Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
From:	"Dave Korn" <dave DOT korn AT artimi DOT com>
To:	<cygwin AT cygwin DOT com>
Subject:	RE: Couldn't create signal pipe - User permission problem? (IIS6/Win2003)
Date:	Wed, 9 Feb 2005 14:49:17 -0000
MIME-Version:	1.0
In-Reply-To:	<4208E252.3060604@besy.co.uk>
Message-ID:	<NUTMEGZV4CllPF6p0V7000007f7@NUTMEG.CAM.ARTIMI.COM>
X-OriginalArrivalTime:	09 Feb 2005 14:49:17.0660 (UTC) FILETIME=[87E389C0:01C50EB6]

> -----Original Message-----
> From: cygwin-owner On Behalf Of andy
> Sent: 08 February 2005 16:01

> Subject: Couldn't create signal pipe - User permission 
> problem? (IIS6/Win2003)

> When I try to execute the binary it exists with the error 
> message shown below:
> 
> 3 [main] ? 1148 cygheap_user::init: OpenProcessToken(), Win32 error 5
> D:\cgi-bin\cdrtools-2.01-win32-bin\mkisofs.exe (1148): *** couldn't
> create signal pipe, Win32 error 0
> 
> I have identified Win32 error 5 as an "access denied" error.

  Well, yes, but it was the OpenProcessToken call that failed with error 5.
It's probably a knock-on effect of that failure that stops the pipe from being
opened, but the actual failure is in cygheap init.  W2k3 does have some locked
down privs that cause problems for cygwin apps.

> I am not executing mkisofs.exe from a command prompt or shell, but
> rather as a CGI application from a PHP script running under the
> IIS6 web server.

> I found this thread:
> http://cygwin.com/ml/cygwin/2003-10/msg00447.html
> 
> I granted the user the application pool is running under 
> "create global 
> objects" permission as suggested. Additionally I have granted 
> the user 
> "adjust memory quotas for a process" and "replace a process at token 
> level" as Microsoft suggests is necessary for CGI applications. But 
> still the process exits with the same error message.

  :-O  Yeessh!  There are VERY VERY VERY good reasons why IWAM_USER should NEVER
UNDER ANY CIRCUMSTANCES BE ALLOWED TO ALTER IT'S OWN PRIVILEGE LEVEL!  Still,
it's probably OK if the server isn't externally accessible in any way.  Still,
it's your machine, it's your funeral.
 
> And so my question is, does anyone have any idea which 
> permission might 
> be missing and be causing this error to occur?

  Well if OpenProcessToken fails, that would suggest that "replace a process
level token" (it's the token that is being replaced, not the process, as you
wrote earlier) might be missing, so verify you set it correctly.

  Failing that, it may well be that IIS6 simply will not allow application pool
processes to get elevated privileges.  Not too sure.


    cheers, 
      DaveK
-- 
Can't think of a witty .sigline today....


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -