System Error 0x5: CreateFileMapping()

Question

I wish to implement IPC using Named Shared Memory.

To do this, one of the steps is getting a handle to a Mapping Memory Object, using CreateFileMapping().

I do it exactly as MSDN website reccommends: http://msdn.microsoft.com/en-us/library/aa366551(v=VS.85).aspx:

hFileMappingHandle = CreateFileMapping
    (
        INVALID_HANDLE_VALUE,      // use paging file
        NULL,                      // default security 
        PAGE_READWRITE,            // read/write access
        0,            // maximum object size (high-order DWORD) 
        256,            // maximum object size (low-order DWORD)  
        "Global\\MyFileMappingObject"          // name of mapping object
    ); 
DWORD dwError = GetLastError();

However, the handle returned is always 0x0, and the System Error Code returned is: 0x5 (Access Denied.)

• Only Named Memory Sharing desired (not file sharing).
• Windows 7 x64 bit OS
• Administrator's user rights available
• Developed Application: 64bit Plug-In application (.dll)

Does anybody have the same experience, and a way to fix it, please? I use MSDN site as my reference, so I to not think, there is problem in the code.

Answer 1

To create global file mappings you need the SeCreateGlobalPrivilege privilege - do you have that? Access-denied implies this is a permissions problem, for sure.

Answer 2

Looks like you don't have enough privileges.

From MSDN:

Creating a file mapping object in the global namespace from a session other than session zero requires the SeCreateGlobalPrivilege privilege. For more information, see Kernel Object Namespaces.

...

The creation of a file-mapping object in the global namespace, by using CreateFileMapping, from a session other than session zero is a privileged operation. Because of this, an application running in an arbitrary Remote Desktop Session Host (RD Session Host) server session must have SeCreateGlobalPrivilege enabled in order to create a file-mapping object in the global namespace successfully. The privilege check is limited to the creation of file-mapping objects, and does not apply to opening existing ones. For example, if a service or the system creates a file-mapping object, any process running in any session can access that file-mapping object provided that the user has the necessary access.

Answer 3

The reference to terminal services in the documentation about global namespace is a bit misleading as it implies you only need to worry about this if you have an unusual situation.

In fact both IIS and system services run in session zero, and the first / only user to log on runs in session 1 - so you have to use Global namespace to communicate between IIS or a service and a normal program.

Answer 4

Administrators, Services and Network Services have SeCreateGlobalPrivilege by default. You must remember though, that Windows7/Vista does not run everything as admin. So use "Start as administrator" to make "Global\" work for your application. If you're debugging, start Visual Studio as admin also.