Which flag in an IRP_MJ_CREATE IRP identifies an file deletion.

NTFSD
1

Hi,

I want to fail deletion operation toward some files. I was suggested to fail an IRP_MJ_CREATE operation. But I don’t know which flag in an IRP_MJ_CREATE IRP identifies a file deletion.

My codes is as follows:

// …

pIrpStack = IoGetCurrentIrpStackLocation(Irp);
pFileObj = pIrpStack->FileObject;
switch(pIrpStack->MajorFunction)
{
case IRP_MJ_CREATE:
pCompletionContext->enOperation = OPEN;

//
// Both flags do not work to block an file deletion
//
// if(pIrpStack->Parameters.Create.Options & FILE_DELETE_ON_CLOSE)
if(pFileObj->DeleteAccess)
goto BLOCK_REQUEST;

break;

}

// …

BLOCK_REQUEST:
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;

2

FILE_DELETE_ON_CLOSE in the create options.

Ho Mun Chuen
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
----- Original Message -----
From: “Chen”
To: “File Systems Developers”
Sent: Thursday, October 03, 2002 4:48 PM
Subject: [ntfsd] Which flag in an IRP_MJ_CREATE IRP identifies an file
deletion.

Hi,

I want to fail deletion operation toward some files. I was suggested to fail
an IRP_MJ_CREATE operation. But I don’t know which flag in an IRP_MJ_CREATE
IRP identifies a file deletion.

My codes is as follows:

// …

pIrpStack = IoGetCurrentIrpStackLocation(Irp);
pFileObj = pIrpStack->FileObject;
switch(pIrpStack->MajorFunction)
{
case IRP_MJ_CREATE:
pCompletionContext->enOperation = OPEN;

//
// Both flags do not work to block an file deletion
//
// if(pIrpStack->Parameters.Create.Options & FILE_DELETE_ON_CLOSE)
if(pFileObj->DeleteAccess)
goto BLOCK_REQUEST;

break;

}

// …

BLOCK_REQUEST:
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;

—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to %%email.unsub%%