[NTOSKRNL] Only allow page file on a few specific device types

This commit is contained in:
Pierre Schweitzer 2018-08-16 19:00:22 +02:00
parent cc59c97308
commit 12e8d7fe0e
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B

View file

@ -364,6 +364,7 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
SECURITY_DESCRIPTOR SecurityDescriptor; SECURITY_DESCRIPTOR SecurityDescriptor;
PACL Dacl; PACL Dacl;
PWSTR Buffer; PWSTR Buffer;
DEVICE_TYPE DeviceType;
DPRINT("NtCreatePagingFile(FileName %wZ, MinimumSize %I64d)\n", DPRINT("NtCreatePagingFile(FileName %wZ, MinimumSize %I64d)\n",
FileName, MinimumSize->QuadPart); FileName, MinimumSize->QuadPart);
@ -727,6 +728,17 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName,
return Status; return Status;
} }
/* Only allow page file on a few device types */
DeviceType = IoGetRelatedDeviceObject(FileObject)->DeviceType;
if (DeviceType != FILE_DEVICE_DISK_FILE_SYSTEM && DeviceType != FILE_DEVICE_NETWORK_FILE_SYSTEM &&
DeviceType != FILE_DEVICE_DFS_VOLUME && DeviceType != FILE_DEVICE_DFS_FILE_SYSTEM)
{
ObDereferenceObject(FileObject);
ZwClose(FileHandle);
ExFreePoolWithTag(Buffer, TAG_MM);
return Status;
}
/* Deny page file creation on a floppy disk */ /* Deny page file creation on a floppy disk */
FsDeviceInfo.Characteristics = 0; FsDeviceInfo.Characteristics = 0;
IoQueryVolumeInformation(FileObject, FileFsDeviceInformation, sizeof(FsDeviceInfo), &FsDeviceInfo, &Count); IoQueryVolumeInformation(FileObject, FileFsDeviceInformation, sizeof(FsDeviceInfo), &FsDeviceInfo, &Count);