Re: File filter driver or MUP network redirector?

Any access control procedures must be applied in MJ_CREATE and
FastIoQueryOpen only.

Applying access control in, say, write path is a bad idea, since the file
was already opened for write.

So, block opens-for-write, not writes. This is what NTFS ACLs do.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com

"mike h" <mikeh@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6E93383D-72BB-4DAF-82F7-9C42E97DD530@xxxxxxxxxxxxxxxx
Hi
I have a design session coming up where the ultimate aim is to protect parts
of the file system from prying eyes using either a MUP network redirector (
assuming file system mounted through remoted shares) or a file system filter
driver using filter manager.
I need to clear up some assumptions :
Is mup a client or server side ( or both ? ) technology ? I understand I
need to write a network redirector driver that owns a VNC path and will
manage access to that path. If the unc path is on a file server - what needs
to be done at the file server ?

The file mini filter will need to intercept all calls to the filesystem. I
have big fears about all the different MJ call types I will have to handle -
fast IO, asynch io etc. What is the best plan to handle this - my opinion is
to route them all through a common procedure and allow/disallow access as
appropriate ut this can be a lot of different calls which expect different
handling. This may lead to deadlocks and performance problems if not very
carefully handled on a busy fileserver.
The major benefit to me of the latter is that it can be installed everywhere
- so a common build.
Any commentsw or guidance as when to use one and when to use the other. The
WDK docs on MUP haven't been terribly clear to me yet.
regards
Mike


.