connect to minifilter by FilterConnectCommunicationPort in user mode fail.

NTFSD
1

first i install minifilter by admin account, and connect with it is fine,
but then i used a user account to connect the minifilter,it appears fail,and i right click the connection file and choose “run it by admin”,it fail too.
i did this in WIN7 32bit.

any advice in advance is appreciated.

2

how do you set security descriptor for communication port?

call FltBuildDefaultSecurityDescriptor( &sd, FLT_PORT_ALL_ACCESS ) for
system/admin access
and set null dacl for non-admin access: RtlSetDaclSecurityDescriptor( &sd,
TRUE, NULL, FALSE )

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of galaxy.chen@qq.com
Sent: Wednesday, September 14, 2011 9:36 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] connect to minifilter by FilterConnectCommunicationPort in
user mode fail.

first i install minifilter by admin account, and connect with it is fine,
but then i used a user account to connect the minifilter,it appears
fail,and i right click the connection file and choose “run it by admin”,it
fail too.
i did this in WIN7 32bit.

any advice in advance is appreciated.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

thx kurtin,i changed it as you said,but it didn’t work…

4

FltBuildDefaultSecurityDescriptor causes the system to allocate a default security descriptor from paged pool. When this security descriptor is applied to an object, only users with system or administrator privileges have access to the object.

but a user without system or admin privilege how to access the object?

5

You probably don’t want that. But in general passing a NULL pointer to a
function that takes a security descriptor creates an object that has full
access for everyone. In particular, I think that if you leave the
SecurityDescriptor member of the OBJECT_ATTRIBUTES structures NULL you’ll
get a port that everyone can connect to.

Please look at the samples in the WDK, both the scanner and minispy samples
use communication ports.

Thanks,
Alex.

6

Kurtin is right,i made a mistake .lol…