Word and Save as

NTFSD
1

Hi all!

I’ve written a mini-filter driver than denies writes to *.Doc files by
denying accesses when Write Access is requested (I’m doing this in a post
completation routine for IRP_MJ_CREATE via the FltCancelFileOpen.)

When I open a doc file with Word…sure enough…it comes up Read-only and
if I attempt to save the file…access is denied…just like what I want. :slight_smile:

However, if I do a “Save As” and change the name to a non-existing file name
like C:\TEST.DOC (which is a doc file and hence shouldn’t be allowed) Word
is somehow able to get past my filter denials and writing the file.

According to filemon, it looks like I’m denying the IRP_MJ_CREATEs most of
the time but somewhere a IRP_MJ_CREATE with “Options: Open Access: All” gets
thru.with a SUCCESS. I’m assuming that at this point the file is created
and Word starts it’s magic memory mapped file access to put the contents on
it.

My question…how is a doc file getting created when I’m canceling
IRP_MJ_CREATEs if the PFILE_OBJECT->WriteAccess flag is set?

I could have understood a empty file being created since I’m not explicitly
denying Creates, but Writes.

Any ideas?

thanks

2

Have you read Nagar’s book? Have you read the IFS FAQ? Have you read the
posts about active file system filters in this newsgroup? Have you ever
used filemon from Sysinternals? This is far too elementary a question and
must be answered before you design your filter. Also think about
OpenOffice, WordPad, and all the various versions of Microsoft Office that
can read and/or write .DOC files.

“Gene Allen” wrote in message
news:xxxxx@ntfsd…
> Hi all!
>
> I’ve written a mini-filter driver than denies writes to *.Doc files by
> denying accesses when Write Access is requested (I’m doing this in a post
> completation routine for IRP_MJ_CREATE via the FltCancelFileOpen.)
>
> When I open a doc file with Word…sure enough…it comes up Read-only and
> if I attempt to save the file…access is denied…just like what I want.
> :slight_smile:
>
> However, if I do a “Save As” and change the name to a non-existing file
> name like C:\TEST.DOC (which is a doc file and hence shouldn’t be allowed)
> Word is somehow able to get past my filter denials and writing the file.
>
> According to filemon, it looks like I’m denying the IRP_MJ_CREATEs most of
> the time but somewhere a IRP_MJ_CREATE with “Options: Open Access: All”
> gets thru.with a SUCCESS. I’m assuming that at this point the file is
> created and Word starts it’s magic memory mapped file access to put the
> contents on it.
>
> My question…how is a doc file getting created when I’m canceling
> IRP_MJ_CREATEs if the PFILE_OBJECT->WriteAccess flag is set?
>
> I could have understood a empty file being created since I’m not
> explicitly denying Creates, but Writes.
>
> Any ideas?
>
> thanks
>
>
>

3

> but somewhere a IRP_MJ_CREATE with “Options: Open Access: All” gets

thru.with a SUCCESS.

This must be your start. Find where and why.

L.

4

> My question…how is a doc file getting created when I’m canceling

IRP_MJ_CREATEs if the PFILE_OBJECT->WriteAccess flag is set?

Test Parameters.Create.DesiredAccess instead.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com