Question

I’m creating a global semaphore object in a process like this:

CreateSemaphore(NULL, 1, 1, "Global\\bitmap");

now, when I’m trying to open it in a child process (it’s a special case of “another process”, it’s not going to be a child that opens the semaphore created) like this:

bitmapSem = OpenSemaphore(NULL, TRUE, "Global\\bitmap");

the bitmapSem variable equals NULL and I’m getting error 5 (ERROR_ACCESS_DENIED) from GetLastError().

Any ideas?

Answer 1

I must add a clarification to other answers, and a security warning.

First, passing NULL as the lpSemaphoreAttributes argument to ::CreateSemaphore() does not mean no access to anybody; rather, it means that default access control will be assigned. MSDN is crystal clear on that: If this parameter is NULL, the semaphore gets a default security descriptor. The ACLs in the default security descriptor for a semaphore come from the primary or impersonation token of the creator.

Normally, the semaphore can be opened and used by the same user identity. So, if the semaphore is shared by processes running in the same interactive session, or under the same service identity, it may be opened by another process even if created with the default security descriptor. As @hmjd already noted, you must always explicitly call out the right that you want to assert on the semaphore: SYNCHRONIZE|SEMAPHORE_MODIFY_STATE allows both waiting on and releasing it.

Second of all, a word of caution. By granting Everyone full access to the semaphore, as it was suggested above, a security hole for a DoS attack is potentially created. You should consider whether you want arbitrary processes to be able to grab and release the semaphore. Is it intended for unrestricted public use? It is always a good practice to assign minimal, narrowly permitting ACLs to objects. Using SDDL is probably the easiest way to encode a security descriptor, albeit the script itself is not very readable.