IRP_MJ_CREATE with write access?

NTFSD
2

Hai,

In a minifilter, what is the way to find the file was opened with write access in IRP_MJ_CREATE?

Regards,
Solomon.A

Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE!
http://in.mail.yahoo.com

3

ULONG DesiredAccess =
Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;

if( !FlagOn( DesiredAccess, DELETE | FILE_WRITE_DATA | FILE_APPEND_DATA ) )
{
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

HTH,
Ken

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Solomon Anand
Sent: Tuesday, July 12, 2005 9:21 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IRP_MJ_CREATE with write access?

Hai,

In a minifilter, what is the way to find the file was opened with write
access in IRP_MJ_CREATE?

Regards,
Solomon.A

Too much spam in your inbox? Yahoo! Mail gives you the best spam protection
for FREE!
http://in.mail.yahoo.com — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to
xxxxx@lists.osr.com

4

Probably more details than you asked for…

If you want to know if ANY type of file modification (not just data write),
you need to check in pre-CREATE:

writeOperation = ((desiredAccess & (FILE_WRITE_DATA | //
0x0002
FILE_WRITE_ATTRIBUTES |
// 0x0100
FILE_WRITE_EA |
// 0x0010
FILE_APPEND_DATA |
// 0x0004
DELETE |
// 0x00010000
WRITE_DAC |
// 0x00040000
WRITE_OWNER)) ||
// 0x00080000
(createDisposition != FILE_OPEN) ||
// Modes 0 & 2-5
(createOptions & FILE_DELETE_ON_CLOSE));
// 0x00001000

Then, in post-CREATE, you need to check for the special case of FILE_OPEN_IF
with no write access requested which potentially can create a new file:

if ((createDisposition == FILE_OPEN_IF) &&
((desiredAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
FILE_WRITE_EA |
FILE_APPEND_DATA | DELETE | WRITE_DAC |
WRITE_OWNER)) == 0) &&
(Irp->IoStatus.Information != FILE_CREATED))
{
// Just a plain open of an existing file with no write access
requested
}

HTH2, /ted

-----Original Message-----
From: Ken Cross [mailto:xxxxx@comcast.net]
Sent: Tuesday, July 12, 2005 2:42 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] IRP_MJ_CREATE with write access?

ULONG DesiredAccess =
Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;

if( !FlagOn( DesiredAccess, DELETE | FILE_WRITE_DATA | FILE_APPEND_DATA ) )
{
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

HTH,
Ken

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Solomon Anand
Sent: Tuesday, July 12, 2005 9:21 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IRP_MJ_CREATE with write access?

Hai,

In a minifilter, what is the way to find the file was opened with write
access in IRP_MJ_CREATE?

Regards,
Solomon.A

Too much spam in your inbox? Yahoo! Mail gives you the best spam protection
for FREE! http://in.mail.yahoo.com — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: xxxxx@comcast.net To unsubscribe send a blank email to
xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

5

IoGetCurrentIrpStackLocation(Irp)->Parameters.Create.DesiredAccess

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Solomon Anand
To: Windows File Systems Devs Interest List
Sent: Tuesday, July 12, 2005 5:20 PM
Subject: [ntfsd] IRP_MJ_CREATE with write access?

Hai,

In a minifilter, what is the way to find the file was opened with write access in IRP_MJ_CREATE?

Regards,
Solomon.A

Too much spam in your inbox? Yahoo! Mail gives you the best spam protection for FREE!
http://in.mail.yahoo.com — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To unsubscribe send a blank email to xxxxx@lists.osr.com