examples/VFS/audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log selected file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2001
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #include "config.h"
  23 #include <stdio.h>
  24 #include <sys/stat.h>
  25 #ifdef HAVE_UTIME_H
  26 #include <utime.h>
  27 #endif
  28 #ifdef HAVE_DIRENT_H
  29 #include <dirent.h>
  30 #endif
  31 #include <syslog.h>
  32 #ifdef HAVE_FCNTL_H
  33 #include <fcntl.h>
  34 #endif
  35 #include <errno.h>
  36 #include <string.h>
  37 #include <includes.h>
  38 #include <vfs.h>
  39
  40 #ifndef SYSLOG_FACILITY
  41 #define SYSLOG_FACILITY   LOG_USER
  42 #endif
  43
  44 #ifndef SYSLOG_PRIORITY
  45 #define SYSLOG_PRIORITY   LOG_NOTICE
  46 #endif
  47
  48 static struct vfs_ops default_vfs_ops;
  49
  50 /* Implementation of vfs_ops.  Pass everything on to the default
  51    operation but log event first. */
  52
  53 static int audit_connect(struct connection_struct *conn, const char *svc,
  54                          const char *user)
  55 {
  56         syslog(SYSLOG_PRIORITY, "connect to service %s by user %s\n",
  57                svc, user);
  58
  59         return 0;               /* Success */
  60 }
  61
  62 static void audit_disconnect(struct connection_struct *conn)
  63 {
  64         syslog(SYSLOG_PRIORITY, "disconnected\n");
  65 }
  66
  67 static DIR *audit_opendir(struct connection_struct *conn, const char *fname)
  68 {
  69         DIR *result = default_vfs_ops.opendir(conn, fname);
  70
  71         syslog(SYSLOG_PRIORITY, "opendir %s %s%s\n",
  72                fname,
  73                (result == NULL) ? "failed: " : "",
  74                (result == NULL) ? strerror(errno) : "");
  75
  76         return result;
  77 }
  78
  79 static int audit_mkdir(struct connection_struct *conn, const char *path,
  80                        mode_t mode)
  81 {
  82         int result = default_vfs_ops.mkdir(conn, path, mode);
  83
  84         syslog(SYSLOG_PRIORITY, "mkdir %s %s%s\n",
  85                path,
  86                (result < 0) ? "failed: " : "",
  87                (result < 0) ? strerror(errno) : "");
  88
  89         return result;
  90 }
  91
  92 static int audit_rmdir(struct connection_struct *conn, const char *path)
  93 {
  94         int result = default_vfs_ops.rmdir(conn, path);
  95
  96         syslog(SYSLOG_PRIORITY, "rmdir %s %s%s\n",
  97                path,
  98                (result < 0) ? "failed: " : "",
  99                (result < 0) ? strerror(errno) : "");
 100
 101         return result;
 102 }
 103
 104 static int audit_open(struct connection_struct *conn, const char *fname,
 105                       int flags, mode_t mode)
 106 {
 107         int result = default_vfs_ops.open(conn, fname, flags, mode);
 108
 109         syslog(SYSLOG_PRIORITY, "open %s (fd %d) %s%s%s\n",
 110                fname, result,
 111                ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "",
 112                (result < 0) ? "failed: " : "",
 113                (result < 0) ? strerror(errno) : "");
 114
 115         return result;
 116 }
 117
 118 static int audit_close(struct files_struct *fsp, int fd)
 119 {
 120         int result = default_vfs_ops.close(fsp, fd);
 121
 122         syslog(SYSLOG_PRIORITY, "close fd %d %s%s\n",
 123                fd,
 124                (result < 0) ? "failed: " : "",
 125                (result < 0) ? strerror(errno) : "");
 126
 127         return result;
 128 }
 129
 130 static int audit_rename(struct connection_struct *conn, const char *old,
 131                         const char *new)
 132 {
 133         int result = default_vfs_ops.rename(conn, old, new);
 134
 135         syslog(SYSLOG_PRIORITY, "rename %s -> %s %s%s\n",
 136                old, new,
 137                (result < 0) ? "failed: " : "",
 138                (result < 0) ? strerror(errno) : "");
 139
 140         return result;
 141 }
 142
 143 static int audit_unlink(struct connection_struct *conn, const char *path)
 144 {
 145         int result = default_vfs_ops.unlink(conn, path);
 146
 147         syslog(SYSLOG_PRIORITY, "unlink %s %s%s\n",
 148                path,
 149                (result < 0) ? "failed: " : "",
 150                (result < 0) ? strerror(errno) : "");
 151
 152         return result;
 153 }
 154
 155 static int audit_chmod(struct connection_struct *conn, const char *path,
 156                        mode_t mode)
 157 {
 158         int result = default_vfs_ops.chmod(conn, path, mode);
 159
 160         syslog(SYSLOG_PRIORITY, "chmod %s mode 0x%x %s%s\n",
 161                path, mode,
 162                (result < 0) ? "failed: " : "",
 163                (result < 0) ? strerror(errno) : "");
 164
 165         return result;
 166 }
 167
 168 /* VFS initialisation function.  Return initialised vfs_ops structure
 169    back to SAMBA. */
 170
 171 struct vfs_ops *vfs_init(int *vfs_version, struct vfs_ops *ops)
 172 {
 173         *vfs_version = SMB_VFS_INTERFACE_VERSION;
 174
 175         openlog("smbd_audit", LOG_PID, SYSLOG_FACILITY);
 176         syslog(SYSLOG_PRIORITY, "initialised\n");
 177
 178         /* Save a copy of the default ops */
 179
 180         default_vfs_ops = *ops;
 181
 182         /* Override our ones */
 183
 184         ops->connect = audit_connect;
 185         ops->disconnect = audit_disconnect;
 186         ops->opendir = audit_opendir;
 187         ops->mkdir = audit_mkdir;
 188         ops->rmdir = audit_rmdir;
 189         ops->open = audit_open;
 190         ops->close = audit_close;
 191         ops->rename = audit_rename;
 192         ops->unlink = audit_unlink;
 193         ops->chmod = audit_chmod;
 194
 195         return(ops);
 196 }