进程间通信 - C# 和 C++。访问路径被拒绝
Inter-process communication - C# and C++. Access to the path is denied
我有一个使用管道连接到 C++ 服务器应用程序的 C# 客户端应用程序。当我尝试连接时出现错误：System.UnauthorizedAccessException：访问路径被拒绝。
查看后，我发现可以通过创建 PipeSecurity 对象并添加 PipeAccessRule 来修复它。但这仅在服务器也是 C# 应用程序时才有效。
如果我将服务器作为 C++ 应用程序，知道如何解决此访问问题吗？
我已经搜索过，但找不到解决方案。
C#:
int timeOut = 500;
NamedPipeClientStream pipeStream = new NamedPipeClientStream(".", pipeName, PipeDirection.Out, PipeOptions.Asynchronous);
pipeStream.Connect(timeOut);
byte[] buffer = Encoding.UTF8.GetBytes(sendStr);
pipeStream.BeginWrite(buffer, 0, buffer.Length, new AsyncCallback(AsyncSend), pipeStream);
C++:
_hPipe = ::CreateNamedPipe(configurePipeName(getPipeName()).c_str(),
PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE | FILE_FLAG_OVERLAPPED,
PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT | PIPE_REJECT_REMOTE_CLIENTS,
1,
bufferSize,
bufferSize,
NMPWAIT_USE_DEFAULT_WAIT,
NULL);
if (_hPipe == INVALID_HANDLE_VALUE)
{
logStream << "CreateNamedPipe failed for " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
return;
}
HANDLE ioEvent = ::CreateEvent(NULL, FALSE, FALSE, NULL);
overlapped.hEvent = ioEvent;
assert(overlapped.hEvent);
if (ioEvent == INVALID_HANDLE_VALUE)
{
logStream << "CreateEvent failed for " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
return;
}
while (!terminating())
{
BOOL connected = false;
DWORD waitMessage;
DWORD timeOut = 700;
if (!::ConnectNamedPipe(_hPipe, &overlapped))
{
switch (::GetLastError())
{
case ERROR_PIPE_CONNECTED:
connected = true;
break;
case ERROR_IO_PENDING:
waitMessage = ::WaitForSingleObject(overlapped.hEvent, timeOut);
if (waitMessage == WAIT_OBJECT_0)
{
DWORD dwIgnore;
BOOL conn = (::GetOverlappedResult(_hPipe, &overlapped, &dwIgnore, TRUE));
if (conn)
connected = true;
else
logStream << "ConnectedNamedPipe reported an error: " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
else
::CancelIo(_hPipe);
break;
default:
logStream << "ConnectedNamedPipe reported an error: " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
}
if(connected)
{
if (::ReadFile(_hPipe, buffer, sizeof(buffer) - 1, &size, NULL))
{
buffer[size] = '[=11=]';
std::string receivedMessage(buffer);
// if message is received from client, setdirty to call detectDisplay.
if (clientUniqueMessage.compare(receivedMessage) == 0)
setDirty();
else
logStream << "Incoming message from client does not match with the expected message." << blog::over;
}
else
logStream << "ReadFile failed. " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
::DisconnectNamedPipe(_hPipe);
}
}
[CreateNamedPipe function] 的最后一个参数指定：
lpSecurityAttributes [in, optional] A pointer to
a SECURITY_ATTRIBUTES structure that specifies a security descriptor
for the new named pipe and determines whether child processes can
inherit the returned handle. If lpSecurityAttributes is NULL, the
named pipe gets a default security descriptor and the handle cannot be
inherited. The ACLs in the default security descriptor for a named
pipe grant full control to the LocalSystem account, administrators,
and the creator owner. They also grant read access to members of the
Everyone group and the anonymous account.
C++ 命名管道服务器应用程序具有管理员权限，因为它 运行 在 LocalSystem 帐户下作为 Windows 服务。作为标准用户的 C# 客户端应用程序 运行ning 没有管理员权限。默认情况下（lpSecurityAttributes 是 NULL），C# 客户端应用程序只能读取由 C++ 服务器 运行 作为服务创建的命名管道。
作为快速测试，如果您 运行 作为管理员的 C# 客户端应用程序，它应该能够成功地与 C++ 服务器应用程序通信。
要解决此问题，C++ 服务器应用程序需要为命名管道对象创建一个安全描述符，并为 Everyone 授予写入权限。请参阅 MSDN example 创建安全描述符。
我之前为我的 C++ 服务器应用程序 运行 写了一个 class NamedPipeServerStream 作为服务。下面是创建命名管道相关的部分代码，供大家参考。
NamedPipeServerStream::NamedPipeServerStream(const std::string & pipeName, const unsigned pipeBufferSize /*= PIPE_BUFFER_SIZE*/)
: m_hPipe(INVALID_HANDLE_VALUE)
, m_pipeName(PIPE_NAME_ROOT + pipeName)
, m_bConnected(false)
{
PSID pEveryoneSID = NULL;
PSID pAdminSID = NULL;
PACL pACL = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
SECURITY_ATTRIBUTES sa;
SCOPE_GUARD{
if (pEveryoneSID) { FreeSid(pEveryoneSID); }
if (pAdminSID) { FreeSid(pAdminSID); }
if (pACL) { LocalFree(pACL); }
};
// Create a well-known SID for the Everyone group.
if (!AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID))
{
throw std::runtime_error("AllocateAndInitializeSid failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize an EXPLICIT_ACCESS structure for an ACE.
SecureZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
// The ACE will allow Everyone full access to the key.
ea[0].grfAccessPermissions = FILE_ALL_ACCESS | GENERIC_WRITE | GENERIC_READ;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pEveryoneSID;
// Create a SID for the BUILTIN\Administrators group.
if (!AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSID))
{
throw std::runtime_error("AllocateAndInitializeSid failed, GLE=" + std::to_string(GetLastError()));
}
// The ACE will allow the Administrators group full access to the key.
ea[1].grfAccessPermissions = FILE_ALL_ACCESS | GENERIC_WRITE | GENERIC_READ;
ea[1].grfAccessMode = SET_ACCESS;
ea[1].grfInheritance = NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[1].Trustee.ptstrName = (LPTSTR)pAdminSID;
// Create a new ACL that contains the new ACEs.
DWORD dwRes = SetEntriesInAclW(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes)
{
throw std::runtime_error("SetEntriesInAcl failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize a security descriptor.
auto secDesc = std::vector<unsigned char>(SECURITY_DESCRIPTOR_MIN_LENGTH);
PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)(&secDesc[0]);
if (nullptr == pSD)
{
throw std::runtime_error("LocalAlloc failed, GLE=" + std::to_string(GetLastError()));
}
if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION))
{
throw std::runtime_error("InitializeSecurityDescriptor failed, GLE=" + std::to_string(GetLastError()));
}
// Add the ACL to the security descriptor.
if (!SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE)) // not a default DACL
{
throw std::runtime_error("SetSecurityDescriptorDacl failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize a security attributes structure.
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;
// Finally to create the pipe.
m_hPipe = CreateNamedPipeA(
m_pipeName.c_str(), // pipe name
PIPE_ACCESS_DUPLEX, // read/write access
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | // Byte Stream type pipe
PIPE_WAIT, // blocking mode
PIPE_UNLIMITED_INSTANCES, // max. instances
pipeBufferSize, // output buffer size
pipeBufferSize, // input buffer size
0, // client time-out
&sa); // default security attribute
if (!IsPipeCreated())
{
throw std::runtime_error("CreateNamedPipe failed, GLE=" + std::to_string(GetLastError()));
}
}
bool NamedPipeServerStream::IsPipeCreated() const
{
return (INVALID_HANDLE_VALUE != m_hPipe);
}
我有一个使用管道连接到 C++ 服务器应用程序的 C# 客户端应用程序。当我尝试连接时出现错误：System.UnauthorizedAccessException：访问路径被拒绝。
查看后，我发现可以通过创建 PipeSecurity 对象并添加 PipeAccessRule 来修复它。但这仅在服务器也是 C# 应用程序时才有效。
如果我将服务器作为 C++ 应用程序，知道如何解决此访问问题吗？
我已经搜索过，但找不到解决方案。
C#:
int timeOut = 500;
NamedPipeClientStream pipeStream = new NamedPipeClientStream(".", pipeName, PipeDirection.Out, PipeOptions.Asynchronous);
pipeStream.Connect(timeOut);
byte[] buffer = Encoding.UTF8.GetBytes(sendStr);
pipeStream.BeginWrite(buffer, 0, buffer.Length, new AsyncCallback(AsyncSend), pipeStream);
C++:
_hPipe = ::CreateNamedPipe(configurePipeName(getPipeName()).c_str(),
PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE | FILE_FLAG_OVERLAPPED,
PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT | PIPE_REJECT_REMOTE_CLIENTS,
1,
bufferSize,
bufferSize,
NMPWAIT_USE_DEFAULT_WAIT,
NULL);
if (_hPipe == INVALID_HANDLE_VALUE)
{
logStream << "CreateNamedPipe failed for " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
return;
}
HANDLE ioEvent = ::CreateEvent(NULL, FALSE, FALSE, NULL);
overlapped.hEvent = ioEvent;
assert(overlapped.hEvent);
if (ioEvent == INVALID_HANDLE_VALUE)
{
logStream << "CreateEvent failed for " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
return;
}
while (!terminating())
{
BOOL connected = false;
DWORD waitMessage;
DWORD timeOut = 700;
if (!::ConnectNamedPipe(_hPipe, &overlapped))
{
switch (::GetLastError())
{
case ERROR_PIPE_CONNECTED:
connected = true;
break;
case ERROR_IO_PENDING:
waitMessage = ::WaitForSingleObject(overlapped.hEvent, timeOut);
if (waitMessage == WAIT_OBJECT_0)
{
DWORD dwIgnore;
BOOL conn = (::GetOverlappedResult(_hPipe, &overlapped, &dwIgnore, TRUE));
if (conn)
connected = true;
else
logStream << "ConnectedNamedPipe reported an error: " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
else
::CancelIo(_hPipe);
break;
default:
logStream << "ConnectedNamedPipe reported an error: " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
}
if(connected)
{
if (::ReadFile(_hPipe, buffer, sizeof(buffer) - 1, &size, NULL))
{
buffer[size] = '[=11=]';
std::string receivedMessage(buffer);
// if message is received from client, setdirty to call detectDisplay.
if (clientUniqueMessage.compare(receivedMessage) == 0)
setDirty();
else
logStream << "Incoming message from client does not match with the expected message." << blog::over;
}
else
logStream << "ReadFile failed. " << sys::OperatingSystem::getLastErrorMessage() << blog::over;
}
::DisconnectNamedPipe(_hPipe);
}
}
[CreateNamedPipe function] 的最后一个参数指定：
lpSecurityAttributes [in, optional]A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new named pipe and determines whether child processes can inherit the returned handle. If lpSecurityAttributes is NULL, the named pipe gets a default security descriptor and the handle cannot be inherited. The ACLs in the default security descriptor for a named pipe grant full control to the LocalSystem account, administrators, and the creator owner. They also grant read access to members of the Everyone group and the anonymous account.
C++ 命名管道服务器应用程序具有管理员权限，因为它 运行 在 LocalSystem 帐户下作为 Windows 服务。作为标准用户的 C# 客户端应用程序 运行ning 没有管理员权限。默认情况下（lpSecurityAttributes 是 NULL），C# 客户端应用程序只能读取由 C++ 服务器 运行 作为服务创建的命名管道。
作为快速测试，如果您 运行 作为管理员的 C# 客户端应用程序，它应该能够成功地与 C++ 服务器应用程序通信。
要解决此问题，C++ 服务器应用程序需要为命名管道对象创建一个安全描述符，并为 Everyone 授予写入权限。请参阅 MSDN example 创建安全描述符。
我之前为我的 C++ 服务器应用程序 运行 写了一个 class NamedPipeServerStream 作为服务。下面是创建命名管道相关的部分代码，供大家参考。
NamedPipeServerStream::NamedPipeServerStream(const std::string & pipeName, const unsigned pipeBufferSize /*= PIPE_BUFFER_SIZE*/)
: m_hPipe(INVALID_HANDLE_VALUE)
, m_pipeName(PIPE_NAME_ROOT + pipeName)
, m_bConnected(false)
{
PSID pEveryoneSID = NULL;
PSID pAdminSID = NULL;
PACL pACL = NULL;
EXPLICIT_ACCESS ea[2];
SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
SECURITY_ATTRIBUTES sa;
SCOPE_GUARD{
if (pEveryoneSID) { FreeSid(pEveryoneSID); }
if (pAdminSID) { FreeSid(pAdminSID); }
if (pACL) { LocalFree(pACL); }
};
// Create a well-known SID for the Everyone group.
if (!AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID))
{
throw std::runtime_error("AllocateAndInitializeSid failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize an EXPLICIT_ACCESS structure for an ACE.
SecureZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
// The ACE will allow Everyone full access to the key.
ea[0].grfAccessPermissions = FILE_ALL_ACCESS | GENERIC_WRITE | GENERIC_READ;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pEveryoneSID;
// Create a SID for the BUILTIN\Administrators group.
if (!AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSID))
{
throw std::runtime_error("AllocateAndInitializeSid failed, GLE=" + std::to_string(GetLastError()));
}
// The ACE will allow the Administrators group full access to the key.
ea[1].grfAccessPermissions = FILE_ALL_ACCESS | GENERIC_WRITE | GENERIC_READ;
ea[1].grfAccessMode = SET_ACCESS;
ea[1].grfInheritance = NO_INHERITANCE;
ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[1].Trustee.ptstrName = (LPTSTR)pAdminSID;
// Create a new ACL that contains the new ACEs.
DWORD dwRes = SetEntriesInAclW(2, ea, NULL, &pACL);
if (ERROR_SUCCESS != dwRes)
{
throw std::runtime_error("SetEntriesInAcl failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize a security descriptor.
auto secDesc = std::vector<unsigned char>(SECURITY_DESCRIPTOR_MIN_LENGTH);
PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)(&secDesc[0]);
if (nullptr == pSD)
{
throw std::runtime_error("LocalAlloc failed, GLE=" + std::to_string(GetLastError()));
}
if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION))
{
throw std::runtime_error("InitializeSecurityDescriptor failed, GLE=" + std::to_string(GetLastError()));
}
// Add the ACL to the security descriptor.
if (!SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE)) // not a default DACL
{
throw std::runtime_error("SetSecurityDescriptorDacl failed, GLE=" + std::to_string(GetLastError()));
}
// Initialize a security attributes structure.
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.lpSecurityDescriptor = pSD;
sa.bInheritHandle = FALSE;
// Finally to create the pipe.
m_hPipe = CreateNamedPipeA(
m_pipeName.c_str(), // pipe name
PIPE_ACCESS_DUPLEX, // read/write access
PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | // Byte Stream type pipe
PIPE_WAIT, // blocking mode
PIPE_UNLIMITED_INSTANCES, // max. instances
pipeBufferSize, // output buffer size
pipeBufferSize, // input buffer size
0, // client time-out
&sa); // default security attribute
if (!IsPipeCreated())
{
throw std::runtime_error("CreateNamedPipe failed, GLE=" + std::to_string(GetLastError()));
}
}
bool NamedPipeServerStream::IsPipeCreated() const
{
return (INVALID_HANDLE_VALUE != m_hPipe);
}