低权限IE和高权限进程通过管道通信时的权限问题

BOOL CreatePipeSecurity(PSECURITY_ATTRIBUTES *ppSa)
{
BOOL bSuccess = TRUE;
DWORD dwError = ERROR_SUCCESS;
PSECURITY_DESCRIPTOR pSd = NULL;
PSECURITY_ATTRIBUTES pSa = NULL;
PCWSTR szDDL = L"S:(ML;;NW;;;LW)D:(A;;0x12019f;;;WD)";

if (!ConvertStringSecurityDescriptorToSecurityDescriptor(szDDL, SDDL_REVISION_1, &pSd, NULL))
{
return FALSE;
}

pSa = (PSECURITY_ATTRIBUTES)LocalAlloc(LPTR, sizeof(*pSa));
if (pSa == NULL)
{
LocalFree(pSd);
return FALSE;
}

pSa->nLength = sizeof(*pSa);
pSa->lpSecurityDescriptor = pSd;
pSa->bInheritHandle = FALSE;

*ppSa = pSa;

return bSuccess;
}

void FreePipeSecurity(PSECURITY_ATTRIBUTES pSa)
{
if (pSa)
{
if (pSa->lpSecurityDescriptor)
{
LocalFree(pSa->lpSecurityDescriptor);
}

LocalFree(pSa);
}
}

unsigned int __stdcall WorkThread( void *lpParam )
{
SECURITY_ATTRIBUTES* lpPipeSecurity;
CreatePipeSecurity(&lpPipeSecurity);

lpKeyBoardMonitor->m_hLastPipe = CreateNamedPipe( _T( PIPE_NAME ),
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
MAXBYTE,
MAXBYTE,
NULL,
lpPipeSecurity );

......
......
//不需要Pipe的时候，释放
FreePipeSecurity(lpPipeSecurity);
}

参考文章：

How to create an anonymous pipe that gives access to everyone

Named Pipes Not Working When Logged In As
a Standard User in Vista

CreateLowIntegrityProcessCreateLowIntegrityProcess