Hi all,
I sent it to ntdev list, but due to no responce, I am resending it to NTFSD list.
can anyone tell me if the FileHandle and/or File Object opened in the context of a User Process are still valid even after the process
in context of which they were opened, is terminated. I know that in Win32 space, if you leak a handle, it gets closed when the process terminates. Is it also valid for the handles/FileObjects opened in the User Process context, but in the kernel driver.
I am caching the FileHandles and FileObjects and I am worried that my model can fall apart if the cached FileHandle and FileObject
get removed from underneath of my driver.
Here is what I am actually trying to do:
I have to access the file located at a shared folder on network. Initially, the request comes in the User Context,
and therefore I do not have any problem accessing the remote location. But later, I may have to access that file
in the system context, and this creates a problem since I do not have proper privileges in the system context to access the
network file. I am following the approach described at the following URL to overcome this limitation:
http://www.pulsetrainsw.com/article1.htm
Basically, in the User Context, I open the file using ZwCreateFile, save the context using IoGetCurrentProcess,
and get the File Object using ObReferenceObjectByHandle. Later, if I am called in the same context, I just re-use already opened
FileHandle. If I am called in system context, I get the context FileHandle using the undocumented but widely used
ObOpenObjectByPointer API.
It is quite possible that I will receive a request in the System Context some time after the User Process terminates.
Thanks,
Ilya.
…
Ilya Levin
File System Developer
xxxxx@softricity.com
Softricity, Inc.
332 Congress Street
Boston, MA 02210
617.695.0336 x168
www.softricity.com - Powering Software as a Service
…
Unless is a handle created with OBJ_KERNEL_HANDLE, a handle is only and
only valid in the context of the process in which was created. It cant be
used after that process is teminated.
FILE_OBJECTS can be safely used for any contexts. You can ensure a file
object is retained for later processing by keeping a reference to it.
However, be warned. If the file
object receives a IRP_MJ_CLEANUP (this means that the handle count drops to
0),
that file ,even if you have a pointer reference to it, aint valid anymore
for user IO. Youll get back a STATUS_FILE_CLOSED. Only paging IO is allowed
on such a file object. If the file was already processed by a
IRP_MJ_CLEANUP, opening a handle from the object pointer using
ObOpenObjectByPointer() wont reverse this situation.
As mentioned earlier on this list, ObOpenObjectByPointer() is an
undocumented API,
and is not so “widely used” as it appears.
Dan
----- Original Message -----
From: “Ilya Levin”
To: “File Systems Developers”
Cc: “Ilya Levin”
Sent: Wednesday, September 18, 2002 12:01 AM
Subject: [ntfsd] FileHandle, File Object and UserProcess.
Hi all,
I sent it to ntdev list, but due to no responce, I am resending it to NTFSD
list.
can anyone tell me if the FileHandle and/or File Object opened in the
context of a User Process are still valid even after the process
in context of which they were opened, is terminated. I know that in Win32
space, if you leak a handle, it gets closed when the process terminates. Is
it also valid for the handles/FileObjects opened in the User Process
context, but in the kernel driver.
I am caching the FileHandles and FileObjects and I am worried that my model
can fall apart if the cached FileHandle and FileObject
get removed from underneath of my driver.
Here is what I am actually trying to do:
I have to access the file located at a shared folder on network. Initially,
the request comes in the User Context,
and therefore I do not have any problem accessing the remote location. But
later, I may have to access that file
in the system context, and this creates a problem since I do not have proper
privileges in the system context to access the
network file. I am following the approach described at the following URL to
overcome this limitation:
http://www.pulsetrainsw.com/article1.htm
Basically, in the User Context, I open the file using ZwCreateFile, save the
context using IoGetCurrentProcess,
and get the File Object using ObReferenceObjectByHandle. Later, if I am
called in the same context, I just re-use already opened
FileHandle. If I am called in system context, I get the context FileHandle
using the undocumented but widely used
ObOpenObjectByPointer API.
It is quite possible that I will receive a request in the System Context
some time after the User Process terminates.
Thanks,
Ilya.
…
Ilya Levin
File System Developer
xxxxx@softricity.com
Softricity, Inc.
332 Congress Street
Boston, MA 02210
617.695.0336 x168
www.softricity.com - Powering Software as a Service
…
—
You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
To unsubscribe send a blank email to %%email.unsub%%