examples/VFS/audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log select file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2000
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  *
  21  * $Id: audit.c,v 1.2 2000/02/04 05:08:16 tpot Exp $
  22  */
  23
  24 #include "config.h"
  25 #include <stdio.h>
  26 #include <sys/stat.h>
  27 #ifdef HAVE_UTIME_H
  28 #include <utime.h>
  29 #endif
  30 #ifdef HAVE_DIRENT_H
  31 #include <dirent.h>
  32 #endif
  33 #include <syslog.h>
  34 #ifdef HAVE_FCNTL_H
  35 #include <fcntl.h>
  36 #endif
  37 #include <errno.h>
  38 #include <string.h>
  39 #include <vfs.h>
  40
  41 #ifndef SYSLOG_FACILITY
  42 #define SYSLOG_FACILITY   LOG_USER
  43 #endif
  44
  45 #ifndef SYSLOG_PRIORITY
  46 #define SYSLOG_PRIORITY   LOG_NOTICE
  47 #endif
  48
  49 /* Function prototypes */
  50
  51 int audit_connect(struct vfs_connection_struct *conn, char *svc, char *user);
  52 void audit_disconnect(void);
  53 DIR *audit_opendir(char *fname);
  54 int audit_mkdir(char *path, mode_t mode);
  55 int audit_rmdir(char *path);
  56 int audit_open(char *fname, int flags, mode_t mode);
  57 int audit_close(int fd);
  58 int audit_rename(char *old, char *new);
  59 int audit_unlink(char *path);
  60 int audit_chmod(char *path, mode_t mode);
  61
  62 /* VFS operations */
  63
  64 extern struct vfs_ops default_vfs_ops;   /* For passthrough operation */
  65
  66 struct vfs_ops audit_ops = {
  67
  68     /* Disk operations */
  69
  70     audit_connect,
  71     audit_disconnect,
  72     NULL,                     /* disk free */
  73
  74     /* Directory operations */
  75
  76     audit_opendir,
  77     NULL,                     /* readdir */
  78     audit_mkdir,
  79     audit_rmdir,
  80     NULL,                     /* closedir */
  81
  82     /* File operations */
  83
  84     audit_open,
  85     audit_close,
  86     NULL,                     /* read  */
  87     NULL,                     /* write */
  88     NULL,                     /* lseek */
  89     audit_rename,
  90     NULL,                     /* fsync */
  91     NULL,                     /* stat  */
  92     NULL,                     /* fstat */
  93     NULL,                     /* lstat */
  94     audit_unlink,
  95     NULL,                     /* chmod */
  96     NULL                      /* utime */
  97 };
  98
  99 /* VFS initialisation function.  Return initialised vfs_ops structure
 100    back to SAMBA. */
 101
 102 struct vfs_ops *vfs_init(void)
 103 {
 104     openlog("smbd_audit", LOG_PID, SYSLOG_FACILITY);
 105     return(&audit_ops);
 106 }
 107
 108 /* Implementation of vfs_ops.  Pass everything on to the default
 109    operation but log event first. */
 110
 111 int audit_connect(struct vfs_connection_struct *conn, char *svc, char *user)
 112 {
 113     syslog(SYSLOG_PRIORITY, "connect to service %s by user %s\n", svc, user);
 114
 115     return default_vfs_ops.connect(conn, svc, user);
 116 }
 117
 118 void audit_disconnect(void)
 119 {
 120     syslog(SYSLOG_PRIORITY, "disconnected\n");
 121     default_vfs_ops.disconnect();
 122 }
 123
 124 DIR *audit_opendir(char *fname)
 125 {
 126     DIR *result = default_vfs_ops.opendir(fname);
 127
 128     syslog(SYSLOG_PRIORITY, "opendir %s %s%s\n",
 129            fname,
 130            (result == NULL) ? "failed: " : "",
 131            (result == NULL) ? strerror(errno) : "");
 132
 133     return result;
 134 }
 135
 136 int audit_mkdir(char *path, mode_t mode)
 137 {
 138     int result = default_vfs_ops.mkdir(path, mode);
 139
 140     syslog(SYSLOG_PRIORITY, "mkdir %s %s%s\n",
 141            path,
 142            (result < 0) ? "failed: " : "",
 143            (result < 0) ? strerror(errno) : "");
 144
 145     return result;
 146 }
 147
 148 int audit_rmdir(char *path)
 149 {
 150     int result = default_vfs_ops.rmdir(path);
 151
 152     syslog(SYSLOG_PRIORITY, "rmdir %s %s%s\n",
 153            path,
 154            (result < 0) ? "failed: " : "",
 155            (result < 0) ? strerror(errno) : "");
 156
 157     return result;
 158 }
 159
 160 int audit_open(char *fname, int flags, mode_t mode)
 161 {
 162     int result = default_vfs_ops.open(fname, flags, mode);
 163
 164     syslog(SYSLOG_PRIORITY, "open %s (fd %d) %s%s%s\n",
 165            fname, result,
 166            ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "",
 167            (result < 0) ? "failed: " : "",
 168            (result < 0) ? strerror(errno) : "");
 169
 170     return result;
 171 }
 172
 173 int audit_close(int fd)
 174 {
 175     int result = default_vfs_ops.close(fd);
 176
 177     syslog(SYSLOG_PRIORITY, "close fd %d %s%s\n",
 178            fd,
 179            (result < 0) ? "failed: " : "",
 180            (result < 0) ? strerror(errno) : "");
 181
 182     return result;
 183 }
 184
 185 int audit_rename(char *old, char *new)
 186 {
 187     int result = default_vfs_ops.rename(old, new);
 188
 189     syslog(SYSLOG_PRIORITY, "rename %s -> %s %s%s\n",
 190            old, new,
 191            (result < 0) ? "failed: " : "",
 192            (result < 0) ? strerror(errno) : "");
 193
 194     return result;
 195 }
 196
 197 int audit_unlink(char *path)
 198 {
 199     int result = default_vfs_ops.unlink(path);
 200
 201     syslog(SYSLOG_PRIORITY, "unlink %s %s%s\n",
 202            path,
 203            (result < 0) ? "failed: " : "",
 204            (result < 0) ? strerror(errno) : "");
 205
 206     return result;
 207 }