenedException();
@@ -40,13 +122,30 @@ public static EventWaitHandle OpenExisting(string name)
                 case OpenExistingResult.PathNotFound:
                     throw new DirectoryNotFoundException(SR.Format(SR.IO_PathNotFound_Path, name));
                 default:
-                    Debug.Assert(result != null, "result should be non-null on success");
-                    return result;
+                    Debug.Assert(openExistingResult == OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly);
+                    throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
             }
         }
 
+        /// <summary>
+        /// Tries to open an existing named event and returns a value indicating whether it was successful.
+        /// </summary>
+        /// <param name="name">The name of the event to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named event. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying event object.
+        /// </param>
+        /// <param name="result">
+        /// An object that represents the named event if the method returns true; otherwise, null.
+        /// </param>
+        /// <returns>True if the named event was opened successfully; otherwise, false.</returns>
+        [SupportedOSPlatform("windows")]
+        public static bool TryOpenExisting(string name, NamedWaitHandleOptions options, [NotNullWhen(true)] out EventWaitHandle? result) =>
+            OpenExistingWorker(name, new(options), out result!) == OpenExistingResult.Success;
+
         [SupportedOSPlatform("windows")]
         public static bool TryOpenExisting(string name, [NotNullWhen(true)] out EventWaitHandle? result) =>
-            OpenExistingWorker(name, out result!) == OpenExistingResult.Success;
+            OpenExistingWorker(name, options: default, out result!) == OpenExistingResult.Success;
     }
 }

src/libraries/System.Private.CoreLib/src/System/Threading/EventWaitHandle.Unix.cs

@@ -10,10 +10,18 @@ namespace System.Threading
 {
     public sealed partial class Mutex
     {
-        private void CreateMutexCore(bool initiallyOwned, string? name, out bool createdNew)
+        private void CreateMutexCore(bool initiallyOwned) => SafeWaitHandle = WaitSubsystem.NewMutex(initiallyOwned);
+
+        private void CreateMutexCore(
+            bool initiallyOwned,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
         {
-            if (name != null)
+            if (!string.IsNullOrEmpty(name))
             {
+                name = BuildNameForOptions(name, options);
+
                 SafeWaitHandle? safeWaitHandle = WaitSubsystem.CreateNamedMutex(initiallyOwned, name, out createdNew);
                 if (safeWaitHandle == null)
                 {
@@ -27,15 +35,41 @@ private void CreateMutexCore(bool initiallyOwned, string? name, out bool created
             createdNew = true;
         }
 
-        private static OpenExistingResult OpenExistingWorker(string name, out Mutex? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out Mutex? result)
         {
             ArgumentException.ThrowIfNullOrEmpty(name);
 
+            name = BuildNameForOptions(name, options);
+
             OpenExistingResult status = WaitSubsystem.OpenNamedMutex(name, out SafeWaitHandle? safeWaitHandle);
             result = status == OpenExistingResult.Success ? new Mutex(safeWaitHandle!) : null;
             return status;
         }
 
+        private static string BuildNameForOptions(string name, NamedWaitHandleOptionsInternal options)
+        {
+            if (options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+            }
+
+            if (name.StartsWith(NamedWaitHandleOptionsInternal.CurrentSessionPrefix) &&
+                name.Length > NamedWaitHandleOptionsInternal.CurrentSessionPrefix.Length)
+            {
+                name = name.Substring(NamedWaitHandleOptionsInternal.CurrentSessionPrefix.Length);
+            }
+
+            if (options.WasSpecified && options.CurrentUserOnly)
+            {
+                name = @"User\" + name;
+            }
+
+            return name;
+        }
+
         public void ReleaseMutex()
         {
             // The field value is modifiable via the public <see cref="WaitHandle.SafeWaitHandle"/> property, save it locally

src/libraries/System.Private.CoreLib/src/System/Threading/EventWaitHandle.Windows.cs

@@ -15,30 +15,98 @@ public sealed partial class Mutex : WaitHandle
         private const uint AccessRights =
             (uint)Interop.Kernel32.MAXIMUM_ALLOWED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.MUTEX_MODIFY_STATE;
 
-        private void CreateMutexCore(bool initiallyOwned, string? name, out bool createdNew)
+        // Can't use MAXIMUM_ALLOWED in an access control entry (ACE)
+        private const int CurrentUserOnlyAceRights =
+            Interop.Kernel32.STANDARD_RIGHTS_REQUIRED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.MUTEX_MODIFY_STATE;
+
+        private void CreateMutexCore(bool initiallyOwned)
         {
-            uint mutexFlags = initiallyOwned ? Interop.Kernel32.CREATE_MUTEX_INITIAL_OWNER : 0;
-            SafeWaitHandle mutexHandle = Interop.Kernel32.CreateMutexEx(IntPtr.Zero, name, mutexFlags, AccessRights);
-            int errorCode = Marshal.GetLastPInvokeError();
+            uint flags = initiallyOwned ? Interop.Kernel32.CREATE_MUTEX_INITIAL_OWNER : 0;
+            SafeWaitHandle handle = Interop.Kernel32.CreateMutexEx(lpMutexAttributes: 0, name: null, flags, AccessRights);
+            if (handle.IsInvalid)
+            {
+                int errorCode = Marshal.GetLastPInvokeError();
+                handle.SetHandleAsInvalid();
+                throw Win32Marshal.GetExceptionForWin32Error(errorCode);
+            }
+
+            SafeWaitHandle = handle;
+        }
 
-            if (mutexHandle.IsInvalid)
+        private unsafe void CreateMutexCore(
+            bool initiallyOwned,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
+        {
+            Thread.CurrentUserSecurityDescriptorInfo securityDescriptorInfo = default;
+            Interop.Kernel32.SECURITY_ATTRIBUTES securityAttributes = default;
+            Interop.Kernel32.SECURITY_ATTRIBUTES* securityAttributesPtr = null;
+            if (!string.IsNullOrEmpty(name) && options.WasSpecified)
             {
-                mutexHandle.SetHandleAsInvalid();
-                if (errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
-                    throw new WaitHandleCannotBeOpenedException(SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+                name = options.GetNameWithSessionPrefix(name);
+                if (options.CurrentUserOnly)
+                {
+                    securityDescriptorInfo = new(CurrentUserOnlyAceRights);
+                    securityAttributes.nLength = (uint)sizeof(Interop.Kernel32.SECURITY_ATTRIBUTES);
+                    securityAttributes.lpSecurityDescriptor = (void*)securityDescriptorInfo.SecurityDescriptor;
+                    securityAttributesPtr = &securityAttributes;
+                }
+            }
 
-                throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
+            SafeWaitHandle mutexHandle;
+            int errorCode;
+            using (securityDescriptorInfo)
+            {
+                uint mutexFlags = initiallyOwned ? Interop.Kernel32.CREATE_MUTEX_INITIAL_OWNER : 0;
+                mutexHandle = Interop.Kernel32.CreateMutexEx((nint)securityAttributesPtr, name, mutexFlags, AccessRights);
+                errorCode = Marshal.GetLastPInvokeError();
+
+                if (mutexHandle.IsInvalid)
+                {
+                    mutexHandle.SetHandleAsInvalid();
+                    if (errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
+                        throw new WaitHandleCannotBeOpenedException(SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+
+                    throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
+                }
+
+                if (errorCode == Interop.Errors.ERROR_ALREADY_EXISTS && securityAttributesPtr != null)
+                {
+                    try
+                    {
+                        if (!Thread.CurrentUserSecurityDescriptorInfo.IsSecurityDescriptorCompatible(
+                                securityDescriptorInfo.TokenUser,
+                                mutexHandle,
+                                Interop.Kernel32.MUTEX_MODIFY_STATE))
+                        {
+                            throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
+                        }
+                    }
+                    catch
+                    {
+                        mutexHandle.Dispose();
+                        throw;
+                    }
+                }
             }
 
             createdNew = errorCode != Interop.Errors.ERROR_ALREADY_EXISTS;
             SafeWaitHandle = mutexHandle;
         }
 
-        private static OpenExistingResult OpenExistingWorker(string name, out Mutex? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out Mutex? result)
         {
             ArgumentException.ThrowIfNullOrEmpty(name);
 
-            result = null;
+            if (options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+            }
+
             // To allow users to view & edit the ACL's, call OpenMutex
             // with parameters to allow us to view & edit the ACL.  This will
             // fail if we don't have permission to view or edit the ACL's.
@@ -47,6 +115,7 @@ private static OpenExistingResult OpenExistingWorker(string name, out Mutex? res
 
             if (myHandle.IsInvalid)
             {
+                result = null;
                 int errorCode = Marshal.GetLastPInvokeError();
 
                 myHandle.Dispose();
@@ -61,6 +130,26 @@ private static OpenExistingResult OpenExistingWorker(string name, out Mutex? res
                 throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
             }
 
+            if (options.WasSpecified && options.CurrentUserOnly)
+            {
+                try
+                {
+                    if (!Thread.CurrentUserSecurityDescriptorInfo.IsValidSecurityDescriptor(
+                            myHandle,
+                            Interop.Kernel32.MUTEX_MODIFY_STATE))
+                    {
+                        myHandle.Dispose();
+                        result = null;
+                        return OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly;
+                    }
+                }
+                catch
+                {
+                    myHandle.Dispose();
+                    throw;
+                }
+            }
+
             result = new Mutex(myHandle);
             return OpenExistingResult.Success;
         }

src/libraries/System.Private.CoreLib/src/System/Threading/EventWaitHandle.cs

@@ -13,49 +13,158 @@ namespace System.Threading
     /// </summary>
     public sealed partial class Mutex : WaitHandle
     {
+        /// <summary>
+        /// Creates a named or unnamed mutex, or opens a named mutex if a mutex with the name already exists.
+        /// </summary>
+        /// <param name="initiallyOwned">
+        /// True to acquire the mutex on the calling thread if it's created; otherwise, false.
+        /// </param>
+        /// <param name="name">
+        /// The name, if the mutex is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named mutex. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying mutex object.
+        /// </param>
+        /// <param name="createdNew">
+        /// True if the mutex was created; false if an existing named mutex was opened.
+        /// </param>
+        public Mutex(bool initiallyOwned, string? name, NamedWaitHandleOptions options, out bool createdNew)
+        {
+            CreateMutexCore(initiallyOwned, name, new(options), out createdNew);
+        }
+
         public Mutex(bool initiallyOwned, string? name, out bool createdNew)
         {
-            CreateMutexCore(initiallyOwned, name, out createdNew);
+            CreateMutexCore(initiallyOwned, name, options: default, out createdNew);
+        }
+
+        /// <summary>
+        /// Creates a named or unnamed mutex, or opens a named mutex if a mutex with the name already exists.
+        /// </summary>
+        /// <param name="initiallyOwned">
+        /// True to acquire the mutex on the calling thread if it's created; otherwise, false.
+        /// </param>
+        /// <param name="name">
+        /// The name, if the mutex is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named mutex. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying mutex object.
+        /// </param>
+        public Mutex(bool initiallyOwned, string? name, NamedWaitHandleOptions options)
+        {
+            CreateMutexCore(initiallyOwned, name, new(options), createdNew: out _);
         }
 
         public Mutex(bool initiallyOwned, string? name)
         {
-            CreateMutexCore(initiallyOwned, name, out _);
+            CreateMutexCore(initiallyOwned, name, options: default, createdNew: out _);
+        }
+
+        /// <summary>
+        /// Creates a named or unnamed mutex, or opens a named mutex if a mutex with the name already exists.
+        /// </summary>
+        /// <param name="name">
+        /// The name, if the mutex is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named mutex. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying mutex object.
+        /// </param>
+        public Mutex(string? name, NamedWaitHandleOptions options)
+        {
+            CreateMutexCore(initiallyOwned: false, name, new(options), createdNew: out _);
         }
 
         public Mutex(bool initiallyOwned)
         {
-            CreateMutexCore(initiallyOwned, null, out _);
+            CreateMutexCore(initiallyOwned);
         }
 
         public Mutex()
         {
-            CreateMutexCore(false, null, out _);
+            CreateMutexCore(initiallyOwned: false);
         }
 
         private Mutex(SafeWaitHandle handle)
         {
             SafeWaitHandle = handle;
         }
 
+        /// <summary>
+        /// Opens an existing named mutex.
+        /// </summary>
+        /// <param name="name">The name of the mutex to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named mutex. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying mutex object.
+        /// </param>
+        /// <returns>An object that represents the named mutex.</returns>
+        public static Mutex OpenExisting(string name, NamedWaitHandleOptions options)
+        {
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, new(options), out Mutex? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
+
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
+        }
+
         public static Mutex OpenExisting(string name)
         {
-            switch (OpenExistingWorker(name, out Mutex? result))
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, options: default, out Mutex? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
+
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
+        }
+
+        [DoesNotReturn]
+        private static void ThrowForOpenExistingFailure(OpenExistingResult openExistingResult, string name)
+        {
+            Debug.Assert(openExistingResult != OpenExistingResult.Success);
+
+            switch (openExistingResult)
             {
                 case OpenExistingResult.NameNotFound:
                     throw new WaitHandleCannotBeOpenedException();
                 case OpenExistingResult.NameInvalid:
                     throw new WaitHandleCannotBeOpenedException(SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
                 case OpenExistingResult.PathNotFound:
                     throw new DirectoryNotFoundException(SR.Format(SR.IO_PathNotFound_Path, name));
-
                 default:
-                    Debug.Assert(result != null, "result should be non-null on success");
-                    return result;
+                    Debug.Assert(openExistingResult == OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly);
+                    throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
             }
         }
 
+        /// <summary>
+        /// Tries to open an existing named mutex and returns a value indicating whether it was successful.
+        /// </summary>
+        /// <param name="name">The name of the mutex to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named mutex. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying mutex object.
+        /// </param>
+        /// <param name="result">
+        /// An object that represents the named mutex if the method returns true; otherwise, null.
+        /// </param>
+        /// <returns>True if the named mutex was opened successfully; otherwise, false.</returns>
+        public static bool TryOpenExisting(string name, NamedWaitHandleOptions options, [NotNullWhen(true)] out Mutex? result) =>
+            OpenExistingWorker(name, new(options), out result!) == OpenExistingResult.Success;
+
         public static bool TryOpenExisting(string name, [NotNullWhen(true)] out Mutex? result) =>
-            OpenExistingWorker(name, out result!) == OpenExistingResult.Success;
+            OpenExistingWorker(name, options: default, out result!) == OpenExistingResult.Success;
     }
 }

src/libraries/System.Private.CoreLib/src/System/Threading/Mutex.Unix.cs

@@ -0,0 +1,146 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Diagnostics;
+
+namespace System.Threading
+{
+    /// <summary>
+    /// Represents a set of options for named synchronization objects that are wait handles and can be shared between processes,
+    /// such as 'Mutex', 'Semaphore', and 'EventWaitHandle'.
+    /// </summary>
+    public struct NamedWaitHandleOptions
+    {
+        private bool _notCurrentUserOnly;
+        private bool _notCurrentSessionOnly;
+
+        /// <summary>
+        /// Indicates whether the named synchronization object should be limited in access to the current user.
+        /// </summary>
+        /// <remarks>
+        /// The default value is true.
+        ///
+        /// If the option is true when creating a named synchronization object, the object is limited in access to the calling
+        /// user. If the option is true when opening an existing named synchronization object, the object's access controls are
+        /// verified for the calling user.
+        ///
+        /// If the option is false when creating a named synchronization object, the object is not limited in access to a user.
+        ///
+        /// On Unix-like operating systems, each user has namespaces for the object's name that are used when the option is
+        /// true. These user-scoped namespaces are distinct from user-scoped namespaces for other users, and also distinct from
+        /// namespaces used when the option is false.
+        /// </remarks>
+        public bool CurrentUserOnly
+        {
+            get => !_notCurrentUserOnly;
+            set => _notCurrentUserOnly = !value;
+        }
+
+        /// <summary>
+        /// Indicates whether the named synchronization object is intended to be used only within the current session.
+        /// </summary>
+        /// <remarks>
+        /// The default value is true.
+        ///
+        /// Each session has namespaces for the object's name that are used when the option is true. These session-scoped
+        /// namespaces are distinct from session-scoped namespaces for other sessions, and also distinct from namespaces used
+        /// when the option is false.
+        ///
+        /// If the option is true when creating a named synchronization object, the object is limited in scope to the current
+        /// session, and can't be opened by processes running in different sessions.
+        ///
+        /// On Windows, a session is a Terminal Services session. On Unix-like operating systems, a session is typically a shell
+        /// session, where each shell gets its own session in which processes started from the shell run.
+        /// </remarks>
+        public bool CurrentSessionOnly
+        {
+            get => !_notCurrentSessionOnly;
+            set => _notCurrentSessionOnly = !value;
+        }
+    }
+
+    // This is an internal struct used by named wait handle helpers to also track whether the options were specified in APIs
+    // that were used. Using the constructor indicates WasSpecified=true, and 'default' indicates WasSpecified=false.
+    internal readonly struct NamedWaitHandleOptionsInternal
+    {
+        public const string CurrentSessionPrefix = @"Local\";
+        public const string AllSessionsPrefix = @"Global\";
+
+        private readonly NamedWaitHandleOptions _options;
+        private readonly bool _wasSpecified;
+
+        public NamedWaitHandleOptionsInternal(NamedWaitHandleOptions options)
+        {
+            _options = options;
+            _wasSpecified = true;
+        }
+
+        public bool CurrentUserOnly
+        {
+            get
+            {
+                Debug.Assert(WasSpecified);
+                return _options.CurrentUserOnly;
+            }
+        }
+
+        public bool CurrentSessionOnly
+        {
+            get
+            {
+                Debug.Assert(WasSpecified);
+                return _options.CurrentSessionOnly;
+            }
+        }
+
+        public bool WasSpecified => _wasSpecified;
+
+        public string GetNameWithSessionPrefix(string name)
+        {
+            Debug.Assert(!string.IsNullOrEmpty(name));
+            Debug.Assert(WasSpecified);
+
+            bool hasPrefix = name.Contains('\\');
+            if (!hasPrefix)
+            {
+                if (CurrentSessionOnly)
+                {
+#if TARGET_WINDOWS
+                    // Services use the global namespace by default, so always include a prefix on Windows
+                    name = CurrentSessionPrefix + name;
+#endif
+                }
+                else
+                {
+                    name = AllSessionsPrefix + name;
+                }
+
+                return name;
+            }
+
+            // Verify that the prefix is compatible with the CurrentSessionOnly option. On Windows, when CurrentSessionOnly is
+            // false, any other prefix is permitted here, as a custom namespace can be created and used with a prefix.
+
+            bool incompatible;
+            if (CurrentSessionOnly)
+            {
+                incompatible = !name.StartsWith(CurrentSessionPrefix, StringComparison.Ordinal);
+            }
+            else
+            {
+#if TARGET_WINDOWS
+                incompatible = name.StartsWith(CurrentSessionPrefix, StringComparison.Ordinal);
+#else
+                incompatible = !name.StartsWith(AllSessionsPrefix, StringComparison.Ordinal);
+#endif
+            }
+
+            if (incompatible)
+            {
+                throw new ArgumentException(SR.Format(SR.NamedWaitHandles_IncompatibleNamePrefix, name), nameof(name));
+            }
+
+            return name;
+        }
+    }
+}

src/libraries/System.Private.CoreLib/src/System/Threading/Mutex.Windows.cs

@@ -10,8 +10,22 @@ namespace System.Threading
 {
     public sealed partial class Semaphore
     {
-        private void CreateSemaphoreCore(int initialCount, int maximumCount, string? name, out bool createdNew)
+        private void CreateSemaphoreCore(int initialCount, int maximumCount)
         {
+            ValidateArguments(initialCount, maximumCount);
+            SafeWaitHandle = WaitSubsystem.NewSemaphore(initialCount, maximumCount);
+        }
+
+#pragma warning disable IDE0060 // Unused parameter
+        private void CreateSemaphoreCore(
+            int initialCount,
+            int maximumCount,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
+        {
+            ValidateArguments(initialCount, maximumCount);
+
             if (name != null)
             {
                 throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
@@ -20,8 +34,12 @@ private void CreateSemaphoreCore(int initialCount, int maximumCount, string? nam
             SafeWaitHandle = WaitSubsystem.NewSemaphore(initialCount, maximumCount);
             createdNew = true;
         }
+#pragma warning restore IDE0060
 
-        private static OpenExistingResult OpenExistingWorker(string name, out Semaphore? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out Semaphore? result)
         {
             throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
         }

src/libraries/System.Private.CoreLib/src/System/Threading/Mutex.cs

@@ -1,7 +1,6 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System.Diagnostics;
 using System.IO;
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
@@ -12,43 +11,138 @@ public sealed partial class Semaphore
     {
         private const uint AccessRights = (uint)Interop.Kernel32.MAXIMUM_ALLOWED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.SEMAPHORE_MODIFY_STATE;
 
+#if TARGET_WINDOWS
+        // Can't use MAXIMUM_ALLOWED in an access control entry (ACE)
+        private const int CurrentUserOnlyAceRights =
+            Interop.Kernel32.STANDARD_RIGHTS_REQUIRED | Interop.Kernel32.SYNCHRONIZE | Interop.Kernel32.SEMAPHORE_MODIFY_STATE;
+#endif
+
         private Semaphore(SafeWaitHandle handle)
         {
             SafeWaitHandle = handle;
         }
 
-        private void CreateSemaphoreCore(int initialCount, int maximumCount, string? name, out bool createdNew)
+        private void CreateSemaphoreCore(int initialCount, int maximumCount)
         {
-            Debug.Assert(initialCount >= 0);
-            Debug.Assert(maximumCount >= 1);
-            Debug.Assert(initialCount <= maximumCount);
+            ValidateArguments(initialCount, maximumCount);
+
+            SafeWaitHandle handle =
+                Interop.Kernel32.CreateSemaphoreEx(
+                    lpSecurityAttributes: 0,
+                    initialCount,
+                    maximumCount,
+                    name: null,
+                    flags: 0,
+                    AccessRights);
+            if (handle.IsInvalid)
+            {
+                int errorCode = Marshal.GetLastPInvokeError();
+                handle.SetHandleAsInvalid();
+                throw Win32Marshal.GetExceptionForWin32Error(errorCode);
+            }
 
-#if TARGET_UNIX || TARGET_BROWSER || TARGET_WASI
+            SafeWaitHandle = handle;
+        }
+
+        private unsafe void CreateSemaphoreCore(
+            int initialCount,
+            int maximumCount,
+            string? name,
+            NamedWaitHandleOptionsInternal options,
+            out bool createdNew)
+        {
+            ValidateArguments(initialCount, maximumCount);
+
+#if !TARGET_WINDOWS
             if (name != null)
+            {
                 throw new PlatformNotSupportedException(SR.PlatformNotSupported_NamedSynchronizationPrimitives);
+            }
 #endif
-            SafeWaitHandle myHandle = Interop.Kernel32.CreateSemaphoreEx(IntPtr.Zero, initialCount, maximumCount, name, 0, AccessRights);
 
-            int errorCode = Marshal.GetLastPInvokeError();
-            if (myHandle.IsInvalid)
+            void* securityAttributesPtr = null;
+            SafeWaitHandle myHandle;
+            int errorCode;
+#if TARGET_WINDOWS
+            Thread.CurrentUserSecurityDescriptorInfo securityDescriptorInfo = default;
+            Interop.Kernel32.SECURITY_ATTRIBUTES securityAttributes = default;
+            if (!string.IsNullOrEmpty(name) && options.WasSpecified)
             {
-                myHandle.Dispose();
+                name = options.GetNameWithSessionPrefix(name);
+                if (options.CurrentUserOnly)
+                {
+                    securityDescriptorInfo = new(CurrentUserOnlyAceRights);
+                    securityAttributes.nLength = (uint)sizeof(Interop.Kernel32.SECURITY_ATTRIBUTES);
+                    securityAttributes.lpSecurityDescriptor = (void*)securityDescriptorInfo.SecurityDescriptor;
+                    securityAttributesPtr = &securityAttributes;
+                }
+            }
 
-                if (!string.IsNullOrEmpty(name) && errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
-                    throw new WaitHandleCannotBeOpenedException(
-                        SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+            using (securityDescriptorInfo)
+            {
+#endif
+                myHandle =
+                    Interop.Kernel32.CreateSemaphoreEx(
+                        (nint)securityAttributesPtr,
+                        initialCount,
+                        maximumCount,
+                        name,
+                        flags: 0,
+                        AccessRights);
+                errorCode = Marshal.GetLastPInvokeError();
+
+                if (myHandle.IsInvalid)
+                {
+                    myHandle.SetHandleAsInvalid();
+
+                    if (!string.IsNullOrEmpty(name) && errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
+                    {
+                        throw new WaitHandleCannotBeOpenedException(
+                            SR.Format(SR.Threading_WaitHandleCannotBeOpenedException_InvalidHandle, name));
+                    }
+
+                    throw Win32Marshal.GetExceptionForWin32Error(errorCode, name);
+                }
+#if TARGET_WINDOWS
 
-                throw Win32Marshal.GetExceptionForLastWin32Error();
+                if (errorCode == Interop.Errors.ERROR_ALREADY_EXISTS && securityAttributesPtr != null)
+                {
+                    try
+                    {
+                        if (!Thread.CurrentUserSecurityDescriptorInfo.IsSecurityDescriptorCompatible(
+                                securityDescriptorInfo.TokenUser,
+                                myHandle,
+                                Interop.Kernel32.SEMAPHORE_MODIFY_STATE))
+                        {
+                            throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
+                        }
+                    }
+                    catch
+                    {
+                        myHandle.Dispose();
+                        throw;
+                    }
+                }
             }
+#endif
+
             createdNew = errorCode != Interop.Errors.ERROR_ALREADY_EXISTS;
             this.SafeWaitHandle = myHandle;
         }
 
-        private static OpenExistingResult OpenExistingWorker(string name, out Semaphore? result)
+        private static OpenExistingResult OpenExistingWorker(
+            string name,
+            NamedWaitHandleOptionsInternal options,
+            out Semaphore? result)
         {
 #if TARGET_WINDOWS
             ArgumentException.ThrowIfNullOrEmpty(name);
 
+            if (options.WasSpecified)
+            {
+                name = options.GetNameWithSessionPrefix(name);
+            }
+
             // Pass false to OpenSemaphore to prevent inheritedHandles
             SafeWaitHandle myHandle = Interop.Kernel32.OpenSemaphore(AccessRights, false, name);
 
@@ -65,10 +159,31 @@ private static OpenExistingResult OpenExistingWorker(string name, out Semaphore?
                     return OpenExistingResult.PathNotFound;
                 if (errorCode == Interop.Errors.ERROR_INVALID_HANDLE)
                     return OpenExistingResult.NameInvalid;
+
                 // this is for passed through NativeMethods Errors
                 throw Win32Marshal.GetExceptionForLastWin32Error();
             }
 
+            if (options.WasSpecified && options.CurrentUserOnly)
+            {
+                try
+                {
+                    if (!Thread.CurrentUserSecurityDescriptorInfo.IsValidSecurityDescriptor(
+                            myHandle,
+                            Interop.Kernel32.SEMAPHORE_MODIFY_STATE))
+                    {
+                        myHandle.Dispose();
+                        result = null;
+                        return OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly;
+                    }
+                }
+                catch
+                {
+                    myHandle.Dispose();
+                    throw;
+                }
+            }
+
             result = new Semaphore(myHandle);
             return OpenExistingResult.Success;
 #else

src/libraries/System.Private.CoreLib/src/System/Threading/NamedWaitHandleOptions.cs

@@ -12,28 +12,121 @@ public sealed partial class Semaphore : WaitHandle
     {
         // creates a nameless semaphore object
         // Win32 only takes maximum count of int.MaxValue
-        public Semaphore(int initialCount, int maximumCount) : this(initialCount, maximumCount, null) { }
+        public Semaphore(int initialCount, int maximumCount)
+        {
+            CreateSemaphoreCore(initialCount, maximumCount);
+        }
+
+        /// <summary>
+        /// Creates a named or unnamed semaphore, or opens a named semaphore if a semaphore with the name already exists.
+        /// </summary>
+        /// <param name="initialCount">
+        /// The initial number of requests for the semaphore that can be satisfied concurrently.
+        /// </param>
+        /// <param name="maximumCount">
+        /// The maximum number of requests for the semaphore that can be satisfied concurrently.
+        /// </param>
+        /// <param name="name">
+        /// The name, if the semaphore is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named semaphore. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying semaphore object.
+        /// </param>
+        public Semaphore(int initialCount, int maximumCount, string? name, NamedWaitHandleOptions options)
+        {
+            CreateSemaphoreCore(initialCount, maximumCount, name, new(options), out _);
+        }
+
+        public Semaphore(int initialCount, int maximumCount, string? name)
+        {
+            CreateSemaphoreCore(initialCount, maximumCount, name, options: default, out _);
+        }
 
-        public Semaphore(int initialCount, int maximumCount, string? name) :
-            this(initialCount, maximumCount, name, out _)
+        /// <summary>
+        /// Creates a named or unnamed semaphore, or opens a named semaphore if a semaphore with the name already exists.
+        /// </summary>
+        /// <param name="initialCount">
+        /// The initial number of requests for the semaphore that can be satisfied concurrently.
+        /// </param>
+        /// <param name="maximumCount">
+        /// The maximum number of requests for the semaphore that can be satisfied concurrently.
+        /// </param>
+        /// <param name="name">
+        /// The name, if the semaphore is to be shared with other processes; otherwise, null or an empty string.
+        /// </param>
+        /// <param name="options">
+        /// Options for the named semaphore. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying semaphore object.
+        /// </param>
+        /// <param name="createdNew">
+        /// True if the semaphore was created; false if an existing named semaphore was opened.
+        /// </param>
+        public Semaphore(int initialCount, int maximumCount, string? name, NamedWaitHandleOptions options, out bool createdNew)
         {
+            CreateSemaphoreCore(initialCount, maximumCount, name, new(options), out createdNew);
         }
 
         public Semaphore(int initialCount, int maximumCount, string? name, out bool createdNew)
+        {
+            CreateSemaphoreCore(initialCount, maximumCount, name, options: default, out createdNew);
+        }
+
+        private static void ValidateArguments(int initialCount, int maximumCount)
         {
             ArgumentOutOfRangeException.ThrowIfNegative(initialCount);
             ArgumentOutOfRangeException.ThrowIfNegativeOrZero(maximumCount);
 
             if (initialCount > maximumCount)
+            {
                 throw new ArgumentException(SR.Argument_SemaphoreInitialMaximum);
+            }
+        }
 
-            CreateSemaphoreCore(initialCount, maximumCount, name, out createdNew);
+        /// <summary>
+        /// Opens an existing named semaphore.
+        /// </summary>
+        /// <param name="name">The name of the semaphore to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named semaphore. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying semaphore object.
+        /// </param>
+        /// <returns>An object that represents the named semaphore.</returns>
+        [SupportedOSPlatform("windows")]
+        public static Semaphore OpenExisting(string name, NamedWaitHandleOptions options)
+        {
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, new(options), out Semaphore? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
+
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
         }
 
         [SupportedOSPlatform("windows")]
         public static Semaphore OpenExisting(string name)
         {
-            switch (OpenExistingWorker(name, out Semaphore? result))
+            OpenExistingResult openExistingResult = OpenExistingWorker(name, options: default, out Semaphore? result);
+            if (openExistingResult != OpenExistingResult.Success)
+            {
+                ThrowForOpenExistingFailure(openExistingResult, name);
+            }
+
+            Debug.Assert(result != null, "result should be non-null on success");
+            return result;
+        }
+
+        [DoesNotReturn]
+        private static void ThrowForOpenExistingFailure(OpenExistingResult openExistingResult, string name)
+        {
+            Debug.Assert(openExistingResult != OpenExistingResult.Success);
+
+            switch (openExistingResult)
             {
                 case OpenExistingResult.NameNotFound:
                     throw new WaitHandleCannotBeOpenedException();
@@ -42,14 +135,31 @@ public static Semaphore OpenExisting(string name)
                 case OpenExistingResult.PathNotFound:
                     throw new IOException(SR.Format(SR.IO_PathNotFound_Path, name));
                 default:
-                    Debug.Assert(result != null, "result should be non-null on success");
-                    return result;
+                    Debug.Assert(openExistingResult == OpenExistingResult.ObjectIncompatibleWithCurrentUserOnly);
+                    throw new WaitHandleCannotBeOpenedException(SR.Format(SR.NamedWaitHandles_ExistingObjectIncompatibleWithCurrentUserOnly, name));
             }
         }
 
+        /// <summary>
+        /// Tries to open an existing named semaphore and returns a value indicating whether it was successful.
+        /// </summary>
+        /// <param name="name">The name of the semaphore to be shared with other processes.</param>
+        /// <param name="options">
+        /// Options for the named semaphore. Defaulted options, such as when passing 'options: default' in C#, are
+        /// 'CurrentUserOnly = true' and 'CurrentSessionOnly = true'. For more information, see 'NamedWaitHandleOptions'. The
+        /// specified options may affect the namespace for the name, and access to the underlying semaphore object.
+        /// </param>
+        /// <param name="result">
+        /// An object that represents the named semaphore if the method returns true; otherwise, null.
+        /// </param>
+        /// <returns>True if the named semaphore was opened successfully; otherwise, false.</returns>
+        [SupportedOSPlatform("windows")]
+        public static bool TryOpenExisting(string name, NamedWaitHandleOptions options, [NotNullWhen(true)] out Semaphore? result) =>
+            OpenExistingWorker(name, new(options), out result!) == OpenExistingResult.Success;
+
         [SupportedOSPlatform("windows")]
         public static bool TryOpenExisting(string name, [NotNullWhen(true)] out Semaphore? result) =>
-            OpenExistingWorker(name, out result!) == OpenExistingResult.Success;
+            OpenExistingWorker(name, options: default, out result!) == OpenExistingResult.Success;
 
         public int Release() => ReleaseCore(1);