OpenEvent / OpenFileMapping error with ERROR_ACCESS_DENIED

Question

I am developing an open source .NET assembly ( WinSCP.NET assembly ) that launches its own (C ++) application and communicates with this through events and file mapping objects.

The assembly spawns the application using the Process class without special settings. The assembly creates several events (using EventWaitHandle ) and file matching (using PInvoked CreateFileMapping ), and the application "opens" them using OpenEvent and OpenFileMapping .

In most cases, it works great. But now I have a user who uses the assembly from an ASPX application on the 64-bit version of Windows Server 2008 R2.

In his case, both OpenEvent and OpenFileMapping return NULL and GetLastError return ERROR_ACCESS_DENIED .

I tried to improve the assembly code by explicitly giving current users the necessary permissions for the event objects, and the application code should only require the really necessary access rights (instead of the original EVENT_ALL_ACCESS ) according to the example in MSDN . It did not help. So I didn’t even bother to try the same for the file mapping object.

C # code generating the event:

 EventWaitHandleSecurity security = new EventWaitHandleSecurity(); string user = Environment.UserDomainName + "\\" + Environment.UserName; EventWaitHandleAccessRule rule; rule = new EventWaitHandleAccessRule( user, EventWaitHandleRights.Synchronize | EventWaitHandleRights.Modify, AccessControlType.Allow); security.AddAccessRule(rule); rule = new EventWaitHandleAccessRule( user, EventWaitHandleRights.ChangePermissions, AccessControlType.Deny); security.AddAccessRule(rule); new EventWaitHandle( false, EventResetMode.AutoReset, name, out createdNew, security); 

C ++ code that "opens" events:

 OpenEvent(EVENT_MODIFY_STATE, false, name); 

(For other events, SYNCHRONIZE access level, depending on needs).

Does anyone have any idea what causes the "access denied" error in OpenEvent (or CreateFileMapping )?

Answer 1

I assume that the event is fired either by an anonymous user or by a registered user, depending on how the website is configured. But the subprocess starts with the user of the base process. You can check this using the process monitor and look at the acl for the event descriptor to find out who is the creator. Then look at the subprocess to see who it works.
If so, you can update acl in the event to enable the underlying process. In addition to this, you may still need a “global” prefix to make sure that this event can be used across user boundaries.