how to make a file readonly?

NTFSD
1

I have implemented a filter driver to protect some specified files from
being rewriting and deleting.

I intercept the the IRP_MJ_CREATE(CreateDisposition != FILE_OPEN) and
IRP_MJ_WRITE as the following codes, but when rewriting the protected file,
the file is truncated to length 0 with a error message saying" not enough
space", sometimes errors occur.

In IRP_MJ_WRITE dispatch function:
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
In IRP_MJ_CREATE dispatch function:
Options = irpSp->Parameters.Create.Options;
CreateDisposition = (Options >> 24) & 0x000000ff;
if ( CreateDisposition != FILE_OPEN )
{
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_ACCESS_DENIED;
}

Is there any problem in the code?
Please help,thanks!

2

> I intercept the the IRP_MJ_CREATE(CreateDisposition != FILE_OPEN) and

Better don’t check for FILE_OPEN, check the desired access for
FILE_WRITE_DATA. The file can be open for write too.

In IRP_MJ_WRITE dispatch function:
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;

I think you have to set the result status into Irp->IoStatus.Status
too. The same in IRP_MJ_CREATE request. But I’m not sure if
this will solve the problem.

L.

3

Application opened file and then truncated it using IRP_MJ_SET_INFORMATION
that you didn’t reject. When application started writing you rejected
IRP_MJ_WRITE and confused application so it reported “not enough space”
because it didn’t expect to get STATUS_ACCESS_DENIED on write path after
file was opened for write access.
If you want to prevent any modification for a file you need to deny create
requests with desired access that allows modification.

Alexei.

“Holk” wrote in message news:xxxxx@ntfsd…
> I have implemented a filter driver to protect some specified files from
> being rewriting and deleting.
>
> I intercept the the IRP_MJ_CREATE(CreateDisposition != FILE_OPEN) and
> IRP_MJ_WRITE as the following codes, but when rewriting the protected
file,
> the file is truncated to length 0 with a error message saying" not enough
> space", sometimes errors occur.
>
> In IRP_MJ_WRITE dispatch function:
> IoCompleteRequest(Irp,IO_NO_INCREMENT);
> return STATUS_ACCESS_DENIED;
> In IRP_MJ_CREATE dispatch function:
> Options = irpSp->Parameters.Create.Options;
> CreateDisposition = (Options >> 24) & 0x000000ff;
> if ( CreateDisposition != FILE_OPEN )
> {
> IoCompleteRequest( Irp, IO_NO_INCREMENT );
> return STATUS_ACCESS_DENIED;
> }
>
> Is there any problem in the code?
> Please help,thanks!
>
>
>