FltCreateComunicationsPort Security

NTFSD
1

I have a user mode application that comminicates with a filter driver. I would like to NOT run it as an Admin (On Vista).

Any examples on how to setup the security descriptor to allow normal users to access the port.

2

It’s pretty straightforward. Here’s the code, including the pragma to shut up PreFast:

PSECURITY_DESCRIPTOR sd;

status = FltBuildDefaultSecurityDescriptor( &sd, FLT_PORT_ALL_ACCESS );

//
// Modify the SecurityDescriptor so that the DACL
// is essentially disabled. This allows anyone access
// to the communications port.
//
#pragma warning ( push )
#pragma warning ( disable:6248 ) // PREFAST – Yes, we really want no DACL

RtlSetDaclSecurityDescriptor( sd, TRUE, NULL, FALSE );

#pragma warning ( pop )

Then use sd in InitializeObjectAttributes().

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@rts-services.com
Sent: Saturday, March 08, 2008 10:33 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltCreateComunicationsPort Security

I have a user mode application that comminicates with a filter driver. I would like to NOT run it as an Admin (On Vista).

Any examples on how to setup the security descriptor to allow normal users to access the port.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

BTW, of course when you’re done with it, remember to call FltFreeSecurityDescriptor(sd).

Ken

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Sunday, March 09, 2008 11:39 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FltCreateComunicationsPort Security

It’s pretty straightforward. Here’s the code, including the pragma to shut up PreFast:

PSECURITY_DESCRIPTOR sd;

status = FltBuildDefaultSecurityDescriptor( &sd, FLT_PORT_ALL_ACCESS );

//
// Modify the SecurityDescriptor so that the DACL
// is essentially disabled. This allows anyone access
// to the communications port.
//
#pragma warning ( push )
#pragma warning ( disable:6248 ) // PREFAST – Yes, we really want no DACL

RtlSetDaclSecurityDescriptor( sd, TRUE, NULL, FALSE );

#pragma warning ( pop )

Then use sd in InitializeObjectAttributes().

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@rts-services.com
Sent: Saturday, March 08, 2008 10:33 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltCreateComunicationsPort Security

I have a user mode application that comminicates with a filter driver. I would like to NOT run it as an Admin (On Vista).

Any examples on how to setup the security descriptor to allow normal users to access the port.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com