File protection doesn't work properly

Discussion in 'Returnil releases' started by developers, Apr 1, 2009.

Thread Status:
Not open for further replies.
  1. developers

    developers Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    62
    Hi,
    I have noticed an issue/bug with File protection.
    This function doesn't stop folders from being deleted, but it works only with file inside that folder.

    I have also noticed that this issue doesn't always apply, sometimes it works fine and sometimes it doesn't work properly (perhaps a function's hook problem)

    There are others users affected by this issue.

    System:
    Windows XP SP3 with Returnil 2.0.1.9002
     
  2. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi developers and welcome :)

    Are you saying you added the file to the FP list and were able to delete it or did you add only the files in that folder while leaving the folder out of the list?
     
  3. developers

    developers Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    62
    Hi,
    I have added a folder with some file inside to the FP list and i have noticed this issue (I was able to delete the folder)

    then I have added the entire drive partition (D)to the FP list and I have noticed this issue (I was able to delete the folder)

    but sometimes FP works fine, and files and folders aren't deleted
     
  4. developers

    developers Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    62
    I am able to rename the "protected" files also o_O
     
  5. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Where are the files and the folder located? Also, what happens when you try to open something on the FP list?
     
  6. developers

    developers Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    62
    Files and folders are in D (Returnil is in C)

    When I try to open files, access is denied, but I can delete the folder containing these files (and sometimes files inside the folder too).

    There are others users with this issue (another forum), so please correct this bug, because non system partition result vulnerables.
     
  7. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    I follow what you are reporting now and appologize for my confusion here. This is related to Windows itself and is not due to a defect in FP.

    How is it a vulnerability? The feature is working as designed by denying access which means that any mailicious processes or unauthorized users would be similarly restricted from accessing the content other than the fact that the content itself could potentially be deleted...

    Mike
     
  8. developers

    developers Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    62
    An user believes he is protected both in C and D because File protection is ON, and meanwhile a malware in C deletes all files in D (or in a USB flash drive).

    In the manual this limitation is not mentioned

    Returnil developers can implement NTFS ACL, this is just an idea, but I think there are others solutions. Yes you can :)
     
    Last edited: Apr 2, 2009
Thread Status:
Not open for further replies.