CreateFile() on NDIS Protocol Driver failes for Regular User Accou

Hi,
I wrote NDIS Protocol Driver based on NDISUIO DDK sample.
It works fine but only under "Administrators" accounts.
Under normal user ("Power Users", "Backup Operators") CreateFile() fails with error 5 (access denied).
NDISUIO does the same.
I called MS Technical Support and the guy there trying to tell me that all communication drivers work only under Admin.???
Does not seem to make any sence.

After unsuccessful programmatic attempt to AdjustPriviledges() LogonUser() ImpersonateLoggedonUser()...
I have tried to change INF, but with no success (I could be wrong there).

Sorry for rather long post,
Thanks,
Alexei

Here how modified NDISUIO.inf it looks like:

;-------------------------------------------------------------------------
; NDISUIO.INF -- NDIS Usermode I/O Driver
;
; Copyright (c) 2000, Microsoft Corporation
;-------------------------------------------------------------------------
[version]
Signature = "$Windows NT$"
Class = NetTrans
ClassGUID = {4d36e975-e325-11ce-bfc1-08002be10318}
Provider = %Msft%
LayoutFile = layout.inf

[Manufacturer]
%Msft%=MSFT

[MSFT]
%NDISUIO_Desc%=Install, MS_NDISUIO

;-------------------------------------------------------------------------
; Installation Section
;-------------------------------------------------------------------------
[Install]
AddReg=Inst_Ndi

;changed by AK to make it visible and removable
;Characteristics=0x28 ; NCF_HIDDEN | NCF_NOT_USER_REMOVABLE
Characteristics=0x0 ; NCF_USER_REMOVABLE

CopyFiles=CpyFiles_Sys

;added by AK as an attempt to rovide all access to everybody
Security="D:(A;;GA;;;WD)"

;-------------------------------------------------------------------------
; Ndi installation support
;-------------------------------------------------------------------------
[Inst_Ndi]
HKR,Ndi,Service,,"Ndisuio"
HKR,Ndi,HelpText,,%NDISUIO_HelpText%
HKR, Ndi\Interfaces, UpperRange,, noupper
HKR,"Ndi\Interfaces","LowerRange",,"ndis5,ndis4,ndis5_uio"

;added by AK as an attempt to rovide all access to everybody
[Inst_Ndi.Security]
"D:(A;;GA;;;WD)"

;-------------------------------------------------------------------------
; Service installation support
;-------------------------------------------------------------------------
[Install.Services]
AddService=Ndisuio,,NDISUIO_Service_Inst

[Ndisuio_Service_Inst]
DisplayName = %NDISUIO_Desc%
ServiceType = 1 ;SERVICE_KERNEL_DRIVER
StartType = 3 ;SERVICE_MANUAL_START
ErrorControl = 1 ;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\ndisuio.sys
LoadOrderGroup = NDIS
Description = %NDISUIO_Desc%

[Install.Remove.Services]
DelService=Ndisuio

;-------------------------------------------------------------------------
; Declare Destination Directories for file copy/deletion
;-------------------------------------------------------------------------
[DestinationDirs]
CpyFiles_Sys = 12 ; DIRID_DRIVERS


;-------------------------------------------------------------------------
; Files to Copy/Delete - Referenced by Install and Remove sections above
;-------------------------------------------------------------------------
[CpyFiles_Sys]
Ndisuio.sys,,,2

[Strings]
Msft = "Microsoft"
NDISUIO_Desc = "NDIS Usermode I/O Protocol"
NDISUIO_HelpText = "A driver to support user-mode I/O on NDIS devices"

Maxim
Mon Jul 19 23:07:18 CDT 2004

> I called MS Technical Support and the guy there trying to tell me that all
communication drivers
>work only under Admin.???

Surely.

The APIs which have administrative effect over the network interfaces can be
executed from admin only. This is called "security".

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Alexei
Tue Jul 20 00:31:02 CDT 2004


"Maxim S. Shatskih" wrote:

> > I called MS Technical Support and the guy there trying to tell me that all
> communication drivers
> >work only under Admin.???
>
> Surely.
>
> The APIs which have administrative effect over the network interfaces can be
> executed from admin only. This is called "security".
>
Maxim,
Firstly, this is called "lack of functionality", opposed to configurable "security".
Administrator should be able to decide what components can be used by what users.
I can do it under any UNIX like OS.
Secondly, are you saying that all this "security" and "grant access" crap in INF files are there by mistake?
Thirdly, MS Technical support (DDK team) was not sure, so they still "digging":-)
I thought that there is at least one "DDK MVP" out there who knows, or curious.
Thanks,
Alexei Kvasov

Thomas
Tue Jul 20 01:05:14 CDT 2004


"Alexei" <Alexei@discussions.microsoft.com> wrote in message
news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
>
> "Maxim S. Shatskih" wrote:
>
> > > I called MS Technical Support and the guy there trying to tell me that
all
> > communication drivers
> > >work only under Admin.???
> >
> > Surely.
> >
> > The APIs which have administrative effect over the network interfaces
can be
> > executed from admin only. This is called "security".
> >
> Maxim,
> Firstly, this is called "lack of functionality", opposed to configurable
"security".
> Administrator should be able to decide what components can be used by what
users.
> I can do it under any UNIX like OS.
> Secondly, are you saying that all this "security" and "grant access" crap
in INF files are there by mistake?
> Thirdly, MS Technical support (DDK team) was not sure, so they still
"digging":-)
> I thought that there is at least one "DDK MVP" out there who knows, or
curious.
> Thanks,
> Alexei Kvasov

Alexei,

Actually it is certainly possible for an administrator to configure access
that permits a non-admin user's application to access a driver via
DeviceIoControl. Only an administrator can make this adjustment, but after
it is done the functionality that you are looking for is certainly built
into the Windows security model.

The PCAUSA Rawether for Windows NDIS protocol drivers can be accessed from
non-admin users if desired. The "Rawether Guide" programmer's documentation
for Rawether for Windows describes two ways for an administrator to do this.
If you want the details, download the Rawether Guide and examine the topic:

Programmer's Guide
Software Installation
Advanced Installation Topics
Configuring for Non-Administrator Users On Windows NT

This technique can probably be applied to your driver.

The Rawether Guide can be downloaded from a link on this page:

http://www.rawether.net/product/moreinfo1.htm

Good luck,

Thomas F. Divine
http://www.rawether.net

Alexei
Tue Jul 20 01:31:02 CDT 2004

Thanks a lot Thomas

Arkady
Tue Jul 20 07:32:28 CDT 2004

That do security model , and that topic well described in
http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
look at "Driver Visibility in User Mode" part.
Arkady
BTW only XP system restore saved me when I played with security settings
in inf . That absolutely not work, at least for me :)

"Alexei" <Alexei@discussions.microsoft.com> wrote in message
news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
>
> "Maxim S. Shatskih" wrote:
>
> > > I called MS Technical Support and the guy there trying to tell me that
all
> > communication drivers
> > >work only under Admin.???
> >
> > Surely.
> >
> > The APIs which have administrative effect over the network interfaces
can be
> > executed from admin only. This is called "security".
> >
> Maxim,
> Firstly, this is called "lack of functionality", opposed to configurable
"security".
> Administrator should be able to decide what components can be used by what
users.
> I can do it under any UNIX like OS.
> Secondly, are you saying that all this "security" and "grant access" crap
in INF files are there by mistake?
> Thirdly, MS Technical support (DDK team) was not sure, so they still
"digging":-)
> I thought that there is at least one "DDK MVP" out there who knows, or
curious.
> Thanks,
> Alexei Kvasov
>

Arkady
Tue Jul 20 10:29:38 CDT 2004

BTW try to change in ntdisp.c
IoCreateDevice to IoCreateDeviceSecure with needed
string in DefaultSDDLString parameter
Arkady


"Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
news:cdj3cv$dt9$1@home.itg.ti.com...
> That do security model , and that topic well described in
> http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
> look at "Driver Visibility in User Mode" part.
> Arkady
> BTW only XP system restore saved me when I played with security
settings
> in inf . That absolutely not work, at least for me :)
>
> "Alexei" <Alexei@discussions.microsoft.com> wrote in message
> news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
> >
> > "Maxim S. Shatskih" wrote:
> >
> > > > I called MS Technical Support and the guy there trying to tell me
that
> all
> > > communication drivers
> > > >work only under Admin.???
> > >
> > > Surely.
> > >
> > > The APIs which have administrative effect over the network interfaces
> can be
> > > executed from admin only. This is called "security".
> > >
> > Maxim,
> > Firstly, this is called "lack of functionality", opposed to configurable
> "security".
> > Administrator should be able to decide what components can be used by
what
> users.
> > I can do it under any UNIX like OS.
> > Secondly, are you saying that all this "security" and "grant access"
crap
> in INF files are there by mistake?
> > Thirdly, MS Technical support (DDK team) was not sure, so they still
> "digging":-)
> > I thought that there is at least one "DDK MVP" out there who knows, or
> curious.
> > Thanks,
> > Alexei Kvasov
> >
>
>

Alexei
Tue Jul 20 12:03:02 CDT 2004

Thanks a lot.

"Arkady Frenkel" wrote:

> BTW try to change in ntdisp.c
> IoCreateDevice to IoCreateDeviceSecure with needed
> string in DefaultSDDLString parameter
> Arkady
>
>
> "Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
> news:cdj3cv$dt9$1@home.itg.ti.com...
> > That do security model , and that topic well described in
> > http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
> > look at "Driver Visibility in User Mode" part.
> > Arkady
> > BTW only XP system restore saved me when I played with security
> settings
> > in inf . That absolutely not work, at least for me :)
> >
> > "Alexei" <Alexei@discussions.microsoft.com> wrote in message
> > news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
> > >
> > > "Maxim S. Shatskih" wrote:
> > >
> > > > > I called MS Technical Support and the guy there trying to tell me
> that
> > all
> > > > communication drivers
> > > > >work only under Admin.???
> > > >
> > > > Surely.
> > > >
> > > > The APIs which have administrative effect over the network interfaces
> > can be
> > > > executed from admin only. This is called "security".
> > > >
> > > Maxim,
> > > Firstly, this is called "lack of functionality", opposed to configurable
> > "security".
> > > Administrator should be able to decide what components can be used by
> what
> > users.
> > > I can do it under any UNIX like OS.
> > > Secondly, are you saying that all this "security" and "grant access"
> crap
> > in INF files are there by mistake?
> > > Thirdly, MS Technical support (DDK team) was not sure, so they still
> > "digging":-)
> > > I thought that there is at least one "DDK MVP" out there who knows, or
> > curious.
> > > Thanks,
> > > Alexei Kvasov
> > >
> >
> >
>
>
>

Alexei
Tue Jul 20 12:03:02 CDT 2004

thanks a lot

"Arkady Frenkel" wrote:

> BTW try to change in ntdisp.c
> IoCreateDevice to IoCreateDeviceSecure with needed
> string in DefaultSDDLString parameter
> Arkady
>
>
> "Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
> news:cdj3cv$dt9$1@home.itg.ti.com...
> > That do security model , and that topic well described in
> > http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
> > look at "Driver Visibility in User Mode" part.
> > Arkady
> > BTW only XP system restore saved me when I played with security
> settings
> > in inf . That absolutely not work, at least for me :)
> >
> > "Alexei" <Alexei@discussions.microsoft.com> wrote in message
> > news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
> > >
> > > "Maxim S. Shatskih" wrote:
> > >
> > > > > I called MS Technical Support and the guy there trying to tell me
> that
> > all
> > > > communication drivers
> > > > >work only under Admin.???
> > > >
> > > > Surely.
> > > >
> > > > The APIs which have administrative effect over the network interfaces
> > can be
> > > > executed from admin only. This is called "security".
> > > >
> > > Maxim,
> > > Firstly, this is called "lack of functionality", opposed to configurable
> > "security".
> > > Administrator should be able to decide what components can be used by
> what
> > users.
> > > I can do it under any UNIX like OS.
> > > Secondly, are you saying that all this "security" and "grant access"
> crap
> > in INF files are there by mistake?
> > > Thirdly, MS Technical support (DDK team) was not sure, so they still
> > "digging":-)
> > > I thought that there is at least one "DDK MVP" out there who knows, or
> > curious.
> > > Thanks,
> > > Alexei Kvasov
> > >
> >
> >
>
>
>

Eliyas
Tue Jul 20 12:47:56 CDT 2004

If you have server 2003 DDK, take a look at the NDISPROT sample. It shows
how to use IoCreateDeviceSecure function.

--
-Eliyas
This posting is provided "AS IS" with no warranties, and confers no rights.

Arkady
Wed Jul 21 01:10:03 CDT 2004

Not at all. I forgot to mention one though why that not work in inf . I
believe DDK guru's will correct me ( I'm SDK MVP not DDK :) ). The problem
is that such security line in inf file can work not in the predefined class
( like net ) but proprietary. Is it correct ?
Arkady

"Alexei" <Alexei@discussions.microsoft.com> wrote in message
news:F1F4E6E7-CE4C-4282-8798-C5F1957E8FF0@microsoft.com...
> Thanks a lot.
>
> "Arkady Frenkel" wrote:
>
> > BTW try to change in ntdisp.c
> > IoCreateDevice to IoCreateDeviceSecure with needed
> > string in DefaultSDDLString parameter
> > Arkady
> >
> >
> > "Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
> > news:cdj3cv$dt9$1@home.itg.ti.com...
> > > That do security model , and that topic well described in
> > > http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
> > > look at "Driver Visibility in User Mode" part.
> > > Arkady
> > > BTW only XP system restore saved me when I played with security
> > settings
> > > in inf . That absolutely not work, at least for me :)
> > >
> > > "Alexei" <Alexei@discussions.microsoft.com> wrote in message
> > > news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
> > > >
> > > > "Maxim S. Shatskih" wrote:
> > > >
> > > > > > I called MS Technical Support and the guy there trying to tell
me
> > that
> > > all
> > > > > communication drivers
> > > > > >work only under Admin.???
> > > > >
> > > > > Surely.
> > > > >
> > > > > The APIs which have administrative effect over the network
interfaces
> > > can be
> > > > > executed from admin only. This is called "security".
> > > > >
> > > > Maxim,
> > > > Firstly, this is called "lack of functionality", opposed to
configurable
> > > "security".
> > > > Administrator should be able to decide what components can be used
by
> > what
> > > users.
> > > > I can do it under any UNIX like OS.
> > > > Secondly, are you saying that all this "security" and "grant access"
> > crap
> > > in INF files are there by mistake?
> > > > Thirdly, MS Technical support (DDK team) was not sure, so they still
> > > "digging":-)
> > > > I thought that there is at least one "DDK MVP" out there who knows,
or
> > > curious.
> > > > Thanks,
> > > > Alexei Kvasov
> > > >
> > >
> > >
> >
> >
> >

Arkady
Wed Jul 21 02:01:23 CDT 2004

BTW if you open ( CreateFile ) your driver without read/write opportunity
( no read/write but using other IOCTLs ) you'll not have security problems
in user mode too.
Arkady

"Alexei" <Alexei@discussions.microsoft.com> wrote in message
news:CCA0AFCA-BD91-48CC-AF01-EAC1D3ACBE13@microsoft.com...
> thanks a lot
>
> "Arkady Frenkel" wrote:
>
> > BTW try to change in ntdisp.c
> > IoCreateDevice to IoCreateDeviceSecure with needed
> > string in DefaultSDDLString parameter
> > Arkady
> >
> >
> > "Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
> > news:cdj3cv$dt9$1@home.itg.ti.com...
> > > That do security model , and that topic well described in
> > > http://www.microsoft.com/MSJ/0398/DRIVER.aspx .
> > > look at "Driver Visibility in User Mode" part.
> > > Arkady
> > > BTW only XP system restore saved me when I played with security
> > settings
> > > in inf . That absolutely not work, at least for me :)
> > >
> > > "Alexei" <Alexei@discussions.microsoft.com> wrote in message
> > > news:BBEB5198-03B1-4CCF-8A1E-09C01B5F88DE@microsoft.com...
> > > >
> > > > "Maxim S. Shatskih" wrote:
> > > >
> > > > > > I called MS Technical Support and the guy there trying to tell
me
> > that
> > > all
> > > > > communication drivers
> > > > > >work only under Admin.???
> > > > >
> > > > > Surely.
> > > > >
> > > > > The APIs which have administrative effect over the network
interfaces
> > > can be
> > > > > executed from admin only. This is called "security".
> > > > >
> > > > Maxim,
> > > > Firstly, this is called "lack of functionality", opposed to
configurable
> > > "security".
> > > > Administrator should be able to decide what components can be used
by
> > what
> > > users.
> > > > I can do it under any UNIX like OS.
> > > > Secondly, are you saying that all this "security" and "grant access"
> > crap
> > > in INF files are there by mistake?
> > > > Thirdly, MS Technical support (DDK team) was not sure, so they still
> > > "digging":-)
> > > > I thought that there is at least one "DDK MVP" out there who knows,
or
> > > curious.
> > > > Thanks,
> > > > Alexei Kvasov
> > > >
> > >
> > >
> >
> >
> >