Function duplicate_handle_with_access 

pub fn duplicate_handle_with_access(
    handle: impl AsHandle,
    access: Access,
) -> Result<OwnedHandle>

A second handle to the object handle refers to, in this process, carrying exactly access.

The result can do no more than access allows, which is the use: a handle with SYNCHRONIZE alone can wait on an object and change nothing about it. The object lives until every handle to it is closed, and closing the result does not touch the source.

Windows does not confine the result to the source’s access. A duplicate may ask for rights the source handle lacks and get them, so a holder of a narrow handle can make a wider one with this very function. The narrowing is therefore a guard against a handle being used for what it was not handed out for, not a boundary against code in the process that sets out to cross it – no such boundary exists inside a process, and raw DuplicateHandle crosses it just as well.

Not inheritable by child processes. An access of nothing is accepted and gives a handle that can do nothing.

Errors

The error from DuplicateHandle: access denied for a mask Windows refuses, such as one with every bit set, and otherwise only when the process cannot get another handle, which no test reaches.