Problem with IRP_MJ_CREATE

NTFSD
1

Im cancellling the IRP_MJ_CREATE for a file (\Document.txt) in
postoperation in my filter driver. This is how im doing it

if(RtlCompareUnicodeString(&(pIrpSp->FileObject->FileName),&usConstName,TRUE
) == 0)
{

IoCancelFileOpen(devExt->NLExtHeader.AttachedToDeviceObject,pIrpSp->FileObje
ct);
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
}

when im trying to open that file in wordpad im getting following msg: “An
unknown error occurred while accessing e:\document.txt” instead of: “Access
to e:\Document.txt was denied”.

What do u think is the problem? Is there anything im missing ?

Regards,
VC

2

> when im trying to open that file in wordpad im getting following msg: "An

unknown error occurred while accessing e:\document.txt" instead of:
“Access
to e:\Document.txt was denied”.

I would recommend to examine the operations with filemon or filespy.
You may then see what’s going on. Anyway, wordpad may choose
what message will be shown to the user. For example on my computer,
wordpad shows “Failed to open document” (WinXP SP2).

L.

3

Thanx for ur suggestion!
I checked out in filespy. there are multiple IRP_MJ_CREATE requests comming
for that file. I checked the
pIrpSp->Parameters.Create.SecurityContext->DesiredAccess only one
IRP_MJ_CREATE is getting read access bit set. so i changed my code so that
only IRP_MJ_CREATE requests with read or write access bits set are stopped
and returned with SUCCESS_ACCESS_DENIED value. This worked out for me.

Regards
VC

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> > when im trying to open that file in wordpad im getting following msg:
“An
> > unknown error occurred while accessing e:\document.txt” instead of:
> > “Access
> > to e:\Document.txt was denied”.
>
> I would recommend to examine the operations with filemon or filespy.
> You may then see what’s going on. Anyway, wordpad may choose
> what message will be shown to the user. For example on my computer,
> wordpad shows “Failed to open document” (WinXP SP2).
>
> L.
>
>
>
>

4

If your intent is to fail the create based on file name, it would be much
better to do it in create dispatch, not in create completion. There are
good reasons to avoid IoCancelFileOpen unless there is no other way to
achieve your ends. See the archives of this list for details.

You cannot access FileObject->FileName in create completion. The ONLY time
this is guaranteed to be valid is in create dispatch.

You cannot blindly use FileObject->FileName, even in create
dispatch. There may be a related file object which describes the leading
portion of the name. FileObject->RelatedFileObject, again, is valid only
in create dispatch. and FileObject->RelatedFileObject->FileName cannot be
used. You must query the file system for the related name.

You should consider basing the case sensitivity of your filename comparison
on the case sensitivity of the create you have received. There is a
potential for your current comparison to match many distinct files.

  • Dan.

At 02:50 PM 6/17/2005 +0530, you wrote:

Im cancellling the IRP_MJ_CREATE for a file (\Document.txt) in
postoperation in my filter driver. This is how im doing it

if(RtlCompareUnicodeString(&(pIrpSp->FileObject->FileName),&usConstName,TRUE
) == 0)
{

IoCancelFileOpen(devExt->NLExtHeader.AttachedToDeviceObject,pIrpSp->FileObje
ct);
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
}

when im trying to open that file in wordpad im getting following msg: “An
unknown error occurred while accessing e:\document.txt” instead of: “Access
to e:\Document.txt was denied”.

What do u think is the problem? Is there anything im missing ?

Regards,
VC

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@privtek.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Dan captures the common cases quite well. In addition, consider these
cases:

  • Open by ID (file or object)
  • Relative open of a stream; in this case the
    FileObject->RelatedFileObject is “<path><file>::”
    and the FileObject->FileName contains “::” which is
    not amenable to concatenation.

    While this all might seem esoteric, handling these cases is critical -
    and ALL of these happen “in the real world”. They might not happen on
    your test machines, but they will happen somewhere at a customer site.

    Regards,

    Tony

    Tony Mason
    Consulting Partner
    OSR Open Systems Resources, Inc.
    http://www.osr.com

    -----Original Message-----
    From: xxxxx@lists.osr.com
    [mailto:xxxxx@lists.osr.com] On Behalf Of Dan Kyler
    Sent: Friday, June 17, 2005 11:56 AM
    To: ntfsd redirect
    Subject: Re: [ntfsd] Problem with IRP_MJ_CREATE

    If your intent is to fail the create based on file name, it would be
    much
    better to do it in create dispatch, not in create completion. There are

    good reasons to avoid IoCancelFileOpen unless there is no other way to
    achieve your ends. See the archives of this list for details.

    You cannot access FileObject->FileName in create completion. The ONLY
    time
    this is guaranteed to be valid is in create dispatch.

    You cannot blindly use FileObject->FileName, even in create
    dispatch. There may be a related file object which describes the
    leading
    portion of the name. FileObject->RelatedFileObject, again, is valid
    only
    in create dispatch. and FileObject->RelatedFileObject->FileName cannot
    be
    used. You must query the file system for the related name.

    You should consider basing the case sensitivity of your filename
    comparison
    on the case sensitivity of the create you have received. There is a
    potential for your current comparison to match many distinct files.

    - Dan.

    At 02:50 PM 6/17/2005 +0530, you wrote:
    >Im cancellling the IRP_MJ_CREATE for a file (\Document.txt) in
    >postoperation in my filter driver. This is how im doing it
    >
    >if(RtlCompareUnicodeString(&(pIrpSp->FileObject->FileName),&usConstName
    ,TRUE
    >) == 0)
    >{
    >
    >IoCancelFileOpen(devExt->NLExtHeader.AttachedToDeviceObject,pIrpSp->Fil
    eObje
    >ct);
    > Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
    > Irp->IoStatus.Information = 0;
    >}
    >
    >when im trying to open that file in wordpad im getting following msg:
    “An
    >unknown error occurred while accessing e:\document.txt” instead of:
    “Access
    >to e:\Document.txt was denied”.
    >
    >What do u think is the problem? Is there anything im missing ?
    >
    >Regards,
    >VC
    >
    >
    >
    >—
    >Questions? First check the IFS FAQ at
    >https://www.osronline.com/article.cfm?id=17
    >
    >You are currently subscribed to ntfsd as: xxxxx@privtek.com
    >To unsubscribe send a blank email to xxxxx@lists.osr.com

    —
    Questions? First check the IFS FAQ at
    https://www.osronline.com/article.cfm?id=17

    You are currently subscribed to ntfsd as: xxxxx@osr.com
    To unsubscribe send a blank email to xxxxx@lists.osr.com