STATUS_ACCESS_DENIED causes file deletion (minifilter driver)

[Eugene]

Hi,
I’m developing filesystem minifilter driver to control access to files. In
some cases I need to prevent write access to file. To do so I return
STATUS_ACCESS_DENIED from the preoperation callback routine as follows:

Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;

Unfortunately, as stated in the comment to WDK scanner minifilter sample,
"The effect of getting ERROR_ACCESS_DENIED for many apps to delete the file
they are trying to write usually". For instance, the file opened in the Far
manager internal editor will be deleted after an attempt to save changes if
the minifilter returns STATUS_ACCESS_DENIED.

Is there any way to prevent write access without deleting the file?
Thanks, Eugene

[Maxim S. Shatskih]

> Is there any way to prevent write access without deleting the file?

Surely, fail create with write bits in DesiredAccess, do not fail writes.

--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com

[Eugene]

> Surely, fail create with write bits in DesiredAccess, do not fail writes.
>

Thanks, Maxim!
It works well.
Eugene