FltSetInformationFile fails with STATUS_ACCESS_DENIED

NTFSD
1

Hi All,

I am trying to rename file in PostCleanup operation. For that I open the file handle and call FltSetInformationFile. But it fails with error code STATUS_ACCESS_DENIED.

InitializeObjectAttributes(
&ObjectAttribs,
(PUNICODE_STRING)pFilePath,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
0,
0
);

NTStatus = FltCreateFileEx(
s_filter->GetInstance(),
pVolume->GetInstance(),
&hFileHandle,
&pFileObject,
FILE_GENERIC_READ | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES,
&ObjectAttribs,
&IoStatus,
0,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FO_NO_INTERMEDIATE_BUFFERING,
0,
0,
0
);

if (!NT_SUCCESS(NTStatus))
{
__leave;
}

//
// Some Code
//

status = FltSetInformationFile(
pVolume->GetInstance(),
pFileObject,
renameInfo,
renameFileLength,
FileRenameInformation);
if (!NT_SUCCESS(status))
{
__leave;
}

Here I exclusively open the same file for which PostCleanup is called and then I try to rename it using FltSetInformationFile. Not sure why FltSetInformationFile should fail with error code STATUS_ACCESS_DENIED. If anyone have any pointers, please let me know.

Thanks & Regards,
Amit Kulkarni.

2

> I am trying to rename file in PostCleanup operation. For that I open the

file handle and call FltSetInformationFile. But it fails with error code
STATUS_ACCESS_DENIED.

Of course by post cleanup (or indeed at any time) the file may have been
renamed and so you’ll be opened the wrong file.

Also:

  • If its a directory it may have children still open.
  • There may be an ACL on the file
  • If this is the network you may just not have permission to open the file
    (you did say it was the rename but…)
  • If it’s on NTFS you can arrange for NTFS to breakpoint on that status (I
    can’t remember how but if you look at the NTFS symbols it becomes reasonably
    obvious)
  • And so on.

Is the failure occasional or systemic? Does the rename work at other times?