Minifilter: How do I delete a newly created file in post create?

NTFSD
1

I have implemented a minifilter which attempts to prevent files being
created on certain volumes.

In the PostCreate routine if I want to prevent a file being created I call
FltCancelFileOpen and return STATUS_ACCESS_DENIED, this does not delete the
newly created file (as documented).

I have then used FltCreate (open for delete, delete on close set),
FltSetFileInformation (set disposition to delete), FltClose to try and
delete the file from within the PostCreate routine. This also does not
work, I get STATUS_SHARING_VIOLATION from some FltCreates, others do not
fail but the file still remains in the folder after the minifilter has
returned.

I get the same behaviour from explorer and FileTest.

What is the correct sequence of calls to delete the newly created file?

Richard Abraham

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

2

Did you set IO_IGNORE_SHARE_ACCESS_CHECK in FltCreate?

Also, you might try setting FILE_DELETE_ON_CLOSE in the CreateOptions.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Abraham, Richard W
Sent: Tuesday, November 15, 2005 8:50 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: How do I delete a newly created file in post
create?

I have implemented a minifilter which attempts to prevent files being
created on certain volumes.

In the PostCreate routine if I want to prevent a file being created I call
FltCancelFileOpen and return STATUS_ACCESS_DENIED, this does not delete the
newly created file (as documented).

I have then used FltCreate (open for delete, delete on close set),
FltSetFileInformation (set disposition to delete), FltClose to try and
delete the file from within the PostCreate routine. This also does not
work, I get STATUS_SHARING_VIOLATION from some FltCreates, others do not
fail but the file still remains in the folder after the minifilter has
returned.

I get the same behaviour from explorer and FileTest.

What is the correct sequence of calls to delete the newly created file?

Richard Abraham

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

You don’t really need to open the file one more time - you can first call
“FltSetFileInformation” for the file object of the created file and then call
FltCancelFileOpen.

Alexei.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Abraham, Richard
W
Sent: Tuesday, November 15, 2005 5:50 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: How do I delete a newly created file in
post create?

I have implemented a minifilter which attempts to prevent files being
created on certain volumes.

In the PostCreate routine if I want to prevent a file being created I call
FltCancelFileOpen and return STATUS_ACCESS_DENIED, this does not delete the
newly created file (as documented).

I have then used FltCreate (open for delete, delete on close set),
FltSetFileInformation (set disposition to delete), FltClose to try and
delete the file from within the PostCreate routine. This also does not
work, I get STATUS_SHARING_VIOLATION from some FltCreates, others do not
fail but the file still remains in the folder after the minifilter has
returned.

I get the same behaviour from explorer and FileTest.

What is the correct sequence of calls to delete the newly created file?

Richard Abraham

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@vmware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com