Share read and write flags on IRP_MJ_CREATE

NTFSD
1

I’m intercepting IRP_MP_CREATEs and looking at the flags on the FILE_OBJECT.
It looks to me like you can’t rely on the SharedRead, SharedWrite or
SharedDelete to be accurately set. They seem to be set all the time.

Can anyone explain this weirdness?

Gene

2

These values & flags are usually set and/or updated by the FSD during CREATE
and CLEANUP processing. There are documented APIs which manipulate these
fields in the FILE_OBJECT(IoSetShareAccess, IoRemoveShareAccess,
IoCheckShareAccess). If you are expecting them to be “correct” in
pre-CREATE, you will be dissappointed. Also, the actual “summary” sharing
information for all open instances of the file is kept in the FCB/SCB data
private to the FSD. Because of this, the values you see in the FILE_OBJECT
do not represent the actual sharing mode of the file - just its contribution
to it.

/ted

-----Original Message-----
From: Gene Allen [mailto:xxxxx@bystormsoftware.com]
Sent: Tuesday, June 07, 2005 9:56 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Share read and write flags on IRP_MJ_CREATE

I’m intercepting IRP_MP_CREATEs and looking at the flags on the FILE_OBJECT.

It looks to me like you can’t rely on the SharedRead, SharedWrite or
SharedDelete to be accurately set. They seem to be set all the time.

Can anyone explain this weirdness?

Gene

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

Thanks Ted, that helps a lot. :slight_smile:

“Ted Hess” wrote in message news:xxxxx@ntfsd…
> These values & flags are usually set and/or updated by the FSD during
> CREATE
> and CLEANUP processing. There are documented APIs which manipulate these
> fields in the FILE_OBJECT(IoSetShareAccess, IoRemoveShareAccess,
> IoCheckShareAccess). If you are expecting them to be “correct” in
> pre-CREATE, you will be dissappointed. Also, the actual “summary” sharing
> information for all open instances of the file is kept in the FCB/SCB data
> private to the FSD. Because of this, the values you see in the FILE_OBJECT
> do not represent the actual sharing mode of the file - just its
> contribution
> to it.
>
> /ted
>
> -----Original Message-----
> From: Gene Allen [mailto:xxxxx@bystormsoftware.com]
> Sent: Tuesday, June 07, 2005 9:56 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Share read and write flags on IRP_MJ_CREATE
>
>
> I’m intercepting IRP_MP_CREATEs and looking at the flags on the
> FILE_OBJECT.
>
> It looks to me like you can’t rely on the SharedRead, SharedWrite or
> SharedDelete to be accurately set. They seem to be set all the time.
>
> Can anyone explain this weirdness?
>
> Gene
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@livevault.com To
> unsubscribe
> send a blank email to xxxxx@lists.osr.com
>