2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter 1999-2000
6 * Copyright (C) Alexander Bokovoy 2002
7 * Copyright (C) Stefan (metze) Metzmacher 2002
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_VFS
29 static int audit_syslog_facility(vfs_handle_struct
*handle
)
31 static const struct enum_list enum_log_facilities
[] = {
33 { LOG_LOCAL0
, "LOCAL0" },
34 { LOG_LOCAL1
, "LOCAL1" },
35 { LOG_LOCAL2
, "LOCAL2" },
36 { LOG_LOCAL3
, "LOCAL3" },
37 { LOG_LOCAL4
, "LOCAL4" },
38 { LOG_LOCAL5
, "LOCAL5" },
39 { LOG_LOCAL6
, "LOCAL6" },
40 { LOG_LOCAL7
, "LOCAL7" }
45 facility
= lp_parm_enum(SNUM(handle
->conn
), "audit", "facility", enum_log_facilities
, LOG_USER
);
51 static int audit_syslog_priority(vfs_handle_struct
*handle
)
53 static const struct enum_list enum_log_priorities
[] = {
54 { LOG_EMERG
, "EMERG" },
55 { LOG_ALERT
, "ALERT" },
58 { LOG_WARNING
, "WARNING" },
59 { LOG_NOTICE
, "NOTICE" },
61 { LOG_DEBUG
, "DEBUG" }
66 priority
= lp_parm_enum(SNUM(handle
->conn
), "audit", "priority",
67 enum_log_priorities
, LOG_NOTICE
);
69 priority
= LOG_WARNING
;
75 /* Implementation of vfs_ops. Pass everything on to the default
76 operation but log event first. */
78 static int audit_connect(vfs_handle_struct
*handle
, const char *svc
, const char *user
)
82 openlog("smbd_audit", LOG_PID
, audit_syslog_facility(handle
));
84 syslog(audit_syslog_priority(handle
), "connect to service %s by user %s\n",
87 result
= SMB_VFS_NEXT_CONNECT(handle
, svc
, user
);
92 static void audit_disconnect(vfs_handle_struct
*handle
)
94 syslog(audit_syslog_priority(handle
), "disconnected\n");
95 SMB_VFS_NEXT_DISCONNECT(handle
);
100 static SMB_STRUCT_DIR
*audit_opendir(vfs_handle_struct
*handle
, const char *fname
, const char *mask
, uint32 attr
)
102 SMB_STRUCT_DIR
*result
;
104 result
= SMB_VFS_NEXT_OPENDIR(handle
, fname
, mask
, attr
);
106 syslog(audit_syslog_priority(handle
), "opendir %s %s%s\n",
108 (result
== NULL
) ? "failed: " : "",
109 (result
== NULL
) ? strerror(errno
) : "");
114 static int audit_mkdir(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
118 result
= SMB_VFS_NEXT_MKDIR(handle
, path
, mode
);
120 syslog(audit_syslog_priority(handle
), "mkdir %s %s%s\n",
122 (result
< 0) ? "failed: " : "",
123 (result
< 0) ? strerror(errno
) : "");
128 static int audit_rmdir(vfs_handle_struct
*handle
, const char *path
)
132 result
= SMB_VFS_NEXT_RMDIR(handle
, path
);
134 syslog(audit_syslog_priority(handle
), "rmdir %s %s%s\n",
136 (result
< 0) ? "failed: " : "",
137 (result
< 0) ? strerror(errno
) : "");
142 static int audit_open(vfs_handle_struct
*handle
,
143 struct smb_filename
*smb_fname
, files_struct
*fsp
,
144 int flags
, mode_t mode
)
148 result
= SMB_VFS_NEXT_OPEN(handle
, smb_fname
, fsp
, flags
, mode
);
150 syslog(audit_syslog_priority(handle
), "open %s (fd %d) %s%s%s\n",
151 smb_fname
->base_name
, result
,
152 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
153 (result
< 0) ? "failed: " : "",
154 (result
< 0) ? strerror(errno
) : "");
159 static int audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
)
163 result
= SMB_VFS_NEXT_CLOSE(handle
, fsp
);
165 syslog(audit_syslog_priority(handle
), "close fd %d %s%s\n",
167 (result
< 0) ? "failed: " : "",
168 (result
< 0) ? strerror(errno
) : "");
173 static int audit_rename(vfs_handle_struct
*handle
,
174 const struct smb_filename
*smb_fname_src
,
175 const struct smb_filename
*smb_fname_dst
)
179 result
= SMB_VFS_NEXT_RENAME(handle
, smb_fname_src
, smb_fname_dst
);
181 syslog(audit_syslog_priority(handle
), "rename %s -> %s %s%s\n",
182 smb_fname_src
->base_name
,
183 smb_fname_dst
->base_name
,
184 (result
< 0) ? "failed: " : "",
185 (result
< 0) ? strerror(errno
) : "");
190 static int audit_unlink(vfs_handle_struct
*handle
,
191 const struct smb_filename
*smb_fname
)
195 result
= SMB_VFS_NEXT_UNLINK(handle
, smb_fname
);
197 syslog(audit_syslog_priority(handle
), "unlink %s %s%s\n",
198 smb_fname
->base_name
,
199 (result
< 0) ? "failed: " : "",
200 (result
< 0) ? strerror(errno
) : "");
205 static int audit_chmod(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
209 result
= SMB_VFS_NEXT_CHMOD(handle
, path
, mode
);
211 syslog(audit_syslog_priority(handle
), "chmod %s mode 0x%x %s%s\n",
213 (result
< 0) ? "failed: " : "",
214 (result
< 0) ? strerror(errno
) : "");
219 static int audit_chmod_acl(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
223 result
= SMB_VFS_NEXT_CHMOD_ACL(handle
, path
, mode
);
225 syslog(audit_syslog_priority(handle
), "chmod_acl %s mode 0x%x %s%s\n",
227 (result
< 0) ? "failed: " : "",
228 (result
< 0) ? strerror(errno
) : "");
233 static int audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
237 result
= SMB_VFS_NEXT_FCHMOD(handle
, fsp
, mode
);
239 syslog(audit_syslog_priority(handle
), "fchmod %s mode 0x%x %s%s\n",
241 (result
< 0) ? "failed: " : "",
242 (result
< 0) ? strerror(errno
) : "");
247 static int audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
251 result
= SMB_VFS_NEXT_FCHMOD_ACL(handle
, fsp
, mode
);
253 syslog(audit_syslog_priority(handle
), "fchmod_acl %s mode 0x%x %s%s\n",
255 (result
< 0) ? "failed: " : "",
256 (result
< 0) ? strerror(errno
) : "");
262 static vfs_op_tuple audit_op_tuples
[] = {
264 /* Disk operations */
266 {SMB_VFS_OP(audit_connect
), SMB_VFS_OP_CONNECT
, SMB_VFS_LAYER_LOGGER
},
267 {SMB_VFS_OP(audit_disconnect
), SMB_VFS_OP_DISCONNECT
, SMB_VFS_LAYER_LOGGER
},
269 /* Directory operations */
271 {SMB_VFS_OP(audit_opendir
), SMB_VFS_OP_OPENDIR
, SMB_VFS_LAYER_LOGGER
},
272 {SMB_VFS_OP(audit_mkdir
), SMB_VFS_OP_MKDIR
, SMB_VFS_LAYER_LOGGER
},
273 {SMB_VFS_OP(audit_rmdir
), SMB_VFS_OP_RMDIR
, SMB_VFS_LAYER_LOGGER
},
275 /* File operations */
277 {SMB_VFS_OP(audit_open
), SMB_VFS_OP_OPEN
, SMB_VFS_LAYER_LOGGER
},
278 {SMB_VFS_OP(audit_close
), SMB_VFS_OP_CLOSE
, SMB_VFS_LAYER_LOGGER
},
279 {SMB_VFS_OP(audit_rename
), SMB_VFS_OP_RENAME
, SMB_VFS_LAYER_LOGGER
},
280 {SMB_VFS_OP(audit_unlink
), SMB_VFS_OP_UNLINK
, SMB_VFS_LAYER_LOGGER
},
281 {SMB_VFS_OP(audit_chmod
), SMB_VFS_OP_CHMOD
, SMB_VFS_LAYER_LOGGER
},
282 {SMB_VFS_OP(audit_fchmod
), SMB_VFS_OP_FCHMOD
, SMB_VFS_LAYER_LOGGER
},
283 {SMB_VFS_OP(audit_chmod_acl
), SMB_VFS_OP_CHMOD_ACL
, SMB_VFS_LAYER_LOGGER
},
284 {SMB_VFS_OP(audit_fchmod_acl
), SMB_VFS_OP_FCHMOD_ACL
, SMB_VFS_LAYER_LOGGER
},
286 /* Finish VFS operations definition */
288 {SMB_VFS_OP(NULL
), SMB_VFS_OP_NOOP
, SMB_VFS_LAYER_NOOP
}
291 NTSTATUS
vfs_audit_init(void)
293 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION
, "audit", audit_op_tuples
);