NotifyGetFileSecurity Event

Fires when a file or directory's security attributes have been retrieved.

Syntax

public class DefaultCbfilterEventListener implements CbfilterEventListener {
  ...
  public void notifyGetFileSecurity(CbfilterNotifyGetFileSecurityEvent e) {}
  ...
}

public class CbfilterNotifyGetFileSecurityEvent {
  public String fileName;
  public int securityInformation;
  public ByteBuffer securityDescriptor;
  public int length;
  public int status;
  public int resultCode;
}

Remarks

This event fires when security attributes have been retrieved for the file or directory specified by FileName.

Note that this event will not fire every time a file or directory is accessed. To check file security upon each access to a file or directory, implement the file create and open events and perform the necessary checks there instead.

Applications only need to handle this event if they've added a standard filter rule that includes the FS_NE_GET_SECURITY flag.

The SecurityInformation parameter indicates which pieces of security information were requested. Please refer to Microsoft's SECURITY_INFORMATION data type documentation for more information about possible values.

The SecurityDescriptor parameter points to a memory buffer that, if the request was successful, contains the requested security information. The Length parameter reflects the length of this data, in bytes. Please refer to the Buffer Parameters topic for more information on how to work with memory buffer event parameters.

The data itself is formatted as a SECURITY_DESCRIPTOR structure in self-relative format; please refer to the Microsoft's documentation for more information.

The Status parameter contains an NT status code that indicates the outcome of the operation; 0 indicates success. To convert this value to a Win32 error code, call the NtStatusToWin32Error method. Please note that this event won't fire for failed requests unless the ProcessFailedRequests property is enabled.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason, set it to a non-zero value to report an appropriate error. Note, however, that this event fires after the operation has already completed, so reporting an error won't actually affect the operation itself. Please refer to the Error Reporting and Handling topic for more information.

This event is fired asynchronously; please refer to the Event Types topic for more information.