problems blocking folder rename

NTFSD
1

Hi!

I’m trying to block a folder rename. I’m doing this:

if(pStack->Parameters.SetFile.FileInformationClass ==
FileRenameInformation ||
pStack->Parameters.SetFile.FileInformationClass ==
FileLinkInformation)
{
if(bIsMyProtectedFolder)
{
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
}

And I’m getting folders corrupted. Is this code wrong/incomplete? How
can I make it work?

Rodrigo Strauss

2

What do you mean by “corrupted”? How do you determine this
“corruption”?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of Rodrigo Strauss
Sent: Thursday, December 18, 2003 8:38 AM
To: ntfsd redirect
Subject: [ntfsd] problems blocking folder rename

Hi!

I’m trying to block a folder rename. I’m doing this:

if(pStack->Parameters.SetFile.FileInformationClass ==
FileRenameInformation ||
pStack->Parameters.SetFile.FileInformationClass ==
FileLinkInformation)
{
if(bIsMyProtectedFolder)
{
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
}

And I’m getting folders corrupted. Is this code
wrong/incomplete? How
can I make it work?

Rodrigo Strauss

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> What do you mean by “corrupted”? How do you determine this
> “corruption”?

Lot of files inside the folder with invalid names and sizes. When I do
‘chkdsk /f’ my folder is changed to a file. Sometimes, other folders get
corrupted (the same way) too.
I’m reading the Nagar’s book, and the rename section is a 2 pages text,
hard to understand. “Rename is a two steps operation: remove the file
name entry from the source directory, and, add a new file name.”. I
think I’m blocking only one step, so the meta data is getting corrupted.

Is there any flag I can check in the IRP_MJ_CREATE to give the access
denied here instead of in the rename time?

Thank you very much,

Strauss

Tony Mason wrote:

What do you mean by “corrupted”? How do you determine this
“corruption”?

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of Rodrigo Strauss
Sent: Thursday, December 18, 2003 8:38 AM
To: ntfsd redirect
Subject: [ntfsd] problems blocking folder rename

Hi!

I’m trying to block a folder rename. I’m doing this:

if(pStack->Parameters.SetFile.FileInformationClass ==
FileRenameInformation ||
pStack->Parameters.SetFile.FileInformationClass ==
FileLinkInformation)
{
if(bIsMyProtectedFolder)
{
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
}

And I’m getting folders corrupted. Is this code
wrong/incomplete? How
can I make it work?

Rodrigo Strauss

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@scua.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I know this can work, I’ve done it in my own filters.

  1. Could be a problem with other code in your IRP_MJ_SET_INFORMATION
    handler. If you comment out the below code, does everything work?

  2. This may be obvious, but are you sure that you’re checking that this
    is actually a set info request before executing the below code?

Rodrigo Strauss wrote:

Hi!

I’m trying to block a folder rename. I’m doing this:

if(pStack->Parameters.SetFile.FileInformationClass ==
FileRenameInformation ||
pStack->Parameters.SetFile.FileInformationClass ==
FileLinkInformation)
{
if(bIsMyProtectedFolder)
{
pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
return STATUS_ACCESS_DENIED;
}
}

And I’m getting folders corrupted. Is this code wrong/incomplete?
How can I make it work?

Rodrigo Strauss

–
Nick Ryan (MVP for DDK)

5

I solved the problem doing this in IRP_MJ_CREATE instead of blocking
the rename:

if(bIsMyFolder &&
(pStack->Parameters.Create.SecurityContext->DesiredAccess & DELETE))
{
//ACCESS DENIED!
}

Thanks,

Strauss

Nick Ryan wrote:

I know this can work, I’ve done it in my own filters.

  1. Could be a problem with other code in your IRP_MJ_SET_INFORMATION
    handler. If you comment out the below code, does everything work?

  2. This may be obvious, but are you sure that you’re checking that this
    is actually a set info request before executing the below code?

Rodrigo Strauss wrote:

>
> Hi!
>
> I’m trying to block a folder rename. I’m doing this:
>
> if(pStack->Parameters.SetFile.FileInformationClass ==
> FileRenameInformation ||
> pStack->Parameters.SetFile.FileInformationClass ==
> FileLinkInformation)
> {
> if(bIsMyProtectedFolder)
> {
> pIrp->IoStatus.Status = STATUS_ACCESS_DENIED;
> pIrp->IoStatus.Information = 0;
> IoCompleteRequest(pIrp, IO_NO_INCREMENT);
> return STATUS_ACCESS_DENIED;
> }
> }
>
> And I’m getting folders corrupted. Is this code wrong/incomplete?
> How can I make it work?
>
>
> Rodrigo Strauss
>
>