Method HandlePreCreateOperation

PeaceMaker Kernel/FSFilter.cpp:124–227

This function is called prior to a create operation. Data - The data associated with the current operation. FltObjects - Objects related to the filter, instance, and its associated volume. CompletionContext - Optional context to be passed to post operation callbacks. */

	CompletionContext - Optional context to be passed to post operation callbacks.
*/
FLT_PREOP_CALLBACK_STATUS
FSBlockingFilter::HandlePreCreateOperation(
	_Inout_ PFLT_CALLBACK_DATA Data,
	_In_ PCFLT_RELATED_OBJECTS FltObjects,
	_Flt_CompletionContext_Outptr_ PVOID* CompletionContext
	)
{
	FLT_PREOP_CALLBACK_STATUS callbackStatus;
	PFLT_FILE_NAME_INFORMATION fileNameInfo;

	PUNICODE_STRING callerProcessPath;
	PSTACK_RETURN_INFO fileOperationStack;
	ULONG fileOperationStackSize;
	BOOLEAN reportOperation;

	UNREFERENCED_PARAMETER(FltObjects);
	UNREFERENCED_PARAMETER(CompletionContext);

	reportOperation = FALSE;
	fileOperationStackSize = MAX_STACK_RETURN_HISTORY;
	fileNameInfo = NULL;
	callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK;

	//
	// PeaceMaker is not designed to block kernel operations.
	//
	if (ExGetPreviousMode() == KernelMode)
	{
		return callbackStatus;
	}

	if (FlagOn(Data->Iopb->Parameters.Create.Options, FILE_DELETE_ON_CLOSE))
	{
		if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &fileNameInfo)))
		{
			if (FSBlockingFilter::FileStringFilters->MatchesFilter(fileNameInfo->Name.Buffer, FILTER_FLAG_DELETE) != FALSE)
			{
				DBGPRINT("FSBlockingFilter!HandlePreCreateOperation: Detected FILE_DELETE_ON_CLOSE of %wZ. Prevented deletion!", fileNameInfo->Name);

				Data->Iopb->TargetFileObject->DeletePending = FALSE;
				Data->IoStatus.Information = 0;
				Data->IoStatus.Status = STATUS_ACCESS_DENIED;
				callbackStatus = FLT_PREOP_COMPLETE;
				reportOperation = TRUE;
			}
		}
	}
	
	if (Data->Iopb->Parameters.Create.SecurityContext && FlagOn(Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess, FILE_EXECUTE))
	{
		if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &fileNameInfo)))
		{
			if (FSBlockingFilter::FileStringFilters->MatchesFilter(fileNameInfo->Name.Buffer, FILTER_FLAG_EXECUTE) != FALSE)
			{
				DBGPRINT("FSBlockingFilter!HandlePreCreateOperation: Detected FILE_EXECUTE desired access of %wZ. Prevented execute access!", fileNameInfo->Name);
				Data->Iopb->TargetFileObject->DeletePending = FALSE;
				Data->IoStatus.Information = 0;
				Data->IoStatus.Status = STATUS_ACCESS_DENIED;