denying read request

NTFSD
1

Hi All,

I am developing a file system filter driver for Windows 2000/XP, I am trying
to return failiure in the READ request based on the file extension,
following is the code for that

if(MajorFuntion == IRP_MJ_READ)
{

if(fileobject is in the hashtable)
{
pIrp->IoStatus.Information = 0;
pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}

if(filename has specific extension)
{
pIrp->IoStatus.Information = 0;
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
requests on same file object>
return STATUS_UNSUCCESSFUL;
}
}

What I wanted to know is are the error codes that I am returning are
correct? and should I return IO_DISK_INCREMENT instead of IO_NO_INCREMENT in
IoCompleteRequest(…)? are there any issues in the code? because when I test
sometimes the system either crashes or sometimes the applications whose IRP
requests I am completing in filter driver are making full use of the CPU for
long time.

Any information is helpful.

Thanks in advance,
Kedar.

2

Bad idea. It is must better to prohibit CREATE with READ access based on
extension.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “kedar”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Tuesday, January 11, 2005 2:02 PM
Subject: [ntfsd] denying read request

> Hi All,
>
> I am developing a file system filter driver for Windows 2000/XP, I am trying
> to return failiure in the READ request based on the file extension,
> following is the code for that
>
> if(MajorFuntion == IRP_MJ_READ)
> {
>
> if(fileobject is in the hashtable)
> {
> pIrp->IoStatus.Information = 0;
> pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;
> IoCompleteRequest( pIrp, IO_NO_INCREMENT );
> return STATUS_SUCCESS;
> }
>
> if(filename has specific extension)
> {
> pIrp->IoStatus.Information = 0;
> pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
> IoCompleteRequest( pIrp, IO_NO_INCREMENT );
> > requests on same file object>
> return STATUS_UNSUCCESSFUL;
> }
> }
>
> What I wanted to know is are the error codes that I am returning are
> correct? and should I return IO_DISK_INCREMENT instead of IO_NO_INCREMENT in
> IoCompleteRequest(…)? are there any issues in the code? because when I test
> sometimes the system either crashes or sometimes the applications whose IRP
> requests I am completing in filter driver are making full use of the CPU for
> long time.
>
>
> Any information is helpful.
>
> Thanks in advance,
> Kedar.
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Max,

Yes, but I have some specific situation where I have to block read rather
than create is there any kind of work around to do it?

Thanks,
Kedar.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> Bad idea. It is must better to prohibit CREATE with READ access based
on
> extension.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “kedar”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Tuesday, January 11, 2005 2:02 PM
> Subject: [ntfsd] denying read request
>
>
> > Hi All,
> >
> > I am developing a file system filter driver for Windows 2000/XP, I am
trying
> > to return failiure in the READ request based on the file extension,
> > following is the code for that
> >
> > if(MajorFuntion == IRP_MJ_READ)
> > {
> >
> > if(fileobject is in the hashtable)
> > {
> > pIrp->IoStatus.Information = 0;
> > pIrp->IoStatus.Status = STATUS_UNSUCCESSFUL;
> > IoCompleteRequest( pIrp, IO_NO_INCREMENT );
> > return STATUS_SUCCESS;
> > }
> >
> > if(filename has specific extension)
> > {
> > pIrp->IoStatus.Information = 0;
> > pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
> > IoCompleteRequest( pIrp, IO_NO_INCREMENT );
> > > > requests on same file object>
> > return STATUS_UNSUCCESSFUL;
> > }
> > }
> >
> > What I wanted to know is are the error codes that I am returning are
> > correct? and should I return IO_DISK_INCREMENT instead of
IO_NO_INCREMENT in
> > IoCompleteRequest(…)? are there any issues in the code? because when I
test
> > sometimes the system either crashes or sometimes the applications whose
IRP
> > requests I am completing in filter driver are making full use of the CPU
for
> > long time.
> >
> >
> > Any information is helpful.
> >
> > Thanks in advance,
> > Kedar.
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

> Yes, but I have some specific situation where I have to block read rather

than create is there any kind of work around to do it?

Well, this might be done easily using
FileSpy as starting point. It implements
name lookup on every request.

L.