Hmmm… Since there is no way to know the accessor’s intention when
opening a file (you can look at the requested access and get an idea, but
fuzzy logic doesn’t really help, I know), you may have to consider another
approach. Perhaps you could allow the open to succeed, but if the file
meets whatever condition you are looking for, make an entry for that file’s
FCB in a hash table or some similar data structure. Then you can
selectively allow or disallow any subsequent IO by looking for the presence
of the target FCB in you table and making a decision if the FCB is present.
For example, you could pass thru a set disposition irp, but reject all
others with access denied.
Just a thought.
-Joel
-----Original Message-----
From: Miguel Angel M?ndez Gil [mailto:xxxxx@seg.inf.cu]
Sent: Thursday, October 12, 2000 12:05 PM
To: File Systems Developers
Subject: [ntfsd] Problems deleting files
Hello,
I’m developing a File System Filter Driver, I hook the function
IRP_MJ_CREATE in order to processes files when opened or created, and
depending of certain conditions the operation is aborted. The problem is
when I tried to delete a file that match the desired condition, the
operation is aborted too, and I can’t delete the file.
We know that the idea is to send first a CLEANUP and then a CLOSE, but we
still don’t know if the file is being created, read or deleted.
Please help us.