?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture: FinderInfo conversion test with AppleDouble without xattr data
[Samba.git] / source3 / modules / vfs_full_audit.c
blob2ab7d83957b80043f2ba000ae700954d73ab8915
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
65 #include "auth.h"
66 #include "ntioctl.h"
67 #include "lib/param/loadparm.h"
68 #include "lib/util/bitmap.h"
69 #include "lib/util/tevent_unix.h"
70 #include "libcli/security/sddl.h"
71 #include "passdb/machine_sid.h"
72
73 static int vfs_full_audit_debug_level = DBGC_VFS;
74
75 struct vfs_full_audit_private_data {
76 struct bitmap *success_ops;
77 struct bitmap *failure_ops;
78 int syslog_facility;
79 int syslog_priority;
80 bool log_secdesc;
81 bool do_syslog;
82 };
83
84 #undef DBGC_CLASS
85 #define DBGC_CLASS vfs_full_audit_debug_level
86
87 typedef enum _vfs_op_type {
88 SMB_VFS_OP_NOOP = -1,
89
90 /* Disk operations */
91
92 SMB_VFS_OP_CONNECT = 0,
93 SMB_VFS_OP_DISCONNECT,
94 SMB_VFS_OP_DISK_FREE,
95 SMB_VFS_OP_GET_QUOTA,
96 SMB_VFS_OP_SET_QUOTA,
97 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
98 SMB_VFS_OP_STATVFS,
99 SMB_VFS_OP_FS_CAPABILITIES,
100 SMB_VFS_OP_GET_DFS_REFERRALS,
101
102 /* Directory operations */
103
104 SMB_VFS_OP_OPENDIR,
105 SMB_VFS_OP_FDOPENDIR,
106 SMB_VFS_OP_READDIR,
107 SMB_VFS_OP_SEEKDIR,
108 SMB_VFS_OP_TELLDIR,
109 SMB_VFS_OP_REWINDDIR,
110 SMB_VFS_OP_MKDIR,
111 SMB_VFS_OP_RMDIR,
112 SMB_VFS_OP_CLOSEDIR,
113
114 /* File operations */
115
116 SMB_VFS_OP_OPEN,
117 SMB_VFS_OP_CREATE_FILE,
118 SMB_VFS_OP_CLOSE,
119 SMB_VFS_OP_READ,
120 SMB_VFS_OP_PREAD,
121 SMB_VFS_OP_PREAD_SEND,
122 SMB_VFS_OP_PREAD_RECV,
123 SMB_VFS_OP_WRITE,
124 SMB_VFS_OP_PWRITE,
125 SMB_VFS_OP_PWRITE_SEND,
126 SMB_VFS_OP_PWRITE_RECV,
127 SMB_VFS_OP_LSEEK,
128 SMB_VFS_OP_SENDFILE,
129 SMB_VFS_OP_RECVFILE,
130 SMB_VFS_OP_RENAME,
131 SMB_VFS_OP_FSYNC,
132 SMB_VFS_OP_FSYNC_SEND,
133 SMB_VFS_OP_FSYNC_RECV,
134 SMB_VFS_OP_STAT,
135 SMB_VFS_OP_FSTAT,
136 SMB_VFS_OP_LSTAT,
137 SMB_VFS_OP_GET_ALLOC_SIZE,
138 SMB_VFS_OP_UNLINK,
139 SMB_VFS_OP_CHMOD,
140 SMB_VFS_OP_FCHMOD,
141 SMB_VFS_OP_CHOWN,
142 SMB_VFS_OP_FCHOWN,
143 SMB_VFS_OP_LCHOWN,
144 SMB_VFS_OP_CHDIR,
145 SMB_VFS_OP_GETWD,
146 SMB_VFS_OP_NTIMES,
147 SMB_VFS_OP_FTRUNCATE,
148 SMB_VFS_OP_FALLOCATE,
149 SMB_VFS_OP_LOCK,
150 SMB_VFS_OP_KERNEL_FLOCK,
151 SMB_VFS_OP_LINUX_SETLEASE,
152 SMB_VFS_OP_GETLOCK,
153 SMB_VFS_OP_SYMLINK,
154 SMB_VFS_OP_READLINK,
155 SMB_VFS_OP_LINK,
156 SMB_VFS_OP_MKNOD,
157 SMB_VFS_OP_REALPATH,
158 SMB_VFS_OP_CHFLAGS,
159 SMB_VFS_OP_FILE_ID_CREATE,
160 SMB_VFS_OP_STREAMINFO,
161 SMB_VFS_OP_GET_REAL_FILENAME,
162 SMB_VFS_OP_CONNECTPATH,
163 SMB_VFS_OP_BRL_LOCK_WINDOWS,
164 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
165 SMB_VFS_OP_BRL_CANCEL_WINDOWS,
166 SMB_VFS_OP_STRICT_LOCK_CHECK,
167 SMB_VFS_OP_TRANSLATE_NAME,
168 SMB_VFS_OP_FSCTL,
169 SMB_VFS_OP_OFFLOAD_READ_SEND,
170 SMB_VFS_OP_OFFLOAD_READ_RECV,
171 SMB_VFS_OP_OFFLOAD_WRITE_SEND,
172 SMB_VFS_OP_OFFLOAD_WRITE_RECV,
173 SMB_VFS_OP_GET_COMPRESSION,
174 SMB_VFS_OP_SET_COMPRESSION,
175 SMB_VFS_OP_SNAP_CHECK_PATH,
176 SMB_VFS_OP_SNAP_CREATE,
177 SMB_VFS_OP_SNAP_DELETE,
178
179 /* DOS attribute operations. */
180 SMB_VFS_OP_GET_DOS_ATTRIBUTES,
181 SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
182 SMB_VFS_OP_SET_DOS_ATTRIBUTES,
183 SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
184
185 /* NT ACL operations. */
186
187 SMB_VFS_OP_FGET_NT_ACL,
188 SMB_VFS_OP_GET_NT_ACL,
189 SMB_VFS_OP_FSET_NT_ACL,
190 SMB_VFS_OP_AUDIT_FILE,
191
192 /* POSIX ACL operations. */
193
194 SMB_VFS_OP_SYS_ACL_GET_FILE,
195 SMB_VFS_OP_SYS_ACL_GET_FD,
196 SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE,
197 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
198 SMB_VFS_OP_SYS_ACL_SET_FILE,
199 SMB_VFS_OP_SYS_ACL_SET_FD,
200 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
201
202 /* EA operations. */
203 SMB_VFS_OP_GETXATTR,
204 SMB_VFS_OP_FGETXATTR,
205 SMB_VFS_OP_LISTXATTR,
206 SMB_VFS_OP_FLISTXATTR,
207 SMB_VFS_OP_REMOVEXATTR,
208 SMB_VFS_OP_FREMOVEXATTR,
209 SMB_VFS_OP_SETXATTR,
210 SMB_VFS_OP_FSETXATTR,
211
212 /* aio operations */
213 SMB_VFS_OP_AIO_FORCE,
214
215 /* offline operations */
216 SMB_VFS_OP_IS_OFFLINE,
217 SMB_VFS_OP_SET_OFFLINE,
218
219 /* Durable handle operations. */
220 SMB_VFS_OP_DURABLE_COOKIE,
221 SMB_VFS_OP_DURABLE_DISCONNECT,
222 SMB_VFS_OP_DURABLE_RECONNECT,
223
224 SMB_VFS_OP_READDIR_ATTR,
225
226 /* This should always be last enum value */
227
228 SMB_VFS_OP_LAST
229 } vfs_op_type;
230
231 /* The following array *must* be in the same order as defined in vfs_op_type */
232
233 static struct {
234 vfs_op_type type;
235 const char *name;
236 } vfs_op_names[] = {
237 { SMB_VFS_OP_CONNECT, "connect" },
238 { SMB_VFS_OP_DISCONNECT, "disconnect" },
239 { SMB_VFS_OP_DISK_FREE, "disk_free" },
240 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
241 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
242 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
243 { SMB_VFS_OP_STATVFS, "statvfs" },
244 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
245 { SMB_VFS_OP_GET_DFS_REFERRALS, "get_dfs_referrals" },
246 { SMB_VFS_OP_OPENDIR, "opendir" },
247 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
248 { SMB_VFS_OP_READDIR, "readdir" },
249 { SMB_VFS_OP_SEEKDIR, "seekdir" },
250 { SMB_VFS_OP_TELLDIR, "telldir" },
251 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
252 { SMB_VFS_OP_MKDIR, "mkdir" },
253 { SMB_VFS_OP_RMDIR, "rmdir" },
254 { SMB_VFS_OP_CLOSEDIR, "closedir" },
255 { SMB_VFS_OP_OPEN, "open" },
256 { SMB_VFS_OP_CREATE_FILE, "create_file" },
257 { SMB_VFS_OP_CLOSE, "close" },
258 { SMB_VFS_OP_READ, "read" },
259 { SMB_VFS_OP_PREAD, "pread" },
260 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
261 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
262 { SMB_VFS_OP_WRITE, "write" },
263 { SMB_VFS_OP_PWRITE, "pwrite" },
264 { SMB_VFS_OP_PWRITE_SEND, "pwrite_send" },
265 { SMB_VFS_OP_PWRITE_RECV, "pwrite_recv" },
266 { SMB_VFS_OP_LSEEK, "lseek" },
267 { SMB_VFS_OP_SENDFILE, "sendfile" },
268 { SMB_VFS_OP_RECVFILE, "recvfile" },
269 { SMB_VFS_OP_RENAME, "rename" },
270 { SMB_VFS_OP_FSYNC, "fsync" },
271 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
272 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
273 { SMB_VFS_OP_STAT, "stat" },
274 { SMB_VFS_OP_FSTAT, "fstat" },
275 { SMB_VFS_OP_LSTAT, "lstat" },
276 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
277 { SMB_VFS_OP_UNLINK, "unlink" },
278 { SMB_VFS_OP_CHMOD, "chmod" },
279 { SMB_VFS_OP_FCHMOD, "fchmod" },
280 { SMB_VFS_OP_CHOWN, "chown" },
281 { SMB_VFS_OP_FCHOWN, "fchown" },
282 { SMB_VFS_OP_LCHOWN, "lchown" },
283 { SMB_VFS_OP_CHDIR, "chdir" },
284 { SMB_VFS_OP_GETWD, "getwd" },
285 { SMB_VFS_OP_NTIMES, "ntimes" },
286 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
287 { SMB_VFS_OP_FALLOCATE,"fallocate" },
288 { SMB_VFS_OP_LOCK, "lock" },
289 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
290 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
291 { SMB_VFS_OP_GETLOCK, "getlock" },
292 { SMB_VFS_OP_SYMLINK, "symlink" },
293 { SMB_VFS_OP_READLINK, "readlink" },
294 { SMB_VFS_OP_LINK, "link" },
295 { SMB_VFS_OP_MKNOD, "mknod" },
296 { SMB_VFS_OP_REALPATH, "realpath" },
297 { SMB_VFS_OP_CHFLAGS, "chflags" },
298 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
299 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
300 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
301 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
302 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
303 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
304 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
305 { SMB_VFS_OP_STRICT_LOCK_CHECK, "strict_lock_check" },
306 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
307 { SMB_VFS_OP_FSCTL, "fsctl" },
308 { SMB_VFS_OP_OFFLOAD_READ_SEND, "offload_read_send" },
309 { SMB_VFS_OP_OFFLOAD_READ_RECV, "offload_read_recv" },
310 { SMB_VFS_OP_OFFLOAD_WRITE_SEND, "offload_write_send" },
311 { SMB_VFS_OP_OFFLOAD_WRITE_RECV, "offload_write_recv" },
312 { SMB_VFS_OP_GET_COMPRESSION, "get_compression" },
313 { SMB_VFS_OP_SET_COMPRESSION, "set_compression" },
314 { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
315 { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
316 { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
317 { SMB_VFS_OP_GET_DOS_ATTRIBUTES, "get_dos_attributes" },
318 { SMB_VFS_OP_FGET_DOS_ATTRIBUTES, "fget_dos_attributes" },
319 { SMB_VFS_OP_SET_DOS_ATTRIBUTES, "set_dos_attributes" },
320 { SMB_VFS_OP_FSET_DOS_ATTRIBUTES, "fset_dos_attributes" },
321 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
322 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
323 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
324 { SMB_VFS_OP_AUDIT_FILE, "audit_file" },
325 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
326 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
327 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, "sys_acl_blob_get_file" },
328 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, "sys_acl_blob_get_fd" },
329 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
330 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
331 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
332 { SMB_VFS_OP_GETXATTR, "getxattr" },
333 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
334 { SMB_VFS_OP_LISTXATTR, "listxattr" },
335 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
336 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
337 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
338 { SMB_VFS_OP_SETXATTR, "setxattr" },
339 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
340 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
341 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
342 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
343 { SMB_VFS_OP_DURABLE_COOKIE, "durable_cookie" },
344 { SMB_VFS_OP_DURABLE_DISCONNECT, "durable_disconnect" },
345 { SMB_VFS_OP_DURABLE_RECONNECT, "durable_reconnect" },
346 { SMB_VFS_OP_READDIR_ATTR, "readdir_attr" },
347 { SMB_VFS_OP_LAST, NULL }
348 };
349
350 static int audit_syslog_facility(vfs_handle_struct *handle)
351 {
352 static const struct enum_list enum_log_facilities[] = {
353 #ifdef LOG_AUTH
354 { LOG_AUTH, "AUTH" },
355 #endif
356 #ifdef LOG_AUTHPRIV
357 { LOG_AUTHPRIV, "AUTHPRIV" },
358 #endif
359 #ifdef LOG_AUDIT
360 { LOG_AUDIT, "AUDIT" },
361 #endif
362 #ifdef LOG_CONSOLE
363 { LOG_CONSOLE, "CONSOLE" },
364 #endif
365 #ifdef LOG_CRON
366 { LOG_CRON, "CRON" },
367 #endif
368 #ifdef LOG_DAEMON
369 { LOG_DAEMON, "DAEMON" },
370 #endif
371 #ifdef LOG_FTP
372 { LOG_FTP, "FTP" },
373 #endif
374 #ifdef LOG_INSTALL
375 { LOG_INSTALL, "INSTALL" },
376 #endif
377 #ifdef LOG_KERN
378 { LOG_KERN, "KERN" },
379 #endif
380 #ifdef LOG_LAUNCHD
381 { LOG_LAUNCHD, "LAUNCHD" },
382 #endif
383 #ifdef LOG_LFMT
384 { LOG_LFMT, "LFMT" },
385 #endif
386 #ifdef LOG_LPR
387 { LOG_LPR, "LPR" },
388 #endif
389 #ifdef LOG_MAIL
390 { LOG_MAIL, "MAIL" },
391 #endif
392 #ifdef LOG_MEGASAFE
393 { LOG_MEGASAFE, "MEGASAFE" },
394 #endif
395 #ifdef LOG_NETINFO
396 { LOG_NETINFO, "NETINFO" },
397 #endif
398 #ifdef LOG_NEWS
399 { LOG_NEWS, "NEWS" },
400 #endif
401 #ifdef LOG_NFACILITIES
402 { LOG_NFACILITIES, "NFACILITIES" },
403 #endif
404 #ifdef LOG_NTP
405 { LOG_NTP, "NTP" },
406 #endif
407 #ifdef LOG_RAS
408 { LOG_RAS, "RAS" },
409 #endif
410 #ifdef LOG_REMOTEAUTH
411 { LOG_REMOTEAUTH, "REMOTEAUTH" },
412 #endif
413 #ifdef LOG_SECURITY
414 { LOG_SECURITY, "SECURITY" },
415 #endif
416 #ifdef LOG_SYSLOG
417 { LOG_SYSLOG, "SYSLOG" },
418 #endif
419 #ifdef LOG_USER
420 { LOG_USER, "USER" },
421 #endif
422 #ifdef LOG_UUCP
423 { LOG_UUCP, "UUCP" },
424 #endif
425 { LOG_LOCAL0, "LOCAL0" },
426 { LOG_LOCAL1, "LOCAL1" },
427 { LOG_LOCAL2, "LOCAL2" },
428 { LOG_LOCAL3, "LOCAL3" },
429 { LOG_LOCAL4, "LOCAL4" },
430 { LOG_LOCAL5, "LOCAL5" },
431 { LOG_LOCAL6, "LOCAL6" },
432 { LOG_LOCAL7, "LOCAL7" },
433 { -1, NULL }
434 };
435
436 int facility;
437
438 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
439
440 return facility;
441 }
442
443 static int audit_syslog_priority(vfs_handle_struct *handle)
444 {
445 static const struct enum_list enum_log_priorities[] = {
446 { LOG_EMERG, "EMERG" },
447 { LOG_ALERT, "ALERT" },
448 { LOG_CRIT, "CRIT" },
449 { LOG_ERR, "ERR" },
450 { LOG_WARNING, "WARNING" },
451 { LOG_NOTICE, "NOTICE" },
452 { LOG_INFO, "INFO" },
453 { LOG_DEBUG, "DEBUG" },
454 { -1, NULL }
455 };
456
457 int priority;
458
459 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
460 enum_log_priorities, LOG_NOTICE);
461 if (priority == -1) {
462 priority = LOG_WARNING;
463 }
464
465 return priority;
466 }
467
468 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
469 {
470 char *prefix = NULL;
471 char *result;
472
473 prefix = talloc_strdup(ctx,
474 lp_parm_const_string(SNUM(conn), "full_audit",
475 "prefix", "%u|%I"));
476 if (!prefix) {
477 return NULL;
478 }
479 result = talloc_sub_advanced(ctx,
480 lp_servicename(talloc_tos(), SNUM(conn)),
481 conn->session_info->unix_info->unix_name,
482 conn->connectpath,
483 conn->session_info->unix_token->gid,
484 conn->session_info->unix_info->sanitized_username,
485 conn->session_info->info->domain_name,
486 prefix);
487 TALLOC_FREE(prefix);
488 return result;
489 }
490
491 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
492 {
493 if (pd->success_ops == NULL) {
494 return True;
495 }
496
497 return bitmap_query(pd->success_ops, op);
498 }
499
500 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
501 {
502 if (pd->failure_ops == NULL)
503 return True;
504
505 return bitmap_query(pd->failure_ops, op);
506 }
507
508 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
509 {
510 struct bitmap *bm;
511
512 if (ops == NULL) {
513 return NULL;
514 }
515
516 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
517 if (bm == NULL) {
518 DEBUG(0, ("Could not alloc bitmap -- "
519 "defaulting to logging everything\n"));
520 return NULL;
521 }
522
523 for (; *ops != NULL; ops += 1) {
524 int i;
525 bool neg = false;
526 const char *op;
527
528 if (strequal(*ops, "all")) {
529 for (i=0; i<SMB_VFS_OP_LAST; i++) {
530 bitmap_set(bm, i);
531 }
532 continue;
533 }
534
535 if (strequal(*ops, "none")) {
536 break;
537 }
538
539 op = ops[0];
540 if (op[0] == '!') {
541 neg = true;
542 op += 1;
543 }
544
545 for (i=0; i<SMB_VFS_OP_LAST; i++) {
546 if ((vfs_op_names[i].name == NULL)
547 || (vfs_op_names[i].type != i)) {
548 smb_panic("vfs_full_audit.c: name table not "
549 "in sync with vfs_op_type enums\n");
550 }
551 if (strequal(op, vfs_op_names[i].name)) {
552 if (neg) {
553 bitmap_clear(bm, i);
554 } else {
555 bitmap_set(bm, i);
556 }
557 break;
558 }
559 }
560 if (i == SMB_VFS_OP_LAST) {
561 DEBUG(0, ("Could not find opname %s, logging all\n",
562 *ops));
563 TALLOC_FREE(bm);
564 return NULL;
565 }
566 }
567 return bm;
568 }
569
570 static const char *audit_opname(vfs_op_type op)
571 {
572 if (op >= SMB_VFS_OP_LAST)
573 return "INVALID VFS OP";
574 return vfs_op_names[op].name;
575 }
576
577 static TALLOC_CTX *tmp_do_log_ctx;
578 /*
579 * Get us a temporary talloc context usable just for DEBUG arguments
580 */
581 static TALLOC_CTX *do_log_ctx(void)
582 {
583 if (tmp_do_log_ctx == NULL) {
584 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
585 }
586 return tmp_do_log_ctx;
587 }
588
589 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
590 const char *format, ...) PRINTF_ATTRIBUTE(4, 5);
591
592 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
593 const char *format, ...)
594 {
595 struct vfs_full_audit_private_data *pd;
596 fstring err_msg;
597 char *audit_pre = NULL;
598 va_list ap;
599 char *op_msg = NULL;
600
601 SMB_VFS_HANDLE_GET_DATA(handle, pd,
602 struct vfs_full_audit_private_data,
603 return;);
604
605 if (success && (!log_success(pd, op)))
606 goto out;
607
608 if (!success && (!log_failure(pd, op)))
609 goto out;
610
611 if (success)
612 fstrcpy(err_msg, "ok");
613 else
614 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
615
616 va_start(ap, format);
617 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
618 va_end(ap);
619
620 if (!op_msg) {
621 goto out;
622 }
623
624 audit_pre = audit_prefix(talloc_tos(), handle->conn);
625
626 if (pd->do_syslog) {
627 int priority;
628
629 /*
630 * Specify the facility to interoperate with other syslog
631 * callers (smbd for example).
632 */
633 priority = pd->syslog_priority | pd->syslog_facility;
634
635 syslog(priority, "%s|%s|%s|%s\n",
636 audit_pre ? audit_pre : "",
637 audit_opname(op), err_msg, op_msg);
638 } else {
639 DEBUG(1, ("%s|%s|%s|%s\n",
640 audit_pre ? audit_pre : "",
641 audit_opname(op), err_msg, op_msg));
642 }
643 out:
644 TALLOC_FREE(audit_pre);
645 TALLOC_FREE(op_msg);
646 TALLOC_FREE(tmp_do_log_ctx);
647 }
648
649 /**
650 * Return a string using the do_log_ctx()
651 */
652 static const char *smb_fname_str_do_log(const struct smb_filename *cwd,
653 const struct smb_filename *smb_fname)
654 {
655 char *fname = NULL;
656 NTSTATUS status;
657
658 if (smb_fname == NULL) {
659 return "";
660 }
661
662 if (smb_fname->base_name[0] != '/') {
663 char *abs_name = NULL;
664 struct smb_filename *fname_copy = cp_smb_filename(
665 do_log_ctx(),
666 smb_fname);
667 if (fname_copy == NULL) {
668 return "";
669 }
670
671 if (!ISDOT(smb_fname->base_name)) {
672 abs_name = talloc_asprintf(do_log_ctx(),
673 "%s/%s",
674 cwd->base_name,
675 smb_fname->base_name);
676 } else {
677 abs_name = talloc_strdup(do_log_ctx(),
678 cwd->base_name);
679 }
680 if (abs_name == NULL) {
681 return "";
682 }
683 fname_copy->base_name = abs_name;
684 smb_fname = fname_copy;
685 }
686
687 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
688 if (!NT_STATUS_IS_OK(status)) {
689 return "";
690 }
691 return fname;
692 }
693
694 /**
695 * Return an fsp debug string using the do_log_ctx()
696 */
697 static const char *fsp_str_do_log(const struct files_struct *fsp)
698 {
699 return smb_fname_str_do_log(fsp->conn->cwd_fname, fsp->fsp_name);
700 }
701
702 /* Implementation of vfs_ops. Pass everything on to the default
703 operation but log event first. */
704
705 static int smb_full_audit_connect(vfs_handle_struct *handle,
706 const char *svc, const char *user)
707 {
708 int result;
709 const char *none[] = { "none" };
710 struct vfs_full_audit_private_data *pd = NULL;
711
712 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
713 if (result < 0) {
714 return result;
715 }
716
717 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
718 if (!pd) {
719 SMB_VFS_NEXT_DISCONNECT(handle);
720 return -1;
721 }
722
723 pd->syslog_facility = audit_syslog_facility(handle);
724 if (pd->syslog_facility == -1) {
725 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
726 lp_parm_const_string(SNUM(handle->conn),
727 "full_audit", "facility",
728 "USER")));
729 SMB_VFS_NEXT_DISCONNECT(handle);
730 return -1;
731 }
732
733 pd->syslog_priority = audit_syslog_priority(handle);
734
735 pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
736 "full_audit", "log_secdesc", false);
737
738 pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
739 "full_audit", "syslog", true);
740
741 #ifdef WITH_SYSLOG
742 if (pd->do_syslog) {
743 openlog("smbd_audit", 0, pd->syslog_facility);
744 }
745 #endif
746
747 pd->success_ops = init_bitmap(
748 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
749 "success", none));
750 pd->failure_ops = init_bitmap(
751 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
752 "failure", none));
753
754 /* Store the private data. */
755 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
756 struct vfs_full_audit_private_data, return -1);
757
758 do_log(SMB_VFS_OP_CONNECT, True, handle,
759 "%s", svc);
760
761 return 0;
762 }
763
764 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
765 {
766 SMB_VFS_NEXT_DISCONNECT(handle);
767
768 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
769 "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
770
771 /* The bitmaps will be disconnected when the private
772 data is deleted. */
773 }
774
775 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
776 const struct smb_filename *smb_fname,
777 uint64_t *bsize,
778 uint64_t *dfree,
779 uint64_t *dsize)
780 {
781 uint64_t result;
782
783 result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
784
785 /* Don't have a reasonable notion of failure here */
786
787 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", smb_fname->base_name);
788
789 return result;
790 }
791
792 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
793 const struct smb_filename *smb_fname,
794 enum SMB_QUOTA_TYPE qtype,
795 unid_t id,
796 SMB_DISK_QUOTA *qt)
797 {
798 int result;
799
800 result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
801
802 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "%s",
803 smb_fname->base_name);
804
805 return result;
806 }
807
808 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
809 enum SMB_QUOTA_TYPE qtype, unid_t id,
810 SMB_DISK_QUOTA *qt)
811 {
812 int result;
813
814 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
815
816 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
817
818 return result;
819 }
820
821 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
822 struct files_struct *fsp,
823 struct shadow_copy_data *shadow_copy_data,
824 bool labels)
825 {
826 int result;
827
828 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
829
830 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
831
832 return result;
833 }
834
835 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
836 const struct smb_filename *smb_fname,
837 struct vfs_statvfs_struct *statbuf)
838 {
839 int result;
840
841 result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
842
843 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
844
845 return result;
846 }
847
848 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
849 {
850 int result;
851
852 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
853
854 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
855
856 return result;
857 }
858
859 static NTSTATUS smb_full_audit_get_dfs_referrals(
860 struct vfs_handle_struct *handle,
861 struct dfs_GetDFSReferral *r)
862 {
863 NTSTATUS status;
864
865 status = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
866
867 do_log(SMB_VFS_OP_GET_DFS_REFERRALS, NT_STATUS_IS_OK(status),
868 handle, "");
869
870 return status;
871 }
872
873 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
874 TALLOC_CTX *mem_ctx,
875 const char *service_path,
876 char **base_volume)
877 {
878 NTSTATUS status;
879
880 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
881 base_volume);
882 do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
883 handle, "");
884
885 return status;
886 }
887
888 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
889 TALLOC_CTX *mem_ctx,
890 const char *base_volume,
891 time_t *tstamp,
892 bool rw,
893 char **base_path,
894 char **snap_path)
895 {
896 NTSTATUS status;
897
898 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
899 rw, base_path, snap_path);
900 do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
901
902 return status;
903 }
904
905 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
906 TALLOC_CTX *mem_ctx,
907 char *base_path,
908 char *snap_path)
909 {
910 NTSTATUS status;
911
912 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
913 snap_path);
914 do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
915
916 return status;
917 }
918
919 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
920 const struct smb_filename *smb_fname,
921 const char *mask,
922 uint32_t attr)
923 {
924 DIR *result;
925
926 result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
927
928 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s",
929 smb_fname->base_name);
930
931 return result;
932 }
933
934 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
935 files_struct *fsp, const char *mask, uint32_t attr)
936 {
937 DIR *result;
938
939 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
940
941 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
942 fsp_str_do_log(fsp));
943
944 return result;
945 }
946
947 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
948 DIR *dirp, SMB_STRUCT_STAT *sbuf)
949 {
950 struct dirent *result;
951
952 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
953
954 /* This operation has no reasonable error condition
955 * (End of dir is also failure), so always succeed.
956 */
957 do_log(SMB_VFS_OP_READDIR, True, handle, "");
958
959 return result;
960 }
961
962 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
963 DIR *dirp, long offset)
964 {
965 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
966
967 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
968 }
969
970 static long smb_full_audit_telldir(vfs_handle_struct *handle,
971 DIR *dirp)
972 {
973 long result;
974
975 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
976
977 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
978
979 return result;
980 }
981
982 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
983 DIR *dirp)
984 {
985 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
986
987 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
988 }
989
990 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
991 const struct smb_filename *smb_fname, mode_t mode)
992 {
993 int result;
994
995 result = SMB_VFS_NEXT_MKDIR(handle, smb_fname, mode);
996
997 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s",
998 smb_fname->base_name);
999
1000 return result;
1001 }
1002
1003 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
1004 const struct smb_filename *smb_fname)
1005 {
1006 int result;
1007
1008 result = SMB_VFS_NEXT_RMDIR(handle, smb_fname);
1009
1010 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s",
1011 smb_fname->base_name);
1012
1013 return result;
1014 }
1015
1016 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1017 DIR *dirp)
1018 {
1019 int result;
1020
1021 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1022
1023 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1024
1025 return result;
1026 }
1027
1028 static int smb_full_audit_open(vfs_handle_struct *handle,
1029 struct smb_filename *smb_fname,
1030 files_struct *fsp, int flags, mode_t mode)
1031 {
1032 int result;
1033
1034 result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
1035
1036 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
1037 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1038 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1039
1040 return result;
1041 }
1042
1043 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1044 struct smb_request *req,
1045 uint16_t root_dir_fid,
1046 struct smb_filename *smb_fname,
1047 uint32_t access_mask,
1048 uint32_t share_access,
1049 uint32_t create_disposition,
1050 uint32_t create_options,
1051 uint32_t file_attributes,
1052 uint32_t oplock_request,
1053 struct smb2_lease *lease,
1054 uint64_t allocation_size,
1055 uint32_t private_flags,
1056 struct security_descriptor *sd,
1057 struct ea_list *ea_list,
1058 files_struct **result_fsp,
1059 int *pinfo,
1060 const struct smb2_create_blobs *in_context_blobs,
1061 struct smb2_create_blobs *out_context_blobs)
1062 {
1063 NTSTATUS result;
1064 const char* str_create_disposition;
1065
1066 switch (create_disposition) {
1067 case FILE_SUPERSEDE:
1068 str_create_disposition = "supersede";
1069 break;
1070 case FILE_OVERWRITE_IF:
1071 str_create_disposition = "overwrite_if";
1072 break;
1073 case FILE_OPEN:
1074 str_create_disposition = "open";
1075 break;
1076 case FILE_OVERWRITE:
1077 str_create_disposition = "overwrite";
1078 break;
1079 case FILE_CREATE:
1080 str_create_disposition = "create";
1081 break;
1082 case FILE_OPEN_IF:
1083 str_create_disposition = "open_if";
1084 break;
1085 default:
1086 str_create_disposition = "unknown";
1087 }
1088
1089 result = SMB_VFS_NEXT_CREATE_FILE(
1090 handle, /* handle */
1091 req, /* req */
1092 root_dir_fid, /* root_dir_fid */
1093 smb_fname, /* fname */
1094 access_mask, /* access_mask */
1095 share_access, /* share_access */
1096 create_disposition, /* create_disposition*/
1097 create_options, /* create_options */
1098 file_attributes, /* file_attributes */
1099 oplock_request, /* oplock_request */
1100 lease, /* lease */
1101 allocation_size, /* allocation_size */
1102 private_flags,
1103 sd, /* sd */
1104 ea_list, /* ea_list */
1105 result_fsp, /* result */
1106 pinfo, /* pinfo */
1107 in_context_blobs, out_context_blobs); /* create context */
1108
1109 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
1110 "0x%x|%s|%s|%s", access_mask,
1111 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
1112 str_create_disposition,
1113 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1114
1115 return result;
1116 }
1117
1118 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1119 {
1120 int result;
1121
1122 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1123
1124 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
1125 fsp_str_do_log(fsp));
1126
1127 return result;
1128 }
1129
1130 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1131 void *data, size_t n, off_t offset)
1132 {
1133 ssize_t result;
1134
1135 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1136
1137 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1138 fsp_str_do_log(fsp));
1139
1140 return result;
1141 }
1142
1143 struct smb_full_audit_pread_state {
1144 vfs_handle_struct *handle;
1145 files_struct *fsp;
1146 ssize_t ret;
1147 struct vfs_aio_state vfs_aio_state;
1148 };
1149
1150 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1151
1152 static struct tevent_req *smb_full_audit_pread_send(
1153 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1154 struct tevent_context *ev, struct files_struct *fsp,
1155 void *data, size_t n, off_t offset)
1156 {
1157 struct tevent_req *req, *subreq;
1158 struct smb_full_audit_pread_state *state;
1159
1160 req = tevent_req_create(mem_ctx, &state,
1161 struct smb_full_audit_pread_state);
1162 if (req == NULL) {
1163 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1164 fsp_str_do_log(fsp));
1165 return NULL;
1166 }
1167 state->handle = handle;
1168 state->fsp = fsp;
1169
1170 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1171 n, offset);
1172 if (tevent_req_nomem(subreq, req)) {
1173 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1174 fsp_str_do_log(fsp));
1175 return tevent_req_post(req, ev);
1176 }
1177 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1178
1179 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1180 return req;
1181 }
1182
1183 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1184 {
1185 struct tevent_req *req = tevent_req_callback_data(
1186 subreq, struct tevent_req);
1187 struct smb_full_audit_pread_state *state = tevent_req_data(
1188 req, struct smb_full_audit_pread_state);
1189
1190 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
1191 TALLOC_FREE(subreq);
1192 tevent_req_done(req);
1193 }
1194
1195 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req,
1196 struct vfs_aio_state *vfs_aio_state)
1197 {
1198 struct smb_full_audit_pread_state *state = tevent_req_data(
1199 req, struct smb_full_audit_pread_state);
1200
1201 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1202 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1203 fsp_str_do_log(state->fsp));
1204 return -1;
1205 }
1206
1207 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1208 fsp_str_do_log(state->fsp));
1209
1210 *vfs_aio_state = state->vfs_aio_state;
1211 return state->ret;
1212 }
1213
1214 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1215 const void *data, size_t n,
1216 off_t offset)
1217 {
1218 ssize_t result;
1219
1220 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1221
1222 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1223 fsp_str_do_log(fsp));
1224
1225 return result;
1226 }
1227
1228 struct smb_full_audit_pwrite_state {
1229 vfs_handle_struct *handle;
1230 files_struct *fsp;
1231 ssize_t ret;
1232 struct vfs_aio_state vfs_aio_state;
1233 };
1234
1235 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1236
1237 static struct tevent_req *smb_full_audit_pwrite_send(
1238 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1239 struct tevent_context *ev, struct files_struct *fsp,
1240 const void *data, size_t n, off_t offset)
1241 {
1242 struct tevent_req *req, *subreq;
1243 struct smb_full_audit_pwrite_state *state;
1244
1245 req = tevent_req_create(mem_ctx, &state,
1246 struct smb_full_audit_pwrite_state);
1247 if (req == NULL) {
1248 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1249 fsp_str_do_log(fsp));
1250 return NULL;
1251 }
1252 state->handle = handle;
1253 state->fsp = fsp;
1254
1255 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1256 n, offset);
1257 if (tevent_req_nomem(subreq, req)) {
1258 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1259 fsp_str_do_log(fsp));
1260 return tevent_req_post(req, ev);
1261 }
1262 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1263
1264 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1265 fsp_str_do_log(fsp));
1266 return req;
1267 }
1268
1269 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1270 {
1271 struct tevent_req *req = tevent_req_callback_data(
1272 subreq, struct tevent_req);
1273 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1274 req, struct smb_full_audit_pwrite_state);
1275
1276 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
1277 TALLOC_FREE(subreq);
1278 tevent_req_done(req);
1279 }
1280
1281 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req,
1282 struct vfs_aio_state *vfs_aio_state)
1283 {
1284 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1285 req, struct smb_full_audit_pwrite_state);
1286
1287 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1288 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1289 fsp_str_do_log(state->fsp));
1290 return -1;
1291 }
1292
1293 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1294 fsp_str_do_log(state->fsp));
1295
1296 *vfs_aio_state = state->vfs_aio_state;
1297 return state->ret;
1298 }
1299
1300 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1301 off_t offset, int whence)
1302 {
1303 ssize_t result;
1304
1305 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1306
1307 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1308 "%s", fsp_str_do_log(fsp));
1309
1310 return result;
1311 }
1312
1313 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1314 files_struct *fromfsp,
1315 const DATA_BLOB *hdr, off_t offset,
1316 size_t n)
1317 {
1318 ssize_t result;
1319
1320 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1321
1322 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1323 "%s", fsp_str_do_log(fromfsp));
1324
1325 return result;
1326 }
1327
1328 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1329 files_struct *tofsp,
1330 off_t offset,
1331 size_t n)
1332 {
1333 ssize_t result;
1334
1335 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1336
1337 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1338 "%s", fsp_str_do_log(tofsp));
1339
1340 return result;
1341 }
1342
1343 static int smb_full_audit_rename(vfs_handle_struct *handle,
1344 const struct smb_filename *smb_fname_src,
1345 const struct smb_filename *smb_fname_dst)
1346 {
1347 int result;
1348
1349 result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1350
1351 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1352 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname_src),
1353 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname_dst));
1354
1355 return result;
1356 }
1357
1358 struct smb_full_audit_fsync_state {
1359 vfs_handle_struct *handle;
1360 files_struct *fsp;
1361 int ret;
1362 struct vfs_aio_state vfs_aio_state;
1363 };
1364
1365 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1366
1367 static struct tevent_req *smb_full_audit_fsync_send(
1368 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1369 struct tevent_context *ev, struct files_struct *fsp)
1370 {
1371 struct tevent_req *req, *subreq;
1372 struct smb_full_audit_fsync_state *state;
1373
1374 req = tevent_req_create(mem_ctx, &state,
1375 struct smb_full_audit_fsync_state);
1376 if (req == NULL) {
1377 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1378 fsp_str_do_log(fsp));
1379 return NULL;
1380 }
1381 state->handle = handle;
1382 state->fsp = fsp;
1383
1384 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1385 if (tevent_req_nomem(subreq, req)) {
1386 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1387 fsp_str_do_log(fsp));
1388 return tevent_req_post(req, ev);
1389 }
1390 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1391
1392 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1393 return req;
1394 }
1395
1396 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1397 {
1398 struct tevent_req *req = tevent_req_callback_data(
1399 subreq, struct tevent_req);
1400 struct smb_full_audit_fsync_state *state = tevent_req_data(
1401 req, struct smb_full_audit_fsync_state);
1402
1403 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1404 TALLOC_FREE(subreq);
1405 tevent_req_done(req);
1406 }
1407
1408 static int smb_full_audit_fsync_recv(struct tevent_req *req,
1409 struct vfs_aio_state *vfs_aio_state)
1410 {
1411 struct smb_full_audit_fsync_state *state = tevent_req_data(
1412 req, struct smb_full_audit_fsync_state);
1413
1414 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1415 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1416 fsp_str_do_log(state->fsp));
1417 return -1;
1418 }
1419
1420 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1421 fsp_str_do_log(state->fsp));
1422
1423 *vfs_aio_state = state->vfs_aio_state;
1424 return state->ret;
1425 }
1426
1427 static int smb_full_audit_stat(vfs_handle_struct *handle,
1428 struct smb_filename *smb_fname)
1429 {
1430 int result;
1431
1432 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1433
1434 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1435 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1436
1437 return result;
1438 }
1439
1440 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1441 SMB_STRUCT_STAT *sbuf)
1442 {
1443 int result;
1444
1445 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1446
1447 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1448 fsp_str_do_log(fsp));
1449
1450 return result;
1451 }
1452
1453 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1454 struct smb_filename *smb_fname)
1455 {
1456 int result;
1457
1458 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1459
1460 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1461 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1462
1463 return result;
1464 }
1465
1466 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1467 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1468 {
1469 uint64_t result;
1470
1471 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1472
1473 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1474 "%llu", (unsigned long long)result);
1475
1476 return result;
1477 }
1478
1479 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1480 const struct smb_filename *smb_fname)
1481 {
1482 int result;
1483
1484 result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1485
1486 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1487 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1488
1489 return result;
1490 }
1491
1492 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1493 const struct smb_filename *smb_fname,
1494 mode_t mode)
1495 {
1496 int result;
1497
1498 result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1499
1500 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o",
1501 smb_fname->base_name,
1502 mode);
1503
1504 return result;
1505 }
1506
1507 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1508 mode_t mode)
1509 {
1510 int result;
1511
1512 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1513
1514 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1515 "%s|%o", fsp_str_do_log(fsp), mode);
1516
1517 return result;
1518 }
1519
1520 static int smb_full_audit_chown(vfs_handle_struct *handle,
1521 const struct smb_filename *smb_fname,
1522 uid_t uid,
1523 gid_t gid)
1524 {
1525 int result;
1526
1527 result = SMB_VFS_NEXT_CHOWN(handle, smb_fname, uid, gid);
1528
1529 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1530 smb_fname->base_name, (long int)uid, (long int)gid);
1531
1532 return result;
1533 }
1534
1535 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1536 uid_t uid, gid_t gid)
1537 {
1538 int result;
1539
1540 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1541
1542 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1543 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1544
1545 return result;
1546 }
1547
1548 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1549 const struct smb_filename *smb_fname,
1550 uid_t uid,
1551 gid_t gid)
1552 {
1553 int result;
1554
1555 result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1556
1557 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1558 smb_fname->base_name, (long int)uid, (long int)gid);
1559
1560 return result;
1561 }
1562
1563 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1564 const struct smb_filename *smb_fname)
1565 {
1566 int result;
1567
1568 result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1569
1570 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s",
1571 smb_fname->base_name);
1572
1573 return result;
1574 }
1575
1576 static struct smb_filename *smb_full_audit_getwd(vfs_handle_struct *handle,
1577 TALLOC_CTX *ctx)
1578 {
1579 struct smb_filename *result;
1580
1581 result = SMB_VFS_NEXT_GETWD(handle, ctx);
1582
1583 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1584 result == NULL? "" : result->base_name);
1585
1586 return result;
1587 }
1588
1589 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1590 const struct smb_filename *smb_fname,
1591 struct smb_file_time *ft)
1592 {
1593 int result;
1594
1595 result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1596
1597 do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s",
1598 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1599
1600 return result;
1601 }
1602
1603 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1604 off_t len)
1605 {
1606 int result;
1607
1608 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1609
1610 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1611 "%s", fsp_str_do_log(fsp));
1612
1613 return result;
1614 }
1615
1616 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1617 uint32_t mode,
1618 off_t offset,
1619 off_t len)
1620 {
1621 int result;
1622
1623 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1624
1625 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1626 "%s", fsp_str_do_log(fsp));
1627
1628 return result;
1629 }
1630
1631 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1632 int op, off_t offset, off_t count, int type)
1633 {
1634 bool result;
1635
1636 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1637
1638 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1639
1640 return result;
1641 }
1642
1643 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1644 struct files_struct *fsp,
1645 uint32_t share_mode, uint32_t access_mask)
1646 {
1647 int result;
1648
1649 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1650
1651 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1652 fsp_str_do_log(fsp));
1653
1654 return result;
1655 }
1656
1657 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1658 int leasetype)
1659 {
1660 int result;
1661
1662 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1663
1664 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1665 fsp_str_do_log(fsp));
1666
1667 return result;
1668 }
1669
1670 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1671 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1672 {
1673 bool result;
1674
1675 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1676
1677 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1678
1679 return result;
1680 }
1681
1682 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1683 const char *link_contents,
1684 const struct smb_filename *new_smb_fname)
1685 {
1686 int result;
1687
1688 result = SMB_VFS_NEXT_SYMLINK(handle, link_contents, new_smb_fname);
1689
1690 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1691 "%s|%s", link_contents, new_smb_fname->base_name);
1692
1693 return result;
1694 }
1695
1696 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1697 const struct smb_filename *smb_fname,
1698 char *buf,
1699 size_t bufsiz)
1700 {
1701 int result;
1702
1703 result = SMB_VFS_NEXT_READLINK(handle, smb_fname, buf, bufsiz);
1704
1705 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s",
1706 smb_fname->base_name);
1707
1708 return result;
1709 }
1710
1711 static int smb_full_audit_link(vfs_handle_struct *handle,
1712 const struct smb_filename *old_smb_fname,
1713 const struct smb_filename *new_smb_fname)
1714 {
1715 int result;
1716
1717 result = SMB_VFS_NEXT_LINK(handle, old_smb_fname, new_smb_fname);
1718
1719 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1720 "%s|%s", old_smb_fname->base_name, new_smb_fname->base_name);
1721
1722 return result;
1723 }
1724
1725 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1726 const struct smb_filename *smb_fname,
1727 mode_t mode,
1728 SMB_DEV_T dev)
1729 {
1730 int result;
1731
1732 result = SMB_VFS_NEXT_MKNOD(handle, smb_fname, mode, dev);
1733
1734 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s",
1735 smb_fname->base_name);
1736
1737 return result;
1738 }
1739
1740 static struct smb_filename *smb_full_audit_realpath(vfs_handle_struct *handle,
1741 TALLOC_CTX *ctx,
1742 const struct smb_filename *smb_fname)
1743 {
1744 struct smb_filename *result_fname = NULL;
1745
1746 result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1747
1748 do_log(SMB_VFS_OP_REALPATH, (result_fname != NULL), handle, "%s",
1749 smb_fname->base_name);
1750
1751 return result_fname;
1752 }
1753
1754 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1755 const struct smb_filename *smb_fname,
1756 unsigned int flags)
1757 {
1758 int result;
1759
1760 result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1761
1762 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s",
1763 smb_fname->base_name);
1764
1765 return result;
1766 }
1767
1768 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1769 const SMB_STRUCT_STAT *sbuf)
1770 {
1771 struct file_id id_zero;
1772 struct file_id result;
1773
1774 ZERO_STRUCT(id_zero);
1775
1776 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1777
1778 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1779 !file_id_equal(&id_zero, &result),
1780 handle, "%s", file_id_string_tos(&result));
1781
1782 return result;
1783 }
1784
1785 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1786 struct files_struct *fsp,
1787 const struct smb_filename *smb_fname,
1788 TALLOC_CTX *mem_ctx,
1789 unsigned int *pnum_streams,
1790 struct stream_struct **pstreams)
1791 {
1792 NTSTATUS result;
1793
1794 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1795 pnum_streams, pstreams);
1796
1797 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1798 "%s", smb_fname->base_name);
1799
1800 return result;
1801 }
1802
1803 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1804 const char *path,
1805 const char *name,
1806 TALLOC_CTX *mem_ctx,
1807 char **found_name)
1808 {
1809 int result;
1810
1811 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1812 found_name);
1813
1814 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1815 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1816
1817 return result;
1818 }
1819
1820 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1821 const struct smb_filename *smb_fname)
1822 {
1823 const char *result;
1824
1825 result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1826
1827 do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1828 "%s", smb_fname->base_name);
1829
1830 return result;
1831 }
1832
1833 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1834 struct byte_range_lock *br_lck,
1835 struct lock_struct *plock,
1836 bool blocking_lock)
1837 {
1838 NTSTATUS result;
1839
1840 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1841 blocking_lock);
1842
1843 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1844 "%s:%llu-%llu. type=%d. blocking=%d",
1845 fsp_str_do_log(brl_fsp(br_lck)),
1846 (unsigned long long)plock->start,
1847 (unsigned long long)plock->size,
1848 plock->lock_type,
1849 blocking_lock);
1850
1851 return result;
1852 }
1853
1854 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1855 struct messaging_context *msg_ctx,
1856 struct byte_range_lock *br_lck,
1857 const struct lock_struct *plock)
1858 {
1859 bool result;
1860
1861 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1862 plock);
1863
1864 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1865 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1866 (unsigned long long)plock->start,
1867 (unsigned long long)plock->size,
1868 plock->lock_type);
1869
1870 return result;
1871 }
1872
1873 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1874 struct byte_range_lock *br_lck,
1875 struct lock_struct *plock)
1876 {
1877 bool result;
1878
1879 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1880
1881 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1882 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1883 (unsigned long long)plock->start,
1884 (unsigned long long)plock->size,
1885 plock->lock_type);
1886
1887 return result;
1888 }
1889
1890 static bool smb_full_audit_strict_lock_check(struct vfs_handle_struct *handle,
1891 struct files_struct *fsp,
1892 struct lock_struct *plock)
1893 {
1894 bool result;
1895
1896 result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1897
1898 do_log(SMB_VFS_OP_STRICT_LOCK_CHECK, result, handle,
1899 "%s:%llu-%llu:%d", fsp_str_do_log(fsp),
1900 (unsigned long long)plock->start,
1901 (unsigned long long)plock->size,
1902 plock->lock_type);
1903
1904 return result;
1905 }
1906
1907 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1908 const char *name,
1909 enum vfs_translate_direction direction,
1910 TALLOC_CTX *mem_ctx,
1911 char **mapped_name)
1912 {
1913 NTSTATUS result;
1914
1915 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1916 mapped_name);
1917
1918 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1919
1920 return result;
1921 }
1922
1923 static NTSTATUS smb_full_audit_fsctl(struct vfs_handle_struct *handle,
1924 struct files_struct *fsp,
1925 TALLOC_CTX *ctx,
1926 uint32_t function,
1927 uint16_t req_flags,
1928 const uint8_t *_in_data,
1929 uint32_t in_len,
1930 uint8_t **_out_data,
1931 uint32_t max_out_len,
1932 uint32_t *out_len)
1933 {
1934 NTSTATUS result;
1935
1936 result = SMB_VFS_NEXT_FSCTL(handle,
1937 fsp,
1938 ctx,
1939 function,
1940 req_flags,
1941 _in_data,
1942 in_len,
1943 _out_data,
1944 max_out_len,
1945 out_len);
1946
1947 do_log(SMB_VFS_OP_FSCTL, NT_STATUS_IS_OK(result), handle, "");
1948
1949 return result;
1950 }
1951
1952 static struct tevent_req *smb_full_audit_offload_read_send(
1953 TALLOC_CTX *mem_ctx,
1954 struct tevent_context *ev,
1955 struct vfs_handle_struct *handle,
1956 struct files_struct *fsp,
1957 uint32_t fsctl,
1958 uint32_t ttl,
1959 off_t offset,
1960 size_t to_copy)
1961 {
1962 struct tevent_req *req = NULL;
1963
1964 req = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev, handle, fsp,
1965 fsctl, ttl, offset, to_copy);
1966
1967 do_log(SMB_VFS_OP_OFFLOAD_READ_SEND, req, handle, "");
1968
1969 return req;
1970 }
1971
1972 static NTSTATUS smb_full_audit_offload_read_recv(
1973 struct tevent_req *req,
1974 struct vfs_handle_struct *handle,
1975 TALLOC_CTX *mem_ctx,
1976 DATA_BLOB *_token_blob)
1977 {
1978 NTSTATUS status;
1979
1980 status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(req, handle, mem_ctx,
1981 _token_blob);
1982
1983 do_log(SMB_VFS_OP_OFFLOAD_READ_RECV, NT_STATUS_IS_OK(status), handle, "");
1984
1985 return status;
1986 }
1987
1988 static struct tevent_req *smb_full_audit_offload_write_send(struct vfs_handle_struct *handle,
1989 TALLOC_CTX *mem_ctx,
1990 struct tevent_context *ev,
1991 uint32_t fsctl,
1992 DATA_BLOB *token,
1993 off_t transfer_offset,
1994 struct files_struct *dest_fsp,
1995 off_t dest_off,
1996 off_t num)
1997 {
1998 struct tevent_req *req;
1999
2000 req = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, mem_ctx, ev,
2001 fsctl, token, transfer_offset,
2002 dest_fsp, dest_off, num);
2003
2004 do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND, req, handle, "");
2005
2006 return req;
2007 }
2008
2009 static NTSTATUS smb_full_audit_offload_write_recv(struct vfs_handle_struct *handle,
2010 struct tevent_req *req,
2011 off_t *copied)
2012 {
2013 NTSTATUS result;
2014
2015 result = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle, req, copied);
2016
2017 do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV, NT_STATUS_IS_OK(result), handle, "");
2018
2019 return result;
2020 }
2021
2022 static NTSTATUS smb_full_audit_get_compression(vfs_handle_struct *handle,
2023 TALLOC_CTX *mem_ctx,
2024 struct files_struct *fsp,
2025 struct smb_filename *smb_fname,
2026 uint16_t *_compression_fmt)
2027 {
2028 NTSTATUS result;
2029
2030 result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2031 _compression_fmt);
2032
2033 do_log(SMB_VFS_OP_GET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2034 "%s",
2035 (fsp ? fsp_str_do_log(fsp) :
2036 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname)));
2037
2038 return result;
2039 }
2040
2041 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
2042 TALLOC_CTX *mem_ctx,
2043 struct files_struct *fsp,
2044 uint16_t compression_fmt)
2045 {
2046 NTSTATUS result;
2047
2048 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2049 compression_fmt);
2050
2051 do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2052 "%s", fsp_str_do_log(fsp));
2053
2054 return result;
2055 }
2056
2057 static NTSTATUS smb_full_audit_readdir_attr(struct vfs_handle_struct *handle,
2058 const struct smb_filename *fname,
2059 TALLOC_CTX *mem_ctx,
2060 struct readdir_attr_data **pattr_data)
2061 {
2062 NTSTATUS status;
2063
2064 status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2065
2066 do_log(SMB_VFS_OP_READDIR_ATTR, NT_STATUS_IS_OK(status), handle, "%s",
2067 smb_fname_str_do_log(handle->conn->cwd_fname, fname));
2068
2069 return status;
2070 }
2071
2072 static NTSTATUS smb_full_audit_get_dos_attributes(
2073 struct vfs_handle_struct *handle,
2074 struct smb_filename *smb_fname,
2075 uint32_t *dosmode)
2076 {
2077 NTSTATUS status;
2078
2079 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
2080 smb_fname,
2081 dosmode);
2082
2083 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES,
2084 NT_STATUS_IS_OK(status),
2085 handle,
2086 "%s",
2087 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2088
2089 return status;
2090 }
2091
2092 static NTSTATUS smb_full_audit_fget_dos_attributes(
2093 struct vfs_handle_struct *handle,
2094 struct files_struct *fsp,
2095 uint32_t *dosmode)
2096 {
2097 NTSTATUS status;
2098
2099 status = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
2100 fsp,
2101 dosmode);
2102
2103 do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
2104 NT_STATUS_IS_OK(status),
2105 handle,
2106 "%s",
2107 fsp_str_do_log(fsp));
2108
2109 return status;
2110 }
2111
2112 static NTSTATUS smb_full_audit_set_dos_attributes(
2113 struct vfs_handle_struct *handle,
2114 const struct smb_filename *smb_fname,
2115 uint32_t dosmode)
2116 {
2117 NTSTATUS status;
2118
2119 status = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
2120 smb_fname,
2121 dosmode);
2122
2123 do_log(SMB_VFS_OP_SET_DOS_ATTRIBUTES,
2124 NT_STATUS_IS_OK(status),
2125 handle,
2126 "%s",
2127 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2128
2129 return status;
2130 }
2131
2132 static NTSTATUS smb_full_audit_fset_dos_attributes(
2133 struct vfs_handle_struct *handle,
2134 struct files_struct *fsp,
2135 uint32_t dosmode)
2136 {
2137 NTSTATUS status;
2138
2139 status = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2140 fsp,
2141 dosmode);
2142
2143 do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
2144 NT_STATUS_IS_OK(status),
2145 handle,
2146 "%s",
2147 fsp_str_do_log(fsp));
2148
2149 return status;
2150 }
2151
2152 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2153 uint32_t security_info,
2154 TALLOC_CTX *mem_ctx,
2155 struct security_descriptor **ppdesc)
2156 {
2157 NTSTATUS result;
2158
2159 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2160 mem_ctx, ppdesc);
2161
2162 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2163 "%s", fsp_str_do_log(fsp));
2164
2165 return result;
2166 }
2167
2168 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
2169 const struct smb_filename *smb_fname,
2170 uint32_t security_info,
2171 TALLOC_CTX *mem_ctx,
2172 struct security_descriptor **ppdesc)
2173 {
2174 NTSTATUS result;
2175
2176 result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2177 mem_ctx, ppdesc);
2178
2179 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2180 "%s", smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2181
2182 return result;
2183 }
2184
2185 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2186 uint32_t security_info_sent,
2187 const struct security_descriptor *psd)
2188 {
2189 struct vfs_full_audit_private_data *pd;
2190 NTSTATUS result;
2191 char *sd = NULL;
2192
2193 SMB_VFS_HANDLE_GET_DATA(handle, pd,
2194 struct vfs_full_audit_private_data,
2195 return NT_STATUS_INTERNAL_ERROR);
2196
2197 if (pd->log_secdesc) {
2198 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
2199 }
2200
2201 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
2202
2203 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2204 "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
2205
2206 TALLOC_FREE(sd);
2207
2208 return result;
2209 }
2210
2211 static NTSTATUS smb_full_audit_audit_file(struct vfs_handle_struct *handle,
2212 struct smb_filename *file,
2213 struct security_acl *sacl,
2214 uint32_t access_requested,
2215 uint32_t access_denied)
2216 {
2217 NTSTATUS result;
2218
2219 result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2220 file,
2221 sacl,
2222 access_requested,
2223 access_denied);
2224
2225 do_log(SMB_VFS_OP_AUDIT_FILE, NT_STATUS_IS_OK(result), handle,
2226 "%s",
2227 smb_fname_str_do_log(handle->conn->cwd_fname, file));
2228
2229 return result;
2230 }
2231
2232 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
2233 const struct smb_filename *smb_fname,
2234 SMB_ACL_TYPE_T type,
2235 TALLOC_CTX *mem_ctx)
2236 {
2237 SMB_ACL_T result;
2238
2239 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2240 type, mem_ctx);
2241
2242 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
2243 "%s", smb_fname->base_name);
2244
2245 return result;
2246 }
2247
2248 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2249 files_struct *fsp, TALLOC_CTX *mem_ctx)
2250 {
2251 SMB_ACL_T result;
2252
2253 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2254
2255 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2256 "%s", fsp_str_do_log(fsp));
2257
2258 return result;
2259 }
2260
2261 static int smb_full_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2262 const struct smb_filename *smb_fname,
2263 TALLOC_CTX *mem_ctx,
2264 char **blob_description,
2265 DATA_BLOB *blob)
2266 {
2267 int result;
2268
2269 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2270 mem_ctx, blob_description, blob);
2271
2272 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, (result >= 0), handle,
2273 "%s", smb_fname->base_name);
2274
2275 return result;
2276 }
2277
2278 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2279 files_struct *fsp,
2280 TALLOC_CTX *mem_ctx,
2281 char **blob_description,
2282 DATA_BLOB *blob)
2283 {
2284 int result;
2285
2286 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2287
2288 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2289 "%s", fsp_str_do_log(fsp));
2290
2291 return result;
2292 }
2293
2294 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
2295 const struct smb_filename *smb_fname,
2296 SMB_ACL_TYPE_T acltype,
2297 SMB_ACL_T theacl)
2298 {
2299 int result;
2300
2301 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2302 theacl);
2303
2304 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
2305 "%s", smb_fname->base_name);
2306
2307 return result;
2308 }
2309
2310 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
2311 SMB_ACL_T theacl)
2312 {
2313 int result;
2314
2315 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2316
2317 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2318 "%s", fsp_str_do_log(fsp));
2319
2320 return result;
2321 }
2322
2323 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2324 const struct smb_filename *smb_fname)
2325 {
2326 int result;
2327
2328 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2329
2330 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2331 "%s", smb_fname->base_name);
2332
2333 return result;
2334 }
2335
2336 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2337 const struct smb_filename *smb_fname,
2338 const char *name, void *value, size_t size)
2339 {
2340 ssize_t result;
2341
2342 result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2343
2344 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2345 "%s|%s", smb_fname->base_name, name);
2346
2347 return result;
2348 }
2349
2350 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2351 struct files_struct *fsp,
2352 const char *name, void *value, size_t size)
2353 {
2354 ssize_t result;
2355
2356 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2357
2358 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2359 "%s|%s", fsp_str_do_log(fsp), name);
2360
2361 return result;
2362 }
2363
2364 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2365 const struct smb_filename *smb_fname,
2366 char *list,
2367 size_t size)
2368 {
2369 ssize_t result;
2370
2371 result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2372
2373 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s",
2374 smb_fname->base_name);
2375
2376 return result;
2377 }
2378
2379 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2380 struct files_struct *fsp, char *list,
2381 size_t size)
2382 {
2383 ssize_t result;
2384
2385 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2386
2387 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2388 "%s", fsp_str_do_log(fsp));
2389
2390 return result;
2391 }
2392
2393 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2394 const struct smb_filename *smb_fname,
2395 const char *name)
2396 {
2397 int result;
2398
2399 result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2400
2401 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2402 "%s|%s", smb_fname->base_name, name);
2403
2404 return result;
2405 }
2406
2407 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2408 struct files_struct *fsp,
2409 const char *name)
2410 {
2411 int result;
2412
2413 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2414
2415 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2416 "%s|%s", fsp_str_do_log(fsp), name);
2417
2418 return result;
2419 }
2420
2421 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2422 const struct smb_filename *smb_fname,
2423 const char *name, const void *value, size_t size,
2424 int flags)
2425 {
2426 int result;
2427
2428 result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2429 flags);
2430
2431 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2432 "%s|%s", smb_fname->base_name, name);
2433
2434 return result;
2435 }
2436
2437 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2438 struct files_struct *fsp, const char *name,
2439 const void *value, size_t size, int flags)
2440 {
2441 int result;
2442
2443 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2444
2445 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2446 "%s|%s", fsp_str_do_log(fsp), name);
2447
2448 return result;
2449 }
2450
2451 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2452 struct files_struct *fsp)
2453 {
2454 bool result;
2455
2456 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2457 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2458 "%s", fsp_str_do_log(fsp));
2459
2460 return result;
2461 }
2462
2463 static NTSTATUS smb_full_audit_durable_cookie(struct vfs_handle_struct *handle,
2464 struct files_struct *fsp,
2465 TALLOC_CTX *mem_ctx,
2466 DATA_BLOB *cookie)
2467 {
2468 NTSTATUS result;
2469
2470 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle,
2471 fsp,
2472 mem_ctx,
2473 cookie);
2474
2475 do_log(SMB_VFS_OP_DURABLE_COOKIE, NT_STATUS_IS_OK(result), handle,
2476 "%s", fsp_str_do_log(fsp));
2477
2478 return result;
2479 }
2480
2481 static NTSTATUS smb_full_audit_durable_disconnect(
2482 struct vfs_handle_struct *handle,
2483 struct files_struct *fsp,
2484 const DATA_BLOB old_cookie,
2485 TALLOC_CTX *mem_ctx,
2486 DATA_BLOB *new_cookie)
2487 {
2488 NTSTATUS result;
2489
2490 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle,
2491 fsp,
2492 old_cookie,
2493 mem_ctx,
2494 new_cookie);
2495
2496 do_log(SMB_VFS_OP_DURABLE_DISCONNECT, NT_STATUS_IS_OK(result), handle,
2497 "%s", fsp_str_do_log(fsp));
2498
2499 return result;
2500 }
2501
2502 static NTSTATUS smb_full_audit_durable_reconnect(
2503 struct vfs_handle_struct *handle,
2504 struct smb_request *smb1req,
2505 struct smbXsrv_open *op,
2506 const DATA_BLOB old_cookie,
2507 TALLOC_CTX *mem_ctx,
2508 struct files_struct **fsp,
2509 DATA_BLOB *new_cookie)
2510 {
2511 NTSTATUS result;
2512
2513 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle,
2514 smb1req,
2515 op,
2516 old_cookie,
2517 mem_ctx,
2518 fsp,
2519 new_cookie);
2520
2521 do_log(SMB_VFS_OP_DURABLE_RECONNECT,
2522 NT_STATUS_IS_OK(result),
2523 handle,
2524 "");
2525
2526 return result;
2527 }
2528
2529 static struct vfs_fn_pointers vfs_full_audit_fns = {
2530
2531 /* Disk operations */
2532
2533 .connect_fn = smb_full_audit_connect,
2534 .disconnect_fn = smb_full_audit_disconnect,
2535 .disk_free_fn = smb_full_audit_disk_free,
2536 .get_quota_fn = smb_full_audit_get_quota,
2537 .set_quota_fn = smb_full_audit_set_quota,
2538 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2539 .statvfs_fn = smb_full_audit_statvfs,
2540 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2541 .get_dfs_referrals_fn = smb_full_audit_get_dfs_referrals,
2542 .opendir_fn = smb_full_audit_opendir,
2543 .fdopendir_fn = smb_full_audit_fdopendir,
2544 .readdir_fn = smb_full_audit_readdir,
2545 .seekdir_fn = smb_full_audit_seekdir,
2546 .telldir_fn = smb_full_audit_telldir,
2547 .rewind_dir_fn = smb_full_audit_rewinddir,
2548 .mkdir_fn = smb_full_audit_mkdir,
2549 .rmdir_fn = smb_full_audit_rmdir,
2550 .closedir_fn = smb_full_audit_closedir,
2551 .open_fn = smb_full_audit_open,
2552 .create_file_fn = smb_full_audit_create_file,
2553 .close_fn = smb_full_audit_close,
2554 .pread_fn = smb_full_audit_pread,
2555 .pread_send_fn = smb_full_audit_pread_send,
2556 .pread_recv_fn = smb_full_audit_pread_recv,
2557 .pwrite_fn = smb_full_audit_pwrite,
2558 .pwrite_send_fn = smb_full_audit_pwrite_send,
2559 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2560 .lseek_fn = smb_full_audit_lseek,
2561 .sendfile_fn = smb_full_audit_sendfile,
2562 .recvfile_fn = smb_full_audit_recvfile,
2563 .rename_fn = smb_full_audit_rename,
2564 .fsync_send_fn = smb_full_audit_fsync_send,
2565 .fsync_recv_fn = smb_full_audit_fsync_recv,
2566 .stat_fn = smb_full_audit_stat,
2567 .fstat_fn = smb_full_audit_fstat,
2568 .lstat_fn = smb_full_audit_lstat,
2569 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2570 .unlink_fn = smb_full_audit_unlink,
2571 .chmod_fn = smb_full_audit_chmod,
2572 .fchmod_fn = smb_full_audit_fchmod,
2573 .chown_fn = smb_full_audit_chown,
2574 .fchown_fn = smb_full_audit_fchown,
2575 .lchown_fn = smb_full_audit_lchown,
2576 .chdir_fn = smb_full_audit_chdir,
2577 .getwd_fn = smb_full_audit_getwd,
2578 .ntimes_fn = smb_full_audit_ntimes,
2579 .ftruncate_fn = smb_full_audit_ftruncate,
2580 .fallocate_fn = smb_full_audit_fallocate,
2581 .lock_fn = smb_full_audit_lock,
2582 .kernel_flock_fn = smb_full_audit_kernel_flock,
2583 .linux_setlease_fn = smb_full_audit_linux_setlease,
2584 .getlock_fn = smb_full_audit_getlock,
2585 .symlink_fn = smb_full_audit_symlink,
2586 .readlink_fn = smb_full_audit_readlink,
2587 .link_fn = smb_full_audit_link,
2588 .mknod_fn = smb_full_audit_mknod,
2589 .realpath_fn = smb_full_audit_realpath,
2590 .chflags_fn = smb_full_audit_chflags,
2591 .file_id_create_fn = smb_full_audit_file_id_create,
2592 .offload_read_send_fn = smb_full_audit_offload_read_send,
2593 .offload_read_recv_fn = smb_full_audit_offload_read_recv,
2594 .offload_write_send_fn = smb_full_audit_offload_write_send,
2595 .offload_write_recv_fn = smb_full_audit_offload_write_recv,
2596 .get_compression_fn = smb_full_audit_get_compression,
2597 .set_compression_fn = smb_full_audit_set_compression,
2598 .snap_check_path_fn = smb_full_audit_snap_check_path,
2599 .snap_create_fn = smb_full_audit_snap_create,
2600 .snap_delete_fn = smb_full_audit_snap_delete,
2601 .streaminfo_fn = smb_full_audit_streaminfo,
2602 .get_real_filename_fn = smb_full_audit_get_real_filename,
2603 .connectpath_fn = smb_full_audit_connectpath,
2604 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2605 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2606 .brl_cancel_windows_fn = smb_full_audit_brl_cancel_windows,
2607 .strict_lock_check_fn = smb_full_audit_strict_lock_check,
2608 .translate_name_fn = smb_full_audit_translate_name,
2609 .fsctl_fn = smb_full_audit_fsctl,
2610 .get_dos_attributes_fn = smb_full_audit_get_dos_attributes,
2611 .fget_dos_attributes_fn = smb_full_audit_fget_dos_attributes,
2612 .set_dos_attributes_fn = smb_full_audit_set_dos_attributes,
2613 .fset_dos_attributes_fn = smb_full_audit_fset_dos_attributes,
2614 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2615 .get_nt_acl_fn = smb_full_audit_get_nt_acl,
2616 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2617 .audit_file_fn = smb_full_audit_audit_file,
2618 .sys_acl_get_file_fn = smb_full_audit_sys_acl_get_file,
2619 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2620 .sys_acl_blob_get_file_fn = smb_full_audit_sys_acl_blob_get_file,
2621 .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2622 .sys_acl_set_file_fn = smb_full_audit_sys_acl_set_file,
2623 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2624 .sys_acl_delete_def_file_fn = smb_full_audit_sys_acl_delete_def_file,
2625 .getxattr_fn = smb_full_audit_getxattr,
2626 .fgetxattr_fn = smb_full_audit_fgetxattr,
2627 .listxattr_fn = smb_full_audit_listxattr,
2628 .flistxattr_fn = smb_full_audit_flistxattr,
2629 .removexattr_fn = smb_full_audit_removexattr,
2630 .fremovexattr_fn = smb_full_audit_fremovexattr,
2631 .setxattr_fn = smb_full_audit_setxattr,
2632 .fsetxattr_fn = smb_full_audit_fsetxattr,
2633 .aio_force_fn = smb_full_audit_aio_force,
2634 .durable_cookie_fn = smb_full_audit_durable_cookie,
2635 .durable_disconnect_fn = smb_full_audit_durable_disconnect,
2636 .durable_reconnect_fn = smb_full_audit_durable_reconnect,
2637 .readdir_attr_fn = smb_full_audit_readdir_attr
2638
2639 };
2640
2641 static_decl_vfs;
2642 NTSTATUS vfs_full_audit_init(TALLOC_CTX *ctx)
2643 {
2644 NTSTATUS ret;
2645
2646 smb_vfs_assert_all_fns(&vfs_full_audit_fns, "full_audit");
2647
2648 ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "full_audit",
2649 &vfs_full_audit_fns);
2650
2651 if (!NT_STATUS_IS_OK(ret))
2652 return ret;
2653
2654 vfs_full_audit_debug_level = debug_add_class("full_audit");
2655 if (vfs_full_audit_debug_level == -1) {
2656 vfs_full_audit_debug_level = DBGC_VFS;
2657 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2658 "class!\n"));
2659 } else {
2660 DEBUG(10, ("vfs_full_audit: Debug class number of "
2661 "'full_audit': %d\n", vfs_full_audit_debug_level));
2662 }
2663
2664 return ret;
2665 }
Samba GIT mirror