Control StorPort Adapter Device Object Access

NTDEV
1

I have a Virtual StorPort driver that handles custom IOCTL’s on it’s adapter device via HwProcessServiceRequest. I register a device interface on the adapter control device object. I would like to change the SDDL for the adapter to modify the device access. I have a few questions:

  1. Can I change the SDDL from within the driver? I don’t create the device object, so I can’t specify the SDDL at device creation time. Is there a StorPort way to do this or is that just not intended with StorPort?

  2. Can I change the device objects security descriptor on the existing adapter device object? If this is a viable route, I’m pretty weak an ACL’s, ACE’s and SID’s. I’d like some guidance on this. As a test, I put in a hack to clear the FILE_DEVICE_SECURE_OPEN flag from each device in the device stack and that didn’t help, but maybe StorPort’s create handler is blocking this still. I know this is not a viable solution anyway; it was just a test.

  3. I set the SDDL string in the INF file for my driver. It didn’t seem to change the device access until I disabled and re-enabled the device. Then it took effect. After initial install and after a reboot, I can’t access it again without disable/enable. I was not able to configure the INF to that it would add a Security key with a binay Security value under my service key or software key. I did get it to add a Security string value under my service and software keys. Am I doing something wrong with the INF?

  4. Would it just be easier to create a WDM control device object so I can specify my own SDDL using IoCreateDeviceSecure and handle ordinary IOCTL’s?

Thanks

2

Anyone have any ideas on this?

Thanks

3

What kind of access you want to enable?

4

Make your device NON boot start.

5

The device is demand start. I want to allow non-admin code access. This is an internal only test driver so I’m not worried about security.

6

Here are the sections in my INF that I added Security directives to:

; --------- Windows NT Install Section -----------------
[MyDriverInstall.NT]
CopyFiles = MyDriverDriverFiles
AddReg = MyDriverInstall.NT.AddReg

[MyDriverInstall.NT.AddReg]
HKR,Security,“D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)”

[MyDriverInstall.NT.AddReg.Security]
“D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)”

[MyDriverInstall.NT.Services]
Addservice = MyDriver, %SPSVCINST_ASSOCSERVICE%, MyDriverAddService, FusionAddEventLog

[MyDriverAddService]
DisplayName = %SvcDesc%
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_DEMAND_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
LoadOrderGroup = SCSI Miniport
ServiceBinary = %12%\MyDriver.sys
AddReg = bus_type_scsi, mydevice.reg

[mydevice.reg]
HKR,Security,“D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)”

[mydevice.reg.Security]
“D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)”

7

The .Security directives don’t seem to work, but the directives to add Security string values do.