Question about the desired access check

NTFSD
1

Hi,

Sorry for a probably stupid question…

If I need to open a file in my driver using ZwCreateFile()/IoCreateFile(),
I have to specify the DesiredAccess parameter.

The question is: will the requested operation be checked against the
security descriptor in the case of ZwCreateFile and in the case of
IoCreateFile and how IO_FORCE_ACCESS_CHECK flag in later case
affects this.

If, after opening the file, I need to obtain a pointer to the file object
and
issue a number of IRPs to that file object, I have to specify the
DesiredAccess
again. The DDK says, that in the case of AccessMode=KernelMode, the
access is always granted, regardless of the DesiredAccess value.

The question is: will it be possible to send IRPs, say to write file, for
the file
object which has been obtained with DesiredAccess = 0.

More general:
Is it a legal to open a file with DesiredAccess = 0, then obtain its file
object
with DesiredAccess = 0 and then to work with this file using IRP interface?
Are there any limitations on the set of operations I can perform with that
file
object?

Thanks in advance for any information.

Kind regards,
Leonid Zhigunov.

2

> If I need to open a file in my driver using ZwCreateFile()/IoCreateFile(),

I have to specify the DesiredAccess parameter.

The question is: will the requested operation be checked against the
security descriptor in the case of ZwCreateFile and in the case of
IoCreateFile and how IO_FORCE_ACCESS_CHECK flag in later case
affects this.

Create/Open requests from kernel are not subject for security check. If
kernel component wants this check to be performed it should set
IO_FORCE_ACCESS_CHECK. This is normally requested by SRV when it opens files
on behalf of remote user.

If, after opening the file, I need to obtain a pointer to the file object
and
issue a number of IRPs to that file object, I have to specify the
DesiredAccess
again. The DDK says, that in the case of AccessMode=KernelMode, the
access is always granted, regardless of the DesiredAccess value.

The question is: will it be possible to send IRPs, say to write file, for
the file
object which has been obtained with DesiredAccess = 0.

Yes, you can. DesiredAccess is assosiated with the handle and is checked by
IoManager only when Zw* functions are used.

More general:
Is it a legal to open a file with DesiredAccess = 0, then obtain its file
object
with DesiredAccess = 0 and then to work with this file using IRP
interface?
Are there any limitations on the set of operations I can perform with that
file
object?

Put is this way, your request will not be rejected if the operation is
incompatible with DesiredAccess = 0. There may be some side effects because
of violating rules related to shared access.

Thanks in advance for any information.

Kind regards,
Leonid Zhigunov.

3

Alexei,
Thank you for your help.

Leonid.

“Alexei Jelvis” wrote in message news:xxxxx@ntfsd…
>
>
> > If I need to open a file in my driver using
ZwCreateFile()/IoCreateFile(),
> > I have to specify the DesiredAccess parameter.
> >
> > The question is: will the requested operation be checked against the
> > security descriptor in the case of ZwCreateFile and in the case of
> > IoCreateFile and how IO_FORCE_ACCESS_CHECK flag in later case
> > affects this.
> >
>
> Create/Open requests from kernel are not subject for security check. If
> kernel component wants this check to be performed it should set
> IO_FORCE_ACCESS_CHECK. This is normally requested by SRV when it opens
files
> on behalf of remote user.
>
> > If, after opening the file, I need to obtain a pointer to the file
object
> > and
> > issue a number of IRPs to that file object, I have to specify the
> > DesiredAccess
> > again. The DDK says, that in the case of AccessMode=KernelMode, the
> > access is always granted, regardless of the DesiredAccess value.
> >
> > The question is: will it be possible to send IRPs, say to write file,
for
> > the file
> > object which has been obtained with DesiredAccess = 0.
> >
>
> Yes, you can. DesiredAccess is assosiated with the handle and is checked
by
> IoManager only when Zw* functions are used.
>
> > More general:
> > Is it a legal to open a file with DesiredAccess = 0, then obtain its
file
> > object
> > with DesiredAccess = 0 and then to work with this file using IRP
> interface?
> > Are there any limitations on the set of operations I can perform with
that
> > file
> > object?
> >
>
> Put is this way, your request will not be rejected if the operation is
> incompatible with DesiredAccess = 0. There may be some side effects
because
> of violating rules related to shared access.
>
> > Thanks in advance for any information.
> >
> > Kind regards,
> > Leonid Zhigunov.
> >
> >
> >
> >
> >
>
>
>
>