Share Access Violation

NTFSD
1

Hi,

I have written a file system filter driver. It is similar to a FileMon
filter driver. Job of the File System filter driver is to monitor the
read/create calls from a specified user application.

At some point, when user application is accessing the files, my GUI
application has to write data to the same files that a user application is
accessing.

On IRP_MJ_CREATE, I am bypassing the share access control by setting the
currentIrpStack->Parameters.Create.ShareAccess to shareed mode always(like
currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
FILE_SHARE_READ )

This bypassing has worked for me for certain files(like .bik file, that used
to give SHARE_ACCESS_VIOLATION when bypassing share control was not in
place) but for some files(.m3d, .asi files) I still get the shared access
violation error whenever User application is running and my GUI application
tries to create the files (already opened by User application).

Do I need to bypass any other flag too?

I know there has been already some articles posted on this kind of problem.
Apart from bypassing the share access, they talk about emulating the share
access control in the filter and in their case, the file has been already
opened in exclusive mode and then they want to get around the share access
control. In my case, before the user application starts, I load up my
driver, so user application should open all files in share mode. Do I still
need to emulate the share access control in my filter. If yes, What all do I
need to do for it?

Please help me in resolving this problem. Let me know if somebody needs more
explanation on this.

Thanks,
Mahesh Bajaj

2

Try setting FILE_SHARE_DELETE and see if that helps.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mahesh Bajaj
Sent: Thursday, August 19, 2004 12:49 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Share Access Violation

Hi,

I have written a file system filter driver. It is similar to a FileMon
filter driver. Job of the File System filter driver is to monitor the
read/create calls from a specified user application.

At some point, when user application is accessing the files, my GUI
application has to write data to the same files that a user application
is
accessing.

On IRP_MJ_CREATE, I am bypassing the share access control by setting the
currentIrpStack->Parameters.Create.ShareAccess to shareed mode
always(like
currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
FILE_SHARE_READ )

This bypassing has worked for me for certain files(like .bik file, that
used
to give SHARE_ACCESS_VIOLATION when bypassing share control was not in
place) but for some files(.m3d, .asi files) I still get the shared
access
violation error whenever User application is running and my GUI
application
tries to create the files (already opened by User application).

Do I need to bypass any other flag too?

I know there has been already some articles posted on this kind of
problem.
Apart from bypassing the share access, they talk about emulating the
share
access control in the filter and in their case, the file has been
already
opened in exclusive mode and then they want to get around the share
access
control. In my case, before the user application starts, I load up my
driver, so user application should open all files in share mode. Do I
still
need to emulate the share access control in my filter. If yes, What all
do I
need to do for it?

Please help me in resolving this problem. Let me know if somebody needs
more
explanation on this.

Thanks,
Mahesh Bajaj

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks Neal for the reply.

I tried setting the FILE_SHARE_DELETE (Like
currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
FILE_SHARE_READ | FILESHARE_DELETE) ) but I still get the sharing violation
error (error no. 32 returned by GetLastError() )

Thanks,
Mahesh Bajaj

“Neal Christiansen” wrote in message
> news:xxxxx@ntfsd…
> Try setting FILE_SHARE_DELETE and see if that helps.
>
> Neal Christiansen
> Microsoft File System Filter Group Lead
> This posting is provided “AS IS” with no warranties, and confers no
> rights
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mahesh Bajaj
> Sent: Thursday, August 19, 2004 12:49 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Share Access Violation
>
> Hi,
>
> I have written a file system filter driver. It is similar to a FileMon
> filter driver. Job of the File System filter driver is to monitor the
> read/create calls from a specified user application.
>
> At some point, when user application is accessing the files, my GUI
> application has to write data to the same files that a user application
> is
> accessing.
>
> On IRP_MJ_CREATE, I am bypassing the share access control by setting the
> currentIrpStack->Parameters.Create.ShareAccess to shareed mode
> always(like
> currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
> FILE_SHARE_READ )
>
> This bypassing has worked for me for certain files(like .bik file, that
> used
> to give SHARE_ACCESS_VIOLATION when bypassing share control was not in
> place) but for some files(.m3d, .asi files) I still get the shared
> access
> violation error whenever User application is running and my GUI
> application
> tries to create the files (already opened by User application).
>
> Do I need to bypass any other flag too?
>
> I know there has been already some articles posted on this kind of
> problem.
> Apart from bypassing the share access, they talk about emulating the
> share
> access control in the filter and in their case, the file has been
> already
> opened in exclusive mode and then they want to get around the share
> access
> control. In my case, before the user application starts, I load up my
> driver, so user application should open all files in share mode. Do I
> still
> need to emulate the share access control in my filter. If yes, What all
> do I
> need to do for it?
>
> Please help me in resolving this problem. Let me know if somebody needs
> more
> explanation on this.
>
> Thanks,
> Mahesh Bajaj
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

Before modifying the currentIrpStack->Parameters.Create.ShareAccess value I
tried to check out its value. It looks like sharing violation error is
coming for the files that user application is trying to create with a share
access value of 5 (most likely FILE_READ_DATA(0x0001) |
FILE_APPEND_DATA(0x0004) )

I hope this small information may help you in analyzing the problem I am
facing.

Thanks,
Mahesh Bajaj

“Mahesh Bajaj” wrote in message news:…
> > Thanks Neal for the reply.
> >
> > I tried setting the FILE_SHARE_DELETE (Like
> > currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
> > FILE_SHARE_READ | FILESHARE_DELETE) ) but I still get the sharing
> violation
> > error (error no. 32 returned by GetLastError() )
> >
> > Thanks,
> > Mahesh Bajaj
> >
> >
> >
> >
> >
> > “Neal Christiansen” wrote in message
> > news:xxxxx@ntfsd…
> > Try setting FILE_SHARE_DELETE and see if that helps.
> >
> > Neal Christiansen
> > Microsoft File System Filter Group Lead
> > This posting is provided “AS IS” with no warranties, and confers no
> > rights
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Mahesh Bajaj
> > Sent: Thursday, August 19, 2004 12:49 PM
> > To: Windows File Systems Devs Interest List
> > Subject: [ntfsd] Share Access Violation
> >
> > Hi,
> >
> > I have written a file system filter driver. It is similar to a FileMon
> > filter driver. Job of the File System filter driver is to monitor the
> > read/create calls from a specified user application.
> >
> > At some point, when user application is accessing the files, my GUI
> > application has to write data to the same files that a user application
> > is
> > accessing.
> >
> > On IRP_MJ_CREATE, I am bypassing the share access control by setting the
> > currentIrpStack->Parameters.Create.ShareAccess to shareed mode
> > always(like
> > currentIrpStack->Parameters.Create.ShareAccess |= FILE_SHARE_WRITE |
> > FILE_SHARE_READ )
> >
> > This bypassing has worked for me for certain files(like .bik file, that
> > used
> > to give SHARE_ACCESS_VIOLATION when bypassing share control was not in
> > place) but for some files(.m3d, .asi files) I still get the shared
> > access
> > violation error whenever User application is running and my GUI
> > application
> > tries to create the files (already opened by User application).
> >
> > Do I need to bypass any other flag too?
> >
> > I know there has been already some articles posted on this kind of
> > problem.
> > Apart from bypassing the share access, they talk about emulating the
> > share
> > access control in the filter and in their case, the file has been
> > already
> > opened in exclusive mode and then they want to get around the share
> > access
> > control. In my case, before the user application starts, I load up my
> > driver, so user application should open all files in share mode. Do I
> > still
> > need to emulate the share access control in my filter. If yes, What all
> > do I
> > need to do for it?
> >
> > Please help me in resolving this problem. Let me know if somebody needs
> > more
> > explanation on this.
> >
> > Thanks,
> > Mahesh Bajaj
> >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
>
>