[confignet] Allow setting security descriptors for npipes

Author: swiatekm

.chloggen/confignet-npipe-security-descriptor.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/otlp)
+component: pkg/config/confignet
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add `dialer.security_descriptor` to set an SDDL security descriptor on Windows named pipe (npipe) listeners
+
+# One or more tracking issues or pull requests related to the change
+issues: [15211]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user, api]

config/confignet/README.md

@@ -16,6 +16,14 @@ leverage network configuration to set connection and transport information.
   "npipe" (Windows named pipes, Windows-only).
 - `dialer`: Dialer configuration
   - `timeout`: Dialer timeout is the maximum amount of time a dial will wait for a connect to complete. The default is no timeout.
+  - `security_descriptor`: A [Security Descriptor Definition Language (SDDL)](https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language)
+    string applied when creating a Windows named pipe listener. Ignored for any
+    transport other than `npipe` and for client-side dials. When empty, Windows
+    applies its [default named pipe DACL](https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights),
+    which is roughly equivalent to
+    `D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)` — full
+    control for `LocalSystem` (`SY`) and `Administrators` (`BA`), and read plus
+    limited write for `Everyone` (`WD`) and `Anonymous Logon` (`AN`).
 
 Note that for TCP receivers only the `endpoint` configuration setting is
 required.

config/confignet/config.schema.yaml

@@ -16,6 +16,9 @@ $defs:
     description: DialerConfig contains options for connecting to an address.
     type: object
     properties:
+      security_descriptor:
+        description: SecurityDescriptor is a Security Descriptor Definition Language (SDDL) string used when creating a Windows named pipe listener. It is ignored for any transport other than "npipe" and for client-side dials. When empty, Windows applies its default named pipe DACL, which is roughly equivalent to "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)" — full control for LocalSystem (SY) and Administrators (BA), and read plus limited write for Everyone (WD) and Anonymous Logon (AN). See https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights and https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
+        type: string
       timeout:
         description: Timeout is the maximum amount of time a dial will wait for a connect to complete. The default is no timeout.
         type: string

config/confignet/confignet.go

@@ -63,6 +63,17 @@ type DialerConfig struct {
 	// Timeout is the maximum amount of time a dial will wait for
 	// a connect to complete. The default is no timeout.
 	Timeout time.Duration `mapstructure:"timeout,omitempty"`
+	// SecurityDescriptor is a Security Descriptor Definition Language (SDDL)
+	// string used when creating a Windows named pipe listener. It is ignored
+	// for any transport other than "npipe" and for client-side dials. When
+	// empty, Windows applies its default named pipe DACL, which is roughly
+	// equivalent to "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)"
+	// — full control for LocalSystem (SY) and Administrators (BA), and
+	// read plus limited write for Everyone (WD) and Anonymous Logon (AN).
+	// See:
+	//   - https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights
+	//   - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
+	SecurityDescriptor string `mapstructure:"security_descriptor,omitempty"`
 	// prevent unkeyed literal initialization
 	_ struct{}
 }
@@ -111,7 +122,7 @@ func (na *AddrConfig) Dial(ctx context.Context) (net.Conn, error) {
 // Listen equivalent with net.ListenConfig's Listen for this address.
 func (na *AddrConfig) Listen(ctx context.Context) (net.Listener, error) {
 	if na.Transport == TransportTypeNpipe {
-		return listenNpipe(na.Endpoint)
+		return listenNpipe(na.Endpoint, na.DialerConfig.SecurityDescriptor)
 	}
 	lc := net.ListenConfig{}
 	return lc.Listen(ctx, string(na.Transport), na.Endpoint)

config/confignet/npipe_others.go

@@ -18,6 +18,6 @@ func dialNpipe(_ context.Context, _ string, _ time.Duration) (net.Conn, error) {
 	return nil, errNpipeUnsupported
 }
 
-func listenNpipe(_ string) (net.Listener, error) {
+func listenNpipe(_, _ string) (net.Listener, error) {
 	return nil, errNpipeUnsupported
 }

config/confignet/npipe_windows.go

@@ -22,6 +22,10 @@ func dialNpipe(ctx context.Context, endpoint string, timeout time.Duration) (net
 	return winio.DialPipeContext(ctx, endpoint)
 }
 
-func listenNpipe(endpoint string) (net.Listener, error) {
-	return winio.ListenPipe(endpoint, nil)
+func listenNpipe(endpoint, securityDescriptor string) (net.Listener, error) {
+	var cfg *winio.PipeConfig
+	if securityDescriptor != "" {
+		cfg = &winio.PipeConfig{SecurityDescriptor: securityDescriptor}
+	}
+	return winio.ListenPipe(endpoint, cfg)
 }

config/confignet/npipe_windows_test.go

@@ -52,3 +52,33 @@ func TestNpipeListenAndDial(t *testing.T) {
 	assert.NoError(t, conn.Close())
 	<-done
 }
+
+func TestNpipeListenSecurityDescriptor(t *testing.T) {
+	tests := []struct {
+		name               string
+		securityDescriptor string
+		wantErr            bool
+	}{
+		{name: "default", securityDescriptor: "", wantErr: false},
+		{name: "owner local system, allow everyone read/write", securityDescriptor: "O:SYG:SYD:(A;;GRGW;;;WD)", wantErr: false},
+		{name: "invalid SDDL", securityDescriptor: "not-a-valid-sddl", wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			nas := &AddrConfig{
+				Endpoint:  `\\.\pipe\otel-test-confignet-sd`,
+				Transport: TransportTypeNpipe,
+				DialerConfig: DialerConfig{
+					SecurityDescriptor: tt.securityDescriptor,
+				},
+			}
+			ln, err := nas.Listen(t.Context())
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.NoError(t, ln.Close())
+		})
+	}
+}