?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netcmd:domain:policy: Fix missing conversion from tgt_lifetime minutes to 10^(-7...
[Samba.git] / source3 / modules / vfs_full_audit.c
blob187e6dd76c9e361c1d5aef89ea763211c548312b
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir create_file
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|/tmp
42 * smbd_audit: nobody|192.168.234.1|create_file|fail (No such file or directory)|0x1|file|open|/ts/doesNotExist
43 * smbd_audit: nobody|192.168.234.1|open|ok|w|/tmp/file.txt
44 * smbd_audit: nobody|192.168.234.1|create_file|ok|0x3|file|open|/tmp/file.txt
45 *
46 * where "nobody" is the connected username and "192.168.234.1" is the
47 * client's IP address.
48 *
49 * Options:
50 *
51 * prefix: A macro expansion template prepended to the syslog entry.
52 *
53 * success: A list of VFS operations for which a successful completion should
54 * be logged. Defaults to no logging at all. The special operation "all" logs
55 * - you guessed it - everything.
56 *
57 * failure: A list of VFS operations for which failure to complete should be
58 * logged. Defaults to logging everything.
59 */
60
61
62 #include "includes.h"
63 #include "system/filesys.h"
64 #include "system/syslog.h"
65 #include "smbd/smbd.h"
66 #include "../librpc/gen_ndr/ndr_netlogon.h"
67 #include "auth.h"
68 #include "ntioctl.h"
69 #include "lib/param/loadparm.h"
70 #include "lib/util/bitmap.h"
71 #include "lib/util/tevent_unix.h"
72 #include "libcli/security/sddl.h"
73 #include "passdb/machine_sid.h"
74 #include "lib/util/tevent_ntstatus.h"
75 #include "lib/util/string_wrappers.h"
76 #include "source3/lib/substitute.h"
77
78 static int vfs_full_audit_debug_level = DBGC_VFS;
79
80 struct vfs_full_audit_private_data {
81 struct bitmap *success_ops;
82 struct bitmap *failure_ops;
83 int syslog_facility;
84 int syslog_priority;
85 bool log_secdesc;
86 bool do_syslog;
87 };
88
89 #undef DBGC_CLASS
90 #define DBGC_CLASS vfs_full_audit_debug_level
91
92 typedef enum _vfs_op_type {
93 SMB_VFS_OP_NOOP = -1,
94
95 /* Disk operations */
96
97 SMB_VFS_OP_CONNECT = 0,
98 SMB_VFS_OP_DISCONNECT,
99 SMB_VFS_OP_DISK_FREE,
100 SMB_VFS_OP_GET_QUOTA,
101 SMB_VFS_OP_SET_QUOTA,
102 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
103 SMB_VFS_OP_STATVFS,
104 SMB_VFS_OP_FS_CAPABILITIES,
105 SMB_VFS_OP_GET_DFS_REFERRALS,
106 SMB_VFS_OP_CREATE_DFS_PATHAT,
107 SMB_VFS_OP_READ_DFS_PATHAT,
108
109 /* Directory operations */
110
111 SMB_VFS_OP_FDOPENDIR,
112 SMB_VFS_OP_READDIR,
113 SMB_VFS_OP_REWINDDIR,
114 SMB_VFS_OP_MKDIRAT,
115 SMB_VFS_OP_CLOSEDIR,
116
117 /* File operations */
118
119 SMB_VFS_OP_OPEN,
120 SMB_VFS_OP_OPENAT,
121 SMB_VFS_OP_CREATE_FILE,
122 SMB_VFS_OP_CLOSE,
123 SMB_VFS_OP_READ,
124 SMB_VFS_OP_PREAD,
125 SMB_VFS_OP_PREAD_SEND,
126 SMB_VFS_OP_PREAD_RECV,
127 SMB_VFS_OP_WRITE,
128 SMB_VFS_OP_PWRITE,
129 SMB_VFS_OP_PWRITE_SEND,
130 SMB_VFS_OP_PWRITE_RECV,
131 SMB_VFS_OP_LSEEK,
132 SMB_VFS_OP_SENDFILE,
133 SMB_VFS_OP_RECVFILE,
134 SMB_VFS_OP_RENAMEAT,
135 SMB_VFS_OP_FSYNC_SEND,
136 SMB_VFS_OP_FSYNC_RECV,
137 SMB_VFS_OP_STAT,
138 SMB_VFS_OP_FSTAT,
139 SMB_VFS_OP_LSTAT,
140 SMB_VFS_OP_FSTATAT,
141 SMB_VFS_OP_GET_ALLOC_SIZE,
142 SMB_VFS_OP_UNLINKAT,
143 SMB_VFS_OP_FCHMOD,
144 SMB_VFS_OP_FCHOWN,
145 SMB_VFS_OP_LCHOWN,
146 SMB_VFS_OP_CHDIR,
147 SMB_VFS_OP_GETWD,
148 SMB_VFS_OP_NTIMES,
149 SMB_VFS_OP_FNTIMES,
150 SMB_VFS_OP_FTRUNCATE,
151 SMB_VFS_OP_FALLOCATE,
152 SMB_VFS_OP_LOCK,
153 SMB_VFS_OP_FILESYSTEM_SHAREMODE,
154 SMB_VFS_OP_FCNTL,
155 SMB_VFS_OP_LINUX_SETLEASE,
156 SMB_VFS_OP_GETLOCK,
157 SMB_VFS_OP_SYMLINKAT,
158 SMB_VFS_OP_READLINKAT,
159 SMB_VFS_OP_LINKAT,
160 SMB_VFS_OP_MKNODAT,
161 SMB_VFS_OP_REALPATH,
162 SMB_VFS_OP_FCHFLAGS,
163 SMB_VFS_OP_FILE_ID_CREATE,
164 SMB_VFS_OP_FS_FILE_ID,
165 SMB_VFS_OP_FSTREAMINFO,
166 SMB_VFS_OP_GET_REAL_FILENAME,
167 SMB_VFS_OP_GET_REAL_FILENAME_AT,
168 SMB_VFS_OP_CONNECTPATH,
169 SMB_VFS_OP_BRL_LOCK_WINDOWS,
170 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
171 SMB_VFS_OP_STRICT_LOCK_CHECK,
172 SMB_VFS_OP_TRANSLATE_NAME,
173 SMB_VFS_OP_PARENT_PATHNAME,
174 SMB_VFS_OP_FSCTL,
175 SMB_VFS_OP_OFFLOAD_READ_SEND,
176 SMB_VFS_OP_OFFLOAD_READ_RECV,
177 SMB_VFS_OP_OFFLOAD_WRITE_SEND,
178 SMB_VFS_OP_OFFLOAD_WRITE_RECV,
179 SMB_VFS_OP_FGET_COMPRESSION,
180 SMB_VFS_OP_SET_COMPRESSION,
181 SMB_VFS_OP_SNAP_CHECK_PATH,
182 SMB_VFS_OP_SNAP_CREATE,
183 SMB_VFS_OP_SNAP_DELETE,
184
185 /* DOS attribute operations. */
186 SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
187 SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
188 SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
189 SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
190
191 /* NT ACL operations. */
192
193 SMB_VFS_OP_FGET_NT_ACL,
194 SMB_VFS_OP_FSET_NT_ACL,
195 SMB_VFS_OP_AUDIT_FILE,
196
197 /* POSIX ACL operations. */
198
199 SMB_VFS_OP_SYS_ACL_GET_FD,
200 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
201 SMB_VFS_OP_SYS_ACL_SET_FD,
202 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD,
203
204 /* EA operations. */
205 SMB_VFS_OP_GETXATTRAT_SEND,
206 SMB_VFS_OP_GETXATTRAT_RECV,
207 SMB_VFS_OP_FGETXATTR,
208 SMB_VFS_OP_FLISTXATTR,
209 SMB_VFS_OP_REMOVEXATTR,
210 SMB_VFS_OP_FREMOVEXATTR,
211 SMB_VFS_OP_FSETXATTR,
212
213 /* aio operations */
214 SMB_VFS_OP_AIO_FORCE,
215
216 /* offline operations */
217 SMB_VFS_OP_IS_OFFLINE,
218 SMB_VFS_OP_SET_OFFLINE,
219
220 /* Durable handle operations. */
221 SMB_VFS_OP_DURABLE_COOKIE,
222 SMB_VFS_OP_DURABLE_DISCONNECT,
223 SMB_VFS_OP_DURABLE_RECONNECT,
224
225 SMB_VFS_OP_FREADDIR_ATTR,
226
227 /* This should always be last enum value */
228
229 SMB_VFS_OP_LAST
230 } vfs_op_type;
231
232 /* The following array *must* be in the same order as defined in vfs_op_type */
233
234 static struct {
235 vfs_op_type type;
236 const char *name;
237 } vfs_op_names[] = {
238 { SMB_VFS_OP_CONNECT, "connect" },
239 { SMB_VFS_OP_DISCONNECT, "disconnect" },
240 { SMB_VFS_OP_DISK_FREE, "disk_free" },
241 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
242 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
243 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
244 { SMB_VFS_OP_STATVFS, "statvfs" },
245 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
246 { SMB_VFS_OP_GET_DFS_REFERRALS, "get_dfs_referrals" },
247 { SMB_VFS_OP_CREATE_DFS_PATHAT, "create_dfs_pathat" },
248 { SMB_VFS_OP_READ_DFS_PATHAT, "read_dfs_pathat" },
249 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
250 { SMB_VFS_OP_READDIR, "readdir" },
251 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
252 { SMB_VFS_OP_MKDIRAT, "mkdirat" },
253 { SMB_VFS_OP_CLOSEDIR, "closedir" },
254 { SMB_VFS_OP_OPEN, "open" },
255 { SMB_VFS_OP_OPENAT, "openat" },
256 { SMB_VFS_OP_CREATE_FILE, "create_file" },
257 { SMB_VFS_OP_CLOSE, "close" },
258 { SMB_VFS_OP_READ, "read" },
259 { SMB_VFS_OP_PREAD, "pread" },
260 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
261 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
262 { SMB_VFS_OP_WRITE, "write" },
263 { SMB_VFS_OP_PWRITE, "pwrite" },
264 { SMB_VFS_OP_PWRITE_SEND, "pwrite_send" },
265 { SMB_VFS_OP_PWRITE_RECV, "pwrite_recv" },
266 { SMB_VFS_OP_LSEEK, "lseek" },
267 { SMB_VFS_OP_SENDFILE, "sendfile" },
268 { SMB_VFS_OP_RECVFILE, "recvfile" },
269 { SMB_VFS_OP_RENAMEAT, "renameat" },
270 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
271 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
272 { SMB_VFS_OP_STAT, "stat" },
273 { SMB_VFS_OP_FSTAT, "fstat" },
274 { SMB_VFS_OP_LSTAT, "lstat" },
275 { SMB_VFS_OP_FSTATAT, "fstatat" },
276 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
277 { SMB_VFS_OP_UNLINKAT, "unlinkat" },
278 { SMB_VFS_OP_FCHMOD, "fchmod" },
279 { SMB_VFS_OP_FCHOWN, "fchown" },
280 { SMB_VFS_OP_LCHOWN, "lchown" },
281 { SMB_VFS_OP_CHDIR, "chdir" },
282 { SMB_VFS_OP_GETWD, "getwd" },
283 { SMB_VFS_OP_NTIMES, "ntimes" },
284 { SMB_VFS_OP_FNTIMES, "fntimes" },
285 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
286 { SMB_VFS_OP_FALLOCATE,"fallocate" },
287 { SMB_VFS_OP_LOCK, "lock" },
288 { SMB_VFS_OP_FILESYSTEM_SHAREMODE, "filesystem_sharemode" },
289 { SMB_VFS_OP_FCNTL, "fcntl" },
290 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
291 { SMB_VFS_OP_GETLOCK, "getlock" },
292 { SMB_VFS_OP_SYMLINKAT, "symlinkat" },
293 { SMB_VFS_OP_READLINKAT,"readlinkat" },
294 { SMB_VFS_OP_LINKAT, "linkat" },
295 { SMB_VFS_OP_MKNODAT, "mknodat" },
296 { SMB_VFS_OP_REALPATH, "realpath" },
297 { SMB_VFS_OP_FCHFLAGS, "fchflags" },
298 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
299 { SMB_VFS_OP_FS_FILE_ID, "fs_file_id" },
300 { SMB_VFS_OP_FSTREAMINFO, "fstreaminfo" },
301 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
302 { SMB_VFS_OP_GET_REAL_FILENAME_AT, "get_real_filename_at" },
303 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
304 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
305 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
306 { SMB_VFS_OP_STRICT_LOCK_CHECK, "strict_lock_check" },
307 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
308 { SMB_VFS_OP_PARENT_PATHNAME, "parent_pathname" },
309 { SMB_VFS_OP_FSCTL, "fsctl" },
310 { SMB_VFS_OP_OFFLOAD_READ_SEND, "offload_read_send" },
311 { SMB_VFS_OP_OFFLOAD_READ_RECV, "offload_read_recv" },
312 { SMB_VFS_OP_OFFLOAD_WRITE_SEND, "offload_write_send" },
313 { SMB_VFS_OP_OFFLOAD_WRITE_RECV, "offload_write_recv" },
314 { SMB_VFS_OP_FGET_COMPRESSION, "fget_compression" },
315 { SMB_VFS_OP_SET_COMPRESSION, "set_compression" },
316 { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
317 { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
318 { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
319 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND, "get_dos_attributes_send" },
320 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV, "get_dos_attributes_recv" },
321 { SMB_VFS_OP_FGET_DOS_ATTRIBUTES, "fget_dos_attributes" },
322 { SMB_VFS_OP_FSET_DOS_ATTRIBUTES, "fset_dos_attributes" },
323 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
324 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
325 { SMB_VFS_OP_AUDIT_FILE, "audit_file" },
326 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
327 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, "sys_acl_blob_get_fd" },
328 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
329 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD, "sys_acl_delete_def_fd" },
330 { SMB_VFS_OP_GETXATTRAT_SEND, "getxattrat_send" },
331 { SMB_VFS_OP_GETXATTRAT_RECV, "getxattrat_recv" },
332 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
333 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
334 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
335 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
336 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
337 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
338 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
339 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
340 { SMB_VFS_OP_DURABLE_COOKIE, "durable_cookie" },
341 { SMB_VFS_OP_DURABLE_DISCONNECT, "durable_disconnect" },
342 { SMB_VFS_OP_DURABLE_RECONNECT, "durable_reconnect" },
343 { SMB_VFS_OP_FREADDIR_ATTR, "freaddir_attr" },
344 { SMB_VFS_OP_LAST, NULL }
345 };
346
347 static int audit_syslog_facility(vfs_handle_struct *handle)
348 {
349 static const struct enum_list enum_log_facilities[] = {
350 #ifdef LOG_AUTH
351 { LOG_AUTH, "AUTH" },
352 #endif
353 #ifdef LOG_AUTHPRIV
354 { LOG_AUTHPRIV, "AUTHPRIV" },
355 #endif
356 #ifdef LOG_AUDIT
357 { LOG_AUDIT, "AUDIT" },
358 #endif
359 #ifdef LOG_CONSOLE
360 { LOG_CONSOLE, "CONSOLE" },
361 #endif
362 #ifdef LOG_CRON
363 { LOG_CRON, "CRON" },
364 #endif
365 #ifdef LOG_DAEMON
366 { LOG_DAEMON, "DAEMON" },
367 #endif
368 #ifdef LOG_FTP
369 { LOG_FTP, "FTP" },
370 #endif
371 #ifdef LOG_INSTALL
372 { LOG_INSTALL, "INSTALL" },
373 #endif
374 #ifdef LOG_KERN
375 { LOG_KERN, "KERN" },
376 #endif
377 #ifdef LOG_LAUNCHD
378 { LOG_LAUNCHD, "LAUNCHD" },
379 #endif
380 #ifdef LOG_LFMT
381 { LOG_LFMT, "LFMT" },
382 #endif
383 #ifdef LOG_LPR
384 { LOG_LPR, "LPR" },
385 #endif
386 #ifdef LOG_MAIL
387 { LOG_MAIL, "MAIL" },
388 #endif
389 #ifdef LOG_MEGASAFE
390 { LOG_MEGASAFE, "MEGASAFE" },
391 #endif
392 #ifdef LOG_NETINFO
393 { LOG_NETINFO, "NETINFO" },
394 #endif
395 #ifdef LOG_NEWS
396 { LOG_NEWS, "NEWS" },
397 #endif
398 #ifdef LOG_NFACILITIES
399 { LOG_NFACILITIES, "NFACILITIES" },
400 #endif
401 #ifdef LOG_NTP
402 { LOG_NTP, "NTP" },
403 #endif
404 #ifdef LOG_RAS
405 { LOG_RAS, "RAS" },
406 #endif
407 #ifdef LOG_REMOTEAUTH
408 { LOG_REMOTEAUTH, "REMOTEAUTH" },
409 #endif
410 #ifdef LOG_SECURITY
411 { LOG_SECURITY, "SECURITY" },
412 #endif
413 #ifdef LOG_SYSLOG
414 { LOG_SYSLOG, "SYSLOG" },
415 #endif
416 #ifdef LOG_USER
417 { LOG_USER, "USER" },
418 #endif
419 #ifdef LOG_UUCP
420 { LOG_UUCP, "UUCP" },
421 #endif
422 { LOG_LOCAL0, "LOCAL0" },
423 { LOG_LOCAL1, "LOCAL1" },
424 { LOG_LOCAL2, "LOCAL2" },
425 { LOG_LOCAL3, "LOCAL3" },
426 { LOG_LOCAL4, "LOCAL4" },
427 { LOG_LOCAL5, "LOCAL5" },
428 { LOG_LOCAL6, "LOCAL6" },
429 { LOG_LOCAL7, "LOCAL7" },
430 { -1, NULL }
431 };
432
433 int facility;
434
435 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
436
437 return facility;
438 }
439
440 static int audit_syslog_priority(vfs_handle_struct *handle)
441 {
442 static const struct enum_list enum_log_priorities[] = {
443 { LOG_EMERG, "EMERG" },
444 { LOG_ALERT, "ALERT" },
445 { LOG_CRIT, "CRIT" },
446 { LOG_ERR, "ERR" },
447 { LOG_WARNING, "WARNING" },
448 { LOG_NOTICE, "NOTICE" },
449 { LOG_INFO, "INFO" },
450 { LOG_DEBUG, "DEBUG" },
451 { -1, NULL }
452 };
453
454 int priority;
455
456 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
457 enum_log_priorities, LOG_NOTICE);
458 if (priority == -1) {
459 priority = LOG_WARNING;
460 }
461
462 return priority;
463 }
464
465 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
466 {
467 const struct loadparm_substitution *lp_sub =
468 loadparm_s3_global_substitution();
469 char *prefix = NULL;
470 char *result;
471
472 prefix = talloc_strdup(ctx,
473 lp_parm_const_string(SNUM(conn), "full_audit",
474 "prefix", "%u|%I"));
475 if (!prefix) {
476 return NULL;
477 }
478 result = talloc_sub_full(ctx,
479 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
480 conn->session_info->unix_info->unix_name,
481 conn->connectpath,
482 conn->session_info->unix_token->gid,
483 conn->session_info->unix_info->sanitized_username,
484 conn->session_info->info->domain_name,
485 prefix);
486 TALLOC_FREE(prefix);
487 return result;
488 }
489
490 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
491 {
492 if (pd->success_ops == NULL) {
493 return True;
494 }
495
496 return bitmap_query(pd->success_ops, op);
497 }
498
499 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
500 {
501 if (pd->failure_ops == NULL)
502 return True;
503
504 return bitmap_query(pd->failure_ops, op);
505 }
506
507 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
508 {
509 struct bitmap *bm;
510
511 if (ops == NULL) {
512 DBG_ERR("init_bitmap, ops list is empty (logic error)\n");
513 return NULL;
514 }
515
516 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
517 if (bm == NULL) {
518 DBG_ERR("Could not alloc bitmap\n");
519 return NULL;
520 }
521
522 for (; *ops != NULL; ops += 1) {
523 int i;
524 bool neg = false;
525 const char *op;
526
527 if (strequal(*ops, "all")) {
528 for (i=0; i<SMB_VFS_OP_LAST; i++) {
529 bitmap_set(bm, i);
530 }
531 continue;
532 }
533
534 if (strequal(*ops, "none")) {
535 break;
536 }
537
538 op = ops[0];
539 if (op[0] == '!') {
540 neg = true;
541 op += 1;
542 }
543
544 for (i=0; i<SMB_VFS_OP_LAST; i++) {
545 if ((vfs_op_names[i].name == NULL)
546 || (vfs_op_names[i].type != i)) {
547 smb_panic("vfs_full_audit.c: name table not "
548 "in sync with vfs_op_type enums\n");
549 }
550 if (strequal(op, vfs_op_names[i].name)) {
551 if (neg) {
552 bitmap_clear(bm, i);
553 } else {
554 bitmap_set(bm, i);
555 }
556 break;
557 }
558 }
559 if (i == SMB_VFS_OP_LAST) {
560 DBG_ERR("Could not find opname %s\n", *ops);
561 TALLOC_FREE(bm);
562 return NULL;
563 }
564 }
565 return bm;
566 }
567
568 static const char *audit_opname(vfs_op_type op)
569 {
570 if (op >= SMB_VFS_OP_LAST)
571 return "INVALID VFS OP";
572 return vfs_op_names[op].name;
573 }
574
575 static TALLOC_CTX *tmp_do_log_ctx;
576 /*
577 * Get us a temporary talloc context usable just for DEBUG arguments
578 */
579 static TALLOC_CTX *do_log_ctx(void)
580 {
581 if (tmp_do_log_ctx == NULL) {
582 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
583 }
584 return tmp_do_log_ctx;
585 }
586
587 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
588 const char *format, ...) PRINTF_ATTRIBUTE(4, 5);
589
590 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
591 const char *format, ...)
592 {
593 struct vfs_full_audit_private_data *pd;
594 fstring err_msg;
595 char *audit_pre = NULL;
596 va_list ap;
597 char *op_msg = NULL;
598
599 SMB_VFS_HANDLE_GET_DATA(handle, pd,
600 struct vfs_full_audit_private_data,
601 return;);
602
603 if (success && (!log_success(pd, op)))
604 goto out;
605
606 if (!success && (!log_failure(pd, op)))
607 goto out;
608
609 if (success)
610 fstrcpy(err_msg, "ok");
611 else
612 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
613
614 va_start(ap, format);
615 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
616 va_end(ap);
617
618 if (!op_msg) {
619 goto out;
620 }
621
622 audit_pre = audit_prefix(talloc_tos(), handle->conn);
623
624 if (pd->do_syslog) {
625 int priority;
626
627 /*
628 * Specify the facility to interoperate with other syslog
629 * callers (smbd for example).
630 */
631 priority = pd->syslog_priority | pd->syslog_facility;
632
633 syslog(priority, "%s|%s|%s|%s\n",
634 audit_pre ? audit_pre : "",
635 audit_opname(op), err_msg, op_msg);
636 } else {
637 DEBUG(1, ("%s|%s|%s|%s\n",
638 audit_pre ? audit_pre : "",
639 audit_opname(op), err_msg, op_msg));
640 }
641 out:
642 TALLOC_FREE(audit_pre);
643 TALLOC_FREE(op_msg);
644 TALLOC_FREE(tmp_do_log_ctx);
645 }
646
647 /**
648 * Return a string using the do_log_ctx()
649 */
650 static const char *smb_fname_str_do_log(struct connection_struct *conn,
651 const struct smb_filename *smb_fname)
652 {
653 char *fname = NULL;
654 NTSTATUS status;
655
656 if (smb_fname == NULL) {
657 return "";
658 }
659
660 if (smb_fname->base_name[0] != '/') {
661 char *abs_name = NULL;
662 struct smb_filename *fname_copy = cp_smb_filename(
663 do_log_ctx(),
664 smb_fname);
665 if (fname_copy == NULL) {
666 return "";
667 }
668
669 if (!ISDOT(smb_fname->base_name)) {
670 abs_name = talloc_asprintf(do_log_ctx(),
671 "%s/%s",
672 conn->cwd_fsp->fsp_name->base_name,
673 smb_fname->base_name);
674 } else {
675 abs_name = talloc_strdup(do_log_ctx(),
676 conn->cwd_fsp->fsp_name->base_name);
677 }
678 if (abs_name == NULL) {
679 return "";
680 }
681 fname_copy->base_name = abs_name;
682 smb_fname = fname_copy;
683 }
684
685 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
686 if (!NT_STATUS_IS_OK(status)) {
687 return "";
688 }
689 return fname;
690 }
691
692 /**
693 * Return an fsp debug string using the do_log_ctx()
694 */
695 static const char *fsp_str_do_log(const struct files_struct *fsp)
696 {
697 return smb_fname_str_do_log(fsp->conn, fsp->fsp_name);
698 }
699
700 /* Implementation of vfs_ops. Pass everything on to the default
701 operation but log event first. */
702
703 static int smb_full_audit_connect(vfs_handle_struct *handle,
704 const char *svc, const char *user)
705 {
706 int result;
707 const char *none[] = { "none" };
708 struct vfs_full_audit_private_data *pd = NULL;
709
710 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
711 if (result < 0) {
712 return result;
713 }
714
715 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
716 if (!pd) {
717 SMB_VFS_NEXT_DISCONNECT(handle);
718 return -1;
719 }
720
721 pd->syslog_facility = audit_syslog_facility(handle);
722 if (pd->syslog_facility == -1) {
723 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
724 lp_parm_const_string(SNUM(handle->conn),
725 "full_audit", "facility",
726 "USER")));
727 SMB_VFS_NEXT_DISCONNECT(handle);
728 return -1;
729 }
730
731 pd->syslog_priority = audit_syslog_priority(handle);
732
733 pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
734 "full_audit", "log_secdesc", false);
735
736 pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
737 "full_audit", "syslog", true);
738
739 #ifdef WITH_SYSLOG
740 if (pd->do_syslog) {
741 openlog("smbd_audit", 0, pd->syslog_facility);
742 }
743 #endif
744
745 pd->success_ops = init_bitmap(
746 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
747 "success", none));
748 if (pd->success_ops == NULL) {
749 DBG_ERR("Invalid success operations list. Failing connect\n");
750 SMB_VFS_NEXT_DISCONNECT(handle);
751 return -1;
752 }
753 pd->failure_ops = init_bitmap(
754 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
755 "failure", none));
756 if (pd->failure_ops == NULL) {
757 DBG_ERR("Invalid failure operations list. Failing connect\n");
758 SMB_VFS_NEXT_DISCONNECT(handle);
759 return -1;
760 }
761
762 /* Store the private data. */
763 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
764 struct vfs_full_audit_private_data, return -1);
765
766 do_log(SMB_VFS_OP_CONNECT, True, handle,
767 "%s", svc);
768
769 return 0;
770 }
771
772 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
773 {
774 const struct loadparm_substitution *lp_sub =
775 loadparm_s3_global_substitution();
776
777 SMB_VFS_NEXT_DISCONNECT(handle);
778
779 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
780 "%s", lp_servicename(talloc_tos(), lp_sub, SNUM(handle->conn)));
781
782 /* The bitmaps will be disconnected when the private
783 data is deleted. */
784 }
785
786 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
787 const struct smb_filename *smb_fname,
788 uint64_t *bsize,
789 uint64_t *dfree,
790 uint64_t *dsize)
791 {
792 uint64_t result;
793
794 result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
795
796 /* Don't have a reasonable notion of failure here */
797
798 do_log(SMB_VFS_OP_DISK_FREE,
799 True,
800 handle,
801 "%s",
802 smb_fname_str_do_log(handle->conn, smb_fname));
803
804 return result;
805 }
806
807 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
808 const struct smb_filename *smb_fname,
809 enum SMB_QUOTA_TYPE qtype,
810 unid_t id,
811 SMB_DISK_QUOTA *qt)
812 {
813 int result;
814
815 result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
816
817 do_log(SMB_VFS_OP_GET_QUOTA,
818 (result >= 0),
819 handle,
820 "%s",
821 smb_fname_str_do_log(handle->conn, smb_fname));
822
823 return result;
824 }
825
826 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
827 enum SMB_QUOTA_TYPE qtype, unid_t id,
828 SMB_DISK_QUOTA *qt)
829 {
830 int result;
831
832 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
833
834 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
835
836 return result;
837 }
838
839 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
840 struct files_struct *fsp,
841 struct shadow_copy_data *shadow_copy_data,
842 bool labels)
843 {
844 int result;
845
846 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
847
848 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
849
850 return result;
851 }
852
853 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
854 const struct smb_filename *smb_fname,
855 struct vfs_statvfs_struct *statbuf)
856 {
857 int result;
858
859 result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
860
861 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
862
863 return result;
864 }
865
866 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
867 {
868 int result;
869
870 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
871
872 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
873
874 return result;
875 }
876
877 static NTSTATUS smb_full_audit_get_dfs_referrals(
878 struct vfs_handle_struct *handle,
879 struct dfs_GetDFSReferral *r)
880 {
881 NTSTATUS status;
882
883 status = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
884
885 do_log(SMB_VFS_OP_GET_DFS_REFERRALS, NT_STATUS_IS_OK(status),
886 handle, "");
887
888 return status;
889 }
890
891 static NTSTATUS smb_full_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
892 struct files_struct *dirfsp,
893 const struct smb_filename *smb_fname,
894 const struct referral *reflist,
895 size_t referral_count)
896 {
897 NTSTATUS status;
898 struct smb_filename *full_fname = NULL;
899
900 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
901 dirfsp,
902 smb_fname);
903 if (full_fname == NULL) {
904 return NT_STATUS_NO_MEMORY;
905 }
906
907 status = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
908 dirfsp,
909 smb_fname,
910 reflist,
911 referral_count);
912
913 do_log(SMB_VFS_OP_CREATE_DFS_PATHAT,
914 NT_STATUS_IS_OK(status),
915 handle,
916 "%s",
917 smb_fname_str_do_log(handle->conn, full_fname));
918
919 TALLOC_FREE(full_fname);
920 return status;
921 }
922
923 static NTSTATUS smb_full_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
924 TALLOC_CTX *mem_ctx,
925 struct files_struct *dirfsp,
926 struct smb_filename *smb_fname,
927 struct referral **ppreflist,
928 size_t *preferral_count)
929 {
930 struct smb_filename *full_fname = NULL;
931 NTSTATUS status;
932
933 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
934 dirfsp,
935 smb_fname);
936 if (full_fname == NULL) {
937 return NT_STATUS_NO_MEMORY;
938 }
939
940 status = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
941 mem_ctx,
942 dirfsp,
943 smb_fname,
944 ppreflist,
945 preferral_count);
946
947 do_log(SMB_VFS_OP_READ_DFS_PATHAT,
948 NT_STATUS_IS_OK(status),
949 handle,
950 "%s",
951 smb_fname_str_do_log(handle->conn, full_fname));
952
953 TALLOC_FREE(full_fname);
954 return status;
955 }
956
957 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
958 TALLOC_CTX *mem_ctx,
959 const char *service_path,
960 char **base_volume)
961 {
962 NTSTATUS status;
963
964 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
965 base_volume);
966 do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
967 handle, "");
968
969 return status;
970 }
971
972 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
973 TALLOC_CTX *mem_ctx,
974 const char *base_volume,
975 time_t *tstamp,
976 bool rw,
977 char **base_path,
978 char **snap_path)
979 {
980 NTSTATUS status;
981
982 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
983 rw, base_path, snap_path);
984 do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
985
986 return status;
987 }
988
989 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
990 TALLOC_CTX *mem_ctx,
991 char *base_path,
992 char *snap_path)
993 {
994 NTSTATUS status;
995
996 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
997 snap_path);
998 do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
999
1000 return status;
1001 }
1002
1003 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
1004 files_struct *fsp, const char *mask, uint32_t attr)
1005 {
1006 DIR *result;
1007
1008 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
1009
1010 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
1011 fsp_str_do_log(fsp));
1012
1013 return result;
1014 }
1015
1016 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
1017 struct files_struct *dirfsp,
1018 DIR *dirp)
1019 {
1020 struct dirent *result;
1021
1022 result = SMB_VFS_NEXT_READDIR(handle, dirfsp, dirp);
1023
1024 /* This operation has no reasonable error condition
1025 * (End of dir is also failure), so always succeed.
1026 */
1027 do_log(SMB_VFS_OP_READDIR, True, handle, "");
1028
1029 return result;
1030 }
1031
1032 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
1033 DIR *dirp)
1034 {
1035 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
1036
1037 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
1038 }
1039
1040 static int smb_full_audit_mkdirat(vfs_handle_struct *handle,
1041 struct files_struct *dirfsp,
1042 const struct smb_filename *smb_fname,
1043 mode_t mode)
1044 {
1045 struct smb_filename *full_fname = NULL;
1046 int result;
1047
1048 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1049 dirfsp,
1050 smb_fname);
1051 if (full_fname == NULL) {
1052 errno = ENOMEM;
1053 return -1;
1054 }
1055
1056 result = SMB_VFS_NEXT_MKDIRAT(handle,
1057 dirfsp,
1058 smb_fname,
1059 mode);
1060
1061 do_log(SMB_VFS_OP_MKDIRAT,
1062 (result >= 0),
1063 handle,
1064 "%s",
1065 smb_fname_str_do_log(handle->conn, full_fname));
1066
1067 TALLOC_FREE(full_fname);
1068
1069 return result;
1070 }
1071
1072 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1073 DIR *dirp)
1074 {
1075 int result;
1076
1077 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1078
1079 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1080
1081 return result;
1082 }
1083
1084 static int smb_full_audit_openat(vfs_handle_struct *handle,
1085 const struct files_struct *dirfsp,
1086 const struct smb_filename *smb_fname,
1087 struct files_struct *fsp,
1088 const struct vfs_open_how *how)
1089 {
1090 int result;
1091
1092 result = SMB_VFS_NEXT_OPENAT(handle, dirfsp, smb_fname, fsp, how);
1093
1094 do_log(SMB_VFS_OP_OPENAT, (result >= 0), handle, "%s|%s",
1095 ((how->flags & O_WRONLY) || (how->flags & O_RDWR))?"w":"r",
1096 fsp_str_do_log(fsp));
1097
1098 return result;
1099 }
1100
1101 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1102 struct smb_request *req,
1103 struct files_struct *dirfsp,
1104 struct smb_filename *smb_fname,
1105 uint32_t access_mask,
1106 uint32_t share_access,
1107 uint32_t create_disposition,
1108 uint32_t create_options,
1109 uint32_t file_attributes,
1110 uint32_t oplock_request,
1111 const struct smb2_lease *lease,
1112 uint64_t allocation_size,
1113 uint32_t private_flags,
1114 struct security_descriptor *sd,
1115 struct ea_list *ea_list,
1116 files_struct **result_fsp,
1117 int *pinfo,
1118 const struct smb2_create_blobs *in_context_blobs,
1119 struct smb2_create_blobs *out_context_blobs)
1120 {
1121 NTSTATUS result;
1122 const char* str_create_disposition;
1123
1124 switch (create_disposition) {
1125 case FILE_SUPERSEDE:
1126 str_create_disposition = "supersede";
1127 break;
1128 case FILE_OVERWRITE_IF:
1129 str_create_disposition = "overwrite_if";
1130 break;
1131 case FILE_OPEN:
1132 str_create_disposition = "open";
1133 break;
1134 case FILE_OVERWRITE:
1135 str_create_disposition = "overwrite";
1136 break;
1137 case FILE_CREATE:
1138 str_create_disposition = "create";
1139 break;
1140 case FILE_OPEN_IF:
1141 str_create_disposition = "open_if";
1142 break;
1143 default:
1144 str_create_disposition = "unknown";
1145 }
1146
1147 result = SMB_VFS_NEXT_CREATE_FILE(
1148 handle, /* handle */
1149 req, /* req */
1150 dirfsp, /* dirfsp */
1151 smb_fname, /* fname */
1152 access_mask, /* access_mask */
1153 share_access, /* share_access */
1154 create_disposition, /* create_disposition*/
1155 create_options, /* create_options */
1156 file_attributes, /* file_attributes */
1157 oplock_request, /* oplock_request */
1158 lease, /* lease */
1159 allocation_size, /* allocation_size */
1160 private_flags,
1161 sd, /* sd */
1162 ea_list, /* ea_list */
1163 result_fsp, /* result */
1164 pinfo, /* pinfo */
1165 in_context_blobs, out_context_blobs); /* create context */
1166
1167 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
1168 "0x%x|%s|%s|%s", access_mask,
1169 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
1170 str_create_disposition,
1171 smb_fname_str_do_log(handle->conn, smb_fname));
1172
1173 return result;
1174 }
1175
1176 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1177 {
1178 int result;
1179
1180 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1181
1182 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
1183 fsp_str_do_log(fsp));
1184
1185 return result;
1186 }
1187
1188 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1189 void *data, size_t n, off_t offset)
1190 {
1191 ssize_t result;
1192
1193 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1194
1195 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1196 fsp_str_do_log(fsp));
1197
1198 return result;
1199 }
1200
1201 struct smb_full_audit_pread_state {
1202 vfs_handle_struct *handle;
1203 files_struct *fsp;
1204 ssize_t ret;
1205 struct vfs_aio_state vfs_aio_state;
1206 };
1207
1208 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1209
1210 static struct tevent_req *smb_full_audit_pread_send(
1211 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1212 struct tevent_context *ev, struct files_struct *fsp,
1213 void *data, size_t n, off_t offset)
1214 {
1215 struct tevent_req *req, *subreq;
1216 struct smb_full_audit_pread_state *state;
1217
1218 req = tevent_req_create(mem_ctx, &state,
1219 struct smb_full_audit_pread_state);
1220 if (req == NULL) {
1221 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1222 fsp_str_do_log(fsp));
1223 return NULL;
1224 }
1225 state->handle = handle;
1226 state->fsp = fsp;
1227
1228 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1229 n, offset);
1230 if (tevent_req_nomem(subreq, req)) {
1231 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1232 fsp_str_do_log(fsp));
1233 return tevent_req_post(req, ev);
1234 }
1235 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1236
1237 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1238 return req;
1239 }
1240
1241 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1242 {
1243 struct tevent_req *req = tevent_req_callback_data(
1244 subreq, struct tevent_req);
1245 struct smb_full_audit_pread_state *state = tevent_req_data(
1246 req, struct smb_full_audit_pread_state);
1247
1248 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
1249 TALLOC_FREE(subreq);
1250 tevent_req_done(req);
1251 }
1252
1253 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req,
1254 struct vfs_aio_state *vfs_aio_state)
1255 {
1256 struct smb_full_audit_pread_state *state = tevent_req_data(
1257 req, struct smb_full_audit_pread_state);
1258
1259 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1260 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1261 fsp_str_do_log(state->fsp));
1262 return -1;
1263 }
1264
1265 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1266 fsp_str_do_log(state->fsp));
1267
1268 *vfs_aio_state = state->vfs_aio_state;
1269 return state->ret;
1270 }
1271
1272 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1273 const void *data, size_t n,
1274 off_t offset)
1275 {
1276 ssize_t result;
1277
1278 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1279
1280 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1281 fsp_str_do_log(fsp));
1282
1283 return result;
1284 }
1285
1286 struct smb_full_audit_pwrite_state {
1287 vfs_handle_struct *handle;
1288 files_struct *fsp;
1289 ssize_t ret;
1290 struct vfs_aio_state vfs_aio_state;
1291 };
1292
1293 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1294
1295 static struct tevent_req *smb_full_audit_pwrite_send(
1296 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1297 struct tevent_context *ev, struct files_struct *fsp,
1298 const void *data, size_t n, off_t offset)
1299 {
1300 struct tevent_req *req, *subreq;
1301 struct smb_full_audit_pwrite_state *state;
1302
1303 req = tevent_req_create(mem_ctx, &state,
1304 struct smb_full_audit_pwrite_state);
1305 if (req == NULL) {
1306 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1307 fsp_str_do_log(fsp));
1308 return NULL;
1309 }
1310 state->handle = handle;
1311 state->fsp = fsp;
1312
1313 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1314 n, offset);
1315 if (tevent_req_nomem(subreq, req)) {
1316 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1317 fsp_str_do_log(fsp));
1318 return tevent_req_post(req, ev);
1319 }
1320 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1321
1322 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1323 fsp_str_do_log(fsp));
1324 return req;
1325 }
1326
1327 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1328 {
1329 struct tevent_req *req = tevent_req_callback_data(
1330 subreq, struct tevent_req);
1331 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1332 req, struct smb_full_audit_pwrite_state);
1333
1334 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
1335 TALLOC_FREE(subreq);
1336 tevent_req_done(req);
1337 }
1338
1339 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req,
1340 struct vfs_aio_state *vfs_aio_state)
1341 {
1342 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1343 req, struct smb_full_audit_pwrite_state);
1344
1345 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1346 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1347 fsp_str_do_log(state->fsp));
1348 return -1;
1349 }
1350
1351 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1352 fsp_str_do_log(state->fsp));
1353
1354 *vfs_aio_state = state->vfs_aio_state;
1355 return state->ret;
1356 }
1357
1358 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1359 off_t offset, int whence)
1360 {
1361 ssize_t result;
1362
1363 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1364
1365 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1366 "%s", fsp_str_do_log(fsp));
1367
1368 return result;
1369 }
1370
1371 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1372 files_struct *fromfsp,
1373 const DATA_BLOB *hdr, off_t offset,
1374 size_t n)
1375 {
1376 ssize_t result;
1377
1378 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1379
1380 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1381 "%s", fsp_str_do_log(fromfsp));
1382
1383 return result;
1384 }
1385
1386 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1387 files_struct *tofsp,
1388 off_t offset,
1389 size_t n)
1390 {
1391 ssize_t result;
1392
1393 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1394
1395 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1396 "%s", fsp_str_do_log(tofsp));
1397
1398 return result;
1399 }
1400
1401 static int smb_full_audit_renameat(vfs_handle_struct *handle,
1402 files_struct *srcfsp,
1403 const struct smb_filename *smb_fname_src,
1404 files_struct *dstfsp,
1405 const struct smb_filename *smb_fname_dst,
1406 const struct vfs_rename_how *how)
1407 {
1408 int result;
1409 int saved_errno;
1410 struct smb_filename *full_fname_src = NULL;
1411 struct smb_filename *full_fname_dst = NULL;
1412
1413 full_fname_src = full_path_from_dirfsp_atname(talloc_tos(),
1414 srcfsp,
1415 smb_fname_src);
1416 if (full_fname_src == NULL) {
1417 errno = ENOMEM;
1418 return -1;
1419 }
1420 full_fname_dst = full_path_from_dirfsp_atname(talloc_tos(),
1421 dstfsp,
1422 smb_fname_dst);
1423 if (full_fname_dst == NULL) {
1424 TALLOC_FREE(full_fname_src);
1425 errno = ENOMEM;
1426 return -1;
1427 }
1428
1429 result = SMB_VFS_NEXT_RENAMEAT(handle,
1430 srcfsp,
1431 smb_fname_src,
1432 dstfsp,
1433 smb_fname_dst,
1434 how);
1435
1436 if (result == -1) {
1437 saved_errno = errno;
1438 }
1439 do_log(SMB_VFS_OP_RENAMEAT, (result >= 0), handle, "%s|%s",
1440 smb_fname_str_do_log(handle->conn, full_fname_src),
1441 smb_fname_str_do_log(handle->conn, full_fname_dst));
1442
1443 TALLOC_FREE(full_fname_src);
1444 TALLOC_FREE(full_fname_dst);
1445
1446 if (result == -1) {
1447 errno = saved_errno;
1448 }
1449 return result;
1450 }
1451
1452 struct smb_full_audit_fsync_state {
1453 vfs_handle_struct *handle;
1454 files_struct *fsp;
1455 int ret;
1456 struct vfs_aio_state vfs_aio_state;
1457 };
1458
1459 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1460
1461 static struct tevent_req *smb_full_audit_fsync_send(
1462 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1463 struct tevent_context *ev, struct files_struct *fsp)
1464 {
1465 struct tevent_req *req, *subreq;
1466 struct smb_full_audit_fsync_state *state;
1467
1468 req = tevent_req_create(mem_ctx, &state,
1469 struct smb_full_audit_fsync_state);
1470 if (req == NULL) {
1471 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1472 fsp_str_do_log(fsp));
1473 return NULL;
1474 }
1475 state->handle = handle;
1476 state->fsp = fsp;
1477
1478 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1479 if (tevent_req_nomem(subreq, req)) {
1480 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1481 fsp_str_do_log(fsp));
1482 return tevent_req_post(req, ev);
1483 }
1484 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1485
1486 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1487 return req;
1488 }
1489
1490 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1491 {
1492 struct tevent_req *req = tevent_req_callback_data(
1493 subreq, struct tevent_req);
1494 struct smb_full_audit_fsync_state *state = tevent_req_data(
1495 req, struct smb_full_audit_fsync_state);
1496
1497 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1498 TALLOC_FREE(subreq);
1499 tevent_req_done(req);
1500 }
1501
1502 static int smb_full_audit_fsync_recv(struct tevent_req *req,
1503 struct vfs_aio_state *vfs_aio_state)
1504 {
1505 struct smb_full_audit_fsync_state *state = tevent_req_data(
1506 req, struct smb_full_audit_fsync_state);
1507
1508 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1509 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1510 fsp_str_do_log(state->fsp));
1511 return -1;
1512 }
1513
1514 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1515 fsp_str_do_log(state->fsp));
1516
1517 *vfs_aio_state = state->vfs_aio_state;
1518 return state->ret;
1519 }
1520
1521 static int smb_full_audit_stat(vfs_handle_struct *handle,
1522 struct smb_filename *smb_fname)
1523 {
1524 int result;
1525
1526 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1527
1528 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1529 smb_fname_str_do_log(handle->conn, smb_fname));
1530
1531 return result;
1532 }
1533
1534 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1535 SMB_STRUCT_STAT *sbuf)
1536 {
1537 int result;
1538
1539 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1540
1541 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1542 fsp_str_do_log(fsp));
1543
1544 return result;
1545 }
1546
1547 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1548 struct smb_filename *smb_fname)
1549 {
1550 int result;
1551
1552 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1553
1554 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1555 smb_fname_str_do_log(handle->conn, smb_fname));
1556
1557 return result;
1558 }
1559
1560 static int smb_full_audit_fstatat(
1561 struct vfs_handle_struct *handle,
1562 const struct files_struct *dirfsp,
1563 const struct smb_filename *smb_fname,
1564 SMB_STRUCT_STAT *sbuf,
1565 int flags)
1566 {
1567 int result;
1568
1569 result = SMB_VFS_NEXT_FSTATAT(handle, dirfsp, smb_fname, sbuf, flags);
1570
1571 do_log(SMB_VFS_OP_FSTATAT,
1572 (result >= 0),
1573 handle,
1574 "%s/%s",
1575 fsp_str_do_log(dirfsp),
1576 smb_fname_str_do_log(handle->conn, smb_fname));
1577
1578 return result;
1579 }
1580 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1581 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1582 {
1583 uint64_t result;
1584
1585 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1586
1587 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1588 "%llu", (unsigned long long)result);
1589
1590 return result;
1591 }
1592
1593 static int smb_full_audit_unlinkat(vfs_handle_struct *handle,
1594 struct files_struct *dirfsp,
1595 const struct smb_filename *smb_fname,
1596 int flags)
1597 {
1598 struct smb_filename *full_fname = NULL;
1599 int result;
1600
1601 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1602 dirfsp,
1603 smb_fname);
1604 if (full_fname == NULL) {
1605 return -1;
1606 }
1607
1608 result = SMB_VFS_NEXT_UNLINKAT(handle,
1609 dirfsp,
1610 smb_fname,
1611 flags);
1612
1613 do_log(SMB_VFS_OP_UNLINKAT, (result >= 0), handle, "%s",
1614 smb_fname_str_do_log(handle->conn, full_fname));
1615
1616 TALLOC_FREE(full_fname);
1617 return result;
1618 }
1619
1620 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1621 mode_t mode)
1622 {
1623 int result;
1624
1625 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1626
1627 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1628 "%s|%o", fsp_str_do_log(fsp), mode);
1629
1630 return result;
1631 }
1632
1633 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1634 uid_t uid, gid_t gid)
1635 {
1636 int result;
1637
1638 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1639
1640 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1641 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1642
1643 return result;
1644 }
1645
1646 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1647 const struct smb_filename *smb_fname,
1648 uid_t uid,
1649 gid_t gid)
1650 {
1651 int result;
1652
1653 result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1654
1655 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1656 smb_fname->base_name, (long int)uid, (long int)gid);
1657
1658 return result;
1659 }
1660
1661 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1662 const struct smb_filename *smb_fname)
1663 {
1664 int result;
1665
1666 result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1667
1668 do_log(SMB_VFS_OP_CHDIR,
1669 (result >= 0),
1670 handle,
1671 "chdir|%s",
1672 smb_fname_str_do_log(handle->conn, smb_fname));
1673
1674 return result;
1675 }
1676
1677 static struct smb_filename *smb_full_audit_getwd(vfs_handle_struct *handle,
1678 TALLOC_CTX *ctx)
1679 {
1680 struct smb_filename *result;
1681
1682 result = SMB_VFS_NEXT_GETWD(handle, ctx);
1683
1684 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1685 result == NULL? "" : result->base_name);
1686
1687 return result;
1688 }
1689
1690 static int smb_full_audit_fntimes(vfs_handle_struct *handle,
1691 files_struct *fsp,
1692 struct smb_file_time *ft)
1693 {
1694 int result;
1695 time_t create_time = convert_timespec_to_time_t(ft->create_time);
1696 time_t atime = convert_timespec_to_time_t(ft->atime);
1697 time_t mtime = convert_timespec_to_time_t(ft->mtime);
1698 time_t ctime = convert_timespec_to_time_t(ft->ctime);
1699 const char *create_time_str = "";
1700 const char *atime_str = "";
1701 const char *mtime_str = "";
1702 const char *ctime_str = "";
1703 TALLOC_CTX *frame = talloc_stackframe();
1704
1705 if (frame == NULL) {
1706 errno = ENOMEM;
1707 return -1;
1708 }
1709
1710 result = SMB_VFS_NEXT_FNTIMES(handle, fsp, ft);
1711
1712 if (create_time > 0) {
1713 create_time_str = timestring(frame, create_time);
1714 }
1715 if (atime > 0) {
1716 atime_str = timestring(frame, atime);
1717 }
1718 if (mtime > 0) {
1719 mtime_str = timestring(frame, mtime);
1720 }
1721 if (ctime > 0) {
1722 ctime_str = timestring(frame, ctime);
1723 }
1724
1725 do_log(SMB_VFS_OP_FNTIMES,
1726 (result >= 0),
1727 handle,
1728 "%s|%s|%s|%s|%s",
1729 fsp_str_do_log(fsp),
1730 create_time_str,
1731 atime_str,
1732 mtime_str,
1733 ctime_str);
1734
1735 TALLOC_FREE(frame);
1736
1737 return result;
1738 }
1739
1740 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1741 off_t len)
1742 {
1743 int result;
1744
1745 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1746
1747 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1748 "%s", fsp_str_do_log(fsp));
1749
1750 return result;
1751 }
1752
1753 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1754 uint32_t mode,
1755 off_t offset,
1756 off_t len)
1757 {
1758 int result;
1759
1760 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1761
1762 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1763 "%s", fsp_str_do_log(fsp));
1764
1765 return result;
1766 }
1767
1768 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1769 int op, off_t offset, off_t count, int type)
1770 {
1771 bool result;
1772
1773 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1774
1775 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1776
1777 return result;
1778 }
1779
1780 static int smb_full_audit_filesystem_sharemode(struct vfs_handle_struct *handle,
1781 struct files_struct *fsp,
1782 uint32_t share_access,
1783 uint32_t access_mask)
1784 {
1785 int result;
1786
1787 result = SMB_VFS_NEXT_FILESYSTEM_SHAREMODE(handle,
1788 fsp,
1789 share_access,
1790 access_mask);
1791
1792 do_log(SMB_VFS_OP_FILESYSTEM_SHAREMODE, (result >= 0), handle, "%s",
1793 fsp_str_do_log(fsp));
1794
1795 return result;
1796 }
1797
1798 static int smb_full_audit_fcntl(struct vfs_handle_struct *handle,
1799 struct files_struct *fsp,
1800 int cmd, va_list cmd_arg)
1801 {
1802 void *arg;
1803 va_list dup_cmd_arg;
1804 int result;
1805
1806 va_copy(dup_cmd_arg, cmd_arg);
1807 arg = va_arg(dup_cmd_arg, void *);
1808 result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1809 va_end(dup_cmd_arg);
1810
1811 do_log(SMB_VFS_OP_FCNTL, (result >= 0), handle, "%s",
1812 fsp_str_do_log(fsp));
1813
1814 return result;
1815 }
1816
1817 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1818 int leasetype)
1819 {
1820 int result;
1821
1822 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1823
1824 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1825 fsp_str_do_log(fsp));
1826
1827 return result;
1828 }
1829
1830 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1831 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1832 {
1833 bool result;
1834
1835 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1836
1837 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1838
1839 return result;
1840 }
1841
1842 static int smb_full_audit_symlinkat(vfs_handle_struct *handle,
1843 const struct smb_filename *link_contents,
1844 struct files_struct *dirfsp,
1845 const struct smb_filename *new_smb_fname)
1846 {
1847 struct smb_filename *full_fname = NULL;
1848 int result;
1849
1850 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1851 dirfsp,
1852 new_smb_fname);
1853 if (full_fname == NULL) {
1854 return -1;
1855 }
1856
1857 result = SMB_VFS_NEXT_SYMLINKAT(handle,
1858 link_contents,
1859 dirfsp,
1860 new_smb_fname);
1861
1862 do_log(SMB_VFS_OP_SYMLINKAT,
1863 (result >= 0),
1864 handle,
1865 "%s|%s",
1866 link_contents->base_name,
1867 smb_fname_str_do_log(handle->conn, full_fname));
1868
1869 TALLOC_FREE(full_fname);
1870
1871 return result;
1872 }
1873
1874 static int smb_full_audit_readlinkat(vfs_handle_struct *handle,
1875 const struct files_struct *dirfsp,
1876 const struct smb_filename *smb_fname,
1877 char *buf,
1878 size_t bufsiz)
1879 {
1880 struct smb_filename *full_fname = NULL;
1881 int result;
1882
1883 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1884 dirfsp,
1885 smb_fname);
1886 if (full_fname == NULL) {
1887 return -1;
1888 }
1889
1890 result = SMB_VFS_NEXT_READLINKAT(handle,
1891 dirfsp,
1892 smb_fname,
1893 buf,
1894 bufsiz);
1895
1896 do_log(SMB_VFS_OP_READLINKAT,
1897 (result >= 0),
1898 handle,
1899 "%s",
1900 smb_fname_str_do_log(handle->conn, full_fname));
1901
1902 TALLOC_FREE(full_fname);
1903
1904 return result;
1905 }
1906
1907 static int smb_full_audit_linkat(vfs_handle_struct *handle,
1908 files_struct *srcfsp,
1909 const struct smb_filename *old_smb_fname,
1910 files_struct *dstfsp,
1911 const struct smb_filename *new_smb_fname,
1912 int flags)
1913 {
1914 struct smb_filename *old_full_fname = NULL;
1915 struct smb_filename *new_full_fname = NULL;
1916 int result;
1917
1918 old_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1919 srcfsp,
1920 old_smb_fname);
1921 if (old_full_fname == NULL) {
1922 return -1;
1923 }
1924 new_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1925 dstfsp,
1926 new_smb_fname);
1927 if (new_full_fname == NULL) {
1928 TALLOC_FREE(old_full_fname);
1929 return -1;
1930 }
1931 result = SMB_VFS_NEXT_LINKAT(handle,
1932 srcfsp,
1933 old_smb_fname,
1934 dstfsp,
1935 new_smb_fname,
1936 flags);
1937
1938 do_log(SMB_VFS_OP_LINKAT,
1939 (result >= 0),
1940 handle,
1941 "%s|%s",
1942 smb_fname_str_do_log(handle->conn, old_full_fname),
1943 smb_fname_str_do_log(handle->conn, new_full_fname));
1944
1945 TALLOC_FREE(old_full_fname);
1946 TALLOC_FREE(new_full_fname);
1947
1948 return result;
1949 }
1950
1951 static int smb_full_audit_mknodat(vfs_handle_struct *handle,
1952 files_struct *dirfsp,
1953 const struct smb_filename *smb_fname,
1954 mode_t mode,
1955 SMB_DEV_T dev)
1956 {
1957 struct smb_filename *full_fname = NULL;
1958 int result;
1959
1960 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1961 dirfsp,
1962 smb_fname);
1963 if (full_fname == NULL) {
1964 return -1;
1965 }
1966
1967 result = SMB_VFS_NEXT_MKNODAT(handle,
1968 dirfsp,
1969 smb_fname,
1970 mode,
1971 dev);
1972
1973 do_log(SMB_VFS_OP_MKNODAT,
1974 (result >= 0),
1975 handle,
1976 "%s",
1977 smb_fname_str_do_log(handle->conn, full_fname));
1978
1979 TALLOC_FREE(full_fname);
1980
1981 return result;
1982 }
1983
1984 static struct smb_filename *smb_full_audit_realpath(vfs_handle_struct *handle,
1985 TALLOC_CTX *ctx,
1986 const struct smb_filename *smb_fname)
1987 {
1988 struct smb_filename *result_fname = NULL;
1989
1990 result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1991
1992 do_log(SMB_VFS_OP_REALPATH,
1993 (result_fname != NULL),
1994 handle,
1995 "%s",
1996 smb_fname_str_do_log(handle->conn, smb_fname));
1997
1998 return result_fname;
1999 }
2000
2001 static int smb_full_audit_fchflags(vfs_handle_struct *handle,
2002 struct files_struct *fsp,
2003 unsigned int flags)
2004 {
2005 int result;
2006
2007 result = SMB_VFS_NEXT_FCHFLAGS(handle, fsp, flags);
2008
2009 do_log(SMB_VFS_OP_FCHFLAGS,
2010 (result != 0),
2011 handle,
2012 "%s",
2013 smb_fname_str_do_log(handle->conn, fsp->fsp_name));
2014
2015 return result;
2016 }
2017
2018 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
2019 const SMB_STRUCT_STAT *sbuf)
2020 {
2021 struct file_id id_zero = { 0 };
2022 struct file_id result;
2023 struct file_id_buf idbuf;
2024
2025 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
2026
2027 do_log(SMB_VFS_OP_FILE_ID_CREATE,
2028 !file_id_equal(&id_zero, &result),
2029 handle,
2030 "%s",
2031 file_id_str_buf(result, &idbuf));
2032
2033 return result;
2034 }
2035
2036 static uint64_t smb_full_audit_fs_file_id(struct vfs_handle_struct *handle,
2037 const SMB_STRUCT_STAT *sbuf)
2038 {
2039 uint64_t result;
2040
2041 result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
2042
2043 do_log(SMB_VFS_OP_FS_FILE_ID,
2044 result != 0,
2045 handle, "%" PRIu64, result);
2046
2047 return result;
2048 }
2049
2050 static NTSTATUS smb_full_audit_fstreaminfo(vfs_handle_struct *handle,
2051 struct files_struct *fsp,
2052 TALLOC_CTX *mem_ctx,
2053 unsigned int *pnum_streams,
2054 struct stream_struct **pstreams)
2055 {
2056 NTSTATUS result;
2057
2058 result = SMB_VFS_NEXT_FSTREAMINFO(handle, fsp, mem_ctx,
2059 pnum_streams, pstreams);
2060
2061 do_log(SMB_VFS_OP_FSTREAMINFO,
2062 NT_STATUS_IS_OK(result),
2063 handle,
2064 "%s",
2065 smb_fname_str_do_log(handle->conn, fsp->fsp_name));
2066
2067 return result;
2068 }
2069
2070 static NTSTATUS smb_full_audit_get_real_filename_at(
2071 struct vfs_handle_struct *handle,
2072 struct files_struct *dirfsp,
2073 const char *name,
2074 TALLOC_CTX *mem_ctx,
2075 char **found_name)
2076 {
2077 NTSTATUS result;
2078
2079 result = SMB_VFS_NEXT_GET_REAL_FILENAME_AT(
2080 handle, dirfsp, name, mem_ctx, found_name);
2081
2082 do_log(SMB_VFS_OP_GET_REAL_FILENAME_AT,
2083 NT_STATUS_IS_OK(result),
2084 handle,
2085 "%s/%s->%s",
2086 fsp_str_dbg(dirfsp),
2087 name,
2088 NT_STATUS_IS_OK(result) ? *found_name : "");
2089
2090 return result;
2091 }
2092
2093 static const char *smb_full_audit_connectpath(
2094 vfs_handle_struct *handle,
2095 const struct files_struct *dirfsp,
2096 const struct smb_filename *smb_fname)
2097 {
2098 const char *result;
2099
2100 result = SMB_VFS_NEXT_CONNECTPATH(handle, dirfsp, smb_fname);
2101
2102 do_log(SMB_VFS_OP_CONNECTPATH,
2103 result != NULL,
2104 handle,
2105 "%s",
2106 smb_fname_str_do_log(handle->conn, smb_fname));
2107
2108 return result;
2109 }
2110
2111 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
2112 struct byte_range_lock *br_lck,
2113 struct lock_struct *plock)
2114 {
2115 NTSTATUS result;
2116
2117 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
2118
2119 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
2120 "%s:%llu-%llu. type=%d.",
2121 fsp_str_do_log(brl_fsp(br_lck)),
2122 (unsigned long long)plock->start,
2123 (unsigned long long)plock->size,
2124 plock->lock_type);
2125
2126 return result;
2127 }
2128
2129 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
2130 struct byte_range_lock *br_lck,
2131 const struct lock_struct *plock)
2132 {
2133 bool result;
2134
2135 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
2136
2137 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
2138 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
2139 (unsigned long long)plock->start,
2140 (unsigned long long)plock->size,
2141 plock->lock_type);
2142
2143 return result;
2144 }
2145
2146 static bool smb_full_audit_strict_lock_check(struct vfs_handle_struct *handle,
2147 struct files_struct *fsp,
2148 struct lock_struct *plock)
2149 {
2150 bool result;
2151
2152 result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
2153
2154 do_log(SMB_VFS_OP_STRICT_LOCK_CHECK, result, handle,
2155 "%s:%llu-%llu:%d", fsp_str_do_log(fsp),
2156 (unsigned long long)plock->start,
2157 (unsigned long long)plock->size,
2158 plock->lock_type);
2159
2160 return result;
2161 }
2162
2163 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
2164 const char *name,
2165 enum vfs_translate_direction direction,
2166 TALLOC_CTX *mem_ctx,
2167 char **mapped_name)
2168 {
2169 NTSTATUS result;
2170
2171 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
2172 mapped_name);
2173
2174 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
2175
2176 return result;
2177 }
2178
2179 static NTSTATUS smb_full_audit_parent_pathname(struct vfs_handle_struct *handle,
2180 TALLOC_CTX *mem_ctx,
2181 const struct smb_filename *smb_fname_in,
2182 struct smb_filename **parent_dir_out,
2183 struct smb_filename **atname_out)
2184 {
2185 NTSTATUS result;
2186
2187 result = SMB_VFS_NEXT_PARENT_PATHNAME(handle,
2188 mem_ctx,
2189 smb_fname_in,
2190 parent_dir_out,
2191 atname_out);
2192 do_log(SMB_VFS_OP_CONNECTPATH,
2193 NT_STATUS_IS_OK(result),
2194 handle,
2195 "%s",
2196 smb_fname_str_do_log(handle->conn, smb_fname_in));
2197
2198 return result;
2199 }
2200
2201 static NTSTATUS smb_full_audit_fsctl(struct vfs_handle_struct *handle,
2202 struct files_struct *fsp,
2203 TALLOC_CTX *ctx,
2204 uint32_t function,
2205 uint16_t req_flags,
2206 const uint8_t *_in_data,
2207 uint32_t in_len,
2208 uint8_t **_out_data,
2209 uint32_t max_out_len,
2210 uint32_t *out_len)
2211 {
2212 NTSTATUS result;
2213
2214 result = SMB_VFS_NEXT_FSCTL(handle,
2215 fsp,
2216 ctx,
2217 function,
2218 req_flags,
2219 _in_data,
2220 in_len,
2221 _out_data,
2222 max_out_len,
2223 out_len);
2224
2225 do_log(SMB_VFS_OP_FSCTL, NT_STATUS_IS_OK(result), handle, "");
2226
2227 return result;
2228 }
2229
2230 static struct tevent_req *smb_full_audit_offload_read_send(
2231 TALLOC_CTX *mem_ctx,
2232 struct tevent_context *ev,
2233 struct vfs_handle_struct *handle,
2234 struct files_struct *fsp,
2235 uint32_t fsctl,
2236 uint32_t ttl,
2237 off_t offset,
2238 size_t to_copy)
2239 {
2240 struct tevent_req *req = NULL;
2241
2242 req = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev, handle, fsp,
2243 fsctl, ttl, offset, to_copy);
2244
2245 do_log(SMB_VFS_OP_OFFLOAD_READ_SEND, req, handle, "");
2246
2247 return req;
2248 }
2249
2250 static NTSTATUS smb_full_audit_offload_read_recv(
2251 struct tevent_req *req,
2252 struct vfs_handle_struct *handle,
2253 TALLOC_CTX *mem_ctx,
2254 uint32_t *flags,
2255 uint64_t *xferlen,
2256 DATA_BLOB *_token_blob)
2257 {
2258 NTSTATUS status;
2259
2260 status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(req, handle, mem_ctx,
2261 flags, xferlen, _token_blob);
2262
2263 do_log(SMB_VFS_OP_OFFLOAD_READ_RECV, NT_STATUS_IS_OK(status), handle, "");
2264
2265 return status;
2266 }
2267
2268 static struct tevent_req *smb_full_audit_offload_write_send(struct vfs_handle_struct *handle,
2269 TALLOC_CTX *mem_ctx,
2270 struct tevent_context *ev,
2271 uint32_t fsctl,
2272 DATA_BLOB *token,
2273 off_t transfer_offset,
2274 struct files_struct *dest_fsp,
2275 off_t dest_off,
2276 off_t num)
2277 {
2278 struct tevent_req *req;
2279
2280 req = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, mem_ctx, ev,
2281 fsctl, token, transfer_offset,
2282 dest_fsp, dest_off, num);
2283
2284 do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND, req, handle, "");
2285
2286 return req;
2287 }
2288
2289 static NTSTATUS smb_full_audit_offload_write_recv(struct vfs_handle_struct *handle,
2290 struct tevent_req *req,
2291 off_t *copied)
2292 {
2293 NTSTATUS result;
2294
2295 result = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle, req, copied);
2296
2297 do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV, NT_STATUS_IS_OK(result), handle, "");
2298
2299 return result;
2300 }
2301
2302 static NTSTATUS smb_full_audit_fget_compression(vfs_handle_struct *handle,
2303 TALLOC_CTX *mem_ctx,
2304 struct files_struct *fsp,
2305 uint16_t *_compression_fmt)
2306 {
2307 NTSTATUS result;
2308
2309 result = SMB_VFS_NEXT_FGET_COMPRESSION(handle, mem_ctx, fsp,
2310 _compression_fmt);
2311
2312 do_log(SMB_VFS_OP_FGET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2313 "%s",
2314 fsp_str_do_log(fsp));
2315
2316 return result;
2317 }
2318
2319 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
2320 TALLOC_CTX *mem_ctx,
2321 struct files_struct *fsp,
2322 uint16_t compression_fmt)
2323 {
2324 NTSTATUS result;
2325
2326 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2327 compression_fmt);
2328
2329 do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2330 "%s", fsp_str_do_log(fsp));
2331
2332 return result;
2333 }
2334
2335 static NTSTATUS smb_full_audit_freaddir_attr(struct vfs_handle_struct *handle,
2336 struct files_struct *fsp,
2337 TALLOC_CTX *mem_ctx,
2338 struct readdir_attr_data **pattr_data)
2339 {
2340 NTSTATUS status;
2341
2342 status = SMB_VFS_NEXT_FREADDIR_ATTR(handle, fsp, mem_ctx, pattr_data);
2343
2344 do_log(SMB_VFS_OP_FREADDIR_ATTR,
2345 NT_STATUS_IS_OK(status),
2346 handle,
2347 "%s",
2348 fsp_str_do_log(fsp));
2349
2350 return status;
2351 }
2352
2353 struct smb_full_audit_get_dos_attributes_state {
2354 struct vfs_aio_state aio_state;
2355 vfs_handle_struct *handle;
2356 files_struct *dir_fsp;
2357 const struct smb_filename *smb_fname;
2358 uint32_t dosmode;
2359 };
2360
2361 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq);
2362
2363 static struct tevent_req *smb_full_audit_get_dos_attributes_send(
2364 TALLOC_CTX *mem_ctx,
2365 struct tevent_context *ev,
2366 struct vfs_handle_struct *handle,
2367 files_struct *dir_fsp,
2368 struct smb_filename *smb_fname)
2369 {
2370 struct tevent_req *req = NULL;
2371 struct smb_full_audit_get_dos_attributes_state *state = NULL;
2372 struct tevent_req *subreq = NULL;
2373
2374 req = tevent_req_create(mem_ctx, &state,
2375 struct smb_full_audit_get_dos_attributes_state);
2376 if (req == NULL) {
2377 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2378 false,
2379 handle,
2380 "%s/%s",
2381 fsp_str_do_log(dir_fsp),
2382 smb_fname->base_name);
2383 return NULL;
2384 }
2385 *state = (struct smb_full_audit_get_dos_attributes_state) {
2386 .handle = handle,
2387 .dir_fsp = dir_fsp,
2388 .smb_fname = smb_fname,
2389 };
2390
2391 subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
2392 ev,
2393 handle,
2394 dir_fsp,
2395 smb_fname);
2396 if (tevent_req_nomem(subreq, req)) {
2397 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2398 false,
2399 handle,
2400 "%s/%s",
2401 fsp_str_do_log(dir_fsp),
2402 smb_fname->base_name);
2403 return tevent_req_post(req, ev);
2404 }
2405 tevent_req_set_callback(subreq,
2406 smb_full_audit_get_dos_attributes_done,
2407 req);
2408
2409 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2410 true,
2411 handle,
2412 "%s/%s",
2413 fsp_str_do_log(dir_fsp),
2414 smb_fname->base_name);
2415
2416 return req;
2417 }
2418
2419 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq)
2420 {
2421 struct tevent_req *req =
2422 tevent_req_callback_data(subreq,
2423 struct tevent_req);
2424 struct smb_full_audit_get_dos_attributes_state *state =
2425 tevent_req_data(req,
2426 struct smb_full_audit_get_dos_attributes_state);
2427 NTSTATUS status;
2428
2429 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
2430 &state->aio_state,
2431 &state->dosmode);
2432 TALLOC_FREE(subreq);
2433 if (tevent_req_nterror(req, status)) {
2434 return;
2435 }
2436
2437 tevent_req_done(req);
2438 return;
2439 }
2440
2441 static NTSTATUS smb_full_audit_get_dos_attributes_recv(struct tevent_req *req,
2442 struct vfs_aio_state *aio_state,
2443 uint32_t *dosmode)
2444 {
2445 struct smb_full_audit_get_dos_attributes_state *state =
2446 tevent_req_data(req,
2447 struct smb_full_audit_get_dos_attributes_state);
2448 NTSTATUS status;
2449
2450 if (tevent_req_is_nterror(req, &status)) {
2451 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2452 false,
2453 state->handle,
2454 "%s/%s",
2455 fsp_str_do_log(state->dir_fsp),
2456 state->smb_fname->base_name);
2457 tevent_req_received(req);
2458 return status;
2459 }
2460
2461 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2462 true,
2463 state->handle,
2464 "%s/%s",
2465 fsp_str_do_log(state->dir_fsp),
2466 state->smb_fname->base_name);
2467
2468 *aio_state = state->aio_state;
2469 *dosmode = state->dosmode;
2470 tevent_req_received(req);
2471 return NT_STATUS_OK;
2472 }
2473
2474 static NTSTATUS smb_full_audit_fget_dos_attributes(
2475 struct vfs_handle_struct *handle,
2476 struct files_struct *fsp,
2477 uint32_t *dosmode)
2478 {
2479 NTSTATUS status;
2480
2481 status = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
2482 fsp,
2483 dosmode);
2484
2485 do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
2486 NT_STATUS_IS_OK(status),
2487 handle,
2488 "%s",
2489 fsp_str_do_log(fsp));
2490
2491 return status;
2492 }
2493
2494 static NTSTATUS smb_full_audit_fset_dos_attributes(
2495 struct vfs_handle_struct *handle,
2496 struct files_struct *fsp,
2497 uint32_t dosmode)
2498 {
2499 NTSTATUS status;
2500
2501 status = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2502 fsp,
2503 dosmode);
2504
2505 do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
2506 NT_STATUS_IS_OK(status),
2507 handle,
2508 "%s",
2509 fsp_str_do_log(fsp));
2510
2511 return status;
2512 }
2513
2514 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2515 uint32_t security_info,
2516 TALLOC_CTX *mem_ctx,
2517 struct security_descriptor **ppdesc)
2518 {
2519 NTSTATUS result;
2520
2521 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2522 mem_ctx, ppdesc);
2523
2524 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2525 "%s", fsp_str_do_log(fsp));
2526
2527 return result;
2528 }
2529
2530 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2531 uint32_t security_info_sent,
2532 const struct security_descriptor *psd)
2533 {
2534 struct vfs_full_audit_private_data *pd;
2535 NTSTATUS result;
2536 char *sd = NULL;
2537
2538 SMB_VFS_HANDLE_GET_DATA(handle, pd,
2539 struct vfs_full_audit_private_data,
2540 return NT_STATUS_INTERNAL_ERROR);
2541
2542 if (pd->log_secdesc) {
2543 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
2544 }
2545
2546 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
2547
2548 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2549 "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
2550
2551 TALLOC_FREE(sd);
2552
2553 return result;
2554 }
2555
2556 static NTSTATUS smb_full_audit_audit_file(struct vfs_handle_struct *handle,
2557 struct smb_filename *file,
2558 struct security_acl *sacl,
2559 uint32_t access_requested,
2560 uint32_t access_denied)
2561 {
2562 NTSTATUS result;
2563
2564 result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2565 file,
2566 sacl,
2567 access_requested,
2568 access_denied);
2569
2570 do_log(SMB_VFS_OP_AUDIT_FILE, NT_STATUS_IS_OK(result), handle,
2571 "%s",
2572 smb_fname_str_do_log(handle->conn, file));
2573
2574 return result;
2575 }
2576
2577 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2578 files_struct *fsp,
2579 SMB_ACL_TYPE_T type,
2580 TALLOC_CTX *mem_ctx)
2581 {
2582 SMB_ACL_T result;
2583
2584 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle,
2585 fsp,
2586 type,
2587 mem_ctx);
2588
2589 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2590 "%s", fsp_str_do_log(fsp));
2591
2592 return result;
2593 }
2594
2595 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2596 files_struct *fsp,
2597 TALLOC_CTX *mem_ctx,
2598 char **blob_description,
2599 DATA_BLOB *blob)
2600 {
2601 int result;
2602
2603 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2604
2605 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2606 "%s", fsp_str_do_log(fsp));
2607
2608 return result;
2609 }
2610
2611 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2612 struct files_struct *fsp,
2613 SMB_ACL_TYPE_T type,
2614 SMB_ACL_T theacl)
2615 {
2616 int result;
2617
2618 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, type, theacl);
2619
2620 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2621 "%s", fsp_str_do_log(fsp));
2622
2623 return result;
2624 }
2625
2626 static int smb_full_audit_sys_acl_delete_def_fd(vfs_handle_struct *handle,
2627 struct files_struct *fsp)
2628 {
2629 int result;
2630
2631 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FD(handle, fsp);
2632
2633 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD,
2634 (result >= 0),
2635 handle,
2636 "%s",
2637 fsp_str_do_log(fsp));
2638
2639 return result;
2640 }
2641
2642 struct smb_full_audit_getxattrat_state {
2643 struct vfs_aio_state aio_state;
2644 vfs_handle_struct *handle;
2645 files_struct *dir_fsp;
2646 const struct smb_filename *smb_fname;
2647 const char *xattr_name;
2648 ssize_t xattr_size;
2649 uint8_t *xattr_value;
2650 };
2651
2652 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq);
2653
2654 static struct tevent_req *smb_full_audit_getxattrat_send(
2655 TALLOC_CTX *mem_ctx,
2656 struct tevent_context *ev,
2657 struct vfs_handle_struct *handle,
2658 files_struct *dir_fsp,
2659 const struct smb_filename *smb_fname,
2660 const char *xattr_name,
2661 size_t alloc_hint)
2662 {
2663 struct tevent_req *req = NULL;
2664 struct tevent_req *subreq = NULL;
2665 struct smb_full_audit_getxattrat_state *state = NULL;
2666
2667 req = tevent_req_create(mem_ctx, &state,
2668 struct smb_full_audit_getxattrat_state);
2669 if (req == NULL) {
2670 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2671 false,
2672 handle,
2673 "%s/%s|%s",
2674 fsp_str_do_log(dir_fsp),
2675 smb_fname->base_name,
2676 xattr_name);
2677 return NULL;
2678 }
2679 *state = (struct smb_full_audit_getxattrat_state) {
2680 .handle = handle,
2681 .dir_fsp = dir_fsp,
2682 .smb_fname = smb_fname,
2683 .xattr_name = xattr_name,
2684 };
2685
2686 subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2687 ev,
2688 handle,
2689 dir_fsp,
2690 smb_fname,
2691 xattr_name,
2692 alloc_hint);
2693 if (tevent_req_nomem(subreq, req)) {
2694 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2695 false,
2696 handle,
2697 "%s/%s|%s",
2698 fsp_str_do_log(dir_fsp),
2699 smb_fname->base_name,
2700 xattr_name);
2701 return tevent_req_post(req, ev);
2702 }
2703 tevent_req_set_callback(subreq, smb_full_audit_getxattrat_done, req);
2704
2705 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2706 true,
2707 handle,
2708 "%s/%s|%s",
2709 fsp_str_do_log(dir_fsp),
2710 smb_fname->base_name,
2711 xattr_name);
2712
2713 return req;
2714 }
2715
2716 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq)
2717 {
2718 struct tevent_req *req = tevent_req_callback_data(
2719 subreq, struct tevent_req);
2720 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2721 req, struct smb_full_audit_getxattrat_state);
2722
2723 state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2724 &state->aio_state,
2725 state,
2726 &state->xattr_value);
2727 TALLOC_FREE(subreq);
2728 if (state->xattr_size == -1) {
2729 tevent_req_error(req, state->aio_state.error);
2730 return;
2731 }
2732
2733 tevent_req_done(req);
2734 }
2735
2736 static ssize_t smb_full_audit_getxattrat_recv(struct tevent_req *req,
2737 struct vfs_aio_state *aio_state,
2738 TALLOC_CTX *mem_ctx,
2739 uint8_t **xattr_value)
2740 {
2741 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2742 req, struct smb_full_audit_getxattrat_state);
2743 ssize_t xattr_size;
2744
2745 if (tevent_req_is_unix_error(req, &aio_state->error)) {
2746 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2747 false,
2748 state->handle,
2749 "%s/%s|%s",
2750 fsp_str_do_log(state->dir_fsp),
2751 state->smb_fname->base_name,
2752 state->xattr_name);
2753 tevent_req_received(req);
2754 return -1;
2755 }
2756
2757 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2758 true,
2759 state->handle,
2760 "%s/%s|%s",
2761 fsp_str_do_log(state->dir_fsp),
2762 state->smb_fname->base_name,
2763 state->xattr_name);
2764
2765 *aio_state = state->aio_state;
2766 xattr_size = state->xattr_size;
2767 if (xattr_value != NULL) {
2768 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2769 }
2770
2771 tevent_req_received(req);
2772 return xattr_size;
2773 }
2774
2775 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2776 struct files_struct *fsp,
2777 const char *name, void *value, size_t size)
2778 {
2779 ssize_t result;
2780
2781 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2782
2783 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2784 "%s|%s", fsp_str_do_log(fsp), name);
2785
2786 return result;
2787 }
2788
2789 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2790 struct files_struct *fsp, char *list,
2791 size_t size)
2792 {
2793 ssize_t result;
2794
2795 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2796
2797 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2798 "%s", fsp_str_do_log(fsp));
2799
2800 return result;
2801 }
2802
2803 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2804 struct files_struct *fsp,
2805 const char *name)
2806 {
2807 int result;
2808
2809 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2810
2811 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2812 "%s|%s", fsp_str_do_log(fsp), name);
2813
2814 return result;
2815 }
2816
2817 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2818 struct files_struct *fsp, const char *name,
2819 const void *value, size_t size, int flags)
2820 {
2821 int result;
2822
2823 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2824
2825 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2826 "%s|%s", fsp_str_do_log(fsp), name);
2827
2828 return result;
2829 }
2830
2831 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2832 struct files_struct *fsp)
2833 {
2834 bool result;
2835
2836 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2837 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2838 "%s", fsp_str_do_log(fsp));
2839
2840 return result;
2841 }
2842
2843 static NTSTATUS smb_full_audit_durable_cookie(struct vfs_handle_struct *handle,
2844 struct files_struct *fsp,
2845 TALLOC_CTX *mem_ctx,
2846 DATA_BLOB *cookie)
2847 {
2848 NTSTATUS result;
2849
2850 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle,
2851 fsp,
2852 mem_ctx,
2853 cookie);
2854
2855 do_log(SMB_VFS_OP_DURABLE_COOKIE, NT_STATUS_IS_OK(result), handle,
2856 "%s", fsp_str_do_log(fsp));
2857
2858 return result;
2859 }
2860
2861 static NTSTATUS smb_full_audit_durable_disconnect(
2862 struct vfs_handle_struct *handle,
2863 struct files_struct *fsp,
2864 const DATA_BLOB old_cookie,
2865 TALLOC_CTX *mem_ctx,
2866 DATA_BLOB *new_cookie)
2867 {
2868 NTSTATUS result;
2869
2870 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle,
2871 fsp,
2872 old_cookie,
2873 mem_ctx,
2874 new_cookie);
2875
2876 do_log(SMB_VFS_OP_DURABLE_DISCONNECT, NT_STATUS_IS_OK(result), handle,
2877 "%s", fsp_str_do_log(fsp));
2878
2879 return result;
2880 }
2881
2882 static NTSTATUS smb_full_audit_durable_reconnect(
2883 struct vfs_handle_struct *handle,
2884 struct smb_request *smb1req,
2885 struct smbXsrv_open *op,
2886 const DATA_BLOB old_cookie,
2887 TALLOC_CTX *mem_ctx,
2888 struct files_struct **fsp,
2889 DATA_BLOB *new_cookie)
2890 {
2891 NTSTATUS result;
2892
2893 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle,
2894 smb1req,
2895 op,
2896 old_cookie,
2897 mem_ctx,
2898 fsp,
2899 new_cookie);
2900
2901 do_log(SMB_VFS_OP_DURABLE_RECONNECT,
2902 NT_STATUS_IS_OK(result),
2903 handle,
2904 "");
2905
2906 return result;
2907 }
2908
2909 static struct vfs_fn_pointers vfs_full_audit_fns = {
2910
2911 /* Disk operations */
2912
2913 .connect_fn = smb_full_audit_connect,
2914 .disconnect_fn = smb_full_audit_disconnect,
2915 .disk_free_fn = smb_full_audit_disk_free,
2916 .get_quota_fn = smb_full_audit_get_quota,
2917 .set_quota_fn = smb_full_audit_set_quota,
2918 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2919 .statvfs_fn = smb_full_audit_statvfs,
2920 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2921 .get_dfs_referrals_fn = smb_full_audit_get_dfs_referrals,
2922 .create_dfs_pathat_fn = smb_full_audit_create_dfs_pathat,
2923 .read_dfs_pathat_fn = smb_full_audit_read_dfs_pathat,
2924 .fdopendir_fn = smb_full_audit_fdopendir,
2925 .readdir_fn = smb_full_audit_readdir,
2926 .rewind_dir_fn = smb_full_audit_rewinddir,
2927 .mkdirat_fn = smb_full_audit_mkdirat,
2928 .closedir_fn = smb_full_audit_closedir,
2929 .openat_fn = smb_full_audit_openat,
2930 .create_file_fn = smb_full_audit_create_file,
2931 .close_fn = smb_full_audit_close,
2932 .pread_fn = smb_full_audit_pread,
2933 .pread_send_fn = smb_full_audit_pread_send,
2934 .pread_recv_fn = smb_full_audit_pread_recv,
2935 .pwrite_fn = smb_full_audit_pwrite,
2936 .pwrite_send_fn = smb_full_audit_pwrite_send,
2937 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2938 .lseek_fn = smb_full_audit_lseek,
2939 .sendfile_fn = smb_full_audit_sendfile,
2940 .recvfile_fn = smb_full_audit_recvfile,
2941 .renameat_fn = smb_full_audit_renameat,
2942 .fsync_send_fn = smb_full_audit_fsync_send,
2943 .fsync_recv_fn = smb_full_audit_fsync_recv,
2944 .stat_fn = smb_full_audit_stat,
2945 .fstat_fn = smb_full_audit_fstat,
2946 .lstat_fn = smb_full_audit_lstat,
2947 .fstatat_fn = smb_full_audit_fstatat,
2948 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2949 .unlinkat_fn = smb_full_audit_unlinkat,
2950 .fchmod_fn = smb_full_audit_fchmod,
2951 .fchown_fn = smb_full_audit_fchown,
2952 .lchown_fn = smb_full_audit_lchown,
2953 .chdir_fn = smb_full_audit_chdir,
2954 .getwd_fn = smb_full_audit_getwd,
2955 .fntimes_fn = smb_full_audit_fntimes,
2956 .ftruncate_fn = smb_full_audit_ftruncate,
2957 .fallocate_fn = smb_full_audit_fallocate,
2958 .lock_fn = smb_full_audit_lock,
2959 .filesystem_sharemode_fn = smb_full_audit_filesystem_sharemode,
2960 .fcntl_fn = smb_full_audit_fcntl,
2961 .linux_setlease_fn = smb_full_audit_linux_setlease,
2962 .getlock_fn = smb_full_audit_getlock,
2963 .symlinkat_fn = smb_full_audit_symlinkat,
2964 .readlinkat_fn = smb_full_audit_readlinkat,
2965 .linkat_fn = smb_full_audit_linkat,
2966 .mknodat_fn = smb_full_audit_mknodat,
2967 .realpath_fn = smb_full_audit_realpath,
2968 .fchflags_fn = smb_full_audit_fchflags,
2969 .file_id_create_fn = smb_full_audit_file_id_create,
2970 .fs_file_id_fn = smb_full_audit_fs_file_id,
2971 .offload_read_send_fn = smb_full_audit_offload_read_send,
2972 .offload_read_recv_fn = smb_full_audit_offload_read_recv,
2973 .offload_write_send_fn = smb_full_audit_offload_write_send,
2974 .offload_write_recv_fn = smb_full_audit_offload_write_recv,
2975 .fget_compression_fn = smb_full_audit_fget_compression,
2976 .set_compression_fn = smb_full_audit_set_compression,
2977 .snap_check_path_fn = smb_full_audit_snap_check_path,
2978 .snap_create_fn = smb_full_audit_snap_create,
2979 .snap_delete_fn = smb_full_audit_snap_delete,
2980 .fstreaminfo_fn = smb_full_audit_fstreaminfo,
2981 .get_real_filename_at_fn = smb_full_audit_get_real_filename_at,
2982 .connectpath_fn = smb_full_audit_connectpath,
2983 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2984 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2985 .strict_lock_check_fn = smb_full_audit_strict_lock_check,
2986 .translate_name_fn = smb_full_audit_translate_name,
2987 .parent_pathname_fn = smb_full_audit_parent_pathname,
2988 .fsctl_fn = smb_full_audit_fsctl,
2989 .get_dos_attributes_send_fn = smb_full_audit_get_dos_attributes_send,
2990 .get_dos_attributes_recv_fn = smb_full_audit_get_dos_attributes_recv,
2991 .fget_dos_attributes_fn = smb_full_audit_fget_dos_attributes,
2992 .fset_dos_attributes_fn = smb_full_audit_fset_dos_attributes,
2993 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2994 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2995 .audit_file_fn = smb_full_audit_audit_file,
2996 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2997 .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2998 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2999 .sys_acl_delete_def_fd_fn = smb_full_audit_sys_acl_delete_def_fd,
3000 .getxattrat_send_fn = smb_full_audit_getxattrat_send,
3001 .getxattrat_recv_fn = smb_full_audit_getxattrat_recv,
3002 .fgetxattr_fn = smb_full_audit_fgetxattr,
3003 .flistxattr_fn = smb_full_audit_flistxattr,
3004 .fremovexattr_fn = smb_full_audit_fremovexattr,
3005 .fsetxattr_fn = smb_full_audit_fsetxattr,
3006 .aio_force_fn = smb_full_audit_aio_force,
3007 .durable_cookie_fn = smb_full_audit_durable_cookie,
3008 .durable_disconnect_fn = smb_full_audit_durable_disconnect,
3009 .durable_reconnect_fn = smb_full_audit_durable_reconnect,
3010 .freaddir_attr_fn = smb_full_audit_freaddir_attr,
3011 };
3012
3013 static_decl_vfs;
3014 NTSTATUS vfs_full_audit_init(TALLOC_CTX *ctx)
3015 {
3016 NTSTATUS ret;
3017
3018 smb_vfs_assert_all_fns(&vfs_full_audit_fns, "full_audit");
3019
3020 ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "full_audit",
3021 &vfs_full_audit_fns);
3022
3023 if (!NT_STATUS_IS_OK(ret))
3024 return ret;
3025
3026 vfs_full_audit_debug_level = debug_add_class("full_audit");
3027 if (vfs_full_audit_debug_level == -1) {
3028 vfs_full_audit_debug_level = DBGC_VFS;
3029 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
3030 "class!\n"));
3031 } else {
3032 DEBUG(10, ("vfs_full_audit: Debug class number of "
3033 "'full_audit': %d\n", vfs_full_audit_debug_level));
3034 }
3035
3036 return ret;
3037 }
Samba GIT mirror