Use IoGetRequestorProcess to obtain the process that originated the IRP
- that tells you the process that originated the request.
What you seem to miss is that there’s the cache in this mix of
operations - both read ahead and write back are going to be done in
system process context. Thus, there is definitely no guarantee that
just because notepad opened the file that it will be the notepad process
performing the I/O operations.
The code you are using is going to give you the SID of the primary
process token, which isn’t going to be the remote client for CIFS
server. Since I don’t know what you’re trying to achieve here, I can’t
say if this is what you want or not. I’ve never tried to obtain the SID
using the approach you are using (I’ve always done it via the mechanism
described on OSRONLINE article -
http://www.osronline.com/article.cfm?id=50 which doesn’t quite fit your
scenario.)
Perhaps someone else on the list has done it along the lines you are
using and can provide you with further feedback.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006.
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of amitr0
Sent: Friday, April 07, 2006 4:43 AM
To: ntfsd redirect
Subject: Re: [ntfsd] getting SID of the User inside my FSFD
If you just want the SID of the current process, go ahead and get it
whenever you want.
I want the SID of the process that sent that particular IRP down to me.
That doesn’t mean it is the SID of the process that opened the file -
because that’s only guaranteed during IRP_MJ_CREATE and certain
IRP_MJ_SET_INFORMATION calls (rename and create hard link). If you
want the SID of the process that opened the file originally, store it
in your filter context or in a separate lookaside table keyed off the
FILE_OBJECT.
You mean to say that Notepad.exe opened file abcd.txt (which is very
large, > 32 Megs, say) and the multiple IRP_MJ_READs I see on the sysetm
from Notepad, might not return me the correct SID of the guy who has
launched Notepad? Why is it do? Yes, I did read the bit about the CIFS,
but still I need more clarification, if you could kindly tell me a bit
more in detail.
More over I also hav observed that the SID is not even fetched at times,
I cannot figure out why the token query functions return access
violation etc.
Here is the code I use to get the SID, is it worng? I don’t query the
current thread in this code.
void GetSID(PUNICODE_STRING sidString)
{
NTSTATUS ntStatus;
PVOID Token;
HANDLE tokenHandle;
PTOKEN_USER tokenInfoBuffer;
ULONG requiredLength;
// PCHAR sidStringBuffer[512];
PWCHAR sidStringBuffer;
sidStringBuffer= ExAllocatePool(NonPagedPool, 512 );
RtlInitEmptyUnicodeString
(sidString,sidStringBuffer,512);
Token=PsReferencePrimaryToken(PsGetCurrentProcess());
ntStatus=ObOpenObjectByPointer(Token,0, NULL, TOKEN_QUERY,
NULL,KernelMode, &tokenHandle );
ObDereferenceObject(Token);
if( !NT_SUCCESS( ntStatus )) {
KdPrint((“\nGetSID: Could not open process token: %x\n”,
ntStatus ));
return;
}
//
// Pull out the SID
//
ntStatus = NtQueryInformationToken( tokenHandle, TokenUser, NULL, 0,
&requiredLength );
if( ntStatus != STATUS_BUFFER_TOO_SMALL ) {
KdPrint((“\nGetSID: Error getting token information: %x\n”,
ntStatus));
ZwClose( tokenHandle );
return;
}
tokenInfoBuffer=(PTOKEN_USER) ExAllocatePool( NonPagedPool,
requiredLength );
if( tokenInfoBuffer ) {
ntStatus = NtQueryInformationToken( tokenHandle, TokenUser,
tokenInfoBuffer, requiredLength, &requiredLength );
}
if( !NT_SUCCESS( ntStatus ) || !tokenInfoBuffer ) {
KdPrint((“\nGetSID: Error getting token information: %x\n”,
ntStatus));
if( tokenInfoBuffer )
ExFreePool( tokenInfoBuffer );
ZwClose( tokenHandle );
return;
}
ZwClose( tokenHandle );
//
// Got it, now convert to text representation
//
//memset( sidStringBuffer, 0, sizeof(sidStringBuffer ));
//sidStringBuffer= ExAllocatePool(NonPagedPool, 512 );
//sidString->Buffer = (PWCHAR) sidStringBuffer;
//sidString->MaximumLength = sizeof(sidStringBuffer);
//RtlInitEmptyUnicodeString(sidString,sidStringBuffer,512);
ntStatus = RtlConvertSidToUnicodeString( sidString,
tokenInfoBuffer-> User.Sid, FALSE );
sidString->Buffer[sidString->Length+1]=‘\0’;
KdPrint((“\nGetSID: sidString = %ws\n”,sidString->Buffer));
ExFreePool( tokenInfoBuffer );
if( !NT_SUCCESS( ntStatus )) {
KdPrint((“\nGetSID: Unable to convert SID to text: %x\n”,
ntStatus ));
return;
}
}
Your advice us solicited.
amitr0
— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed
to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a
blank email to xxxxx@lists.osr.com
