How to cancel Delete request in my Win2K file system filter driver?

NTFSD
1

Hi,

My file system filter driver will determine if a file can be deleted,
I wrote the following code in my dispatch routine to implement this:

// …

if(CanNotBeDeleted)
{
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}

// …

The goal of deletion prevention is achieved, but when I try to open the
protected file, the system says something like “This file is currently
opened by some other process” and fails to open it.

Thanks for any suggestions!

Chen

2

You seem to need something like:

if (ConNobBeDeleted){
CreateOption &= ~FILE_DELETE_ON_CLOSE;
}

----- Original Message -----
From: “Chen”
To: “File Systems Developers”
Sent: Saturday, September 28, 2002 2:18 PM
Subject: [ntfsd] How to cancel Delete request in my Win2K file system filter
driver?

> Hi,
>
> My file system filter driver will determine if a file can be deleted,
> I wrote the following code in my dispatch routine to implement this:
>
> // …
>
> if(CanNotBeDeleted)
> {
> Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
> Irp->IoStatus.Information = 0;
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> return STATUS_ACCESS_DENIED;
> }
>
> // …
>
> The goal of deletion prevention is achieved, but when I try to open the
> protected file, the system says something like “This file is currently
> opened by some other process” and fails to open it.
>
> Thanks for any suggestions!
>
> Chen
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@linkwave.org
> To unsubscribe send a blank email to %%email.unsub%%

3

> You seem to need something like:

if (ConNobBeDeleted){

Oops… CanNotBeDeleted I mean :*)

CreateOption &= ~FILE_DELETE_ON_CLOSE;
}

4

Hi Tobias,

I have tried your suggestion as follows, but it doesn’t work. I wonder if i have correctly understand you said.

In dispatch routine:

// …

case IRP_MJ_CREATE:
pIrpStack->Parameters.Create.Options &= ~FILE_DELETE_ON_CLOSE;
break;

// …

In completion routine:

// …

if(!pCompletionContext->CanBeDeleted)
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;

return pIrp->IoStatus.Status;

Regards,

Chen

5

Don’t cancel the Irp. If it succeeds the file system will hopefully not
delete the file, but allow any other access requested. An application this
way won’t be aware the deletion was canceled. Maybe it works, but I’ve never
tried it out. Anyway, if it works so far, it could lead to serious problems
later on, depending on how carefuly an application handles subsequential
file create operations.

----- Original Message -----
From: “Chen”
To: “File Systems Developers”
Sent: Sunday, September 29, 2002 2:55 PM
Subject: [ntfsd] Re: How to cancel Delete request in my Win2K file system
filter driver?

> Hi Tobias,
>
> I have tried your suggestion as follows, but it doesn’t work. I wonder if
i have correctly understand you said.
>
> In dispatch routine:
>
> // …
>
> case IRP_MJ_CREATE:
> pIrpStack->Parameters.Create.Options &= ~FILE_DELETE_ON_CLOSE;
> break;
>
> // …
>
>
> In completion routine:
>
> // …
>
> if(!pCompletionContext->CanBeDeleted)
> pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
>
> return pIrp->IoStatus.Status;
>
> Regards,
>
> Chen