IPC between service and user application

[ChristophS]

Hi,

I am trying to implement IPC between a service and user application using Mailslots.

When the Mailslot is created from within my Service (in Session 0) The UserMode application is not able to write to the mailslot. What do I have to do to cross the Session isolation?

[VictorN]

Did you consider using named pipes instead?

[MikeAThon]

Agreement with VictorN: use named pipes instead, as they are more suitable for interaction between a service and a user

[Igor Vartanov]

What do I have to do to cross the Session isolation?

It's very unlikely the issue is about session isolation. Did you set security attributes proper way? In case you place just NULL, only other process running the same account (LocalSystem ?) is able to access the secured object, mailslot in your case.

[ChristophS]

Igor,

thanks for the hint. That was the problem. When using a NULL-Dacl instead of empty security attributes it works.


Mike, Victor: I only need to push data from a user mode app to the service. Thats why Mailslots are more suiteable for me in this case

Regards,
Chris

[eclessiastes]

I'm having the same problem. I use NULL for security attributes but still doesn't work. IPC can only communicate between same user account services but not between windows service (LocalSystem) and user application.

[Igor Vartanov]

Did you read the thread? Using NULL in place of security attributes works exactly like you just described. It's not "but still doesn't work" case, it’s rather "so still won't work ever until you start doing it right" case.

[Igor Vartanov]

Similar problem resolved: see the post

[eclessiastes]

Thanks Igor,

	PSECURITY_DESCRIPTOR psd = NULL;
	BYTE  sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
	psd = (PSECURITY_DESCRIPTOR)sd;
	InitializeSecurityDescriptor(psd, SECURITY_DESCRIPTOR_REVISION);
	SetSecurityDescriptorDacl(psd, TRUE, (PACL)NULL, FALSE);
	SECURITY_ATTRIBUTES sa = { sizeof(sa), psd, FALSE };

[Igor Vartanov]

Thanks Igor,

    PSECURITY_DESCRIPTOR psd = NULL;
    BYTE  sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
    psd = (PSECURITY_DESCRIPTOR)sd;
    InitializeSecurityDescriptor(psd, SECURITY_DESCRIPTOR_REVISION);
    SetSecurityDescriptorDacl(psd, TRUE, (PACL)NULL, FALSE);
    SECURITY_ATTRIBUTES sa = { sizeof(sa), psd, FALSE };

BTW, you can do a bit more targeted ACL setup, something like that:

         LPTCSTR  szSD = TEXT("D:")      // Discretionary ACL
            TEXT("(D;OICI;GA;;;BG)")     // Deny access to built-in guests
            TEXT("(D;OICI;GA;;;AN)")     // Deny access to anonymous logon
            TEXT("(A;OICI;GRGWGX;;;AU)") // Allow read/write/execute to authenticated users
            TEXT("(A;OICI;GA;;;BA)");    // Allow full control to built-in administrators

        BOOL res = ::ConvertStringSecurityDescriptorToSecurityDescriptor(
            szSD, SDDL_REVISION_1, &sa.lpSecurityDescriptor, NULL);