Cancel an IRP_MJ_CREATE operation

NTFSD
1

I have a minidriver which has registered for a pre-operation callback on IRP_MJ_CREATE.
Within the callback, if i find that create is being invoked on certain files, then i want to cancel the create operation.
To cancel the create operation the steps followed by me are as follows:-
set the IoStatus field in Data to STATUS_ACCESS_DENIED and return with FLT_PREOP_COMPLETE.

This seems to work fine, as in the file/program does not get opened, but an alert message stating"Access to the specified device,path or file is not found"

Is this message being thrown because, i have not cancelled the Create IRP in a proper manner??? Is there a way that i can suppress this using my driver.

2

You are probably doing everything correctly, it is just the application
responding to your failure of the open.

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-258763-
xxxxx@lists.osr.com] On Behalf Of xxxxx@patni.com
Sent: Thursday, August 10, 2006 12:29 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Cancel an IRP_MJ_CREATE operation

I have a minidriver which has registered for a pre-operation callback on
IRP_MJ_CREATE.
Within the callback, if i find that create is being invoked on certain
files, then i want to cancel the create operation.
To cancel the create operation the steps followed by me are as follows:-
set the IoStatus field in Data to STATUS_ACCESS_DENIED and return with
FLT_PREOP_COMPLETE.

This seems to work fine, as in the file/program does not get opened, but
an alert message stating"Access to the specified device,path or file is
not found"

Is this message being thrown because, i have not cancelled the Create IRP
in a proper manner??? Is there a way that i can suppress this using my
driver.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Could be but i tried stopping access to a an appln built by us and any txt file etc…in all the cases, i end up getting the access is denied message…
its probably related to the fact that i am setting the status field to status_access_denied. Is that the rite status code to set.
Can i make use of any other status message which wud prevent such messages from appearing.