How to cancel pre-write operation without prompt?

Cal

I have tried the following method to cancel in pre-write, but dialog boxes prompt to save as a different file:

Data->IoStatus.Status = STATUS_CANCELLED;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;

However I don't want any dialog boxes to show, I changed above with:
Data->IoStatus.Status = STATUS_SUCCESS;

then the file become empty afterward, even though no prompt of dialog boxes.

How can I abort write to existing files without changing their content?

Any advice would be appreciated.

Dejan_Maksimovic

Save is not atomic. Each app has different ideas what a Save is.

Cal

So what is the best way of blocking write to a file?

Dejan_Maksimovic

"Writw to a file" can be done in several ways.
Best is to deny Open/Create/Overwrite (IRP MJ CREATE) if write access is
requested.

Dejan.

Cal

Thank you Dejan, but maybe I should provide more details to be clear about what I want to achieve.
Let's say a text file was opened with write access (https://community.osr.com/discussion/77714/irp-mj-create-with-write-access) by WordPad, users can view the content, but I want the file filter to conditionally block the changes made by the users when they are trying to save the file. I should still do that in Pre-Create rather than Pre-Write?

Dejan_Maksimovic

App should not request write until they need to save a file. So view is
still possible.

Yes, in PreCreate.

Cal

As the link (I posted earlier) described, we can find the file was opened with write access in IRP_MJ_CREATE, but how can we tell if the user is actually trying to save the file? Using Irp->IoStatus.Information?

And how should I abort write in Pre-Create, like below?
Data->IoStatus.Status = STATUS_CANCELLED;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;

Dejan_Maksimovic

You don't. If it asks for Write access, presume it does.

Cal

Following previous post, I can differentiate when user is trying to save the file by checking write access. However, the dialogs for "save as" still prompt after I return FLT_PREOP_COMPLETE with status = STATUS_CANCELLED or STATUS_ACCESS_DENIED in pre-create.
Should I do something in post-cteate or CLEANUP / CLOSE in order to get rid of the prompt?

Dejan_Maksimovic

No, just PreCreate.