2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "system/filesys.h"
27 #include "system/syslog.h"
28 #include "smbd/smbd.h"
30 static int vfs_extd_audit_debug_level
= DBGC_VFS
;
33 #define DBGC_CLASS vfs_extd_audit_debug_level
35 static int audit_syslog_facility(vfs_handle_struct
*handle
)
37 static const struct enum_list enum_log_facilities
[] = {
39 { LOG_LOCAL0
, "LOCAL0" },
40 { LOG_LOCAL1
, "LOCAL1" },
41 { LOG_LOCAL2
, "LOCAL2" },
42 { LOG_LOCAL3
, "LOCAL3" },
43 { LOG_LOCAL4
, "LOCAL4" },
44 { LOG_LOCAL5
, "LOCAL5" },
45 { LOG_LOCAL6
, "LOCAL6" },
46 { LOG_LOCAL7
, "LOCAL7" }
51 facility
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "facility", enum_log_facilities
, LOG_USER
);
57 static int audit_syslog_priority(vfs_handle_struct
*handle
)
59 static const struct enum_list enum_log_priorities
[] = {
60 { LOG_EMERG
, "EMERG" },
61 { LOG_ALERT
, "ALERT" },
64 { LOG_WARNING
, "WARNING" },
65 { LOG_NOTICE
, "NOTICE" },
67 { LOG_DEBUG
, "DEBUG" }
72 priority
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "priority",
73 enum_log_priorities
, LOG_NOTICE
);
75 priority
= LOG_WARNING
;
81 /* Implementation of vfs_ops. Pass everything on to the default
82 operation but log event first. */
84 static int audit_connect(vfs_handle_struct
*handle
, const char *svc
, const char *user
)
86 int result
= SMB_VFS_NEXT_CONNECT(handle
, svc
, user
);
92 openlog("smbd_audit", LOG_PID
, audit_syslog_facility(handle
));
94 if (lp_syslog() > 0) {
95 syslog(audit_syslog_priority(handle
),
96 "connect to service %s by user %s\n",
99 DEBUG(10, ("Connected to service %s as user %s\n",
105 static void audit_disconnect(vfs_handle_struct
*handle
)
107 if (lp_syslog() > 0) {
108 syslog(audit_syslog_priority(handle
), "disconnected\n");
110 DEBUG(10, ("Disconnected from VFS module extd_audit\n"));
111 SMB_VFS_NEXT_DISCONNECT(handle
);
116 static SMB_STRUCT_DIR
*audit_opendir(vfs_handle_struct
*handle
, const char *fname
, const char *mask
, uint32 attr
)
118 SMB_STRUCT_DIR
*result
;
120 result
= SMB_VFS_NEXT_OPENDIR(handle
, fname
, mask
, attr
);
122 if (lp_syslog() > 0) {
123 syslog(audit_syslog_priority(handle
), "opendir %s %s%s\n",
125 (result
== NULL
) ? "failed: " : "",
126 (result
== NULL
) ? strerror(errno
) : "");
128 DEBUG(1, ("vfs_extd_audit: opendir %s %s %s\n",
130 (result
== NULL
) ? "failed: " : "",
131 (result
== NULL
) ? strerror(errno
) : ""));
136 static int audit_mkdir(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
140 result
= SMB_VFS_NEXT_MKDIR(handle
, path
, mode
);
142 if (lp_syslog() > 0) {
143 syslog(audit_syslog_priority(handle
), "mkdir %s %s%s\n",
145 (result
< 0) ? "failed: " : "",
146 (result
< 0) ? strerror(errno
) : "");
148 DEBUG(0, ("vfs_extd_audit: mkdir %s %s %s\n",
150 (result
< 0) ? "failed: " : "",
151 (result
< 0) ? strerror(errno
) : ""));
156 static int audit_rmdir(vfs_handle_struct
*handle
, const char *path
)
160 result
= SMB_VFS_NEXT_RMDIR(handle
, path
);
162 if (lp_syslog() > 0) {
163 syslog(audit_syslog_priority(handle
), "rmdir %s %s%s\n",
165 (result
< 0) ? "failed: " : "",
166 (result
< 0) ? strerror(errno
) : "");
168 DEBUG(0, ("vfs_extd_audit: rmdir %s %s %s\n",
170 (result
< 0) ? "failed: " : "",
171 (result
< 0) ? strerror(errno
) : ""));
176 static int audit_open(vfs_handle_struct
*handle
,
177 struct smb_filename
*smb_fname
, files_struct
*fsp
,
178 int flags
, mode_t mode
)
182 result
= SMB_VFS_NEXT_OPEN(handle
, smb_fname
, fsp
, flags
, mode
);
184 if (lp_syslog() > 0) {
185 syslog(audit_syslog_priority(handle
), "open %s (fd %d) %s%s%s\n",
186 smb_fname
->base_name
, result
,
187 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
188 (result
< 0) ? "failed: " : "",
189 (result
< 0) ? strerror(errno
) : "");
191 DEBUG(2, ("vfs_extd_audit: open %s %s %s\n",
192 smb_fname_str_dbg(smb_fname
),
193 (result
< 0) ? "failed: " : "",
194 (result
< 0) ? strerror(errno
) : ""));
199 static int audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
)
203 result
= SMB_VFS_NEXT_CLOSE(handle
, fsp
);
205 if (lp_syslog() > 0) {
206 syslog(audit_syslog_priority(handle
), "close fd %d %s%s\n",
208 (result
< 0) ? "failed: " : "",
209 (result
< 0) ? strerror(errno
) : "");
211 DEBUG(2, ("vfs_extd_audit: close fd %d %s %s\n",
213 (result
< 0) ? "failed: " : "",
214 (result
< 0) ? strerror(errno
) : ""));
219 static int audit_rename(vfs_handle_struct
*handle
,
220 const struct smb_filename
*smb_fname_src
,
221 const struct smb_filename
*smb_fname_dst
)
225 result
= SMB_VFS_NEXT_RENAME(handle
, smb_fname_src
, smb_fname_dst
);
227 if (lp_syslog() > 0) {
228 syslog(audit_syslog_priority(handle
), "rename %s -> %s %s%s\n",
229 smb_fname_src
->base_name
,
230 smb_fname_dst
->base_name
,
231 (result
< 0) ? "failed: " : "",
232 (result
< 0) ? strerror(errno
) : "");
234 DEBUG(1, ("vfs_extd_audit: rename old: %s newname: %s %s %s\n",
235 smb_fname_str_dbg(smb_fname_src
),
236 smb_fname_str_dbg(smb_fname_dst
),
237 (result
< 0) ? "failed: " : "",
238 (result
< 0) ? strerror(errno
) : ""));
243 static int audit_unlink(vfs_handle_struct
*handle
,
244 const struct smb_filename
*smb_fname
)
248 result
= SMB_VFS_NEXT_UNLINK(handle
, smb_fname
);
250 if (lp_syslog() > 0) {
251 syslog(audit_syslog_priority(handle
), "unlink %s %s%s\n",
252 smb_fname
->base_name
,
253 (result
< 0) ? "failed: " : "",
254 (result
< 0) ? strerror(errno
) : "");
256 DEBUG(0, ("vfs_extd_audit: unlink %s %s %s\n",
257 smb_fname_str_dbg(smb_fname
),
258 (result
< 0) ? "failed: " : "",
259 (result
< 0) ? strerror(errno
) : ""));
264 static int audit_chmod(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
268 result
= SMB_VFS_NEXT_CHMOD(handle
, path
, mode
);
270 if (lp_syslog() > 0) {
271 syslog(audit_syslog_priority(handle
), "chmod %s mode 0x%x %s%s\n",
273 (result
< 0) ? "failed: " : "",
274 (result
< 0) ? strerror(errno
) : "");
276 DEBUG(1, ("vfs_extd_audit: chmod %s mode 0x%x %s %s\n",
277 path
, (unsigned int)mode
,
278 (result
< 0) ? "failed: " : "",
279 (result
< 0) ? strerror(errno
) : ""));
284 static int audit_chmod_acl(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
288 result
= SMB_VFS_NEXT_CHMOD_ACL(handle
, path
, mode
);
290 if (lp_syslog() > 0) {
291 syslog(audit_syslog_priority(handle
), "chmod_acl %s mode 0x%x %s%s\n",
293 (result
< 0) ? "failed: " : "",
294 (result
< 0) ? strerror(errno
) : "");
296 DEBUG(1, ("vfs_extd_audit: chmod_acl %s mode 0x%x %s %s\n",
297 path
, (unsigned int)mode
,
298 (result
< 0) ? "failed: " : "",
299 (result
< 0) ? strerror(errno
) : ""));
304 static int audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
308 result
= SMB_VFS_NEXT_FCHMOD(handle
, fsp
, mode
);
310 if (lp_syslog() > 0) {
311 syslog(audit_syslog_priority(handle
), "fchmod %s mode 0x%x %s%s\n",
312 fsp
->fsp_name
->base_name
, mode
,
313 (result
< 0) ? "failed: " : "",
314 (result
< 0) ? strerror(errno
) : "");
316 DEBUG(1, ("vfs_extd_audit: fchmod %s mode 0x%x %s %s",
317 fsp_str_dbg(fsp
), (unsigned int)mode
,
318 (result
< 0) ? "failed: " : "",
319 (result
< 0) ? strerror(errno
) : ""));
324 static int audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
328 result
= SMB_VFS_NEXT_FCHMOD_ACL(handle
, fsp
, mode
);
330 if (lp_syslog() > 0) {
331 syslog(audit_syslog_priority(handle
), "fchmod_acl %s mode 0x%x %s%s\n",
332 fsp
->fsp_name
->base_name
, mode
,
333 (result
< 0) ? "failed: " : "",
334 (result
< 0) ? strerror(errno
) : "");
336 DEBUG(1, ("vfs_extd_audit: fchmod_acl %s mode 0x%x %s %s",
337 fsp_str_dbg(fsp
), (unsigned int)mode
,
338 (result
< 0) ? "failed: " : "",
339 (result
< 0) ? strerror(errno
) : ""));
344 static struct vfs_fn_pointers vfs_extd_audit_fns
= {
345 .connect_fn
= audit_connect
,
346 .disconnect
= audit_disconnect
,
347 .opendir
= audit_opendir
,
348 .mkdir
= audit_mkdir
,
349 .rmdir
= audit_rmdir
,
350 .open_fn
= audit_open
,
351 .close_fn
= audit_close
,
352 .rename
= audit_rename
,
353 .unlink
= audit_unlink
,
354 .chmod
= audit_chmod
,
355 .fchmod
= audit_fchmod
,
356 .chmod_acl
= audit_chmod_acl
,
357 .fchmod_acl
= audit_fchmod_acl
,
360 NTSTATUS
vfs_extd_audit_init(void)
362 NTSTATUS ret
= smb_register_vfs(SMB_VFS_INTERFACE_VERSION
,
363 "extd_audit", &vfs_extd_audit_fns
);
365 if (!NT_STATUS_IS_OK(ret
))
368 vfs_extd_audit_debug_level
= debug_add_class("extd_audit");
369 if (vfs_extd_audit_debug_level
== -1) {
370 vfs_extd_audit_debug_level
= DBGC_VFS
;
371 DEBUG(0, ("vfs_extd_audit: Couldn't register custom debugging class!\n"));
373 DEBUG(10, ("vfs_extd_audit: Debug class number of 'extd_audit': %d\n", vfs_extd_audit_debug_level
));