how to know "Open for write"?

NTFSD
1

Hi,

In a filesystem filter driver, is there a way to know the file was opened
for write
in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).

thx.

AFei

2

Hope the follow snippet helps shed some light on what you asked. You may not
care about attribute modification vs. data modification in your application.
The tricky ones are the truncation, supersede modes.

/ted

In preCREATE for any type of data/attribute modification:

writeOperation = ((desiredAccess & (FILE_WRITE_DATA | //
0x0002
FILE_WRITE_ATTRIBUTES |
// 0x0100
FILE_WRITE_EA |
// 0x0010
FILE_APPEND_DATA |
// 0x0004
DELETE |
// 0x00010000
WRITE_DAC |
// 0x00040000
WRITE_OWNER)) ||
// 0x00080000
(createDisposition != FILE_OPEN) || //
Modes 0 & 2-5
(createOptions & FILE_DELETE_ON_CLOSE)); //
0x00001000

In postCreate check for the special case of FILE_OPEN_IF with no write
access which creates a new file:

if ((createDisposition == FILE_OPEN_IF) &&
((desiredAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
FILE_WRITE_EA |
FILE_APPEND_DATA | DELETE | WRITE_DAC |
WRITE_OWNER)) == 0) &&
(Irp->IoStatus.Information != FILE_CREATED))
{
// Just a plain open of an existing file with no write access
requested
// Reset status set in PreCreate
}

And… Then there is SFM (Services For Macintosh) which diddles file
attributes on RO FileObjects (sigh!)

-----Original Message-----
From: AFei [mailto:xxxxx@hotmail.com]
Sent: Friday, July 16, 2004 2:37 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] how to know “Open for write”?

Hi,

In a filesystem filter driver, is there a way to know the file was opened
for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).

thx.

AFei

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

Writing to what? The data? Try FILE_WRITE_DATA.

GENERIC_WRITE gets translated, but I can open a file explicitly for
write without using generic rights.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Friday, July 16, 2004 2:37 PM
To: ntfsd redirect
Subject: [ntfsd] how to know “Open for write”?

Hi,

In a filesystem filter driver, is there a way to know the file was
opened for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).

thx.

AFei

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

4

Ted, that’s just what I want, very clear!
thanks a lot.

“Ted Hess” wrote in message news:xxxxx@ntfsd…
> Hope the follow snippet helps shed some light on what you asked. You may
not
> care about attribute modification vs. data modification in your
application.
> The tricky ones are the truncation, supersede modes.
>
> /ted
>
>
> In preCREATE for any type of data/attribute modification:
>
> writeOperation = ((desiredAccess & (FILE_WRITE_DATA | //
> 0x0002
> FILE_WRITE_ATTRIBUTES |
> // 0x0100
> FILE_WRITE_EA |
> // 0x0010
> FILE_APPEND_DATA |
> // 0x0004
> DELETE |
> // 0x00010000
> WRITE_DAC |
> // 0x00040000
> WRITE_OWNER)) ||
> // 0x00080000
> (createDisposition != FILE_OPEN) || //
> Modes 0 & 2-5
> (createOptions & FILE_DELETE_ON_CLOSE)); //
> 0x00001000
>
> In postCreate check for the special case of FILE_OPEN_IF with no write
> access which creates a new file:
>
> if ((createDisposition == FILE_OPEN_IF) &&
> ((desiredAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
> FILE_WRITE_EA |
> FILE_APPEND_DATA | DELETE | WRITE_DAC |
> WRITE_OWNER)) == 0) &&
> (Irp->IoStatus.Information != FILE_CREATED))
> {
> // Just a plain open of an existing file with no write access
> requested
> // Reset status set in PreCreate
> }
>
> And… Then there is SFM (Services For Macintosh) which diddles file
> attributes on RO FileObjects (sigh!)
>
> -----Original Message-----
> From: AFei [mailto:xxxxx@hotmail.com]
> Sent: Friday, July 16, 2004 2:37 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] how to know “Open for write”?
>
>
> Hi,
>
> In a filesystem filter driver, is there a way to know the file was opened
> for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).
>
> thx.
>
> AFei
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@livevault.com To
unsubscribe
> send a blank email to xxxxx@lists.osr.com
>

5

Tony, I got it. thanks!

“Tony Mason” wrote in message news:xxxxx@ntfsd…
Writing to what? The data? Try FILE_WRITE_DATA.

GENERIC_WRITE gets translated, but I can open a file explicitly for
write without using generic rights.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Friday, July 16, 2004 2:37 PM
To: ntfsd redirect
Subject: [ntfsd] how to know “Open for write”?

Hi,

In a filesystem filter driver, is there a way to know the file was
opened for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).

thx.

AFei

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

6

AFei

Just because a file is not opened for write data access doesn’t mean you
won’t see write IRPs on that file object. A filter above you can do
this as well as MM.

Neal Christiansen
Microsoft File System Filter Group Lead This posting is provided “AS IS”
with no warranties, and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Friday, July 16, 2004 3:00 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] how to know “Open for write”?

Ted, that’s just what I want, very clear!
thanks a lot.

“Ted Hess” wrote in message news:xxxxx@ntfsd…
> Hope the follow snippet helps shed some light on what you asked. You
may
not
> care about attribute modification vs. data modification in your
application.
> The tricky ones are the truncation, supersede modes.
>
> /ted
>
>
> In preCREATE for any type of data/attribute modification:
>
> writeOperation = ((desiredAccess & (FILE_WRITE_DATA | //
> 0x0002
> FILE_WRITE_ATTRIBUTES |
> // 0x0100
> FILE_WRITE_EA |
> // 0x0010
> FILE_APPEND_DATA |
> // 0x0004
> DELETE |
> // 0x00010000
> WRITE_DAC |
> // 0x00040000
> WRITE_OWNER)) ||
> // 0x00080000
> (createDisposition != FILE_OPEN) || //
> Modes 0 & 2-5
> (createOptions & FILE_DELETE_ON_CLOSE)); //
> 0x00001000
>
> In postCreate check for the special case of FILE_OPEN_IF with no write
> access which creates a new file:
>
> if ((createDisposition == FILE_OPEN_IF) &&
> ((desiredAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
> FILE_WRITE_EA |
> FILE_APPEND_DATA | DELETE | WRITE_DAC |
> WRITE_OWNER)) == 0) &&
> (Irp->IoStatus.Information != FILE_CREATED))
> {
> // Just a plain open of an existing file with no write access
> requested
> // Reset status set in PreCreate
> }
>
> And… Then there is SFM (Services For Macintosh) which diddles file
> attributes on RO FileObjects (sigh!)
>
> -----Original Message-----
> From: AFei [mailto:xxxxx@hotmail.com]
> Sent: Friday, July 16, 2004 2:37 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] how to know “Open for write”?
>
>
> Hi,
>
> In a filesystem filter driver, is there a way to know the file was
opened
> for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).
>
> thx.
>
> AFei
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@livevault.com To
unsubscribe
> send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Yes, It’s a problem if any above filters generate IRPs to modify a file.
As an example, the file system encryption/decryption drivers should do
their real works in READ/WRITE IRPs, please notify me if I was in
the wrong direction, I’m going to try it. thx.

“Neal Christiansen” wrote in message
news:xxxxx@ntfsd…
AFei

Just because a file is not opened for write data access doesn’t mean you
won’t see write IRPs on that file object. A filter above you can do
this as well as MM.

Neal Christiansen
Microsoft File System Filter Group Lead This posting is provided “AS IS”
with no warranties, and confers no rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Friday, July 16, 2004 3:00 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] how to know “Open for write”?

Ted, that’s just what I want, very clear!
thanks a lot.

“Ted Hess” wrote in message news:xxxxx@ntfsd…
> Hope the follow snippet helps shed some light on what you asked. You
may
not
> care about attribute modification vs. data modification in your
application.
> The tricky ones are the truncation, supersede modes.
>
> /ted
>
>
> In preCREATE for any type of data/attribute modification:
>
> writeOperation = ((desiredAccess & (FILE_WRITE_DATA | //
> 0x0002
> FILE_WRITE_ATTRIBUTES |
> // 0x0100
> FILE_WRITE_EA |
> // 0x0010
> FILE_APPEND_DATA |
> // 0x0004
> DELETE |
> // 0x00010000
> WRITE_DAC |
> // 0x00040000
> WRITE_OWNER)) ||
> // 0x00080000
> (createDisposition != FILE_OPEN) || //
> Modes 0 & 2-5
> (createOptions & FILE_DELETE_ON_CLOSE)); //
> 0x00001000
>
> In postCreate check for the special case of FILE_OPEN_IF with no write
> access which creates a new file:
>
> if ((createDisposition == FILE_OPEN_IF) &&
> ((desiredAccess & (FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
> FILE_WRITE_EA |
> FILE_APPEND_DATA | DELETE | WRITE_DAC |
> WRITE_OWNER)) == 0) &&
> (Irp->IoStatus.Information != FILE_CREATED))
> {
> // Just a plain open of an existing file with no write access
> requested
> // Reset status set in PreCreate
> }
>
> And… Then there is SFM (Services For Macintosh) which diddles file
> attributes on RO FileObjects (sigh!)
>
> -----Original Message-----
> From: AFei [mailto:xxxxx@hotmail.com]
> Sent: Friday, July 16, 2004 2:37 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] how to know “Open for write”?
>
>
> Hi,
>
> In a filesystem filter driver, is there a way to know the file was
opened
> for write in IRP_MJ_CREATE? (mapping from GENERIC_WRITE flag).
>
> thx.
>
> AFei
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@livevault.com To
unsubscribe
> send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com