?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
KCC: docstring for kcc.graph.InternalEdge
[Samba.git] / source3 / modules / vfs_full_audit.c
blobc6648d15fb3722c7720d551103262ae19d838471
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
65 #include "auth.h"
66 #include "ntioctl.h"
67 #include "lib/param/loadparm.h"
68 #include "lib/util/bitmap.h"
69 #include "lib/util/tevent_unix.h"
70 #include "libcli/security/sddl.h"
71 #include "passdb/machine_sid.h"
72
73 static int vfs_full_audit_debug_level = DBGC_VFS;
74
75 struct vfs_full_audit_private_data {
76 struct bitmap *success_ops;
77 struct bitmap *failure_ops;
78 int syslog_facility;
79 int syslog_priority;
80 bool log_secdesc;
81 bool do_syslog;
82 };
83
84 #undef DBGC_CLASS
85 #define DBGC_CLASS vfs_full_audit_debug_level
86
87 typedef enum _vfs_op_type {
88 SMB_VFS_OP_NOOP = -1,
89
90 /* Disk operations */
91
92 SMB_VFS_OP_CONNECT = 0,
93 SMB_VFS_OP_DISCONNECT,
94 SMB_VFS_OP_DISK_FREE,
95 SMB_VFS_OP_GET_QUOTA,
96 SMB_VFS_OP_SET_QUOTA,
97 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
98 SMB_VFS_OP_STATVFS,
99 SMB_VFS_OP_FS_CAPABILITIES,
100 SMB_VFS_OP_SNAP_CHECK_PATH,
101 SMB_VFS_OP_SNAP_CREATE,
102 SMB_VFS_OP_SNAP_DELETE,
103
104 /* Directory operations */
105
106 SMB_VFS_OP_OPENDIR,
107 SMB_VFS_OP_FDOPENDIR,
108 SMB_VFS_OP_READDIR,
109 SMB_VFS_OP_SEEKDIR,
110 SMB_VFS_OP_TELLDIR,
111 SMB_VFS_OP_REWINDDIR,
112 SMB_VFS_OP_MKDIR,
113 SMB_VFS_OP_RMDIR,
114 SMB_VFS_OP_CLOSEDIR,
115 SMB_VFS_OP_INIT_SEARCH_OP,
116
117 /* File operations */
118
119 SMB_VFS_OP_OPEN,
120 SMB_VFS_OP_CREATE_FILE,
121 SMB_VFS_OP_CLOSE,
122 SMB_VFS_OP_READ,
123 SMB_VFS_OP_PREAD,
124 SMB_VFS_OP_PREAD_SEND,
125 SMB_VFS_OP_PREAD_RECV,
126 SMB_VFS_OP_WRITE,
127 SMB_VFS_OP_PWRITE,
128 SMB_VFS_OP_PWRITE_SEND,
129 SMB_VFS_OP_PWRITE_RECV,
130 SMB_VFS_OP_LSEEK,
131 SMB_VFS_OP_SENDFILE,
132 SMB_VFS_OP_RECVFILE,
133 SMB_VFS_OP_RENAME,
134 SMB_VFS_OP_FSYNC,
135 SMB_VFS_OP_FSYNC_SEND,
136 SMB_VFS_OP_FSYNC_RECV,
137 SMB_VFS_OP_STAT,
138 SMB_VFS_OP_FSTAT,
139 SMB_VFS_OP_LSTAT,
140 SMB_VFS_OP_GET_ALLOC_SIZE,
141 SMB_VFS_OP_UNLINK,
142 SMB_VFS_OP_CHMOD,
143 SMB_VFS_OP_FCHMOD,
144 SMB_VFS_OP_CHOWN,
145 SMB_VFS_OP_FCHOWN,
146 SMB_VFS_OP_LCHOWN,
147 SMB_VFS_OP_CHDIR,
148 SMB_VFS_OP_GETWD,
149 SMB_VFS_OP_NTIMES,
150 SMB_VFS_OP_FTRUNCATE,
151 SMB_VFS_OP_FALLOCATE,
152 SMB_VFS_OP_LOCK,
153 SMB_VFS_OP_KERNEL_FLOCK,
154 SMB_VFS_OP_LINUX_SETLEASE,
155 SMB_VFS_OP_GETLOCK,
156 SMB_VFS_OP_SYMLINK,
157 SMB_VFS_OP_READLINK,
158 SMB_VFS_OP_LINK,
159 SMB_VFS_OP_MKNOD,
160 SMB_VFS_OP_REALPATH,
161 SMB_VFS_OP_NOTIFY_WATCH,
162 SMB_VFS_OP_CHFLAGS,
163 SMB_VFS_OP_FILE_ID_CREATE,
164 SMB_VFS_OP_STREAMINFO,
165 SMB_VFS_OP_GET_REAL_FILENAME,
166 SMB_VFS_OP_CONNECTPATH,
167 SMB_VFS_OP_BRL_LOCK_WINDOWS,
168 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
169 SMB_VFS_OP_BRL_CANCEL_WINDOWS,
170 SMB_VFS_OP_STRICT_LOCK,
171 SMB_VFS_OP_STRICT_UNLOCK,
172 SMB_VFS_OP_TRANSLATE_NAME,
173 SMB_VFS_OP_COPY_CHUNK_SEND,
174 SMB_VFS_OP_COPY_CHUNK_RECV,
175 SMB_VFS_OP_GET_COMPRESSION,
176 SMB_VFS_OP_SET_COMPRESSION,
177 SMB_VFS_OP_READDIR_ATTR,
178
179 /* NT ACL operations. */
180
181 SMB_VFS_OP_FGET_NT_ACL,
182 SMB_VFS_OP_GET_NT_ACL,
183 SMB_VFS_OP_FSET_NT_ACL,
184
185 /* POSIX ACL operations. */
186
187 SMB_VFS_OP_CHMOD_ACL,
188 SMB_VFS_OP_FCHMOD_ACL,
189
190 SMB_VFS_OP_SYS_ACL_GET_FILE,
191 SMB_VFS_OP_SYS_ACL_GET_FD,
192 SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE,
193 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
194 SMB_VFS_OP_SYS_ACL_SET_FILE,
195 SMB_VFS_OP_SYS_ACL_SET_FD,
196 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
197
198 /* EA operations. */
199 SMB_VFS_OP_GETXATTR,
200 SMB_VFS_OP_FGETXATTR,
201 SMB_VFS_OP_LISTXATTR,
202 SMB_VFS_OP_FLISTXATTR,
203 SMB_VFS_OP_REMOVEXATTR,
204 SMB_VFS_OP_FREMOVEXATTR,
205 SMB_VFS_OP_SETXATTR,
206 SMB_VFS_OP_FSETXATTR,
207
208 /* aio operations */
209 SMB_VFS_OP_AIO_FORCE,
210
211 /* offline operations */
212 SMB_VFS_OP_IS_OFFLINE,
213 SMB_VFS_OP_SET_OFFLINE,
214
215 /* This should always be last enum value */
216
217 SMB_VFS_OP_LAST
218 } vfs_op_type;
219
220 /* The following array *must* be in the same order as defined in vfs_op_type */
221
222 static struct {
223 vfs_op_type type;
224 const char *name;
225 } vfs_op_names[] = {
226 { SMB_VFS_OP_CONNECT, "connect" },
227 { SMB_VFS_OP_DISCONNECT, "disconnect" },
228 { SMB_VFS_OP_DISK_FREE, "disk_free" },
229 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
230 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
231 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
232 { SMB_VFS_OP_STATVFS, "statvfs" },
233 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
234 { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
235 { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
236 { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
237 { SMB_VFS_OP_OPENDIR, "opendir" },
238 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
239 { SMB_VFS_OP_READDIR, "readdir" },
240 { SMB_VFS_OP_SEEKDIR, "seekdir" },
241 { SMB_VFS_OP_TELLDIR, "telldir" },
242 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
243 { SMB_VFS_OP_MKDIR, "mkdir" },
244 { SMB_VFS_OP_RMDIR, "rmdir" },
245 { SMB_VFS_OP_CLOSEDIR, "closedir" },
246 { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
247 { SMB_VFS_OP_OPEN, "open" },
248 { SMB_VFS_OP_CREATE_FILE, "create_file" },
249 { SMB_VFS_OP_CLOSE, "close" },
250 { SMB_VFS_OP_READ, "read" },
251 { SMB_VFS_OP_PREAD, "pread" },
252 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
253 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
254 { SMB_VFS_OP_WRITE, "write" },
255 { SMB_VFS_OP_PWRITE, "pwrite" },
256 { SMB_VFS_OP_PWRITE_SEND, "pwrite_send" },
257 { SMB_VFS_OP_PWRITE_RECV, "pwrite_recv" },
258 { SMB_VFS_OP_LSEEK, "lseek" },
259 { SMB_VFS_OP_SENDFILE, "sendfile" },
260 { SMB_VFS_OP_RECVFILE, "recvfile" },
261 { SMB_VFS_OP_RENAME, "rename" },
262 { SMB_VFS_OP_FSYNC, "fsync" },
263 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
264 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
265 { SMB_VFS_OP_STAT, "stat" },
266 { SMB_VFS_OP_FSTAT, "fstat" },
267 { SMB_VFS_OP_LSTAT, "lstat" },
268 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
269 { SMB_VFS_OP_UNLINK, "unlink" },
270 { SMB_VFS_OP_CHMOD, "chmod" },
271 { SMB_VFS_OP_FCHMOD, "fchmod" },
272 { SMB_VFS_OP_CHOWN, "chown" },
273 { SMB_VFS_OP_FCHOWN, "fchown" },
274 { SMB_VFS_OP_LCHOWN, "lchown" },
275 { SMB_VFS_OP_CHDIR, "chdir" },
276 { SMB_VFS_OP_GETWD, "getwd" },
277 { SMB_VFS_OP_NTIMES, "ntimes" },
278 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
279 { SMB_VFS_OP_FALLOCATE,"fallocate" },
280 { SMB_VFS_OP_LOCK, "lock" },
281 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
282 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
283 { SMB_VFS_OP_GETLOCK, "getlock" },
284 { SMB_VFS_OP_SYMLINK, "symlink" },
285 { SMB_VFS_OP_READLINK, "readlink" },
286 { SMB_VFS_OP_LINK, "link" },
287 { SMB_VFS_OP_MKNOD, "mknod" },
288 { SMB_VFS_OP_REALPATH, "realpath" },
289 { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
290 { SMB_VFS_OP_CHFLAGS, "chflags" },
291 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
292 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
293 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
294 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
295 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
296 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
297 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
298 { SMB_VFS_OP_STRICT_LOCK, "strict_lock" },
299 { SMB_VFS_OP_STRICT_UNLOCK, "strict_unlock" },
300 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
301 { SMB_VFS_OP_COPY_CHUNK_SEND, "copy_chunk_send" },
302 { SMB_VFS_OP_COPY_CHUNK_RECV, "copy_chunk_recv" },
303 { SMB_VFS_OP_GET_COMPRESSION, "get_compression" },
304 { SMB_VFS_OP_SET_COMPRESSION, "set_compression" },
305 { SMB_VFS_OP_READDIR_ATTR, "readdir_attr" },
306 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
307 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
308 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
309 { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
310 { SMB_VFS_OP_FCHMOD_ACL, "fchmod_acl" },
311 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
312 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
313 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, "sys_acl_blob_get_file" },
314 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, "sys_acl_blob_get_fd" },
315 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
316 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
317 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
318 { SMB_VFS_OP_GETXATTR, "getxattr" },
319 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
320 { SMB_VFS_OP_LISTXATTR, "listxattr" },
321 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
322 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
323 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
324 { SMB_VFS_OP_SETXATTR, "setxattr" },
325 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
326 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
327 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
328 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
329 { SMB_VFS_OP_LAST, NULL }
330 };
331
332 static int audit_syslog_facility(vfs_handle_struct *handle)
333 {
334 static const struct enum_list enum_log_facilities[] = {
335 { LOG_USER, "USER" },
336 { LOG_LOCAL0, "LOCAL0" },
337 { LOG_LOCAL1, "LOCAL1" },
338 { LOG_LOCAL2, "LOCAL2" },
339 { LOG_LOCAL3, "LOCAL3" },
340 { LOG_LOCAL4, "LOCAL4" },
341 { LOG_LOCAL5, "LOCAL5" },
342 { LOG_LOCAL6, "LOCAL6" },
343 { LOG_LOCAL7, "LOCAL7" },
344 { -1, NULL}
345 };
346
347 int facility;
348
349 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
350
351 return facility;
352 }
353
354 static int audit_syslog_priority(vfs_handle_struct *handle)
355 {
356 static const struct enum_list enum_log_priorities[] = {
357 { LOG_EMERG, "EMERG" },
358 { LOG_ALERT, "ALERT" },
359 { LOG_CRIT, "CRIT" },
360 { LOG_ERR, "ERR" },
361 { LOG_WARNING, "WARNING" },
362 { LOG_NOTICE, "NOTICE" },
363 { LOG_INFO, "INFO" },
364 { LOG_DEBUG, "DEBUG" },
365 { -1, NULL}
366 };
367
368 int priority;
369
370 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
371 enum_log_priorities, LOG_NOTICE);
372 if (priority == -1) {
373 priority = LOG_WARNING;
374 }
375
376 return priority;
377 }
378
379 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
380 {
381 char *prefix = NULL;
382 char *result;
383
384 prefix = talloc_strdup(ctx,
385 lp_parm_const_string(SNUM(conn), "full_audit",
386 "prefix", "%u|%I"));
387 if (!prefix) {
388 return NULL;
389 }
390 result = talloc_sub_advanced(ctx,
391 lp_servicename(talloc_tos(), SNUM(conn)),
392 conn->session_info->unix_info->unix_name,
393 conn->connectpath,
394 conn->session_info->unix_token->gid,
395 conn->session_info->unix_info->sanitized_username,
396 conn->session_info->info->domain_name,
397 prefix);
398 TALLOC_FREE(prefix);
399 return result;
400 }
401
402 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
403 {
404 if (pd->success_ops == NULL) {
405 return True;
406 }
407
408 return bitmap_query(pd->success_ops, op);
409 }
410
411 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
412 {
413 if (pd->failure_ops == NULL)
414 return True;
415
416 return bitmap_query(pd->failure_ops, op);
417 }
418
419 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
420 {
421 struct bitmap *bm;
422
423 if (ops == NULL) {
424 return NULL;
425 }
426
427 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
428 if (bm == NULL) {
429 DEBUG(0, ("Could not alloc bitmap -- "
430 "defaulting to logging everything\n"));
431 return NULL;
432 }
433
434 for (; *ops != NULL; ops += 1) {
435 int i;
436 bool neg = false;
437 const char *op;
438
439 if (strequal(*ops, "all")) {
440 for (i=0; i<SMB_VFS_OP_LAST; i++) {
441 bitmap_set(bm, i);
442 }
443 continue;
444 }
445
446 if (strequal(*ops, "none")) {
447 break;
448 }
449
450 op = ops[0];
451 if (op[0] == '!') {
452 neg = true;
453 op += 1;
454 }
455
456 for (i=0; i<SMB_VFS_OP_LAST; i++) {
457 if ((vfs_op_names[i].name == NULL)
458 || (vfs_op_names[i].type != i)) {
459 smb_panic("vfs_full_audit.c: name table not "
460 "in sync with vfs_op_type enums\n");
461 }
462 if (strequal(op, vfs_op_names[i].name)) {
463 if (neg) {
464 bitmap_clear(bm, i);
465 } else {
466 bitmap_set(bm, i);
467 }
468 break;
469 }
470 }
471 if (i == SMB_VFS_OP_LAST) {
472 DEBUG(0, ("Could not find opname %s, logging all\n",
473 *ops));
474 TALLOC_FREE(bm);
475 return NULL;
476 }
477 }
478 return bm;
479 }
480
481 static const char *audit_opname(vfs_op_type op)
482 {
483 if (op >= SMB_VFS_OP_LAST)
484 return "INVALID VFS OP";
485 return vfs_op_names[op].name;
486 }
487
488 static TALLOC_CTX *tmp_do_log_ctx;
489 /*
490 * Get us a temporary talloc context usable just for DEBUG arguments
491 */
492 static TALLOC_CTX *do_log_ctx(void)
493 {
494 if (tmp_do_log_ctx == NULL) {
495 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
496 }
497 return tmp_do_log_ctx;
498 }
499
500 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
501 const char *format, ...)
502 {
503 struct vfs_full_audit_private_data *pd;
504 fstring err_msg;
505 char *audit_pre = NULL;
506 va_list ap;
507 char *op_msg = NULL;
508
509 SMB_VFS_HANDLE_GET_DATA(handle, pd,
510 struct vfs_full_audit_private_data,
511 return;);
512
513 if (success && (!log_success(pd, op)))
514 goto out;
515
516 if (!success && (!log_failure(pd, op)))
517 goto out;
518
519 if (success)
520 fstrcpy(err_msg, "ok");
521 else
522 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
523
524 va_start(ap, format);
525 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
526 va_end(ap);
527
528 if (!op_msg) {
529 goto out;
530 }
531
532 audit_pre = audit_prefix(talloc_tos(), handle->conn);
533
534 if (pd->do_syslog) {
535 int priority;
536
537 /*
538 * Specify the facility to interoperate with other syslog
539 * callers (smbd for example).
540 */
541 priority = pd->syslog_priority | pd->syslog_facility;
542
543 syslog(priority, "%s|%s|%s|%s\n",
544 audit_pre ? audit_pre : "",
545 audit_opname(op), err_msg, op_msg);
546 } else {
547 DEBUG(1, ("%s|%s|%s|%s\n",
548 audit_pre ? audit_pre : "",
549 audit_opname(op), err_msg, op_msg));
550 }
551 out:
552 TALLOC_FREE(audit_pre);
553 TALLOC_FREE(op_msg);
554 TALLOC_FREE(tmp_do_log_ctx);
555 }
556
557 /**
558 * Return a string using the do_log_ctx()
559 */
560 static const char *smb_fname_str_do_log(const struct smb_filename *smb_fname)
561 {
562 char *fname = NULL;
563 NTSTATUS status;
564
565 if (smb_fname == NULL) {
566 return "";
567 }
568 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
569 if (!NT_STATUS_IS_OK(status)) {
570 return "";
571 }
572 return fname;
573 }
574
575 /**
576 * Return an fsp debug string using the do_log_ctx()
577 */
578 static const char *fsp_str_do_log(const struct files_struct *fsp)
579 {
580 return smb_fname_str_do_log(fsp->fsp_name);
581 }
582
583 /* Implementation of vfs_ops. Pass everything on to the default
584 operation but log event first. */
585
586 static int smb_full_audit_connect(vfs_handle_struct *handle,
587 const char *svc, const char *user)
588 {
589 int result;
590 struct vfs_full_audit_private_data *pd = NULL;
591
592 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
593 if (result < 0) {
594 return result;
595 }
596
597 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
598 if (!pd) {
599 SMB_VFS_NEXT_DISCONNECT(handle);
600 return -1;
601 }
602
603 pd->syslog_facility = audit_syslog_facility(handle);
604 if (pd->syslog_facility == -1) {
605 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
606 lp_parm_const_string(SNUM(handle->conn),
607 "full_audit", "facility",
608 "USER")));
609 SMB_VFS_NEXT_DISCONNECT(handle);
610 return -1;
611 }
612
613 pd->syslog_priority = audit_syslog_priority(handle);
614
615 pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
616 "full_audit", "log_secdesc", false);
617
618 pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
619 "full_audit", "syslog", true);
620
621 #ifdef WITH_SYSLOG
622 if (pd->do_syslog) {
623 openlog("smbd_audit", 0, pd->syslog_facility);
624 }
625 #endif
626
627 pd->success_ops = init_bitmap(
628 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
629 "success", NULL));
630 pd->failure_ops = init_bitmap(
631 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
632 "failure", NULL));
633
634 /* Store the private data. */
635 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
636 struct vfs_full_audit_private_data, return -1);
637
638 do_log(SMB_VFS_OP_CONNECT, True, handle,
639 "%s", svc);
640
641 return 0;
642 }
643
644 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
645 {
646 SMB_VFS_NEXT_DISCONNECT(handle);
647
648 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
649 "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
650
651 /* The bitmaps will be disconnected when the private
652 data is deleted. */
653 }
654
655 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
656 const char *path, uint64_t *bsize,
657 uint64_t *dfree, uint64_t *dsize)
658 {
659 uint64_t result;
660
661 result = SMB_VFS_NEXT_DISK_FREE(handle, path, bsize, dfree, dsize);
662
663 /* Don't have a reasonable notion of failure here */
664
665 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
666
667 return result;
668 }
669
670 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
671 enum SMB_QUOTA_TYPE qtype, unid_t id,
672 SMB_DISK_QUOTA *qt)
673 {
674 int result;
675
676 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
677
678 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
679
680 return result;
681 }
682
683 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
684 enum SMB_QUOTA_TYPE qtype, unid_t id,
685 SMB_DISK_QUOTA *qt)
686 {
687 int result;
688
689 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
690
691 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
692
693 return result;
694 }
695
696 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
697 struct files_struct *fsp,
698 struct shadow_copy_data *shadow_copy_data,
699 bool labels)
700 {
701 int result;
702
703 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
704
705 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
706
707 return result;
708 }
709
710 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
711 const char *path,
712 struct vfs_statvfs_struct *statbuf)
713 {
714 int result;
715
716 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
717
718 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
719
720 return result;
721 }
722
723 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
724 {
725 int result;
726
727 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
728
729 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
730
731 return result;
732 }
733
734 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
735 TALLOC_CTX *mem_ctx,
736 const char *service_path,
737 char **base_volume)
738 {
739 NTSTATUS status;
740
741 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
742 base_volume);
743 do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
744 handle, "");
745
746 return status;
747 }
748
749 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
750 TALLOC_CTX *mem_ctx,
751 const char *base_volume,
752 time_t *tstamp,
753 bool rw,
754 char **base_path,
755 char **snap_path)
756 {
757 NTSTATUS status;
758
759 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
760 rw, base_path, snap_path);
761 do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
762
763 return status;
764 }
765
766 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
767 TALLOC_CTX *mem_ctx,
768 char *base_path,
769 char *snap_path)
770 {
771 NTSTATUS status;
772
773 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
774 snap_path);
775 do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
776
777 return status;
778 }
779
780 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
781 const char *fname, const char *mask, uint32_t attr)
782 {
783 DIR *result;
784
785 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
786
787 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
788
789 return result;
790 }
791
792 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
793 files_struct *fsp, const char *mask, uint32_t attr)
794 {
795 DIR *result;
796
797 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
798
799 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
800 fsp_str_do_log(fsp));
801
802 return result;
803 }
804
805 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
806 DIR *dirp, SMB_STRUCT_STAT *sbuf)
807 {
808 struct dirent *result;
809
810 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
811
812 /* This operation has no reasonable error condition
813 * (End of dir is also failure), so always succeed.
814 */
815 do_log(SMB_VFS_OP_READDIR, True, handle, "");
816
817 return result;
818 }
819
820 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
821 DIR *dirp, long offset)
822 {
823 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
824
825 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
826 }
827
828 static long smb_full_audit_telldir(vfs_handle_struct *handle,
829 DIR *dirp)
830 {
831 long result;
832
833 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
834
835 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
836
837 return result;
838 }
839
840 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
841 DIR *dirp)
842 {
843 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
844
845 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
846 }
847
848 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
849 const char *path, mode_t mode)
850 {
851 int result;
852
853 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
854
855 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
856
857 return result;
858 }
859
860 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
861 const char *path)
862 {
863 int result;
864
865 result = SMB_VFS_NEXT_RMDIR(handle, path);
866
867 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
868
869 return result;
870 }
871
872 static int smb_full_audit_closedir(vfs_handle_struct *handle,
873 DIR *dirp)
874 {
875 int result;
876
877 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
878
879 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
880
881 return result;
882 }
883
884 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
885 DIR *dirp)
886 {
887 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
888
889 do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
890 }
891
892 static int smb_full_audit_open(vfs_handle_struct *handle,
893 struct smb_filename *smb_fname,
894 files_struct *fsp, int flags, mode_t mode)
895 {
896 int result;
897
898 result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
899
900 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
901 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
902 smb_fname_str_do_log(smb_fname));
903
904 return result;
905 }
906
907 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
908 struct smb_request *req,
909 uint16_t root_dir_fid,
910 struct smb_filename *smb_fname,
911 uint32_t access_mask,
912 uint32_t share_access,
913 uint32_t create_disposition,
914 uint32_t create_options,
915 uint32_t file_attributes,
916 uint32_t oplock_request,
917 struct smb2_lease *lease,
918 uint64_t allocation_size,
919 uint32_t private_flags,
920 struct security_descriptor *sd,
921 struct ea_list *ea_list,
922 files_struct **result_fsp,
923 int *pinfo,
924 const struct smb2_create_blobs *in_context_blobs,
925 struct smb2_create_blobs *out_context_blobs)
926 {
927 NTSTATUS result;
928 const char* str_create_disposition;
929
930 switch (create_disposition) {
931 case FILE_SUPERSEDE:
932 str_create_disposition = "supersede";
933 break;
934 case FILE_OVERWRITE_IF:
935 str_create_disposition = "overwrite_if";
936 break;
937 case FILE_OPEN:
938 str_create_disposition = "open";
939 break;
940 case FILE_OVERWRITE:
941 str_create_disposition = "overwrite";
942 break;
943 case FILE_CREATE:
944 str_create_disposition = "create";
945 break;
946 case FILE_OPEN_IF:
947 str_create_disposition = "open_if";
948 break;
949 default:
950 str_create_disposition = "unknown";
951 }
952
953 result = SMB_VFS_NEXT_CREATE_FILE(
954 handle, /* handle */
955 req, /* req */
956 root_dir_fid, /* root_dir_fid */
957 smb_fname, /* fname */
958 access_mask, /* access_mask */
959 share_access, /* share_access */
960 create_disposition, /* create_disposition*/
961 create_options, /* create_options */
962 file_attributes, /* file_attributes */
963 oplock_request, /* oplock_request */
964 lease, /* lease */
965 allocation_size, /* allocation_size */
966 private_flags,
967 sd, /* sd */
968 ea_list, /* ea_list */
969 result_fsp, /* result */
970 pinfo, /* pinfo */
971 in_context_blobs, out_context_blobs); /* create context */
972
973 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
974 "0x%x|%s|%s|%s", access_mask,
975 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
976 str_create_disposition, smb_fname_str_do_log(smb_fname));
977
978 return result;
979 }
980
981 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
982 {
983 int result;
984
985 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
986
987 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
988 fsp_str_do_log(fsp));
989
990 return result;
991 }
992
993 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
994 void *data, size_t n)
995 {
996 ssize_t result;
997
998 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
999
1000 do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s",
1001 fsp_str_do_log(fsp));
1002
1003 return result;
1004 }
1005
1006 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1007 void *data, size_t n, off_t offset)
1008 {
1009 ssize_t result;
1010
1011 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1012
1013 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1014 fsp_str_do_log(fsp));
1015
1016 return result;
1017 }
1018
1019 struct smb_full_audit_pread_state {
1020 vfs_handle_struct *handle;
1021 files_struct *fsp;
1022 ssize_t ret;
1023 int err;
1024 };
1025
1026 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1027
1028 static struct tevent_req *smb_full_audit_pread_send(
1029 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1030 struct tevent_context *ev, struct files_struct *fsp,
1031 void *data, size_t n, off_t offset)
1032 {
1033 struct tevent_req *req, *subreq;
1034 struct smb_full_audit_pread_state *state;
1035
1036 req = tevent_req_create(mem_ctx, &state,
1037 struct smb_full_audit_pread_state);
1038 if (req == NULL) {
1039 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1040 fsp_str_do_log(fsp));
1041 return NULL;
1042 }
1043 state->handle = handle;
1044 state->fsp = fsp;
1045
1046 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1047 n, offset);
1048 if (tevent_req_nomem(subreq, req)) {
1049 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1050 fsp_str_do_log(fsp));
1051 return tevent_req_post(req, ev);
1052 }
1053 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1054
1055 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1056 return req;
1057 }
1058
1059 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1060 {
1061 struct tevent_req *req = tevent_req_callback_data(
1062 subreq, struct tevent_req);
1063 struct smb_full_audit_pread_state *state = tevent_req_data(
1064 req, struct smb_full_audit_pread_state);
1065
1066 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->err);
1067 TALLOC_FREE(subreq);
1068 tevent_req_done(req);
1069 }
1070
1071 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req, int *err)
1072 {
1073 struct smb_full_audit_pread_state *state = tevent_req_data(
1074 req, struct smb_full_audit_pread_state);
1075
1076 if (tevent_req_is_unix_error(req, err)) {
1077 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1078 fsp_str_do_log(state->fsp));
1079 return -1;
1080 }
1081
1082 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1083 fsp_str_do_log(state->fsp));
1084
1085 *err = state->err;
1086 return state->ret;
1087 }
1088
1089 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
1090 const void *data, size_t n)
1091 {
1092 ssize_t result;
1093
1094 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
1095
1096 do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s",
1097 fsp_str_do_log(fsp));
1098
1099 return result;
1100 }
1101
1102 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1103 const void *data, size_t n,
1104 off_t offset)
1105 {
1106 ssize_t result;
1107
1108 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1109
1110 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1111 fsp_str_do_log(fsp));
1112
1113 return result;
1114 }
1115
1116 struct smb_full_audit_pwrite_state {
1117 vfs_handle_struct *handle;
1118 files_struct *fsp;
1119 ssize_t ret;
1120 int err;
1121 };
1122
1123 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1124
1125 static struct tevent_req *smb_full_audit_pwrite_send(
1126 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1127 struct tevent_context *ev, struct files_struct *fsp,
1128 const void *data, size_t n, off_t offset)
1129 {
1130 struct tevent_req *req, *subreq;
1131 struct smb_full_audit_pwrite_state *state;
1132
1133 req = tevent_req_create(mem_ctx, &state,
1134 struct smb_full_audit_pwrite_state);
1135 if (req == NULL) {
1136 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1137 fsp_str_do_log(fsp));
1138 return NULL;
1139 }
1140 state->handle = handle;
1141 state->fsp = fsp;
1142
1143 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1144 n, offset);
1145 if (tevent_req_nomem(subreq, req)) {
1146 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1147 fsp_str_do_log(fsp));
1148 return tevent_req_post(req, ev);
1149 }
1150 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1151
1152 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1153 fsp_str_do_log(fsp));
1154 return req;
1155 }
1156
1157 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1158 {
1159 struct tevent_req *req = tevent_req_callback_data(
1160 subreq, struct tevent_req);
1161 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1162 req, struct smb_full_audit_pwrite_state);
1163
1164 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->err);
1165 TALLOC_FREE(subreq);
1166 tevent_req_done(req);
1167 }
1168
1169 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req, int *err)
1170 {
1171 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1172 req, struct smb_full_audit_pwrite_state);
1173
1174 if (tevent_req_is_unix_error(req, err)) {
1175 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1176 fsp_str_do_log(state->fsp));
1177 return -1;
1178 }
1179
1180 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1181 fsp_str_do_log(state->fsp));
1182
1183 *err = state->err;
1184 return state->ret;
1185 }
1186
1187 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1188 off_t offset, int whence)
1189 {
1190 ssize_t result;
1191
1192 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1193
1194 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1195 "%s", fsp_str_do_log(fsp));
1196
1197 return result;
1198 }
1199
1200 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1201 files_struct *fromfsp,
1202 const DATA_BLOB *hdr, off_t offset,
1203 size_t n)
1204 {
1205 ssize_t result;
1206
1207 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1208
1209 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1210 "%s", fsp_str_do_log(fromfsp));
1211
1212 return result;
1213 }
1214
1215 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1216 files_struct *tofsp,
1217 off_t offset,
1218 size_t n)
1219 {
1220 ssize_t result;
1221
1222 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1223
1224 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1225 "%s", fsp_str_do_log(tofsp));
1226
1227 return result;
1228 }
1229
1230 static int smb_full_audit_rename(vfs_handle_struct *handle,
1231 const struct smb_filename *smb_fname_src,
1232 const struct smb_filename *smb_fname_dst)
1233 {
1234 int result;
1235
1236 result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1237
1238 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1239 smb_fname_str_do_log(smb_fname_src),
1240 smb_fname_str_do_log(smb_fname_dst));
1241
1242 return result;
1243 }
1244
1245 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1246 {
1247 int result;
1248
1249 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1250
1251 do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s",
1252 fsp_str_do_log(fsp));
1253
1254 return result;
1255 }
1256
1257 struct smb_full_audit_fsync_state {
1258 vfs_handle_struct *handle;
1259 files_struct *fsp;
1260 int ret;
1261 int err;
1262 };
1263
1264 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1265
1266 static struct tevent_req *smb_full_audit_fsync_send(
1267 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1268 struct tevent_context *ev, struct files_struct *fsp)
1269 {
1270 struct tevent_req *req, *subreq;
1271 struct smb_full_audit_fsync_state *state;
1272
1273 req = tevent_req_create(mem_ctx, &state,
1274 struct smb_full_audit_fsync_state);
1275 if (req == NULL) {
1276 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1277 fsp_str_do_log(fsp));
1278 return NULL;
1279 }
1280 state->handle = handle;
1281 state->fsp = fsp;
1282
1283 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1284 if (tevent_req_nomem(subreq, req)) {
1285 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1286 fsp_str_do_log(fsp));
1287 return tevent_req_post(req, ev);
1288 }
1289 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1290
1291 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1292 return req;
1293 }
1294
1295 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1296 {
1297 struct tevent_req *req = tevent_req_callback_data(
1298 subreq, struct tevent_req);
1299 struct smb_full_audit_fsync_state *state = tevent_req_data(
1300 req, struct smb_full_audit_fsync_state);
1301
1302 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->err);
1303 TALLOC_FREE(subreq);
1304 tevent_req_done(req);
1305 }
1306
1307 static int smb_full_audit_fsync_recv(struct tevent_req *req, int *err)
1308 {
1309 struct smb_full_audit_fsync_state *state = tevent_req_data(
1310 req, struct smb_full_audit_fsync_state);
1311
1312 if (tevent_req_is_unix_error(req, err)) {
1313 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1314 fsp_str_do_log(state->fsp));
1315 return -1;
1316 }
1317
1318 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1319 fsp_str_do_log(state->fsp));
1320
1321 *err = state->err;
1322 return state->ret;
1323 }
1324
1325 static int smb_full_audit_stat(vfs_handle_struct *handle,
1326 struct smb_filename *smb_fname)
1327 {
1328 int result;
1329
1330 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1331
1332 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1333 smb_fname_str_do_log(smb_fname));
1334
1335 return result;
1336 }
1337
1338 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1339 SMB_STRUCT_STAT *sbuf)
1340 {
1341 int result;
1342
1343 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1344
1345 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1346 fsp_str_do_log(fsp));
1347
1348 return result;
1349 }
1350
1351 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1352 struct smb_filename *smb_fname)
1353 {
1354 int result;
1355
1356 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1357
1358 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1359 smb_fname_str_do_log(smb_fname));
1360
1361 return result;
1362 }
1363
1364 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1365 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1366 {
1367 uint64_t result;
1368
1369 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1370
1371 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1372 "%llu", result);
1373
1374 return result;
1375 }
1376
1377 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1378 const struct smb_filename *smb_fname)
1379 {
1380 int result;
1381
1382 result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1383
1384 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1385 smb_fname_str_do_log(smb_fname));
1386
1387 return result;
1388 }
1389
1390 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1391 const char *path, mode_t mode)
1392 {
1393 int result;
1394
1395 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1396
1397 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1398
1399 return result;
1400 }
1401
1402 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1403 mode_t mode)
1404 {
1405 int result;
1406
1407 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1408
1409 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1410 "%s|%o", fsp_str_do_log(fsp), mode);
1411
1412 return result;
1413 }
1414
1415 static int smb_full_audit_chown(vfs_handle_struct *handle,
1416 const char *path, uid_t uid, gid_t gid)
1417 {
1418 int result;
1419
1420 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1421
1422 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1423 path, (long int)uid, (long int)gid);
1424
1425 return result;
1426 }
1427
1428 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1429 uid_t uid, gid_t gid)
1430 {
1431 int result;
1432
1433 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1434
1435 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1436 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1437
1438 return result;
1439 }
1440
1441 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1442 const char *path, uid_t uid, gid_t gid)
1443 {
1444 int result;
1445
1446 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1447
1448 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1449 path, (long int)uid, (long int)gid);
1450
1451 return result;
1452 }
1453
1454 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1455 const char *path)
1456 {
1457 int result;
1458
1459 result = SMB_VFS_NEXT_CHDIR(handle, path);
1460
1461 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1462
1463 return result;
1464 }
1465
1466 static char *smb_full_audit_getwd(vfs_handle_struct *handle)
1467 {
1468 char *result;
1469
1470 result = SMB_VFS_NEXT_GETWD(handle);
1471
1472 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1473 result == NULL? "" : result);
1474
1475 return result;
1476 }
1477
1478 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1479 const struct smb_filename *smb_fname,
1480 struct smb_file_time *ft)
1481 {
1482 int result;
1483
1484 result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1485
1486 do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s",
1487 smb_fname_str_do_log(smb_fname));
1488
1489 return result;
1490 }
1491
1492 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1493 off_t len)
1494 {
1495 int result;
1496
1497 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1498
1499 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1500 "%s", fsp_str_do_log(fsp));
1501
1502 return result;
1503 }
1504
1505 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1506 uint32_t mode,
1507 off_t offset,
1508 off_t len)
1509 {
1510 int result;
1511
1512 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1513
1514 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1515 "%s", fsp_str_do_log(fsp));
1516
1517 return result;
1518 }
1519
1520 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1521 int op, off_t offset, off_t count, int type)
1522 {
1523 bool result;
1524
1525 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1526
1527 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1528
1529 return result;
1530 }
1531
1532 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1533 struct files_struct *fsp,
1534 uint32_t share_mode, uint32_t access_mask)
1535 {
1536 int result;
1537
1538 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1539
1540 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1541 fsp_str_do_log(fsp));
1542
1543 return result;
1544 }
1545
1546 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1547 int leasetype)
1548 {
1549 int result;
1550
1551 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1552
1553 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1554 fsp_str_do_log(fsp));
1555
1556 return result;
1557 }
1558
1559 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1560 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1561 {
1562 bool result;
1563
1564 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1565
1566 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1567
1568 return result;
1569 }
1570
1571 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1572 const char *oldpath, const char *newpath)
1573 {
1574 int result;
1575
1576 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1577
1578 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1579 "%s|%s", oldpath, newpath);
1580
1581 return result;
1582 }
1583
1584 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1585 const char *path, char *buf, size_t bufsiz)
1586 {
1587 int result;
1588
1589 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1590
1591 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1592
1593 return result;
1594 }
1595
1596 static int smb_full_audit_link(vfs_handle_struct *handle,
1597 const char *oldpath, const char *newpath)
1598 {
1599 int result;
1600
1601 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1602
1603 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1604 "%s|%s", oldpath, newpath);
1605
1606 return result;
1607 }
1608
1609 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1610 const char *pathname, mode_t mode, SMB_DEV_T dev)
1611 {
1612 int result;
1613
1614 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1615
1616 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1617
1618 return result;
1619 }
1620
1621 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1622 const char *path)
1623 {
1624 char *result;
1625
1626 result = SMB_VFS_NEXT_REALPATH(handle, path);
1627
1628 do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1629
1630 return result;
1631 }
1632
1633 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1634 struct sys_notify_context *ctx,
1635 const char *path,
1636 uint32_t *filter,
1637 uint32_t *subdir_filter,
1638 void (*callback)(struct sys_notify_context *ctx,
1639 void *private_data,
1640 struct notify_event *ev),
1641 void *private_data, void *handle_p)
1642 {
1643 NTSTATUS result;
1644
1645 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, path,
1646 filter, subdir_filter, callback,
1647 private_data, handle_p);
1648
1649 do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1650
1651 return result;
1652 }
1653
1654 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1655 const char *path, unsigned int flags)
1656 {
1657 int result;
1658
1659 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1660
1661 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1662
1663 return result;
1664 }
1665
1666 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1667 const SMB_STRUCT_STAT *sbuf)
1668 {
1669 struct file_id id_zero;
1670 struct file_id result;
1671
1672 ZERO_STRUCT(id_zero);
1673
1674 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1675
1676 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1677 !file_id_equal(&id_zero, &result),
1678 handle, "%s", file_id_string_tos(&result));
1679
1680 return result;
1681 }
1682
1683 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1684 struct files_struct *fsp,
1685 const char *fname,
1686 TALLOC_CTX *mem_ctx,
1687 unsigned int *pnum_streams,
1688 struct stream_struct **pstreams)
1689 {
1690 NTSTATUS result;
1691
1692 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1693 pnum_streams, pstreams);
1694
1695 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1696 "%s", fname);
1697
1698 return result;
1699 }
1700
1701 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1702 const char *path,
1703 const char *name,
1704 TALLOC_CTX *mem_ctx,
1705 char **found_name)
1706 {
1707 int result;
1708
1709 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1710 found_name);
1711
1712 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1713 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1714
1715 return result;
1716 }
1717
1718 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1719 const char *fname)
1720 {
1721 const char *result;
1722
1723 result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1724
1725 do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1726 "%s", fname);
1727
1728 return result;
1729 }
1730
1731 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1732 struct byte_range_lock *br_lck,
1733 struct lock_struct *plock,
1734 bool blocking_lock)
1735 {
1736 NTSTATUS result;
1737
1738 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1739 blocking_lock);
1740
1741 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1742 "%s:%llu-%llu. type=%d. blocking=%d",
1743 fsp_str_do_log(brl_fsp(br_lck)),
1744 plock->start, plock->size, plock->lock_type, blocking_lock);
1745
1746 return result;
1747 }
1748
1749 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1750 struct messaging_context *msg_ctx,
1751 struct byte_range_lock *br_lck,
1752 const struct lock_struct *plock)
1753 {
1754 bool result;
1755
1756 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1757 plock);
1758
1759 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1760 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1761 plock->start,
1762 plock->size, plock->lock_type);
1763
1764 return result;
1765 }
1766
1767 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1768 struct byte_range_lock *br_lck,
1769 struct lock_struct *plock)
1770 {
1771 bool result;
1772
1773 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1774
1775 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1776 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1777 plock->start,
1778 plock->size, plock->lock_type);
1779
1780 return result;
1781 }
1782
1783 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
1784 struct files_struct *fsp,
1785 struct lock_struct *plock)
1786 {
1787 bool result;
1788
1789 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1790
1791 do_log(SMB_VFS_OP_STRICT_LOCK, result, handle,
1792 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1793 plock->size, plock->lock_type);
1794
1795 return result;
1796 }
1797
1798 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
1799 struct files_struct *fsp,
1800 struct lock_struct *plock)
1801 {
1802 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1803
1804 do_log(SMB_VFS_OP_STRICT_UNLOCK, true, handle,
1805 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1806 plock->size, plock->lock_type);
1807 }
1808
1809 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1810 const char *name,
1811 enum vfs_translate_direction direction,
1812 TALLOC_CTX *mem_ctx,
1813 char **mapped_name)
1814 {
1815 NTSTATUS result;
1816
1817 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1818 mapped_name);
1819
1820 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1821
1822 return result;
1823 }
1824
1825 static struct tevent_req *smb_full_audit_copy_chunk_send(struct vfs_handle_struct *handle,
1826 TALLOC_CTX *mem_ctx,
1827 struct tevent_context *ev,
1828 struct files_struct *src_fsp,
1829 off_t src_off,
1830 struct files_struct *dest_fsp,
1831 off_t dest_off,
1832 off_t num)
1833 {
1834 struct tevent_req *req;
1835
1836 req = SMB_VFS_NEXT_COPY_CHUNK_SEND(handle, mem_ctx, ev, src_fsp,
1837 src_off, dest_fsp, dest_off, num);
1838
1839 do_log(SMB_VFS_OP_COPY_CHUNK_SEND, req, handle, "");
1840
1841 return req;
1842 }
1843
1844 static NTSTATUS smb_full_audit_copy_chunk_recv(struct vfs_handle_struct *handle,
1845 struct tevent_req *req,
1846 off_t *copied)
1847 {
1848 NTSTATUS result;
1849
1850 result = SMB_VFS_NEXT_COPY_CHUNK_RECV(handle, req, copied);
1851
1852 do_log(SMB_VFS_OP_COPY_CHUNK_RECV, NT_STATUS_IS_OK(result), handle, "");
1853
1854 return result;
1855 }
1856
1857 static NTSTATUS smb_full_audit_get_compression(vfs_handle_struct *handle,
1858 TALLOC_CTX *mem_ctx,
1859 struct files_struct *fsp,
1860 struct smb_filename *smb_fname,
1861 uint16_t *_compression_fmt)
1862 {
1863 NTSTATUS result;
1864
1865 result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1866 _compression_fmt);
1867
1868 do_log(SMB_VFS_OP_GET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
1869 "%s",
1870 (fsp ? fsp_str_do_log(fsp) : smb_fname_str_do_log(smb_fname)));
1871
1872 return result;
1873 }
1874
1875 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
1876 TALLOC_CTX *mem_ctx,
1877 struct files_struct *fsp,
1878 uint16_t compression_fmt)
1879 {
1880 NTSTATUS result;
1881
1882 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
1883 compression_fmt);
1884
1885 do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
1886 "%s", fsp_str_do_log(fsp));
1887
1888 return result;
1889 }
1890
1891 static NTSTATUS smb_full_audit_readdir_attr(struct vfs_handle_struct *handle,
1892 const struct smb_filename *fname,
1893 TALLOC_CTX *mem_ctx,
1894 struct readdir_attr_data **pattr_data)
1895 {
1896 NTSTATUS status;
1897
1898 status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
1899
1900 do_log(SMB_VFS_OP_READDIR_ATTR, NT_STATUS_IS_OK(status), handle, "%s",
1901 smb_fname_str_do_log(fname));
1902
1903 return status;
1904 }
1905
1906 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1907 uint32_t security_info,
1908 TALLOC_CTX *mem_ctx,
1909 struct security_descriptor **ppdesc)
1910 {
1911 NTSTATUS result;
1912
1913 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
1914 mem_ctx, ppdesc);
1915
1916 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1917 "%s", fsp_str_do_log(fsp));
1918
1919 return result;
1920 }
1921
1922 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1923 const char *name,
1924 uint32_t security_info,
1925 TALLOC_CTX *mem_ctx,
1926 struct security_descriptor **ppdesc)
1927 {
1928 NTSTATUS result;
1929
1930 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
1931 mem_ctx, ppdesc);
1932
1933 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1934 "%s", name);
1935
1936 return result;
1937 }
1938
1939 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1940 uint32_t security_info_sent,
1941 const struct security_descriptor *psd)
1942 {
1943 struct vfs_full_audit_private_data *pd;
1944 NTSTATUS result;
1945 char *sd = NULL;
1946
1947 SMB_VFS_HANDLE_GET_DATA(handle, pd,
1948 struct vfs_full_audit_private_data,
1949 return NT_STATUS_INTERNAL_ERROR);
1950
1951 if (pd->log_secdesc) {
1952 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
1953 }
1954
1955 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1956
1957 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1958 "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
1959
1960 TALLOC_FREE(sd);
1961
1962 return result;
1963 }
1964
1965 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1966 const char *path, mode_t mode)
1967 {
1968 int result;
1969
1970 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1971
1972 do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1973 "%s|%o", path, mode);
1974
1975 return result;
1976 }
1977
1978 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1979 mode_t mode)
1980 {
1981 int result;
1982
1983 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1984
1985 do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1986 "%s|%o", fsp_str_do_log(fsp), mode);
1987
1988 return result;
1989 }
1990
1991 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1992 const char *path_p,
1993 SMB_ACL_TYPE_T type,
1994 TALLOC_CTX *mem_ctx)
1995 {
1996 SMB_ACL_T result;
1997
1998 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
1999
2000 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
2001 "%s", path_p);
2002
2003 return result;
2004 }
2005
2006 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2007 files_struct *fsp, TALLOC_CTX *mem_ctx)
2008 {
2009 SMB_ACL_T result;
2010
2011 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2012
2013 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2014 "%s", fsp_str_do_log(fsp));
2015
2016 return result;
2017 }
2018
2019 static int smb_full_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2020 const char *path_p,
2021 TALLOC_CTX *mem_ctx,
2022 char **blob_description,
2023 DATA_BLOB *blob)
2024 {
2025 int result;
2026
2027 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, path_p, mem_ctx, blob_description, blob);
2028
2029 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, (result >= 0), handle,
2030 "%s", path_p);
2031
2032 return result;
2033 }
2034
2035 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2036 files_struct *fsp,
2037 TALLOC_CTX *mem_ctx,
2038 char **blob_description,
2039 DATA_BLOB *blob)
2040 {
2041 int result;
2042
2043 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2044
2045 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2046 "%s", fsp_str_do_log(fsp));
2047
2048 return result;
2049 }
2050
2051 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
2052
2053 const char *name, SMB_ACL_TYPE_T acltype,
2054 SMB_ACL_T theacl)
2055 {
2056 int result;
2057
2058 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
2059 theacl);
2060
2061 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
2062 "%s", name);
2063
2064 return result;
2065 }
2066
2067 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
2068 SMB_ACL_T theacl)
2069 {
2070 int result;
2071
2072 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2073
2074 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2075 "%s", fsp_str_do_log(fsp));
2076
2077 return result;
2078 }
2079
2080 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2081
2082 const char *path)
2083 {
2084 int result;
2085
2086 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2087
2088 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2089 "%s", path);
2090
2091 return result;
2092 }
2093
2094 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2095 const char *path,
2096 const char *name, void *value, size_t size)
2097 {
2098 ssize_t result;
2099
2100 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2101
2102 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2103 "%s|%s", path, name);
2104
2105 return result;
2106 }
2107
2108 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2109 struct files_struct *fsp,
2110 const char *name, void *value, size_t size)
2111 {
2112 ssize_t result;
2113
2114 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2115
2116 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2117 "%s|%s", fsp_str_do_log(fsp), name);
2118
2119 return result;
2120 }
2121
2122 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2123 const char *path, char *list, size_t size)
2124 {
2125 ssize_t result;
2126
2127 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2128
2129 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
2130
2131 return result;
2132 }
2133
2134 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2135 struct files_struct *fsp, char *list,
2136 size_t size)
2137 {
2138 ssize_t result;
2139
2140 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2141
2142 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2143 "%s", fsp_str_do_log(fsp));
2144
2145 return result;
2146 }
2147
2148 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2149 const char *path,
2150 const char *name)
2151 {
2152 int result;
2153
2154 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2155
2156 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2157 "%s|%s", path, name);
2158
2159 return result;
2160 }
2161
2162 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2163 struct files_struct *fsp,
2164 const char *name)
2165 {
2166 int result;
2167
2168 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2169
2170 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2171 "%s|%s", fsp_str_do_log(fsp), name);
2172
2173 return result;
2174 }
2175
2176 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2177 const char *path,
2178 const char *name, const void *value, size_t size,
2179 int flags)
2180 {
2181 int result;
2182
2183 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2184 flags);
2185
2186 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2187 "%s|%s", path, name);
2188
2189 return result;
2190 }
2191
2192 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2193 struct files_struct *fsp, const char *name,
2194 const void *value, size_t size, int flags)
2195 {
2196 int result;
2197
2198 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2199
2200 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2201 "%s|%s", fsp_str_do_log(fsp), name);
2202
2203 return result;
2204 }
2205
2206 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2207 struct files_struct *fsp)
2208 {
2209 bool result;
2210
2211 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2212 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2213 "%s", fsp_str_do_log(fsp));
2214
2215 return result;
2216 }
2217
2218 static bool smb_full_audit_is_offline(struct vfs_handle_struct *handle,
2219 const struct smb_filename *fname,
2220 SMB_STRUCT_STAT *sbuf)
2221 {
2222 bool result;
2223
2224 result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
2225 do_log(SMB_VFS_OP_IS_OFFLINE, result, handle, "%s",
2226 smb_fname_str_do_log(fname));
2227 return result;
2228 }
2229
2230 static int smb_full_audit_set_offline(struct vfs_handle_struct *handle,
2231 const struct smb_filename *fname)
2232 {
2233 int result;
2234
2235 result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2236 do_log(SMB_VFS_OP_SET_OFFLINE, result >= 0, handle, "%s",
2237 smb_fname_str_do_log(fname));
2238 return result;
2239 }
2240
2241 static struct vfs_fn_pointers vfs_full_audit_fns = {
2242
2243 /* Disk operations */
2244
2245 .connect_fn = smb_full_audit_connect,
2246 .disconnect_fn = smb_full_audit_disconnect,
2247 .disk_free_fn = smb_full_audit_disk_free,
2248 .get_quota_fn = smb_full_audit_get_quota,
2249 .set_quota_fn = smb_full_audit_set_quota,
2250 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2251 .statvfs_fn = smb_full_audit_statvfs,
2252 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2253 .snap_check_path_fn = smb_full_audit_snap_check_path,
2254 .snap_create_fn = smb_full_audit_snap_create,
2255 .snap_delete_fn = smb_full_audit_snap_delete,
2256 .opendir_fn = smb_full_audit_opendir,
2257 .fdopendir_fn = smb_full_audit_fdopendir,
2258 .readdir_fn = smb_full_audit_readdir,
2259 .seekdir_fn = smb_full_audit_seekdir,
2260 .telldir_fn = smb_full_audit_telldir,
2261 .rewind_dir_fn = smb_full_audit_rewinddir,
2262 .mkdir_fn = smb_full_audit_mkdir,
2263 .rmdir_fn = smb_full_audit_rmdir,
2264 .closedir_fn = smb_full_audit_closedir,
2265 .init_search_op_fn = smb_full_audit_init_search_op,
2266 .open_fn = smb_full_audit_open,
2267 .create_file_fn = smb_full_audit_create_file,
2268 .close_fn = smb_full_audit_close,
2269 .read_fn = smb_full_audit_read,
2270 .pread_fn = smb_full_audit_pread,
2271 .pread_send_fn = smb_full_audit_pread_send,
2272 .pread_recv_fn = smb_full_audit_pread_recv,
2273 .write_fn = smb_full_audit_write,
2274 .pwrite_fn = smb_full_audit_pwrite,
2275 .pwrite_send_fn = smb_full_audit_pwrite_send,
2276 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2277 .lseek_fn = smb_full_audit_lseek,
2278 .sendfile_fn = smb_full_audit_sendfile,
2279 .recvfile_fn = smb_full_audit_recvfile,
2280 .rename_fn = smb_full_audit_rename,
2281 .fsync_fn = smb_full_audit_fsync,
2282 .fsync_send_fn = smb_full_audit_fsync_send,
2283 .fsync_recv_fn = smb_full_audit_fsync_recv,
2284 .stat_fn = smb_full_audit_stat,
2285 .fstat_fn = smb_full_audit_fstat,
2286 .lstat_fn = smb_full_audit_lstat,
2287 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2288 .unlink_fn = smb_full_audit_unlink,
2289 .chmod_fn = smb_full_audit_chmod,
2290 .fchmod_fn = smb_full_audit_fchmod,
2291 .chown_fn = smb_full_audit_chown,
2292 .fchown_fn = smb_full_audit_fchown,
2293 .lchown_fn = smb_full_audit_lchown,
2294 .chdir_fn = smb_full_audit_chdir,
2295 .getwd_fn = smb_full_audit_getwd,
2296 .ntimes_fn = smb_full_audit_ntimes,
2297 .ftruncate_fn = smb_full_audit_ftruncate,
2298 .fallocate_fn = smb_full_audit_fallocate,
2299 .lock_fn = smb_full_audit_lock,
2300 .kernel_flock_fn = smb_full_audit_kernel_flock,
2301 .linux_setlease_fn = smb_full_audit_linux_setlease,
2302 .getlock_fn = smb_full_audit_getlock,
2303 .symlink_fn = smb_full_audit_symlink,
2304 .readlink_fn = smb_full_audit_readlink,
2305 .link_fn = smb_full_audit_link,
2306 .mknod_fn = smb_full_audit_mknod,
2307 .realpath_fn = smb_full_audit_realpath,
2308 .notify_watch_fn = smb_full_audit_notify_watch,
2309 .chflags_fn = smb_full_audit_chflags,
2310 .file_id_create_fn = smb_full_audit_file_id_create,
2311 .streaminfo_fn = smb_full_audit_streaminfo,
2312 .get_real_filename_fn = smb_full_audit_get_real_filename,
2313 .connectpath_fn = smb_full_audit_connectpath,
2314 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2315 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2316 .brl_cancel_windows_fn = smb_full_audit_brl_cancel_windows,
2317 .strict_lock_fn = smb_full_audit_strict_lock,
2318 .strict_unlock_fn = smb_full_audit_strict_unlock,
2319 .translate_name_fn = smb_full_audit_translate_name,
2320 .copy_chunk_send_fn = smb_full_audit_copy_chunk_send,
2321 .copy_chunk_recv_fn = smb_full_audit_copy_chunk_recv,
2322 .get_compression_fn = smb_full_audit_get_compression,
2323 .set_compression_fn = smb_full_audit_set_compression,
2324 .readdir_attr_fn = smb_full_audit_readdir_attr,
2325 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2326 .get_nt_acl_fn = smb_full_audit_get_nt_acl,
2327 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2328 .chmod_acl_fn = smb_full_audit_chmod_acl,
2329 .fchmod_acl_fn = smb_full_audit_fchmod_acl,
2330 .sys_acl_get_file_fn = smb_full_audit_sys_acl_get_file,
2331 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2332 .sys_acl_blob_get_file_fn = smb_full_audit_sys_acl_blob_get_file,
2333 .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2334 .sys_acl_set_file_fn = smb_full_audit_sys_acl_set_file,
2335 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2336 .sys_acl_delete_def_file_fn = smb_full_audit_sys_acl_delete_def_file,
2337 .getxattr_fn = smb_full_audit_getxattr,
2338 .fgetxattr_fn = smb_full_audit_fgetxattr,
2339 .listxattr_fn = smb_full_audit_listxattr,
2340 .flistxattr_fn = smb_full_audit_flistxattr,
2341 .removexattr_fn = smb_full_audit_removexattr,
2342 .fremovexattr_fn = smb_full_audit_fremovexattr,
2343 .setxattr_fn = smb_full_audit_setxattr,
2344 .fsetxattr_fn = smb_full_audit_fsetxattr,
2345 .aio_force_fn = smb_full_audit_aio_force,
2346 .is_offline_fn = smb_full_audit_is_offline,
2347 .set_offline_fn = smb_full_audit_set_offline,
2348 };
2349
2350 NTSTATUS vfs_full_audit_init(void)
2351 {
2352 NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2353 "full_audit", &vfs_full_audit_fns);
2354
2355 if (!NT_STATUS_IS_OK(ret))
2356 return ret;
2357
2358 vfs_full_audit_debug_level = debug_add_class("full_audit");
2359 if (vfs_full_audit_debug_level == -1) {
2360 vfs_full_audit_debug_level = DBGC_VFS;
2361 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2362 "class!\n"));
2363 } else {
2364 DEBUG(10, ("vfs_full_audit: Debug class number of "
2365 "'full_audit': %d\n", vfs_full_audit_debug_level));
2366 }
2367
2368 return ret;
2369 }
Samba GIT mirror