Is there a way to create a named pipe from an AppContainer BHO on IE11?

Question

I'm trying to write a BHO for Internet Explorer 11 (Windows 8.1). My BHO implements the AppContainer sandbox, but I can't seem to create a Named Pipe, CreateNamedPipe fails with that message: Access is denied.

Here's the code I'm using to create the named pipe (which I found on a russian website, last comment:

        LPCWSTR LOW_INTEGRITY_SDDL_SACL_W = L"S:(ML;;NW;;;LW)D:(A;;0x120083;;;WD)(A;;0x120083;;;AC)";

        PSECURITY_DESCRIPTOR pSD = NULL;
        ConvertStringSecurityDescriptorToSecurityDescriptorW (
            LOW_INTEGRITY_SDDL_SACL_W,
            SDDL_REVISION_1,
            &pSD,
            NULL );

        if ( pSD != NULL)
        {
            SECURITY_ATTRIBUTES  SecurityAttributes;

            SecurityAttributes.nLength = sizeof(SECURITY_ATTRIBUTES);
            SecurityAttributes.bInheritHandle = TRUE;
            SecurityAttributes.lpSecurityDescriptor = pSD;

            HANDLE hPipe = CreateNamedPipe(
                L"\\\\.\\pipe\\testpipe",
                PIPE_ACCESS_DUPLEX,                     
                PIPE_TYPE_BYTE | PIPE_READMODE_BYTE,
                1,                                  
                4096,                   
                4096,                               
                1000,
                &SecurityAttributes);           

        }

Unfortunately, it doesn't work. GetLastError() returns this Access is denied as usual.

Gaptoothed

Does it not work for any tab? Could you check with tab in non-protected mode? – Weathers

Yes it works fine when EPM is off. (In works OK in protected mode, what's not working in Enhanced Protected Mode). – Gaptoothed

It seems it is possible to use pipes within appContainer. But could you try S:(ML;;NW;;;RC)D:(A;;0x120083;;;WD)(A;;0x120083;;;AC)? – Weathers

ConvertStringSecurityDescriptorToSecurityDescriptorWW fails with that message: "The parameter is incorrect." (via GetLastError). – Gaptoothed

No more ideas now, sorry. Please answer your question if you find the workaround, it would be useful for IE11 BHO development – Weathers

If I'm not mistaken the security descriptor specify rights for people wanting to access the pipe, it has nothing to do with the pipe creation itself. Passing a NULL pointer for the securityAttributes parameter of the CreateNamedPipe function give the pipe the default security descriptor, cf this. So I guess if even this doesn't work, maybe you just cannot create pipes from an AppContainer.. – Gaptoothed

I guess access denied error means that container does not have privileges to create pipe, it does not mean real permissions issue – Weathers

Answer 1

You cannot create Named Pipe in BHO. But you can create it in your broker process and connect to the pipe from BHO. I'm author of the pointed comment and I tested the code in the broker part of my IE addon.

The code snippets. Pipe creating in auto-started exe (Delphi)

function CreateAppContainerSecurityDescriptor(var SD: PSECURITY_DESCRIPTOR): boolean;
const
  SDDL_REVISION_1 = 1;
var
  pSD: PSECURITY_DESCRIPTOR;
  ConvertStringSecurityDescriptorToSecurityDescriptor: TConvertStringSecurityDescriptorToSecurityDescriptorW;
begin
  @ConvertStringSecurityDescriptorToSecurityDescriptor := GetProcAddress(AdvapiDll(),
    'ConvertStringSecurityDescriptorToSecurityDescriptorW');
  result := false;
  if ConvertStringSecurityDescriptorToSecurityDescriptor('S:(ML;;NW;;;LW)D:(A;;0x120083;;;WD)(A;;0x120083;;;AC)',
    SDDL_REVISION_1, pSD, nil) then begin
    SD := pSD;
    result := true;
  end;
end;

function TPipeServer.Start: boolean;
var
  SD: PSECURITY_DESCRIPTOR;
  SecurityAttributes: SECURITY_ATTRIBUTES;
begin
  result := false;
  if Win32MajorVersion >= 6 then begin
    if CreateAppContainerSecurityDescriptor(SD) then begin
      SecurityAttributes.nLength := sizeof(SECURITY_ATTRIBUTES);
      SecurityAttributes.bInheritHandle := true;
      SecurityAttributes.lpSecurityDescriptor := SD;

      PipeHandle := CreateNamedPipe('\\.\pipe\MyPipe', PIPE_ACCESS_DUPLEX,
        PIPE_TYPE_BYTE or PIPE_READMODE_BYTE, 1, 0, 0, 1000, @SecurityAttributes);
      result := PipeHandle <> INVALID_HANDLE_VALUE;
    end;
  end;
end;

procedure TPipeServer.Execute;
begin
  if Start() then begin
    while true do begin
      if ConnectNamedPipe(PipeHandle, nil) then begin
        ...
      end;
    end;
  end;
end;

Connecting to pipe in IE toolbar (C++)

#define PIPE_NAME "\\\\.\\pipe\\MYPipe"

LRESULT CMFToolbar::OnCommand(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandled)
{
...
    HANDLE PipeHandle;
    if (WaitNamedPipe(PIPE_NAME, NMPWAIT_WAIT_FOREVER) != 0) {
        PipeHandle = CreateFile(PIPE_NAME, FILE_READ_DATA | FILE_WRITE_DATA,
            0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
        if (PipeHandle != INVALID_HANDLE_VALUE) {
            WriteFile(PipeHandle, ...
            CloseHandle(PipeHandle);
        }

}

Description

Thanks for replying, but I wasn't able to use your code, I still get an access denied when trying to connect to the pipe from the BHO. But the code in the russian article works ok ! – Gaptoothed

what do you mean the code from the article works? Do you have issue to create the pipe? OR to connect to the pipe form the other BHO instance? – Weathers

Could you link please the russian article? – Metronome

Answer 2

you can add the ALL_APPLICATION_PACKAGE permission to the handle, but it's a backdoor solution,the broker solution is long term.

DWORD WindowsSecurity::AddDACLToObject(HANDLE hObj,SE_OBJECT_TYPE seObjectType) {
LPWSTR szAddSid = SID_ALL_APP_PACKAGES;

PACL pACL = NULL;
DWORD dwRes;
PSID pSIDAllAppPackage = NULL;

PSECURITY_DESCRIPTOR pSDOld = NULL;
PACL pOldDACL = NULL;
dwRes = GetSecurityInfo(hObj, seObjectType, 
    DACL_SECURITY_INFORMATION,
    NULL, NULL, &pOldDACL, NULL, &pSDOld);
if (ERROR_SUCCESS != dwRes) {
    return dwRes;
} 

if(ConvertStringSidToSid(szAddSid,&pSIDAllAppPackage) == FALSE) {
    dwRes = GetLastError();
    return dwRes;
}

const int NUM_ACES  = 1;
EXPLICIT_ACCESS ea[NUM_ACES];
ZeroMemory(&ea, NUM_ACES * sizeof(EXPLICIT_ACCESS));

ea[0].grfAccessPermissions = GENERIC_ALL;
ea[0].grfAccessMode = SET_ACCESS;
ea[0].grfInheritance = NO_INHERITANCE;
ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
ea[0].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
ea[0].Trustee.ptstrName = (LPTSTR)pSIDAllAppPackage;

dwRes = SetEntriesInAcl(NUM_ACES, ea, pOldDACL, &pACL);
if (ERROR_SUCCESS != dwRes) {
    return dwRes;
}

dwRes = SetSecurityInfo(
    hObj,                 // name of the object
    seObjectType,              // type of object
    DACL_SECURITY_INFORMATION,   // change only the object's DACL
    NULL, NULL,                  // do not change owner or group
    pACL,                        // DACL specified
    NULL);                       // do not change SACL
return dwRes;

}

Farrel

Answer 3

I found this question very useful and wanted to add in my 2 cents based on my recent experience with retrofitting an EPM-compatible BHO in a complex product. Dropping some info here that will hopefully help the community. My original question was posted here, so some of it is a repeat of my comments there - Accessing named pipe servers from within IE EPM BHO

I needed some way to achieve 2-way communication -

1. From BHO to a Windows Service that held some relevant data : The security descriptor above will not work because cross-session IPC doesn't seem to work. I tried setting the named pipes to allow EVERYONE too.

   • Solved it by adding a broker to relay the communication.

2. From external to BHO : This was to provide the BHO some data to perform actions - DOM manipulation etc. Standard IPC options - named pipes, Windows RPC etc. won't work because the BHO cannot host the named pipe servers for external access, looks like.

   • Solved it by creating a HWND_MESSAGE window in the SetSite function and calling to it from the Broker process using SendMessage. Message type used needs to be WM_COPYDATA since this is cross-process.

Espinal