How to get control in cached IRP_MJ_READ

NTFSD
1

I am developing a file system filter driver for encryption. Hard disk
file must be in
encrypted format. Everytime user reads the protected files, my filter
driver should get control, check the authority
and then decrypt the file for the user.

But my filter driver does not always have chances to get control over the
file.

To prevent Cacheing, I set the flag “IRP_NOCACHE” for every IRP_MJ_READ
and IRP_MJ_WRITE.
But in IRP_MJ_READ/IRP_MJ_WRITE, my driver is not notified even with
“IRP_NOCACHE” Flag setting. So, it cannot get control in this situation.

What shall I do to get control?
I am developing filter driver based on Sfilter program…

Thanks and regards,

2

Read the IFS FAQ at www.osr.com to begin. Your design for an active filter
will not work with several programs.

----- Original Message -----
From: “Dongmin Park”
To: “File Systems Developers”
Sent: Saturday, December 07, 2002 7:47 AM
Subject: [ntfsd] How to get control in cached IRP_MJ_READ

> I am developing a file system filter driver for encryption. Hard disk
> file must be in
> encrypted format. Everytime user reads the protected files, my filter
> driver should get control, check the authority
> and then decrypt the file for the user.
>
> But my filter driver does not always have chances to get control over the
> file.
>
> To prevent Cacheing, I set the flag “IRP_NOCACHE” for every IRP_MJ_READ
> and IRP_MJ_WRITE.
> But in IRP_MJ_READ/IRP_MJ_WRITE, my driver is not notified even with
> “IRP_NOCACHE” Flag setting. So, it cannot get control in this situation.
>
> What shall I do to get control?
> I am developing filter driver based on Sfilter program…
>
> Thanks and regards,
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to %%email.unsub%%
>

3

Never even think on prevent cacheing. The cache must be, and must be
populated by the cleartext data. Encryption must occur between the
cache and the disk surface in the noncached path of the FSD.

Max

----- Original Message -----
From: “Dongmin Park”
To: “File Systems Developers”
Sent: Saturday, December 07, 2002 3:47 PM
Subject: [ntfsd] How to get control in cached IRP_MJ_READ

> I am developing a file system filter driver for encryption. Hard
disk
> file must be in
> encrypted format. Everytime user reads the protected files, my
filter
> driver should get control, check the authority
> and then decrypt the file for the user.
>
> But my filter driver does not always have chances to get control
over the
> file.
>
> To prevent Cacheing, I set the flag “IRP_NOCACHE” for every
IRP_MJ_READ
> and IRP_MJ_WRITE.
> But in IRP_MJ_READ/IRP_MJ_WRITE, my driver is not notified even
with
> “IRP_NOCACHE” Flag setting. So, it cannot get control in this
situation.
>
> What shall I do to get control?
> I am developing filter driver based on Sfilter program…
>
> Thanks and regards,
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>