23927634349
82%

Ran 03 Apr 2026 12:05AM UTC

Jobs 1

Files 85

Run time 1min

Badge

Embed ▾

Committed 02 Apr 2026 03:42PM UTC coverage: 85.489%. Remained the same

Build # 23927634349

Build Type

push

github

Committed by

web-flow

Commit Message

fix(gateway): set named pipe ACL so non-elevated admins can connect (#621)

* fix(gateway): set named pipe ACL so non-elevated admins can connect

The gateway service runs as SYSTEM and creates the admin named pipe
with default security, which may not grant access to non-elevated
Administrator sessions.  Replace tokio's ServerOptions with direct
CreateNamedPipeW calls that set an explicit DACL via SDDL:

  D:(A;;GA;;;SY)(A;;GA;;;BA)

This grants Generic All to SYSTEM (SY) and BUILTIN\Administrators (BA).
Members of the local Administrators group can now use sonde-admin
without running an elevated prompt.

Fixes #605

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address review — PIPE_REJECT_REMOTE_CLIENTS, rename to security_descriptor

- Add PIPE_REJECT_REMOTE_CLIENTS to pipe mode so the admin pipe is
  local-only (not reachable over SMB)
- Rename create_pipe_security_attributes → create_pipe_security_descriptor
  and sa → sd for clarity
- Keep FromRawHandle import (needed by from_raw_handle call on OwnedHandle)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Coverage Stats

26912 of 31480 relevant lines covered (85.49%)

136.09 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	23927634349.1	03 Apr 2026 12:05AM UTC	85	85.49	GitHub Action Run

Alan-Jowett / sonde / 23927634349
82%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 23927634349

Alan-Jowett / sonde / 23927634349 82%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 23927634349

Alan-Jowett / sonde / 23927634349
82%

README BADGES
x