OBJECT_ATTRIBUTES should have read-only fields

[ChrisDenton]

According to the docs the pointers in the OBJECT_ATTRIBUTES struct should be read-only, but I'm not sure if that can be expressed in the metadata yet?

All members of this structure are read-only. If a member of this structure is a pointer, the object that this member points to is read-only as well. Read-only members and objects can be used to acquire relevant information but must not be modified.

Also this struct should probably be moved to wdk

[mikebattista]

@kennykerr

There's no metadata to scrape for this so anything would have to be manually added. What did you have in mind here?

[ChrisDenton]

Well the distinction only really matters for pointer types so I was imagining something like adding the [Const] attribute to those:

public struct OBJECT_ATTRIBUTES
{
	public uint Length;
	public HANDLE RootDirectory;
        [Const]
        public unsafe UNICODE_STRING* ObjectName;
	public uint Attributes;
        [Const]
        public unsafe void* SecurityDescriptor;
        [Const]
        public unsafe void* SecurityQualityOfService;
}

This mimics the way it's done for function parameters.

[kennykerr]

Sounds good, I think there are some other structs that already have such const attributes.

[KalleOlaviNiemitalo]

The doc page says "To set the members of this structure, use the InitializeObjectAttributes macro." but function-like macros are not part of the metadata, are they? So applications creating instances of OBJECT_ATTRIBUTES have to the the members directly anyway.

The doc page also says "If you must specify a non-NULL value, set the SecurityQualityOfService member after initialization." even though SecurityQualityOfService is a pointer.

So, I do not believe adding [Const] would be useful.

[ChrisDenton]

Yes, you have to be able to construct the OBJECT_ATTRIBUTES. I'm not intending to prevent that. However, the difference I'm looking for in Rust is:

#[repr(C)]
pub struct OBJECT_ATTRIBUTES {
    pub Length: u32,
    pub RootDirectory: HANDLE,
    pub ObjectName: *const UNICODE_STRING,
    pub Attributes: u32,
    pub SecurityDescriptor: *const c_void,
    pub SecurityQualityOfService: *const c_void,
}

Note the pointers are *const (as opposed to *mut). This is similar to e.g. CreateFileW where the first parameter takes a [In][Const] PWSTR.

[kennykerr]

Adding the const attributes wouldn't prevent initialization.

[riverar]

And to save folks 30 seconds looking it up, here's the initialize macro. Nothing special here.

#define InitializeObjectAttributes( p, n, a, r, s ) { \
    (p)->Length = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->RootDirectory = r;                             \
    (p)->Attributes = a;                                \
    (p)->ObjectName = n;                                \
    (p)->SecurityDescriptor = s;                        \
    (p)->SecurityQualityOfService = NULL;               \
    }

Be aware this structure is used in user-mode (e.g., NtOpenFile) so not sure it warrants the move to wdk metadata.

[ChrisDenton]

Ah, I had somehow got the impression that Nt* functions were being moved too.

[kennykerr]

Me too. Aren't they? 🤔

[mikebattista]

They're moved.

[riverar]

Ah right microsoft/wdkmetadata#37, thanks for reminder.