Hi Everyone,
I implemented my file system filter driver that allows an user create a
symbolic link file to another file using reparse point on Win2K. The filter
redirects the IRP_MJ_CREATE function to the target file name.
My question is that if the user wants to delete the symbolic file itself,
how my filter can distinguish IRP_MJ_CREATEs for reading/writing from
IRP_MJ_CREATE for deletion. Is there any flag I can check for the intended
operations?
Thank you for any idea.
Shangwu
The create may come down with the FILE_DELETE_ON_CLOSE flag, which
indicates that the file should be deleted when the last handle is
closed. But even if this flag is not specified, the file can still be
marked for deletion later by sending down FILE_DISPOSITION_INFORMATION
with DeleteFile set to TRUE. You may have to track the redirected create
by file object and catch any attempts to set
FILE_DISPOSITION_INFORMATION on the file object and redirect them back
to the symbolic link file.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
Sent: Tuesday, January 21, 2003 2:17 PM
To: File Systems Developers
Subject: [ntfsd] How to delete a symbolic link?Hi Everyone,
I implemented my file system filter driver that allows an
user create a symbolic link file to another file using
reparse point on Win2K. The filter redirects the
IRP_MJ_CREATE function to the target file name. My question
is that if the user wants to delete the symbolic file itself,
how my filter can distinguish IRP_MJ_CREATEs for
reading/writing from IRP_MJ_CREATE for deletion. Is there any
flag I can check for the intended operations?Thank you for any idea.
Shangwu
You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
To be able to delete the file there must be DELETE flags set
IrpSp->Parameters.Create.SecurityContext->DesiredAccess and
FILE_READ_DATA/FILE_WRITE_DATA to be able to read/write the file. You can
use this as some kind of heuristic method to destinguish these two type of
IRP_MJ_CREATE operations. Note, however, that if a file was opened with
DELETE access it doesn’t mean that it’s would be deleted. You may even see
cases when both FILE_READ_DATA and DELETE access flags are set.
----- Original Message -----
From: “Shangwu Qi”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Wednesday, January 22, 2003 12:16 AM
Subject: [ntfsd] How to delete a symbolic link?
> Hi Everyone,
>
> I implemented my file system filter driver that allows an user create a
> symbolic link file to another file using reparse point on Win2K. The
filter
> redirects the IRP_MJ_CREATE function to the target file name.
> My question is that if the user wants to delete the symbolic file itself,
> how my filter can distinguish IRP_MJ_CREATEs for reading/writing from
> IRP_MJ_CREATE for deletion. Is there any flag I can check for the intended
> operations?
>
> Thank you for any idea.
>
> Shangwu
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thank you for your response.
How can I track a file object created by IRP_MJ_CREATE function? In other
words, how can I keep some state data between IRP_MJ_XXXs?
Shangwu
“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
>
> The create may come down with the FILE_DELETE_ON_CLOSE flag, which
> indicates that the file should be deleted when the last handle is
> closed. But even if this flag is not specified, the file can still be
> marked for deletion later by sending down FILE_DISPOSITION_INFORMATION
> with DeleteFile set to TRUE. You may have to track the redirected create
> by file object and catch any attempts to set
> FILE_DISPOSITION_INFORMATION on the file object and redirect them back
> to the symbolic link file.
>
> - Nicholas Ryan
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > Sent: Tuesday, January 21, 2003 2:17 PM
> > To: File Systems Developers
> > Subject: [ntfsd] How to delete a symbolic link?
> >
> >
> > Hi Everyone,
> >
> > I implemented my file system filter driver that allows an
> > user create a symbolic link file to another file using
> > reparse point on Win2K. The filter redirects the
> > IRP_MJ_CREATE function to the target file name. My question
> > is that if the user wants to delete the symbolic file itself,
> > how my filter can distinguish IRP_MJ_CREATEs for
> > reading/writing from IRP_MJ_CREATE for deletion. Is there any
> > flag I can check for the intended operations?
> >
> > Thank you for any idea.
> >
> > Shangwu
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
All you need is a hash table or a list of some sort (simple data
structure) that maps file object pointers to a private data structure
containing whatever information you want. In your case, this data
structure would mark the file object as an open that was originally
opened against the symbolic link. When a set disposition for delete
comes down against this file object, you will know it should be for the
link and not the target file.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
Sent: Wednesday, January 22, 2003 2:21 PM
To: File Systems Developers
Subject: [ntfsd] Re: How to delete a symbolic link?Thank you for your response.
How can I track a file object created by IRP_MJ_CREATE
function? In other words, how can I keep some state data
between IRP_MJ_XXXs?Shangwu
“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
> >
> > The create may come down with the FILE_DELETE_ON_CLOSE flag, which
> > indicates that the file should be deleted when the last handle is
> > closed. But even if this flag is not specified, the file
> can still be
> > marked for deletion later by sending down
> FILE_DISPOSITION_INFORMATION
> > with DeleteFile set to TRUE. You may have to track the redirected
> > create by file object and catch any attempts to set
> > FILE_DISPOSITION_INFORMATION on the file object and
> redirect them back
> > to the symbolic link file.
> >
> > - Nicholas Ryan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > > Sent: Tuesday, January 21, 2003 2:17 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] How to delete a symbolic link?
> > >
> > >
> > > Hi Everyone,
> > >
> > > I implemented my file system filter driver that allows an user
> > > create a symbolic link file to another file using reparse
> point on
> > > Win2K. The filter redirects the IRP_MJ_CREATE function to
> the target
> > > file name. My question is that if the user wants to delete the
> > > symbolic file itself, how my filter can distinguish
> IRP_MJ_CREATEs
> > > for reading/writing from IRP_MJ_CREATE for deletion. Is there any
> > > flag I can check for the intended operations?
> > >
> > > Thank you for any idea.
> > >
> > > Shangwu
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thanks for Nicholas.
Where can I keep this hash table or data structure between IRP_MJ_XXXs? Do I
need save it with the current Device Object or the Driver Object?
Regards,
Shangwu
“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
>
> All you need is a hash table or a list of some sort (simple data
> structure) that maps file object pointers to a private data structure
> containing whatever information you want. In your case, this data
> structure would mark the file object as an open that was originally
> opened against the symbolic link. When a set disposition for delete
> comes down against this file object, you will know it should be for the
> link and not the target file.
>
> - Nicholas Ryan
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > Sent: Wednesday, January 22, 2003 2:21 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Re: How to delete a symbolic link?
> >
> >
> > Thank you for your response.
> > How can I track a file object created by IRP_MJ_CREATE
> > function? In other words, how can I keep some state data
> > between IRP_MJ_XXXs?
> >
> > Shangwu
> >
> > “Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
> > >
> > > The create may come down with the FILE_DELETE_ON_CLOSE flag, which
> > > indicates that the file should be deleted when the last handle is
> > > closed. But even if this flag is not specified, the file
> > can still be
> > > marked for deletion later by sending down
> > FILE_DISPOSITION_INFORMATION
> > > with DeleteFile set to TRUE. You may have to track the redirected
> > > create by file object and catch any attempts to set
> > > FILE_DISPOSITION_INFORMATION on the file object and
> > redirect them back
> > > to the symbolic link file.
> > >
> > > - Nicholas Ryan
> > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > > > Sent: Tuesday, January 21, 2003 2:17 PM
> > > > To: File Systems Developers
> > > > Subject: [ntfsd] How to delete a symbolic link?
> > > >
> > > >
> > > > Hi Everyone,
> > > >
> > > > I implemented my file system filter driver that allows an user
> > > > create a symbolic link file to another file using reparse
> > point on
> > > > Win2K. The filter redirects the IRP_MJ_CREATE function to
> > the target
> > > > file name. My question is that if the user wants to delete the
> > > > symbolic file itself, how my filter can distinguish
> > IRP_MJ_CREATEs
> > > > for reading/writing from IRP_MJ_CREATE for deletion. Is there any
> > > > flag I can check for the intended operations?
> > > >
> > > > Thank you for any idea.
> > > >
> > > > Shangwu
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > >
> > >
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
You can just keep it in a global variable. File object addresses are
unique throughout the system so your data structure does not have to be
device specific. Make sure you protect the data structure appropriately
(spin locks, fast mutexes, ERESOURCES, etc.)
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
Sent: Thursday, January 23, 2003 6:02 AM
To: File Systems Developers
Subject: [ntfsd] Re: How to delete a symbolic link?Thanks for Nicholas.
Where can I keep this hash table or data structure between
IRP_MJ_XXXs? Do I need save it with the current Device Object
or the Driver Object?Regards,
Shangwu
“Nicholas Ryan” wrote in message news:xxxxx@ntfsd…
> >
> > All you need is a hash table or a list of some sort (simple data
> > structure) that maps file object pointers to a private data
> structure
> > containing whatever information you want. In your case, this data
> > structure would mark the file object as an open that was originally
> > opened against the symbolic link. When a set disposition for delete
> > comes down against this file object, you will know it should be for
> > the link and not the target file.
> >
> > - Nicholas Ryan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > > Sent: Wednesday, January 22, 2003 2:21 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] Re: How to delete a symbolic link?
> > >
> > >
> > > Thank you for your response.
> > > How can I track a file object created by IRP_MJ_CREATE
> function? In
> > > other words, how can I keep some state data between IRP_MJ_XXXs?
> > >
> > > Shangwu
> > >
> > > “Nicholas Ryan” wrote in message
> > > news:xxxxx@ntfsd…
> > > >
> > > > The create may come down with the FILE_DELETE_ON_CLOSE
> flag, which
> > > > indicates that the file should be deleted when the last
> handle is
> > > > closed. But even if this flag is not specified, the file
> > > can still be
> > > > marked for deletion later by sending down
> > > FILE_DISPOSITION_INFORMATION
> > > > with DeleteFile set to TRUE. You may have to track the
> redirected
> > > > create by file object and catch any attempts to set
> > > > FILE_DISPOSITION_INFORMATION on the file object and
> > > redirect them back
> > > > to the symbolic link file.
> > > >
> > > > - Nicholas Ryan
> > > >
> > > > > -----Original Message-----
> > > > > From: xxxxx@lists.osr.com
> > > > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> Shangwu Qi
> > > > > Sent: Tuesday, January 21, 2003 2:17 PM
> > > > > To: File Systems Developers
> > > > > Subject: [ntfsd] How to delete a symbolic link?
> > > > >
> > > > >
> > > > > Hi Everyone,
> > > > >
> > > > > I implemented my file system filter driver that
> allows an user
> > > > > create a symbolic link file to another file using reparse
> > > point on
> > > > > Win2K. The filter redirects the IRP_MJ_CREATE function to
> > > the target
> > > > > file name. My question is that if the user wants to
> delete the
> > > > > symbolic file itself, how my filter can distinguish
> > > IRP_MJ_CREATEs
> > > > > for reading/writing from IRP_MJ_CREATE for deletion. Is there
> > > > > any flag I can check for the intended operations?
> > > > >
> > > > > Thank you for any idea.
> > > > >
> > > > > Shangwu
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > > > > unsubscribe send a blank email to
> > > > > xxxxx@lists.osr.com
> > > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Use FileObject->FsContext2 field. Allocate a context on CREATE, assign
a pointer to the file object, and free the context on CLOSE.
“Shangwu Qi” wrote in message
news:LYRIS-2023-93861-2003.01.22-17.22.52–maxim#xxxxx@list
s.osr.com…
> Thank you for your response.
> How can I track a file object created by IRP_MJ_CREATE function? In
other
> words, how can I keep some state data between IRP_MJ_XXXs?
>
> Shangwu
>
> “Nicholas Ryan” wrote in message
news:xxxxx@ntfsd…
> >
> > The create may come down with the FILE_DELETE_ON_CLOSE flag, which
> > indicates that the file should be deleted when the last handle is
> > closed. But even if this flag is not specified, the file can still
be
> > marked for deletion later by sending down
FILE_DISPOSITION_INFORMATION
> > with DeleteFile set to TRUE. You may have to track the redirected
create
> > by file object and catch any attempts to set
> > FILE_DISPOSITION_INFORMATION on the file object and redirect them
back
> > to the symbolic link file.
> >
> > - Nicholas Ryan
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu Qi
> > > Sent: Tuesday, January 21, 2003 2:17 PM
> > > To: File Systems Developers
> > > Subject: [ntfsd] How to delete a symbolic link?
> > >
> > >
> > > Hi Everyone,
> > >
> > > I implemented my file system filter driver that allows an
> > > user create a symbolic link file to another file using
> > > reparse point on Win2K. The filter redirects the
> > > IRP_MJ_CREATE function to the target file name. My question
> > > is that if the user wants to delete the symbolic file itself,
> > > how my filter can distinguish IRP_MJ_CREATEs for
> > > reading/writing from IRP_MJ_CREATE for deletion. Is there any
> > > flag I can check for the intended operations?
> > >
> > > Thank you for any idea.
> > >
> > > Shangwu
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > > To unsubscribe send a blank email to
xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>