Is it possible to create a hard-link to a file which is getting deleted, at
the pre-callback stage of IRP_MJ_CLEANUP ?
I tried doing this and repeatedly got a STATUS_ACCESS_DENIED. The code is
functional since I use the same function at every other place.
The function basically uses the file-object and calls FltSetInformationFile
with FILE_LINK_INFORMATION and the FileObject of the file that will be
cleaned up.
I know that the file has been opened with DELETE desired-access and the
deletion has been set using FileDispositionInformation. I tried adding
GENERIC_WRITE access to the file but that didn’t help.
It could well be because the file is marked for delete. A small user mode program might be able to demonstrate that.
What happens if you try to delete with a DELETE_ON_CLOSE rather than setting the disposition. Or you could try to temporarily clear the disposition during the set link. That might give you a hint – Neither of these solutions are necessarily suitable for production, but they may help the understanding.
R
“Arun M. Krishnakumar” wrote in message news:xxxxx@ntfsd… Hi,
Is it possible to create a hard-link to a file which is getting deleted, at the pre-callback stage of IRP_MJ_CLEANUP ?
I tried doing this and repeatedly got a STATUS_ACCESS_DENIED. The code is functional since I use the same function at every other place.
The function basically uses the file-object and calls FltSetInformationFile with FILE_LINK_INFORMATION and the FileObject of the file that will be cleaned up.
I know that the file has been opened with DELETE desired-access and the deletion has been set using FileDispositionInformation. I tried adding GENERIC_WRITE access to the file but that didn’t help.