Volume Security Descriptor and Length setting

[kolbycheesey]

Hello,

I have a question about the DOKAN_OPTIONS "VolumeSecurityDescriptorLength" and "VolumeSecurityDescriptor" on initialization I am trying to set the Volume Security so that I can let Dokan take care of the rest. The issue that I am running into (not understanding) is after finding the PSECURITY_DESCRIPTOR SecurityDescriptor (of the C drive using "GetNameSecurityInfoA()") and finding the length of that security descriptor (using GetSecurityDescriptorLength()) when I set the "VolumeSecurityDescriptorLength" Dokany throws "DokanError: Ioctl 0x92014 failed with code 1305 on DEvice \.\Dokan_2". The Doakn error corresponds to DOKAN_START_ERROR but the length that is being saved is 0x14, it is a DWORD being saved to a ULONG.

Would someone be able to point me in the direction of an efficient way to set these two DOKAN_OPTIONS, other than this I am able to mount create and delete files and folders, but do to this security issue of not have a baseline I am unable to write to any created file because they only belong to "Authorized Users" under the Security tab even though is is owned by "User: Kolbycheesey"

[kolbycheesey]

As a follow up a better question on my end is how are both the Dokan Mirror and Memfs samples setting the security of the volume without any input? This is something that is blocking me from being able to open and write to files, any assistance is appreciated greatly.

[Liryna]

Hi @kolbycheesey, those parameters are optional. What is the reason you want to set them ? Usually it is to limit the access of the whole drive. None of the samples are using it.

If you want to limit the access of the files in the drive, please look at how the library set it when the GetFileSecurity is not implemented https://github.com/dokan-dev/dokany/blob/master/dokan/security.c#L30

[Liryna]

And on the same computer you are not facing this issue with memfs or mirrorfs right ?
If you haven't implemented GetFileSecurity or SetFileSecurity then I believe the error you are seeing is due to one of the other calls to returning the proper information and makes those applications misbehave and wrongly report a security error.

I would suggest using procmon and comparing the activity between your filesystem and one of the samples.

[kolbycheesey]

I had not implemented them, I was letting Dokan build an sddl for me. I will definitely look into procmon and comparing what I am working on and the samples.

[kolbycheesey]

@Liryna Thank you for all of your help I was able to figure out that issue. I do have one follow up question I am noticing that when I copy and paste a directory or file it just pulls the attributes and tries to create a file in the new location with the existing attributes. Which if you have a filesystem that does not have Windows file attributes causing great pain. Is there a way Createfile will let you know that it is creating a copied file?

[Liryna]

No, it is really read from sources and create + write to destinations 😢 You don't have a clear info that a copy is made.

[kolbycheesey]

Thank you, I guess I will have to try and find a way around it.

[kolbycheesey]

@Liryna last question, I have added a variable definition for PWIN32_FIND_STREAM_DATA in the dokan.h file just above the *PFillFindStreamData function definition.

When building using Microsoft Visual Studio the error recieved is:
error 2122: 'PVOID': prototype parameter in name list illegal
Below is how the includes are added, but moving the dokan includes below the Windows includes doesn't take away the error it just adds problems with the NTSTATUS handling. I am wondering if anyone else has seemed to have this issue or if there is something that I am missing?

The way the includes are formatted is

#include <dokan\dokan.h>
#include <dokan\fileinfo.h>

#include <windows.h>
#include <winbase.h>
#include <winnt.h>
#include <sddl.h>
#include <securitybaseapi.h>
#include <tchar.h>

#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>
#include <string.h>
#include <wchar.h>

[LTRData]

Okay, yes there are differences in latest versions of the SDK and WDK. For example, many macros are now defined by default Windows headers instead of the "special" ntstatus.h. To avoid this, you need to define WIN32_NO_STATUS before importing Windows headers:
#define WIN32_NO_STATUS

Try that and report back if you get any further similar errors. There are a couple of similar macros to control where Windows headers define various shared marcros nowadays.

[kolbycheesey]

@LTRData, that information did help silence the extra errors. Which I see that exact sort of setup in dokan.h however now trying to include windows.h winbase.h and fileapi.h still results in the same error 2122 at line 228 in dokan.h that you can see at the end of the last output

[LTRData]

You included windows.h and winbase.h before dokan.h?

[kolbycheesey]

@LTRData yes it looks like this

#define WIN32_NO_STATUS
#include <windows.h>
#include <winbase.h>
#include <fileapi.h>

#include <dokan\dokan.h>
#include <dokan\fileinfo.h>

and this is the error I get
C:\Program Files\Dokan\Dokan Library-2.0.4\include\dokan\dokan.h(228): error C2122: 'PVOID': prototype parameter in name list illegal

[kolbycheesey]

@LTRData, I have news to report. Somewhere deep in the code base I was using was explicitly setting the Windows version number to 0x0500 and for fileapi.h it needs to be a minimum of 0x0501. So that fixed the issue. I would have just been going in circles without finding that. Thank you for all of the help from both you and Liryna