Why cannot open the file at second time?

NTFSD
1

Hi all,
Does any one know this:
I want to block IRP_MJ_WRITE to the specific files and write the same thing
to same name network files.
Every thing is OK when I block the first IRP_MJ_WRITE to a file:
ZwCreateFile(network file), ZwWriteFile(network file), ZwClose(network
file);
But after that when I block the following IRP_MJ_WRITE to the same file , I
cannot open the same network file any more. why?

Thanks to any reply.

Laura Gao

Do You Yahoo!?

Get your free @yahoo.com address at http://mail.yahoo.com

2

What context are you in when you perform the ZwCreateFile? Are you
seeing an access_denied error? It could be you don’t have the correct
permissions.

And you may not when you are in the system thread such as the lazy
writer or modified page writer but you may have the correct permissions
while in the user calling thread context.

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>-----Original Message-----
>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>xxxxx@lists.osr.com] On Behalf Of gaoren
>Sent: Tuesday, June 11, 2002 3:09 PM
>To: File Systems Developers
>Subject: [ntfsd] Why cannot open the file at second time?
>
>Hi all,
>Does any one know this:
>I want to block IRP_MJ_WRITE to the specific files and write the same
>thing
>to same name network files.
>Every thing is OK when I block the first IRP_MJ_WRITE to a file:
>ZwCreateFile(network file), ZwWriteFile(network file), ZwClose(network
>file);
>But after that when I block the following IRP_MJ_WRITE to the same
file ,
>I
>cannot open the same network file any more. why?
>
>Thanks to any reply.
>
>Laura Gao
>
>
>
>_________________________________________________________
>
>Do You Yahoo!?
>
>Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>To unsubscribe send a blank email to %%email.unsub%%

3

Oh, yes. I think the second time ZwCreateFile is in the context of system
thread of lazy writer. Can I get the permission in this situation?

Thanks a lot.
Laura

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Peter Scott
Sent: Wednesday, June 12, 2002 6:40 PM
To: File Systems Developers
Subject: [ntfsd] RE: Why cannot open the file at second time?

What context are you in when you perform the ZwCreateFile? Are you
seeing an access_denied error? It could be you don’t have the correct
permissions.

And you may not when you are in the system thread such as the lazy
writer or modified page writer but you may have the correct permissions
while in the user calling thread context.

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>-----Original Message-----
>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>xxxxx@lists.osr.com] On Behalf Of gaoren
>Sent: Tuesday, June 11, 2002 3:09 PM
>To: File Systems Developers
>Subject: [ntfsd] Why cannot open the file at second time?
>
>Hi all,
>Does any one know this:
>I want to block IRP_MJ_WRITE to the specific files and write the same
>thing
>to same name network files.
>Every thing is OK when I block the first IRP_MJ_WRITE to a file:
>ZwCreateFile(network file), ZwWriteFile(network file), ZwClose(network
>file);
>But after that when I block the following IRP_MJ_WRITE to the same
file ,
>I
>cannot open the same network file any more. why?
>
>Thanks to any reply.
>
>Laura Gao
>
>
>
>_________________________________________________________
>
>Do You Yahoo!?
>
>Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
To unsubscribe send a blank email to %%email.unsub%%

Do You Yahoo!?

Get your free @yahoo.com address at http://mail.yahoo.com

4

The problem is that the permissions are not the same between your
calling process and the system process.

You will have to impersonate the calling thread in your process, to get
the correct permissions.

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>-----Original Message-----
>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>xxxxx@lists.osr.com] On Behalf Of gaoren
>Sent: Thursday, June 13, 2002 6:51 AM
>To: File Systems Developers
>Subject: [ntfsd] RE: Why cannot open the file at second time?
>
>Oh, yes. I think the second time ZwCreateFile is in the context of
system
>thread of lazy writer. Can I get the permission in this situation?
>
>Thanks a lot.
>Laura
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Peter Scott
>Sent: Wednesday, June 12, 2002 6:40 PM
>To: File Systems Developers
>Subject: [ntfsd] RE: Why cannot open the file at second time?
>
>
>
>What context are you in when you perform the ZwCreateFile? Are you
>seeing an access_denied error? It could be you don’t have the correct
>permissions.
>
>And you may not when you are in the system thread such as the lazy
>writer or modified page writer but you may have the correct
permissions
>while in the user calling thread context.
>
>Pete
>
>Peter Scott
>xxxxx@KernelDrivers.com
>http://www.KernelDrivers.com
>
>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>>>xxxxx@lists.osr.com] On Behalf Of gaoren
>>>Sent: Tuesday, June 11, 2002 3:09 PM
>>>To: File Systems Developers
>>>Subject: [ntfsd] Why cannot open the file at second time?
>>>
>>>Hi all,
>>>Does any one know this:
>>>I want to block IRP_MJ_WRITE to the specific files and write the
same
>>>thing
>>>to same name network files.
>>>Every thing is OK when I block the first IRP_MJ_WRITE to a file:
>>>ZwCreateFile(network file), ZwWriteFile(network file),
ZwClose(network
>>>file);
>>>But after that when I block the following IRP_MJ_WRITE to the same
>file ,
>>>I
>>>cannot open the same network file any more. why?
>>>
>>>Thanks to any reply.
>>>
>>>Laura Gao
>>>
>>>
>>>
>>>_________________________________________________________
>>>
>>>Do You Yahoo!?
>>>
>>>Get your free @yahoo.com address at http://mail.yahoo.com
>>>
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>>>To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
>To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>_________________________________________________________
>
>Do You Yahoo!?
>
>Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>To unsubscribe send a blank email to %%email.unsub%%

5

This is probably not a security problem, but a problem accessing the file
for read or write without the proper sharing on the first instance.

-----Original Message-----
From: Peter Scott [mailto:xxxxx@KernelDrivers.com]
Sent: Thursday, June 13, 2002 12:57 PM
To: File Systems Developers
Subject: [ntfsd] RE: Why cannot open the file at second time?

The problem is that the permissions are not the same between your
calling process and the system process.

You will have to impersonate the calling thread in your process, to get
the correct permissions.

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>-----Original Message-----
>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>xxxxx@lists.osr.com] On Behalf Of gaoren
>Sent: Thursday, June 13, 2002 6:51 AM
>To: File Systems Developers
>Subject: [ntfsd] RE: Why cannot open the file at second time?
>
>Oh, yes. I think the second time ZwCreateFile is in the context of
system
>thread of lazy writer. Can I get the permission in this situation?
>
>Thanks a lot.
>Laura
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Peter Scott
>Sent: Wednesday, June 12, 2002 6:40 PM
>To: File Systems Developers
>Subject: [ntfsd] RE: Why cannot open the file at second time?
>
>
>
>What context are you in when you perform the ZwCreateFile? Are you
>seeing an access_denied error? It could be you don’t have the correct
>permissions.
>
>And you may not when you are in the system thread such as the lazy
>writer or modified page writer but you may have the correct
permissions
>while in the user calling thread context.
>
>Pete
>
>Peter Scott
>xxxxx@KernelDrivers.com
>http://www.KernelDrivers.com
>
>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>>>xxxxx@lists.osr.com] On Behalf Of gaoren
>>>Sent: Tuesday, June 11, 2002 3:09 PM
>>>To: File Systems Developers
>>>Subject: [ntfsd] Why cannot open the file at second time?
>>>
>>>Hi all,
>>>Does any one know this:
>>>I want to block IRP_MJ_WRITE to the specific files and write the
same
>>>thing
>>>to same name network files.
>>>Every thing is OK when I block the first IRP_MJ_WRITE to a file:
>>>ZwCreateFile(network file), ZwWriteFile(network file),
ZwClose(network
>>>file);
>>>But after that when I block the following IRP_MJ_WRITE to the same
>file ,
>>>I
>>>cannot open the same network file any more. why?
>>>
>>>Thanks to any reply.
>>>
>>>Laura Gao
>>>
>>>
>>>
>>>_________________________________________________________
>>>
>>>Do You Yahoo!?
>>>
>>>Get your free @yahoo.com address at http://mail.yahoo.com
>>>
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>>>To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
>To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>_________________________________________________________
>
>Do You Yahoo!?
>
>Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@1vision.com
To unsubscribe send a blank email to %%email.unsub%%