Re: Get/Set Security on the root-directory of a mounted drive

NTFSD
1

Hi,

Some more findings on the same issue:

If I do query security (via GetFileSecurity()) on “Q:\dir1”,
the following is the call-stack:

ZwQuerySecurityObject->nt!KiSystemService->NtQuerySecurity->
IopGetSetSecurityObject->IoGetRelatedDeviceObject() followed
by IofCallDriver()-> my FSD Query_Security dispatch function.

But for a query security call for "Q:", the call-stack is:

ZwQuerySecurityObject->nt!KiSystemService->NtQuerySecurity->
IopGetSetSecurityObject->SeQuerySecurityDescriptorInfo()

So, for some reason, the IopGetSetSecurityObject() function
does NOT want to call my FSD?

This leads me to believe that there is something wrong about
my disk-device-object. Actually “q:” is a symlink to a named
device object (\Device\MyDisk) of type FILE_DEVICE_DISK. And
it is mounted (VPB flags has VPB_MOUNTED which seems to be set
by the I/O Mgr after returning from the FSDs mount-volume dispatch,
plus both DeviceObject & RealDevice are set).
However, this device object is NOT a PDO (I dont have a bus driver
or disk class driver). My FSD itself is creating this dev-obj.

Any clues? I am lost. I can send you the disassembly of
IopGetSetSecurityObject() if you are an assembler guru!

thanks.

-Vipul.

-----Original Message-----
From: Vipul [mailto:xxxxx@excite.com]
Sent: Monday, June 24, 2002 7:13 PM
To: File Systems Developers
Subject: [ntfsd] QUERY_SECURITY for a volume

Hi,

I have a IFS which supports Security (FileSystemAttributes
have the FILE_PERSISTENT_ACLS on). All security features are
working fine. Except that, I don’t see any QUERY_SECURITY or
SET_SECURITY IRPs for the root-directory of the mounted volume.

eg: (q: is the drive mounted by this IFS):

For querying/setting security descriptors on q:\dir1 or
q:\foo.txt, my File system driver gets the respective IRPs.

However, for just "q:", my FSD does NOT see any IRP,
and the Security descriptor shown via “q:”->Properties->Security
is a weird one (4 ACEs)…

Looks like the IO Manager or the Object Manager is NOT forwarding
my FSD these IRPs for JUST the root directory.

Any clues? My FSD is a legacy driver (not WDM or PnP).
Do I have to set any special flags on the device-objects
(for my disk object, and volume object)?

Thanks.

-Vipul.