Closed lhallam closed 9 months ago
Thanks for reporting this @lhallam! We are looking into this issue for you now.
@lhallam , yes you're right, FILE_READ_ATTRIBUTES
should be sufficient for GetFinalPathByHandle
.
This commit should fix the issue. Please do verify it on your end.
@lhallam the fix should now be included with Microsoft.BuildXL.win-x64 0.1.0-20231129.3 or higher.
Confirmed fixed, thank you!
When a process running under DetoursServices opens a file by ID, PathFromObjectAttributesViaId opens the same file with GENERIC_READ. This causes our minifilter to fetch file contents over the network, even when the detoured call includes FILE_OPEN_NO_RECALL (or only requests e.g. READ_ATTRIBUTES, which would not trigger a recall).
Tested with Microsoft.BuildXL.win-x64 0.1.0-20231122.3
Could this be changed to either not request GENERIC_READ (I think READ_ATTRIBUTES should suffice for GetFinalPathByHandle(?)) or pass FILE_OPEN_NO_RECALL?
Thanks, Lewis.