Hello
Scenario:
- Create and don’t close file with DELETE access requested and full sharing - FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE.
- try to read this file with more utility (opens file with share FILE_SHARE_READ | FILE_SHARE_WRITE)
- more gets sharing violation error
I checked this on fastfat driver - sharing violation comes from IoCheckShareAccess.
If file created without requesting delete access more opens file successfully .
If I try to open file second time with FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE - open success.
Is this expected behavior ?
I thought that since I create file with full sharing anyone can open it in any sharing mode.
Actual code of file creation:
UNICODE_STRING file_path = RTL_CONSTANT_STRING(L"\SystemRoot\test_file_for_write");
OBJECT_ATTRIBUTES oba{};
InitializeObjectAttributes(&oba,
&file_path,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
nullptr);
IO_STATUS_BLOCK iosb{};
NTSTATUS stat = IoCreateFileEx(&file,
FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | DELETE | SYNCHRONIZE,
&oba,
&iosb,
nullptr,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_CREATE,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
nullptr,
0,
CreateFileTypeNone,
nullptr,
0,
nullptr);