non-caching a file

NTFSD
1

How can I tell IOManager or file system below to not cache the file the
user is just opening ? I tried to send lower the MJ_CREATE with
FILE_NO_INTERMEDIATE_BUFFERING flag set, but it didn’t work. I think
this flag works only when the opening is initiated by the filter driver
(using ZwCreateFile) because only IoManager responds to it. I also tried
to CcUninitializeCache after the open succeeds, but it returns fail.
This shouldn’t be imposible, but I really cannot see how.

Daniel

2

> This depends on the FS. NTFS will ignore all cache flags, and cache a

file regardless.
Caching is required in order to memory map a file.
What are you trying to accomplish, exactly?

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

3

I want that files that are decrypted using my filter to not be seen
after the filter is deactivated or discarded. Also, when the filter is
active, I want the network users to not be able to see the right content
of the files even if a local user can.

Dejan Maksimovic wrote:

> This depends on the FS. NTFS will ignore all cache flags, and cache a
>file regardless.
> Caching is required in order to memory map a file.
> What are you trying to accomplish, exactly?
>
>

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

You are currently subscribed to ntfsd as: xxxxx@ipdevel.ro
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> I want that files that are decrypted using my filter to not be seen

after the filter is deactivated or discarded.

I assume you just mean deactivated, because the filter mustn’t be unloaded.

You have two choices:

  • Purge the cache on IRP_MJ_CLEANUP. This will fail for files that are
    memory mapped, such as executables (will not fail on network shares!)
  • Just have your filter deny access to those files.

Also, when the filter is active, I want the network users to not be able to see
the right content of the files even if a local user can.

Search the newsgroup for my posts during April. Alexey J. gave a good idea
on how to distinguish network vs. local access. I’ve had a lot of “fun” making this
work:-)

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

5

Actually, caching is NOT required in order to memory-map a file.
Memory-mapping is handled entirely by the Memory Manager. The Cache
Manager uses services provided by the Memory Manager, not vice-versa. A
file can quite easily have valid pointers in the
FileObject->SectionObjectPointer->DataSectionObject or
FileObject->SectionObjectPointer->ImageSectionObject fields (which means
that the file may be mapped somewhere) but have a NULL pointer at
FileObject->SectionObjectPointer->SharedCacheMap (whichs means that the
file is not cached by Cc).

  • Nick Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Thursday, May 29, 2003 10:12 AM
To: File Systems Developers
Cc: File Systems Developers
Subject: [ntfsd] Re: non-caching a file

> This depends on the FS. NTFS will ignore all cache flags, and
> cache a file regardless.
> Caching is required in order to memory map a file.
> What are you trying to accomplish, exactly?

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption
services. Alfa File Protector - File protection and hiding
library for Win32 developers. Alfa File Monitor - File
monitoring library for Win32 developers.

You are currently subscribed to ntfsd as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

I know caching was required for something (executables?), so I assumed
it was memory mapping.
In either case, if the file is memory mapped, the cache cannot be
purged.

Nick Ryan wrote:

Actually, caching is NOT required in order to memory-map a file.
Memory-mapping is handled entirely by the Memory Manager. The Cache
Manager uses services provided by the Memory Manager, not vice-versa. A
file can quite easily have valid pointers in the
FileObject->SectionObjectPointer->DataSectionObject or
FileObject->SectionObjectPointer->ImageSectionObject fields (which means
that the file may be mapped somewhere) but have a NULL pointer at
FileObject->SectionObjectPointer->SharedCacheMap (whichs means that the
file is not cached by Cc).

  • Nick Ryan

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
> Sent: Thursday, May 29, 2003 10:12 AM
> To: File Systems Developers
> Cc: File Systems Developers
> Subject: [ntfsd] Re: non-caching a file
>
>
> > This depends on the FS. NTFS will ignore all cache flags, and
> > cache a file regardless.
> > Caching is required in order to memory map a file.
> > What are you trying to accomplish, exactly?
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption
> services. Alfa File Protector - File protection and hiding
> library for Win32 developers. Alfa File Monitor - File
> monitoring library for Win32 developers.
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

7

Trying to talk about caching as being an artifact of the “cache manager”
misses the implementation point. Cc is only a convenient
filesystem-oriented interface to Mm. Mm is the cache. The shared cache
map is just Cc’s context for providing that interface on that file, and
it is that very data section you see in the section object pointers
that Mm provides to flush, fault data in, purge, etc. that is the cache.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Thursday, May 29, 2003 1:25 PM
To: File Systems Developers

I know caching was required for something (executables?), so I
assumed
it was memory mapping.
In either case, if the file is memory mapped, the cache cannot be
purged.

Nick Ryan wrote:

Actually, caching is NOT required in order to memory-map a file.
Memory-mapping is handled entirely by the Memory Manager. The Cache
Manager uses services provided by the Memory Manager, not vice-versa.
A
file can quite easily have valid pointers in the
FileObject->SectionObjectPointer->DataSectionObject or
FileObject->SectionObjectPointer->ImageSectionObject fields (which
means
that the file may be mapped somewhere) but have a NULL pointer at
FileObject->SectionObjectPointer->SharedCacheMap (whichs means that
the
file is not cached by Cc).

  • Nick Ryan

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan
Maksimovic
> Sent: Thursday, May 29, 2003 10:12 AM
> To: File Systems Developers
> Cc: File Systems Developers
> Subject: [ntfsd] Re: non-caching a file
>
>
> > This depends on the FS. NTFS will ignore all cache flags, and
> > cache a file regardless.
> > Caching is required in order to memory map a file.
> > What are you trying to accomplish, exactly?
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption
> services. Alfa File Protector - File protection and hiding
> library for Win32 developers. Alfa File Monitor - File
> monitoring library for Win32 developers.
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

This is what I thought of:
http://www.ntfsd.org/archive/ntfsd9902/msg0028.html

Nick Ryan wrote:

Actually, caching is NOT required in order to memory-map a file.
Memory-mapping is handled entirely by the Memory Manager. The Cache
Manager uses services provided by the Memory Manager, not vice-versa. A
file can quite easily have valid pointers in the
FileObject->SectionObjectPointer->DataSectionObject or
FileObject->SectionObjectPointer->ImageSectionObject fields (which means
that the file may be mapped somewhere) but have a NULL pointer at
FileObject->SectionObjectPointer->SharedCacheMap (whichs means that the
file is not cached by Cc).

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

9

do u mean that only if FileObject->SectionObjectPointer->SharedCacheMap is
valid then the file is cached?

let’s see if i am right,

SectionObjectPointer == NULL
=> file not mapped nor cached

SectionObjectPointer != NULL && DataSectionObject == NULL &&
ImageSectionObject == NULL && SharedCacheMap == NULL
=> ?? seen this but don’t know what is this scenario

SectionObjectPointer != NULL && (DataSectionObject != NULL ||
ImageSectionObject != NULL) && SharedCacheMap == NULL
=> file mapped but not cached?

SectionObjectPointer != NULL && (DataSectionObject != NULL ||
ImageSectionObject != NULL) && SharedCacheMap != NULL
=> file mapped and cached?

Ampsi

----- Original Message -----
From: “Nick Ryan”
To: “File Systems Developers”
Sent: Friday, May 30, 2003 03:23
Subject: [ntfsd] Re: non-caching a file

Actually, caching is NOT required in order to memory-map a file.
Memory-mapping is handled entirely by the Memory Manager. The Cache
Manager uses services provided by the Memory Manager, not vice-versa. A
file can quite easily have valid pointers in the
FileObject->SectionObjectPointer->DataSectionObject or
FileObject->SectionObjectPointer->ImageSectionObject fields (which means
that the file may be mapped somewhere) but have a NULL pointer at
FileObject->SectionObjectPointer->SharedCacheMap (whichs means that the
file is not cached by Cc).

- Nick Ryan

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
> Sent: Thursday, May 29, 2003 10:12 AM
> To: File Systems Developers
> Cc: File Systems Developers
> Subject: [ntfsd] Re: non-caching a file
>
>
> > This depends on the FS. NTFS will ignore all cache flags, and
> > cache a file regardless.
> > Caching is required in order to memory map a file.
> > What are you trying to accomplish, exactly?
>
> –
> Kind regards, Dejan M. MVP for DDK
> http://www.alfasp.com E-mail: xxxxx@alfasp.com
> Alfa Transparent File Encryptor - Transparent file encryption
> services. Alfa File Protector - File protection and hiding
> library for Win32 developers. Alfa File Monitor - File
> monitoring library for Win32 developers.
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com

10

To determine if a file is cached just call ‘CcIsFileCached’. It’s
implemented as this macro:

#define CcIsFileCached(FO) (
\
((FO)->SectionObjectPointer != NULL) &&
\

(((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap
!= NULL) \
)

To determine if it’s actually mapped is more difficult. Just because the
section objects have been created doesn’t mean that any user-created
views exist into the file. From what I recall the only sure-fire way to
test this is to call MmCanFileBeTruncated. If that fails, the file is
definitely memory-mapped by the user.

  • Nick Ryan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ampsi
Sent: Thursday, May 29, 2003 6:28 PM
To: File Systems Developers
Subject: [ntfsd] Re: non-caching a file

do u mean that only if
FileObject->SectionObjectPointer->SharedCacheMap is valid
then the file is cached?

let’s see if i am right,

SectionObjectPointer == NULL
=> file not mapped nor cached

SectionObjectPointer != NULL && DataSectionObject == NULL &&
ImageSectionObject == NULL && SharedCacheMap == NULL => ??
seen this but don’t know what is this scenario

SectionObjectPointer != NULL && (DataSectionObject != NULL ||
ImageSectionObject != NULL) && SharedCacheMap == NULL => file
mapped but not cached?

SectionObjectPointer != NULL && (DataSectionObject != NULL ||
ImageSectionObject != NULL) && SharedCacheMap != NULL => file
mapped and cached?

Ampsi

----- Original Message -----
From: “Nick Ryan”
> To: “File Systems Developers”
> Sent: Friday, May 30, 2003 03:23
> Subject: [ntfsd] Re: non-caching a file
>
>
> Actually, caching is NOT required in order to memory-map a
> file. Memory-mapping is handled entirely by the Memory
> Manager. The Cache Manager uses services provided by the
> Memory Manager, not vice-versa. A file can quite easily have
> valid pointers in the
> FileObject->SectionObjectPointer->DataSectionObject or
> FileObject->SectionObjectPointer->ImageSectionObject fields
> (which means
> that the file may be mapped somewhere) but have a NULL pointer at
> FileObject->SectionObjectPointer->SharedCacheMap (whichs
> means that the
> file is not cached by Cc).
>
> - Nick Ryan
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan
> Maksimovic
> > Sent: Thursday, May 29, 2003 10:12 AM
> > To: File Systems Developers
> > Cc: File Systems Developers
> > Subject: [ntfsd] Re: non-caching a file
> >
> >
> > > This depends on the FS. NTFS will ignore all cache flags, and
> > > cache a file regardless.
> > > Caching is required in order to memory map a file.
> > > What are you trying to accomplish, exactly?
> >
> > –
> > Kind regards, Dejan M. MVP for DDK
> > http://www.alfasp.com E-mail: xxxxx@alfasp.com
> > Alfa Transparent File Encryptor - Transparent file encryption
> > services. Alfa File Protector - File protection and hiding
> library for
> > Win32 developers. Alfa File Monitor - File monitoring library for
> > Win32 developers.
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@pmail.ntu.edu.sg To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@nryan.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

11

FS filters cannot be discarded.

----- Original Message -----
From: “Daniel Turcanu”
To: “File Systems Developers”
Sent: Thursday, May 29, 2003 9:16 PM
Subject: [ntfsd] Re: non-caching a file

> I want that files that are decrypted using my filter to not be seen
> after the filter is deactivated or discarded. Also, when the filter
is
> active, I want the network users to not be able to see the right
content
> of the files even if a local user can.
>
> Dejan Maksimovic wrote:
>
> >> This depends on the FS. NTFS will ignore all cache flags, and
cache a
> >>file regardless.
> >> Caching is required in order to memory map a file.
> >> What are you trying to accomplish, exactly?
> >>
> >>
> >
> >–
> >Kind regards, Dejan M. MVP for DDK
> >http://www.alfasp.com E-mail: xxxxx@alfasp.com
> >Alfa Transparent File Encryptor - Transparent file encryption
services.
> >Alfa File Protector - File protection and hiding library for Win32
developers.
> >Alfa File Monitor - File monitoring library for Win32 developers.
> >
> >
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@ipdevel.ro
> >To unsubscribe send a blank email to
xxxxx@lists.osr.com
> >
> >
> >
> >
> >
> >
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com