get file access from file handle

NTDEV
1

Hello,

Let’s say I’m opening a file with NtCreateFile (user mode) .
Is there an class in e.g NtQueryInformationFile that for given handle will return share access anyhow?

There is access class, but it looks like i returns only informaiton about desired access.

Is there any possibility to take it in user mode?

thank you.

2

If you are opening the file, you know what you are asking for so just store that information alongside the file HANDLE

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Friday, February 14, 2014 11:32 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] get file access from file handle

Hello,

Let’s say I’m opening a file with NtCreateFile (user mode) .
Is there an class in e.g NtQueryInformationFile that for given handle will return share access anyhow?

There is access class, but it looks like i returns only informaiton about desired access.

Is there any possibility to take it in user mode?

thank you.

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

hehe yes, I just realized that this question looks somehow stupid.
Basically I need to write test application that will check if minifilter is working correct and was wondering if I can do assertion with checking stripped access by taking it from file handle.
So is there such option?

4

On 14-Feb-2014 21:32, xxxxx@gmail.com wrote:

Hello,

Let’s say I’m opening a file with NtCreateFile (user mode) .
Is there an class in e.g NtQueryInformationFile that for given handle will return share access anyhow?

There is access class, but it looks like i returns only informaiton about desired access.

Is there any possibility to take it in user mode?

NtQueryInformationFile(FileAccessInformation) returns desired access,
not filtered (granted)? Is this correct behavior?

  • pa
5

>NtQueryInformationFile(FileAccessInformation) returns desired access,
not filtered (granted)? Is this correct behavior?

not sure if I understand you correct.
You want to say that whem minifilter will filter out some access - then NtQuery with access interomation class will return not filtered access? Are you sure? I think if I would work as you say - this would be wierd since when calling this API you expect to receive real information.

Anyway - this is only partial infomation - what about shared access?

6

On 14-Feb-2014 23:15, xxxxx@gmail.com wrote:

> NtQueryInformationFile(FileAccessInformation) returns desired access,
not filtered (granted)? Is this correct behavior?

not sure if I understand you correct.
You want to say that whem minifilter will filter out some access - then NtQuery with access interomation class will return not filtered access? Are you sure? I think if I would work as you say - this would be wierd since when calling this API you expect to receive real information.

Anyway - this is only partial infomation - what about shared access?

You wrote that NtQuery returned the desired access to you, not filtered
(actually granted) - this is surprising. IIRC it should return the
granted access.
Unfortunately I could not find answer to your question how to get the
sharing mode.
– pa