FILE OBJECT TYPES AND OWNERSHIP

Hi All,

I’m searching for the docs on *type* field on _FILE_OBJECT. Also
once we have a valid
FILEOBJECT created by I/O mgr, is it possible to know the owner ??

thanx
prokash

I *think* that the FILE_OBJECT ‘type’ field is simply part of the
signature of that structure along with the Size field(many DDK structures
start start off with a type and size field so, I suppose, the type of
structure can be determined when the pointer is ambiguous.
To get the owner of the file, you can create an IRP of type
IRP_MJ_QUERY_SECURITY with a SecurityInformation of
OWNER_SECURITY_INFORMATION and send it to the FSD. You can extract the
owner from the returned security descriptor.

Hi All,

I’m searching for the docs on *type* field on _FILE_OBJECT. Also
once we have a valid
FILEOBJECT created by I/O mgr, is it possible to know the owner ??

thanx
prokash


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

thanx so much.

Actually, I am in the file system driver. I thought that may be I would
be able to see the type of the
file object for which this IRP has come, and the owner of the
fileobject.

prokash

“Smith, Joel” wrote:

I *think* that the FILE_OBJECT ‘type’ field is simply part of
the signature of that structure along with the Size field(many DDK
structures start start off with a type and size field so, I suppose,
the type of structure can be determined when the pointer is ambiguous.

To get the owner of the file, you can create an IRP of type
IRP_MJ_QUERY_SECURITY with a SecurityInformation of
OWNER_SECURITY_INFORMATION and send it to the FSD. You can extract
the owner from the returned security descriptor.

Hi All,

I’m searching for the docs on *type* field on _FILE_OBJECT.
Also
once we have a valid
FILEOBJECT created by I/O mgr, is it possible to know the owner ??

thanx
prokash


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

If you call IoGetRequestorProcess(Irp), it will return the process object
that generated the request (EPROCESS).

Jame
StorageCraft

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Prokash Sinha
Sent: Wednesday, March 01, 2000 9:24 AM
To: File Systems Developers Interest List
Subject: [ntfsd] RE: FILE OBJECT TYPES AND OWNERSHIP

thanx so much.
Actually, I am in the file system driver. I thought that may be I would be
able to see the type of the
file object for which this IRP has come, and the owner of the fileobject.

prokash

“Smith, Joel” wrote:

I *think* that the FILE_OBJECT ‘type’ field is simply part of
the signature of that structure along with the Size field(many DDK
structures start start off with a type and size field so, I suppose, the
type of structure can be determined when the pointer is ambiguous.

To get the owner of the file, you can create an IRP of type
IRP_MJ_QUERY_SECURITY with a SecurityInformation of
OWNER_SECURITY_INFORMATION and send it to the FSD. You can extract the
owner from the returned security descriptor.

Hi All,

I’m searching for the docs on *type* field on _FILE_OBJECT. Also
once we have a valid
FILEOBJECT created by I/O mgr, is it possible to know the owner ??

thanx
prokash


You are currently subscribed to ntfsd as: xxxxx@ntpsoftware.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)