Allow setting a security descriptor for Windows named pipes created by confignet

[swiatekm]

Component(s)

config/confignet

Is your feature request related to a problem? Please describe.

#14985 added the ability to use Windows named pipes as a transport in confignet. Unlike unix domain sockets, named pipes don't exist in the file system, and their ACLs are configured separately via security descriptors passed to the pipe creation syscall. This should be configurable in confignet to allow control over which users and processes can connect.

Describe the solution you'd like

Add a new security_descriptor attribute in the dialer section of the confignet config. This is a string that contains the security descriptor in SDDL format.

For example:

endpoint: '\\.\pipe\otel-test-confignet'
transport: npipe
dialer:
  security_descriptor: O:SYG:SYD:(A;;GRGW;;;WD)

Describe alternatives you've considered

It's not possible to configure this any other way, and the dialer section seems like the right place for it. I considered naming the field more verbosely, for example npipe_security_descriptor, but I'm not sure that's necessary. If we add more Windows-specific transports in the future, we can reuse the field.

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[swiatekm]

Feel free to assign me, I got this implemented in #15212.

[swiatekm]

CC @axw, since you were kind enough to review my original PR. 🙏