sfilter sample - winddk - restrict specific file rename

NTFSD
1

Hi,

I am newbie to file system filter driver and using winddk sfilter sample to
control file access. I want that any user should not be able to rename certain
files For ex. dont allow to rename file with extension .doc.?
How should I do that? How should I handle Irps??

Following is code for?IRP_MJ_SET_INFORMATION.

NTSTATUS
SfSetInfo (
??? __in PDEVICE_OBJECT DeviceObject,
??? __in PIRP Irp
??? )
{
??? PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);
??? BOOLEAN IsRename = (irpSp->Parameters.SetFile.FileInformationClass ==
FileRenameInformation);
??? PFILE_OBJECT FileObject = irpSp->FileObject;
??? PWSTR FileName = NULL;
??? PWSTR Extension = NULL;
??? NTSTATUS Status = STATUS_SUCCESS;
??? BOOLEAN Restrict = FALSE;

???

??? if (IsRename) {
??? ??? if(??? FileObject->FileName.Length != 0 )//&& (FileObject->Flags &
FO_REMOTE_ORIGIN)){
??? ??? {??? ??? ???
??? ??? ??? FileName =
ExAllocateFromPagedLookasideList(&gSfNameBufferLookasideList);
??? ??? ??? if (!FileName)
??? ??? ??? {
??? ??? ??? ??? KdPrint((“sfilter!SfSetInformation:
STATUS_INSUFFICIENT_RESOURCES\n”));
??? ??? ??? ??? //Status = STATUS_INSUFFICIENT_RESOURCES;??? ??? ??? ???
??? ??? ??? }

??? ??? ??? Extension =
ExAllocateFromPagedLookasideList(&gSfNameBufferLookasideList);
??? ??? ??? if (!Extension)
??? ??? ??? {
??? ??? ??? ??? KdPrint((“sfilter!SfSetInformation:
STATUS_INSUFFICIENT_RESOURCES\n”));
??? ??? ??? ??? //Status = STATUS_INSUFFICIENT_RESOURCES;??? ??? ??? ???
??? ??? ??? }

??? ??? ??? RtlZeroMemory(FileName, MAX_PATH * sizeof(WCHAR));
??? ??? ??? RtlZeroMemory(Extension, MAX_PATH * sizeof(WCHAR));
??? ??? ??? wcsncpy(Extension, L".doc",4);
??? ??? ???
wcsncpy(FileName,FileObject->FileName.Buffer,FileObject->FileName.Length);

??? ??? ??? if(wcsstr(FileName,Extension) != NULL)
??? ??? ??? {
??? ??? ??? ??? Irp->IoStatus.Status = STATUS_NO_SUCH_FILE;
??? ??? ??? ??? Status = STATUS_NO_SUCH_FILE;??? ??? ??? ???
??? ??? ??? ??? DbgPrint(“Rename file : %wZ”,&FileObject->FileName);??? ??? ???
???
??? ??? ??? ??? Restrict = TRUE;
??? ??? ??? }
??? ??? ??? else{
??? ??? ??? ??? DbgPrint(“Rename file not doc : %wZ”,&FileObject->FileName);???
??? ??? ???
??? ??? ??? }

??? ??? ??? if (FileName)
??? ??? ??? ??? ExFreeToPagedLookasideList(&gSfNameBufferLookasideList,
FileName);

??? ??? ??? if (Extension)
??? ??? ??? ??? ExFreeToPagedLookasideList(&gSfNameBufferLookasideList,
Extension);

??? ??? ??? if(Restrict == TRUE)
??? ??? ??? {
??? ??? ??? ??? IoCompleteRequest(Irp, IO_NO_INCREMENT);
??? ??? ??? ??? return Status;
??? ??? ??? }
??? ??? }
??? }

??? IoSkipCurrentIrpStackLocation( Irp );
??? return IoCallDriver( ((PSFILTER_DEVICE_EXTENSION)
DeviceObject->DeviceExtension)->NLExtHeader.AttachedToDeviceObject,
??? Irp );

}

Thanks,
Devang

2

Can anyone read this ?

3

Yup, we can see it.

Now, to the OP… Why not use a minifilter ? In general if you’re going to
start a new project then minifilters are the way to go…

Thanks,
Alex.

4

Maybe the reason being…for a newbie a legacy filter will help him learn
more.
Like he has to make sure FS is mounted before filter attaches…so he must
read something about mount process.

On Fri, Nov 12, 2010 at 9:28 PM, Alex Carp wrote:

> Yup, we can see it.
>
> Now, to the OP… Why not use a minifilter ? In general if you’re going to
> start a new project then minifilters are the way to go…
>
> Thanks,
> Alex.
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>