Interception of NTFS permissions change

NTDEV
1

Hi

Is there a way to Intercept or get an event (in a driver) when a user changes
the security permissions of a given file ?

Do i need a file system filter driver for this ?

Thanks!

2

Yes, you need either FS filter driver or make a file API hook if you want to
control user-mode applications only

Is there a way to Intercept or get an event (in a driver) when a user
changes
the security permissions of a given file ?

Do i need a file system filter driver for this ?

Thanks!