If a named pipe on Windows has a Low Mandatory Level label and
SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has
WRITE_OWNER for the current user, can a low integrity process running under that user account modify the SACL/DACL?
The context here is running a separate low-integrity process for sandboxing purposes, using IPC over named pipes to expose certain restricted functionality.
accesschk -lv output for the pipe in question:
\\.\Pipe\testpipe123 DESCRIPTOR FLAGS: [SE_DACL_PRESENT] [SE_SACL_PRESENT] OWNER: wvm\Polynomial LABEL: Low Mandatory Level SYSTEM_MANDATORY_LABEL_NO_WRITE_UP  ACCESS_ALLOWED_ACE_TYPE: wvm\Polynomial FILE_ADD_FILE FILE_CREATE_PIPE_INSTANCE FILE_APPEND_DATA FILE_LIST_DIRECTORY FILE_READ_ATTRIBUTES FILE_READ_DATA FILE_READ_EA FILE_WRITE_ATTRIBUTES FILE_WRITE_DATA FILE_WRITE_EA DELETE SYNCHRONIZE READ_CONTROL WRITE_DAC WRITE_OWNER SACL:  : Mandatory Label\Low Mandatory Level FILE_LIST_DIRECTORY FILE_READ_DATA
My expectation is that no, the SACL and DACL can't be modified, because low integrity processes would receive only the permissions from the low mandatory label at the bottom (list directory + read data) and none of the DACL permissions for the current user, thus not receiving the
Am I right? Are there any other factors involved, or things I should consider for ensuring that the low integrity process can't manipulate the pipe unexpectedly?