Re: can I wait an event object in a different driver?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

I think they can see the name and then create a symbolic link that will be
valid in user mode. Also using security on the name can help keep user mode
from playing with it. Try objdir from OSR or the one from sysinternals and
see if your event is exposed. If so, I think they can create a symbolic
link unless security stops them because of the ACL on the name.

"Ray Trent" <ratrent@xxxxxxxxxxxxx> wrote in message
news:%23ac3CucRFHA.3944@xxxxxxxxxxxxxxxxxxxxxxx
> Just curious: if a UM app can open any object anywhere in the namespace,
> why do we have to bother with creating a symbolic link to expose a device
> to user mode?
>
> I was under the impression that UM apps had access to a limited subset of
> the object namespace...
>
> Doron Holan [MS] wrote:
>> it doesn't matter. the \Device name is for devices, not for other types
>> of devices. If 2 drivers are sharing an event, have one driver open the
>> other, send a custom IOCTL and just pass the PKEVENT back to the caller.
>> This way you do not surface a name. Once you create a named object,
>> *anyone* can open it, including user mode. probably not what you want to
>> happen.
>>
>> d
>>
>
> --
> ../ray\..


.

Relevant Pages

  • Re: can I wait an event object in a different driver?
    ... I think they can see the name and then create a symbolic link that will be ... Also using security on the name can help keep user mode ... link unless security stops them because of the ACL on the name. ... Once you create a named object, ...
    (microsoft.public.development.device.drivers)
  • Re: HardBound and SoftBound (was "The State of Software")
    ... I think this is a good argument for doing such checks in hardware, like HardBound, not in software, like SoftBound. ... From time to time people propose that there is no need for hardware support for security at the OS level - i.e. no need for kernel mode versus user mode. ...
    (comp.arch)
  • Re: [PATCH 0/12: eCryptfs] eCryptfs version 0.1.6
    ... I just want to make some notes about the user mode interface. ... I think that current security and encryption solutions that ... create a false sense of security for users. ... should first be designed so that a smart card can be used, ...
    (Linux-Kernel)
  • Re: API Calls Hooking
    ... The official security system of Windows is yet another ... drivers) from receiving semantically invalid requests from user mode. ... Restricting processes based on the code being loaded into those ... There is any legitimate way to make API function Callbacks (w/ filtering) ...
    (microsoft.public.development.device.drivers)
  • UML discussion
    ... I've been playing with user mode all week and I'm wondering what others ... of it from a security viewpoint. ... networking etc in UML ... In summary it's a virtual networking security playground. ...
    (Security-Basics)