2

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity process running under that user account modify the SACL/DACL?

The context here is running a separate low-integrity process for sandboxing purposes, using IPC over named pipes to expose certain restricted functionality.

Here's the accesschk -lv output for the pipe in question:

\\.\Pipe\testpipe123
  DESCRIPTOR FLAGS:
      [SE_DACL_PRESENT]
      [SE_SACL_PRESENT]
  OWNER: wvm\Polynomial
  LABEL: Low Mandatory Level
        SYSTEM_MANDATORY_LABEL_NO_WRITE_UP
  [0] ACCESS_ALLOWED_ACE_TYPE: wvm\Polynomial
        FILE_ADD_FILE
        FILE_CREATE_PIPE_INSTANCE
        FILE_APPEND_DATA
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_DATA
        FILE_READ_EA
        FILE_WRITE_ATTRIBUTES
        FILE_WRITE_DATA
        FILE_WRITE_EA
        DELETE
        SYNCHRONIZE
        READ_CONTROL
        WRITE_DAC
        WRITE_OWNER
  SACL:
  [0] : Mandatory Label\Low Mandatory Level
        FILE_LIST_DIRECTORY
        FILE_READ_DATA

My expectation is that no, the SACL and DACL can't be modified, because low integrity processes would receive only the permissions from the low mandatory label at the bottom (list directory + read data) and none of the DACL permissions for the current user, thus not receiving the WRITE_DAC or WRITE_OWNER permissions.

Am I right? Are there any other factors involved, or things I should consider for ensuring that the low integrity process can't manipulate the pipe unexpectedly?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.