I have a filter driver that blocks access to a specified group of files,
except when I copy them using ‘copy/past’ or ‘drag n drop’.
In the OnCreate function I can see the call in my filter and (if the file
matches an entry in my list) I block with ‘STATUS_ACCESS_DENIED’ and
complete the IRP. This works on all applications except for ‘copy/past’ or
‘drag n drop’.
Is the OS bypassing the filter stack ?
Or any ides on what else could cause this ?
Thanks,
David
I can tell about drag n drop, It is actually a rename
in file system so no create is called for that
file/folder…so u need to monitor rename also in ur
filter
— David Cox wrote:
> I have a filter driver that blocks access to a
> specified group of files,
> except when I copy them using ‘copy/past’ or ‘drag n
> drop’.
>
> In the OnCreate function I can see the call in my
> filter and (if the file
> matches an entry in my list) I block with
> ‘STATUS_ACCESS_DENIED’ and
> complete the IRP. This works on all applications
> except for ‘copy/past’ or
> ‘drag n drop’.
>
> Is the OS bypassing the filter stack ?
>
> Or any ides on what else could cause this ?
>
> Thanks,
>
> David
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Thanks for the info I hadn’t looked at that, but after reviewing it…
A move (cut n paste) goes through the rename process and I am accounting for
that, but a copy doesn’t appear to go through the rename process. The ‘drag
n drop’ I used is a right mouse button ‘drag n drop’ or (copy n paste).
“rahul naik” wrote in message news:xxxxx@ntfsd…
>I can tell about drag n drop, It is actually a rename
> in file system so no create is called for that
> file/folder…so u need to monitor rename also in ur
> filter
>
> — David Cox wrote:
>
>> I have a filter driver that blocks access to a
>> specified group of files,
>> except when I copy them using ‘copy/past’ or ‘drag n
>> drop’.
>>
>> In the OnCreate function I can see the call in my
>> filter and (if the file
>> matches an entry in my list) I block with
>> ‘STATUS_ACCESS_DENIED’ and
>> complete the IRP. This works on all applications
>> except for ‘copy/past’ or
>> ‘drag n drop’.
>>
>> Is the OS bypassing the filter stack ?
>>
>> Or any ides on what else could cause this ?
>>
>> Thanks,
>>
>> David
>>
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as:
>> xxxxx@yahoo.com
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>
In copy n Paste i think u might be missing the
filename in create as it will not be always full path
in fileobject as precreate has…Because when copy
paste happens the file is always opened before reading
it
u will have to look wht filename u get in ur filter
when it’s a copy n paste operation
— David Cox wrote:
> Thanks for the info I hadn’t looked at that, but
> after reviewing it…
>
> A move (cut n paste) goes through the rename process
> and I am accounting for
> that, but a copy doesn’t appear to go through the
> rename process. The ‘drag
> n drop’ I used is a right mouse button ‘drag n drop’
> or (copy n paste).
>
> “rahul naik” wrote in
> message news:xxxxx@ntfsd…
> >I can tell about drag n drop, It is actually a
> rename
> > in file system so no create is called for that
> > file/folder…so u need to monitor rename also in
> ur
> > filter
> >
> > — David Cox wrote:
> >
> >> I have a filter driver that blocks access to a
> >> specified group of files,
> >> except when I copy them using ‘copy/past’ or
> ‘drag n
> >> drop’.
> >>
> >> In the OnCreate function I can see the call in my
> >> filter and (if the file
> >> matches an entry in my list) I block with
> >> ‘STATUS_ACCESS_DENIED’ and
> >> complete the IRP. This works on all applications
> >> except for ‘copy/past’ or
> >> ‘drag n drop’.
> >>
> >> Is the OS bypassing the filter stack ?
> >>
> >> Or any ides on what else could cause this ?
> >>
> >> Thanks,
> >>
> >> David
> >>
> >>
> >>
> >>
> >> —
> >> Questions? First check the IFS FAQ at
> >> https://www.osronline.com/article.cfm?id=17
> >>
> >> You are currently subscribed to ntfsd as:
> >> xxxxx@yahoo.com
> >> To unsubscribe send a blank email to
> >> xxxxx@lists.osr.com
> >>
> >
> >
> >
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam
> protection around
> > http://mail.yahoo.com
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
I suggest you use filemon from www.sysinternals.com, that will tell you
all the file activity going on. Then you can see what you are missing.
Possibly FastI/O?
-Jeff
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of rahul naik
Sent: Friday, July 07, 2006 2:39 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Blocking File Access
In copy n Paste i think u might be missing the
filename in create as it will not be always full path
in fileobject as precreate has…Because when copy
paste happens the file is always opened before reading
it
u will have to look wht filename u get in ur filter
when it’s a copy n paste operation
— David Cox wrote:
> Thanks for the info I hadn’t looked at that, but
> after reviewing it…
>
> A move (cut n paste) goes through the rename process
> and I am accounting for
> that, but a copy doesn’t appear to go through the
> rename process. The ‘drag
> n drop’ I used is a right mouse button ‘drag n drop’
> or (copy n paste).
>
> “rahul naik” wrote in
> message news:xxxxx@ntfsd…
> >I can tell about drag n drop, It is actually a
> rename
> > in file system so no create is called for that
> > file/folder…so u need to monitor rename also in
> ur
> > filter
> >
> > — David Cox wrote:
> >
> >> I have a filter driver that blocks access to a
> >> specified group of files,
> >> except when I copy them using ‘copy/past’ or
> ‘drag n
> >> drop’.
> >>
> >> In the OnCreate function I can see the call in my
> >> filter and (if the file
> >> matches an entry in my list) I block with
> >> ‘STATUS_ACCESS_DENIED’ and
> >> complete the IRP. This works on all applications
> >> except for ‘copy/past’ or
> >> ‘drag n drop’.
> >>
> >> Is the OS bypassing the filter stack ?
> >>
> >> Or any ides on what else could cause this ?
> >>
> >> Thanks,
> >>
> >> David
> >>
> >>
> >>
> >>
> >> —
> >> Questions? First check the IFS FAQ at
> >> https://www.osronline.com/article.cfm?id=17
> >>
> >> You are currently subscribed to ntfsd as:
> >> xxxxx@yahoo.com
> >> To unsubscribe send a blank email to
> >> xxxxx@lists.osr.com
> >>
> >
> >
> >
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam
> protection around
> > http://mail.yahoo.com
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@emc.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks, I am looking at it now and I see a few things that I need to check
out.
David
wrote in message news:xxxxx@ntfsd…
I suggest you use filemon from www.sysinternals.com, that will tell you
all the file activity going on. Then you can see what you are missing.
Possibly FastI/O?
-Jeff
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of rahul naik
Sent: Friday, July 07, 2006 2:39 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Blocking File Access
In copy n Paste i think u might be missing the
filename in create as it will not be always full path
in fileobject as precreate has…Because when copy
paste happens the file is always opened before reading
it
u will have to look wht filename u get in ur filter
when it’s a copy n paste operation
— David Cox wrote:
> Thanks for the info I hadn’t looked at that, but
> after reviewing it…
>
> A move (cut n paste) goes through the rename process
> and I am accounting for
> that, but a copy doesn’t appear to go through the
> rename process. The ‘drag
> n drop’ I used is a right mouse button ‘drag n drop’
> or (copy n paste).
>
> “rahul naik” wrote in
> message news:xxxxx@ntfsd…
> >I can tell about drag n drop, It is actually a
> rename
> > in file system so no create is called for that
> > file/folder…so u need to monitor rename also in
> ur
> > filter
> >
> > — David Cox wrote:
> >
> >> I have a filter driver that blocks access to a
> >> specified group of files,
> >> except when I copy them using ‘copy/past’ or
> ‘drag n
> >> drop’.
> >>
> >> In the OnCreate function I can see the call in my
> >> filter and (if the file
> >> matches an entry in my list) I block with
> >> ‘STATUS_ACCESS_DENIED’ and
> >> complete the IRP. This works on all applications
> >> except for ‘copy/past’ or
> >> ‘drag n drop’.
> >>
> >> Is the OS bypassing the filter stack ?
> >>
> >> Or any ides on what else could cause this ?
> >>
> >> Thanks,
> >>
> >> David
> >>
> >>
> >>
> >>
> >> —
> >> Questions? First check the IFS FAQ at
> >> https://www.osronline.com/article.cfm?id=17
> >>
> >> You are currently subscribed to ntfsd as:
> >> xxxxx@yahoo.com
> >> To unsubscribe send a blank email to
> >> xxxxx@lists.osr.com
> >>
> >
> >
> >
> > Do You Yahoo!?
> > Tired of spam? Yahoo! Mail has the best spam
> protection around
> > http://mail.yahoo.com
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@emc.com
To unsubscribe send a blank email to xxxxx@lists.osr.com