windows.pipe.create now accept a custom security descriptor as parameter

samples/pipe/pipe_custom_acl.py

@@ -0,0 +1,26 @@
+import windows.test
+
+p = windows.test.pop_proc_32()
+print("Child is {0}".format(p))
+
+PIPE_NAME = "PFW_Pipe"
+
+lower_integrity = """
+import windows
+windows.current_process.token.integrity = 0x1000
+"""
+
+p.execute_python(lower_integrity)
+assert p.token.integrity == 0x1000
+
+send_object = """
+windows.pipe.send_object("{pipe}", {{"KIKOU": "LOL"}})
+""".format(pipe=PIPE_NAME)
+
+# S:(ML;;;;;LW) -> Allow connection from LOW integrity
+with windows.pipe.create(PIPE_NAME, security_descriptor="S:(ML;;;;;LW)") as np:
+    print("Created pipe is {0}".format(np))
+    p.execute_python(send_object)
+    print("Receiving object from injected process")
+    obj = np.recv()
+    print("obj = {0}".format(obj))

windows/pipe.py

@@ -3,6 +3,7 @@ from windows import winproxy
 import windows.generated_def as gdef
 
 import _multiprocessing
+import ctypes
 
 # Inspired from 'multiprocessing\connection.py'
 
@@ -29,19 +30,31 @@ class PipeConnection(object): # Cannot inherit: crash the interpreter
         return cls(connection, *args, **kwargs)
 
     @classmethod
-    def create(cls, addr):
+    def create(cls, addr, security_descriptor=None):
         """Create a namedpipe pipe ``addr``
 
         :returns type: :class:`PipeConnection`
         """
         addr = full_pipe_address(addr)
+
+        security_attributes = None
+        if security_descriptor is not None:
+            if isinstance(security_descriptor, str):
+                security_descriptor = windows.security.SecurityDescriptor.from_string(security_descriptor)
+            security_attributes = gdef.SECURITY_ATTRIBUTES()
+            security_attributes.nLength = ctypes.sizeof(security_attributes)
+            security_attributes.lpSecurityDescriptor = security_descriptor # Accept as arg ?
+            security_attributes.bInheritHandle = True # Accept as arg ?
+
+
         pipehandle = winproxy.CreateNamedPipeA(
             addr, gdef.PIPE_ACCESS_DUPLEX,
             gdef.PIPE_TYPE_MESSAGE | gdef.PIPE_READMODE_MESSAGE |
             gdef.PIPE_WAIT,
             gdef.PIPE_UNLIMITED_INSTANCES, cls.BUFFER_SIZE, cls.BUFFER_SIZE,
-            gdef.NMPWAIT_WAIT_FOREVER, None
+            gdef.NMPWAIT_WAIT_FOREVER, security_attributes
             )
+        import pdb;pdb.set_trace()
         return cls.from_handle(pipehandle, name=addr, server=True)
 
     @classmethod
@@ -67,6 +80,16 @@ class PipeConnection(object): # Cannot inherit: crash the interpreter
         """Wait for a client process to connect to the named pipe"""
         return winproxy.ConnectNamedPipe(self.handle, None)
 
+    def get_security_descriptor(self):
+        return windows.security.SecurityDescriptor.from_handle(self.handle)
+
+    def set_security_descriptor(self, sd):
+        if isinstance(sd, basestring):
+            sd = windows.security.SecurityDescriptor.from_string(sd)
+        sd._apply_to_handle_and_type(self.handle)
+
+    security_descriptor = property(get_security_descriptor, set_security_descriptor)
+
     def close(self):
         """Close the handle of the pipe"""
         self.connection.close()