Re: !!! Somebody has an answer ? --> IoCreateNotification Event problem using it between ring0

In .NET we have fixed IoCreateNotificationEvent and
IoCreateSynchronizationEvent to always create a kernel handle. This means if
the driver calls this API in a random process context the handle is not
accidentally or maliciously closed. Only the driver can close the handle.

“Roddy, Mark” wrote in message news:xxxxx@ntdev…
>
> If you create the event in the process context of a user application then
> when that application closes the event will, as you observed, be deleted.
On
> process termination all handles created in that process context are
closed.
> This is the expected behavior.
>
> You can create the event in the system process context, but then you will
> discover that the default security on the object prevents most
applications
> from accessing the event :frowning:
>
> There exist undocumented nt apis that allow you to create the event in the
> kernel with more friendly security, but alas these methods are
undocumented.
> If you search this mail list you will find out how to do this.
>
> You could open the event twice in the driver: once to create it using the
> process context of the first application that accesses your driver, and
then
> a second time using a system process context. This ought to keep the event
> in existance for this system incarnation, or until your driver decides to
> close the system handle. It also ought to give the event the default
> security from the first application, which is probably what you want.
>
> > -----Original Message-----
> > From: Daniel Simard [mailto:xxxxx@matrox.com]
> > Sent: Wednesday, January 09, 2002 6:41 AM
> > To: NT Developers Interest List
> > Subject: [ntdev] !!! Somebody has an answer ? –>
> > IoCreateNotificationEvent problem using it between ring0 and ring3
> >
> >
> > I am creating an event with IoCreateNotificationEvent with the name
> > L"\BaseNamedObjects\EventX" into my WDM driver at open
> > time. After that
> > I
> > open the event into an MFC App by using OpenEvent(SYNCHRONIZE, FALSE,
> > “EventX”) and I wait on it. I then do a KePulseEvent into my
> > driver and
> > everything works fine into my app (it unblocks). I then close my app
> > (without closing the event object), and the at that moment
> > the event is
> > removed from \BaseNamedObjects directory. If I want to
> > reopen it from my app it is failing.
> >
> > I tryed to open it twice into my driver (to simulate a
> > increment refcount of the event object) and it is not working.
> >
> > The only workaround I found is to create the event at open
> > time and to
> > delete it at close time if the refcount of the driver is 0.
> > So I will be
> > recreated everytime someone open the driver.
> >
> > Is this a bug ? Is there another better workaround ?
> >
> > thanks
> >
> > —
> > You are currently subscribed to ntdev as:
> > xxxxx@stratus.com To unsubscribe send a blank email to
> > %%email.unsub%%
> >
>
>
>