Updated security attributes for named shared control pipes and introspection named shared memory.

Author: markgalvan-intel

IntelPresentMon/Interprocess/source/Interprocess.cpp

@@ -78,7 +78,7 @@ namespace pmon::ipc
 				Permissions_()
 				{
 					if (!ConvertStringSecurityDescriptorToSecurityDescriptorA(
-						"D:PNO_ACCESS_CONTROLS:(ML;;NW;;;LW)",
+						"D:(A;OICI;GA;;;WD)",
 						SDDL_REVISION_1, &secAttr_.lpSecurityDescriptor, NULL)) {
 						throw std::runtime_error{ "Failed to create security descriptor for shared memory" };
 					}

IntelPresentMon/PresentMonService/NamedPipeServer.cpp

@@ -388,8 +388,22 @@ DWORD NamedPipeServer::Pipe::CreatePipeInstance(LPCTSTR pipe_name, int max_pipes
     LOG(INFO) << "Creating control pipe with name: [" << util::str::ToNarrow(pipe_name) << "]" << std::endl;
 
     auto& opt = clio::Options::Get();
-    if (opt.etwSessionName.AsOptional().has_value()) {
-        LOG(INFO) << "Using Default Security" << std::endl;
+    if (opt.controlPipe.AsOptional().has_value()) {
+        
+        PSECURITY_DESCRIPTOR pSD = NULL;
+        if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(
+            L"D:(A;OICI;GA;;;WD)", SDDL_REVISION_1,
+            &pSD, NULL)) {
+            auto error = GetLastError();
+            LOG(INFO) << "Failed to create security descriptor: [" <<
+                util::str::ToNarrow(pipe_name) <<
+                "] Error: " <<
+                error << std::endl;
+            return error;
+        }
+        SECURITY_ATTRIBUTES sa = { .nLength = sizeof(sa),
+                                   .lpSecurityDescriptor = pSD,
+                                   .bInheritHandle = FALSE};
         HANDLE tempPipeInstance =
             CreateNamedPipe(pipe_name,  // pipe name
                 PIPE_ACCESS_DUPLEX |    // read/write access
@@ -401,49 +415,60 @@ DWORD NamedPipeServer::Pipe::CreatePipeInstance(LPCTSTR pipe_name, int max_pipes
                 MaxBufferSize,          // output buffer size
                 MaxBufferSize,          // input buffer size
                 pipe_timeout,           // client time-out
-                NULL);                  // default security attributes
+                &sa);                   // security attributes
+        // Free the allocated security descriptor regardless if the
+        // named pipe was successfully created
+        LocalFree(sa.lpSecurityDescriptor);
         if (tempPipeInstance == INVALID_HANDLE_VALUE) {
             auto error = GetLastError();
             LOG(INFO) << "Failed to create pipe: [" <<
                 util::str::ToNarrow(pipe_name) <<
                 "] Error: " <<
                 error << std::endl;
-            return error;
+             return error;
         }
         mPipeInstance.reset(tempPipeInstance);
         return ERROR_SUCCESS;
     }
     else {
-        SECURITY_ATTRIBUTES sa = { sizeof(sa) };
-        if (ConvertStringSecurityDescriptorToSecurityDescriptorW(
+        PSECURITY_DESCRIPTOR pSD = NULL;
+        if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(
             L"D:PNO_ACCESS_CONTROLS:(ML;;NW;;;LW)", SDDL_REVISION_1,
-            &sa.lpSecurityDescriptor, NULL)) {
-            HANDLE tempPipeInstance =
-                CreateNamedPipe(pipe_name,   // pipe name
-                    PIPE_ACCESS_DUPLEX |     // read/write access
-                    FILE_FLAG_OVERLAPPED,    // overlapped mode
-                    PIPE_TYPE_MESSAGE |      // message-type pipe
-                    PIPE_READMODE_MESSAGE |  // message-read mode
-                    PIPE_WAIT,               // blocking mode
-                    max_pipes,               // number of instances
-                    MaxBufferSize,           // output buffer size
-                    MaxBufferSize,           // input buffer size
-                    pipe_timeout,            // client time-out
-                    &sa);                    // use specified security attributes
-            if (tempPipeInstance == INVALID_HANDLE_VALUE) {
-                auto error = GetLastError();
-                LOG(INFO) << "Failed to create pipe: [" <<
-                    util::str::ToNarrow(pipe_name) <<
-                    "] Error: " <<
-                    error << std::endl;
-                return error;
-            }
-            mPipeInstance.reset(tempPipeInstance);
-            LocalFree(sa.lpSecurityDescriptor);
-            return ERROR_SUCCESS;
+            &pSD, NULL)) {
+            auto error = GetLastError();
+            LOG(INFO) << "Failed to create security descriptor: [" <<
+                util::str::ToNarrow(pipe_name) <<
+                "] Error: " <<
+                error << std::endl;
+            return error;
         }
-        else {
-            return GetLastError();
+        SECURITY_ATTRIBUTES sa = { .nLength = sizeof(sa),
+                                   .lpSecurityDescriptor = pSD,
+                                   .bInheritHandle = FALSE };
+        HANDLE tempPipeInstance =
+            CreateNamedPipe(pipe_name,   // pipe name
+                PIPE_ACCESS_DUPLEX |     // read/write access
+                FILE_FLAG_OVERLAPPED,    // overlapped mode
+                PIPE_TYPE_MESSAGE |      // message-type pipe
+                PIPE_READMODE_MESSAGE |  // message-read mode
+                PIPE_WAIT,               // blocking mode
+                max_pipes,               // number of instances
+                MaxBufferSize,           // output buffer size
+                MaxBufferSize,           // input buffer size
+                pipe_timeout,            // client time-out
+                &sa);                    // use specified security attributes
+        // Free the allocated security descriptor regardless if the
+        // named pipe was successfully created
+        LocalFree(sa.lpSecurityDescriptor);
+        if (tempPipeInstance == INVALID_HANDLE_VALUE) {
+            auto error = GetLastError();
+            LOG(INFO) << "Failed to create pipe: [" <<
+                util::str::ToNarrow(pipe_name) <<
+                "] Error: " <<
+                error << std::endl;
+            return error;
         }
+        mPipeInstance.reset(tempPipeInstance);
+        return ERROR_SUCCESS;
     }
 }

IntelPresentMon/SampleClient/SampleClient.args.json

@@ -84,7 +84,15 @@
     },
     {
       "Id": "4d012d46-c606-4e44-91a4-8bfa0865cfbc",
-      "Command": "--process-name Balatro.exe"
+      "Command": "--process-name Valley.exe"
+    },
+    {
+      "Id": "90f7b819-b9e5-4f19-a315-186c1affaa5d",
+      "Command": "--control-pipe \\\\.\\pipe\\igs"
+    },
+    {
+      "Id": "b37ef2ea-3c9c-4929-8f5b-29ba539674e2",
+      "Command": "--intro-nsm Global\\pm2_bip_shm_igs"
     },
     {
       "Id": "7f6ffa38-2a9a-480c-a811-a10c76820b74",