Hi,
I have written a mini-filter driver on the models of minispy…
but unlike minispy, based on certain rules i set the status field to status_access_denied and also complete the pre-operation call back.
I have registered for pre-operation callback of create.
It seems to be working fine in most cases but following is the problem:-
say my rule is that file1.txt should be allowed only read access by any process…
then in the precreate i check for the desired access and do accordingly…
it works fine when tested with applications like notepad/winword/wordpad…they are able to open the file but cant save it…
But if i open the file with msdev, i am able to save the same…
try as i might i am not able to understand this…
can someone please help…this is really urgent.
xxxxx@yahoo.com wrote:
But if i open the file with msdev, i am able to save the same…
try as i might i am not able to understand this…
can someone please help…this is really urgent.
msdev is probably never opening the file for write, just writing a
temporary file and renaming the temporary over the top of the original
file (MS Word does the same IIRC).
You are checking at the wrong point. You should be checking for
write/delete access at IRP_MJ_OPEN.
Tony
Hi Tony,
I made a mistake in the subject heading it shud read IRP_MJ_CREATE instead of IRP_MJ_WRITE.
I am checking for the desired access in the pre-create path…
Maybe FileSpy would help you … try to observe what MSDEV process is doing
and look for possible case of your problem.
My pure guess is that MSDEV renames file, which means opens for DELETE
access.
L.
Thanks for the response.
MSDEV indeed creates a temporary copy and then renames it during the save operation.