Blocking IRP_MJ_WRITE in minifilter

NTFSD
1

Hi,
I have a mini filter that where I want to block writing to a file when it reaches a certain size. Now the mini filter does not know anything about at which size it should block, this is provided by the user application.
Of course I am blocking a create when I can but in some cases I need to block a write after a file has been opened for write.

What is the best way to do this? Is it as simple as in Pre-op of IRP_MJ_WRITE? What do I need to think of? Is the handling for Fast-IO the same as for a regular write?

Thanks for your help.

2

> What is the best way to do this? Is it as simple as in Pre-op of

IRP_MJ_WRITE?

Architecturally, yes.

Is the handling for Fast-IO the same as for a regular write?
yes.

What do I need to think of?

The greatest majority of applications will blindly assume that write
succeeds and do not code around it. So you are liable to fall foul of many
applications which will not fail as you suspect.

In general, if and it sounds as though your requirements allow it, you would
be better to deny those operations which set the size of the file;
IRP_MJ_SET_FILE_INFORMATION for FileEndOfFileInformation and
FileAllocationInformation are the obvious candidates, but you also have to
worry about extending writes and you might also want to think about what
happens when a sparse file gets populated…

3

快捷回复给：emir, Windows File Systems Devs Interest List
At 2010-11-30 01:20:15，xxxxx@northern.net wrote:

Hi,
I have a mini filter that where I want to block writing to a file when it reaches a certain size. Now the mini filter does not know anything about at which size it should block, this is provided by the user application.
Of course I am blocking a create when I can but in some cases I need to block a write after a file has been opened for write.

What is the best way to do this? Is it as simple as in Pre-op of IRP_MJ_WRITE? What do I need to think of? Is the handling for Fast-IO the same as for a regular write?

Thanks for your help.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Thank you Rod. SetFileInformation sounds like a good idea but I will probably need to stop the writes anyway.