Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow named_pipe::ServerOptions to set security flags #4844

Closed
dwattttt opened this issue Jul 20, 2022 · 3 comments · Fixed by #4845
Closed

Allow named_pipe::ServerOptions to set security flags #4844

dwattttt opened this issue Jul 20, 2022 · 3 comments · Fixed by #4845
Labels
A-tokio Area: The main tokio crate C-feature-request Category: A feature request. E-help-wanted Call for participation: Help is requested to fix this issue. M-net Module: tokio/net

Comments

@dwattttt
Copy link
Contributor

Is your feature request related to a problem? Please describe.
It's not possible to request security access mode permissions for a named pipe created by NamedPipeServer. These correspond to setting the flags WRITE_DAC, WRITE_OWNER, and ACCESS_SYSTEM_SECURITY in the dwOpenMode parameter of the CreateNamedPipeW call (see https://docs.microsoft.com/en-us/windows/win32/api/namedpipeapi/nf-namedpipeapi-createnamedpipew ).

This prevents named pipe handles created through tokio from having their security properties set on the pipe via a handle from AsRawHandle.

These flags do not change the IO behaviour of the pipe, and are safe to expose to users.

Describe the solution you'd like
I'd like helpers added to ServerOptions to add these bits to the CreateNamedPipeW call. These would be identical to access_inbound etc, except that they would set WRITE_DAC, WRITE_OWNER, and ACCESS_SYSTEM_SECURITY.

Describe alternatives you've considered
The only alternative would be to produce a handle to the pipe via the native API while additionally requesting these flags. This is not ideal because to open additional server sides to the pipe requires identical flags to be passed for several parameters; without diving into tokio's source it's not possible to know what these are.

Additional context
Allowing security settings to be changed on a named pipe allows users to leverage Windows access control, e.g. to allow or restrict access to the pipe to various users/groups.

@dwattttt dwattttt added A-tokio Area: The main tokio crate C-feature-request Category: A feature request. labels Jul 20, 2022
@Darksonn Darksonn added the M-net Module: tokio/net label Jul 20, 2022
@Darksonn
Copy link
Contributor

This feature request sounds good to me.

@Darksonn Darksonn added the E-help-wanted Call for participation: Help is requested to fix this issue. label Jul 20, 2022
@dwattttt
Copy link
Contributor Author

@Darksonn
Copy link
Contributor

You will need to open a pull request for your branch to get it merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-tokio Area: The main tokio crate C-feature-request Category: A feature request. E-help-wanted Call for participation: Help is requested to fix this issue. M-net Module: tokio/net
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants