2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 static int vfs_extd_audit_debug_level
= DBGC_VFS
;
30 #define DBGC_CLASS vfs_extd_audit_debug_level
32 static int audit_syslog_facility(vfs_handle_struct
*handle
)
34 static const struct enum_list enum_log_facilities
[] = {
36 { LOG_LOCAL0
, "LOCAL0" },
37 { LOG_LOCAL1
, "LOCAL1" },
38 { LOG_LOCAL2
, "LOCAL2" },
39 { LOG_LOCAL3
, "LOCAL3" },
40 { LOG_LOCAL4
, "LOCAL4" },
41 { LOG_LOCAL5
, "LOCAL5" },
42 { LOG_LOCAL6
, "LOCAL6" },
43 { LOG_LOCAL7
, "LOCAL7" }
48 facility
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "facility", enum_log_facilities
, LOG_USER
);
54 static int audit_syslog_priority(vfs_handle_struct
*handle
)
56 static const struct enum_list enum_log_priorities
[] = {
57 { LOG_EMERG
, "EMERG" },
58 { LOG_ALERT
, "ALERT" },
61 { LOG_WARNING
, "WARNING" },
62 { LOG_NOTICE
, "NOTICE" },
64 { LOG_DEBUG
, "DEBUG" }
69 priority
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "priority",
70 enum_log_priorities
, LOG_NOTICE
);
72 priority
= LOG_WARNING
;
78 /* Implementation of vfs_ops. Pass everything on to the default
79 operation but log event first. */
81 static int audit_connect(vfs_handle_struct
*handle
, const char *svc
, const char *user
)
85 openlog("smbd_audit", LOG_PID
, audit_syslog_facility(handle
));
87 if (lp_syslog() > 0) {
88 syslog(audit_syslog_priority(handle
),
89 "connect to service %s by user %s\n",
92 DEBUG(10, ("Connected to service %s as user %s\n",
95 result
= SMB_VFS_NEXT_CONNECT(handle
, svc
, user
);
100 static void audit_disconnect(vfs_handle_struct
*handle
)
102 if (lp_syslog() > 0) {
103 syslog(audit_syslog_priority(handle
), "disconnected\n");
105 DEBUG(10, ("Disconnected from VFS module extd_audit\n"));
106 SMB_VFS_NEXT_DISCONNECT(handle
);
111 static SMB_STRUCT_DIR
*audit_opendir(vfs_handle_struct
*handle
, const char *fname
, const char *mask
, uint32 attr
)
113 SMB_STRUCT_DIR
*result
;
115 result
= SMB_VFS_NEXT_OPENDIR(handle
, fname
, mask
, attr
);
117 if (lp_syslog() > 0) {
118 syslog(audit_syslog_priority(handle
), "opendir %s %s%s\n",
120 (result
== NULL
) ? "failed: " : "",
121 (result
== NULL
) ? strerror(errno
) : "");
123 DEBUG(1, ("vfs_extd_audit: opendir %s %s %s\n",
125 (result
== NULL
) ? "failed: " : "",
126 (result
== NULL
) ? strerror(errno
) : ""));
131 static int audit_mkdir(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
135 result
= SMB_VFS_NEXT_MKDIR(handle
, path
, mode
);
137 if (lp_syslog() > 0) {
138 syslog(audit_syslog_priority(handle
), "mkdir %s %s%s\n",
140 (result
< 0) ? "failed: " : "",
141 (result
< 0) ? strerror(errno
) : "");
143 DEBUG(0, ("vfs_extd_audit: mkdir %s %s %s\n",
145 (result
< 0) ? "failed: " : "",
146 (result
< 0) ? strerror(errno
) : ""));
151 static int audit_rmdir(vfs_handle_struct
*handle
, const char *path
)
155 result
= SMB_VFS_NEXT_RMDIR(handle
, path
);
157 if (lp_syslog() > 0) {
158 syslog(audit_syslog_priority(handle
), "rmdir %s %s%s\n",
160 (result
< 0) ? "failed: " : "",
161 (result
< 0) ? strerror(errno
) : "");
163 DEBUG(0, ("vfs_extd_audit: rmdir %s %s %s\n",
165 (result
< 0) ? "failed: " : "",
166 (result
< 0) ? strerror(errno
) : ""));
171 static int audit_open(vfs_handle_struct
*handle
,
172 struct smb_filename
*smb_fname
, files_struct
*fsp
,
173 int flags
, mode_t mode
)
177 result
= SMB_VFS_NEXT_OPEN(handle
, smb_fname
, fsp
, flags
, mode
);
179 if (lp_syslog() > 0) {
180 syslog(audit_syslog_priority(handle
), "open %s (fd %d) %s%s%s\n",
181 smb_fname
->base_name
, result
,
182 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
183 (result
< 0) ? "failed: " : "",
184 (result
< 0) ? strerror(errno
) : "");
186 DEBUG(2, ("vfs_extd_audit: open %s %s %s\n",
187 smb_fname_str_dbg(smb_fname
),
188 (result
< 0) ? "failed: " : "",
189 (result
< 0) ? strerror(errno
) : ""));
194 static int audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
)
198 result
= SMB_VFS_NEXT_CLOSE(handle
, fsp
);
200 if (lp_syslog() > 0) {
201 syslog(audit_syslog_priority(handle
), "close fd %d %s%s\n",
203 (result
< 0) ? "failed: " : "",
204 (result
< 0) ? strerror(errno
) : "");
206 DEBUG(2, ("vfs_extd_audit: close fd %d %s %s\n",
208 (result
< 0) ? "failed: " : "",
209 (result
< 0) ? strerror(errno
) : ""));
214 static int audit_rename(vfs_handle_struct
*handle
,
215 const struct smb_filename
*smb_fname_src
,
216 const struct smb_filename
*smb_fname_dst
)
220 result
= SMB_VFS_NEXT_RENAME(handle
, smb_fname_src
, smb_fname_dst
);
222 if (lp_syslog() > 0) {
223 syslog(audit_syslog_priority(handle
), "rename %s -> %s %s%s\n",
224 smb_fname_src
->base_name
,
225 smb_fname_dst
->base_name
,
226 (result
< 0) ? "failed: " : "",
227 (result
< 0) ? strerror(errno
) : "");
229 DEBUG(1, ("vfs_extd_audit: rename old: %s newname: %s %s %s\n",
230 smb_fname_str_dbg(smb_fname_src
),
231 smb_fname_str_dbg(smb_fname_dst
),
232 (result
< 0) ? "failed: " : "",
233 (result
< 0) ? strerror(errno
) : ""));
238 static int audit_unlink(vfs_handle_struct
*handle
,
239 const struct smb_filename
*smb_fname
)
243 result
= SMB_VFS_NEXT_UNLINK(handle
, smb_fname
);
245 if (lp_syslog() > 0) {
246 syslog(audit_syslog_priority(handle
), "unlink %s %s%s\n",
247 smb_fname
->base_name
,
248 (result
< 0) ? "failed: " : "",
249 (result
< 0) ? strerror(errno
) : "");
251 DEBUG(0, ("vfs_extd_audit: unlink %s %s %s\n",
252 smb_fname_str_dbg(smb_fname
),
253 (result
< 0) ? "failed: " : "",
254 (result
< 0) ? strerror(errno
) : ""));
259 static int audit_chmod(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
263 result
= SMB_VFS_NEXT_CHMOD(handle
, path
, mode
);
265 if (lp_syslog() > 0) {
266 syslog(audit_syslog_priority(handle
), "chmod %s mode 0x%x %s%s\n",
268 (result
< 0) ? "failed: " : "",
269 (result
< 0) ? strerror(errno
) : "");
271 DEBUG(1, ("vfs_extd_audit: chmod %s mode 0x%x %s %s\n",
272 path
, (unsigned int)mode
,
273 (result
< 0) ? "failed: " : "",
274 (result
< 0) ? strerror(errno
) : ""));
279 static int audit_chmod_acl(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
283 result
= SMB_VFS_NEXT_CHMOD_ACL(handle
, path
, mode
);
285 if (lp_syslog() > 0) {
286 syslog(audit_syslog_priority(handle
), "chmod_acl %s mode 0x%x %s%s\n",
288 (result
< 0) ? "failed: " : "",
289 (result
< 0) ? strerror(errno
) : "");
291 DEBUG(1, ("vfs_extd_audit: chmod_acl %s mode 0x%x %s %s\n",
292 path
, (unsigned int)mode
,
293 (result
< 0) ? "failed: " : "",
294 (result
< 0) ? strerror(errno
) : ""));
299 static int audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
303 result
= SMB_VFS_NEXT_FCHMOD(handle
, fsp
, mode
);
305 if (lp_syslog() > 0) {
306 syslog(audit_syslog_priority(handle
), "fchmod %s mode 0x%x %s%s\n",
307 fsp
->fsp_name
->base_name
, mode
,
308 (result
< 0) ? "failed: " : "",
309 (result
< 0) ? strerror(errno
) : "");
311 DEBUG(1, ("vfs_extd_audit: fchmod %s mode 0x%x %s %s",
312 fsp_str_dbg(fsp
), (unsigned int)mode
,
313 (result
< 0) ? "failed: " : "",
314 (result
< 0) ? strerror(errno
) : ""));
319 static int audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
323 result
= SMB_VFS_NEXT_FCHMOD_ACL(handle
, fsp
, mode
);
325 if (lp_syslog() > 0) {
326 syslog(audit_syslog_priority(handle
), "fchmod_acl %s mode 0x%x %s%s\n",
327 fsp
->fsp_name
->base_name
, mode
,
328 (result
< 0) ? "failed: " : "",
329 (result
< 0) ? strerror(errno
) : "");
331 DEBUG(1, ("vfs_extd_audit: fchmod_acl %s mode 0x%x %s %s",
332 fsp_str_dbg(fsp
), (unsigned int)mode
,
333 (result
< 0) ? "failed: " : "",
334 (result
< 0) ? strerror(errno
) : ""));
339 static struct vfs_fn_pointers vfs_extd_audit_fns
= {
340 .connect_fn
= audit_connect
,
341 .disconnect
= audit_disconnect
,
342 .opendir
= audit_opendir
,
343 .mkdir
= audit_mkdir
,
344 .rmdir
= audit_rmdir
,
346 .close_fn
= audit_close
,
347 .rename
= audit_rename
,
348 .unlink
= audit_unlink
,
349 .chmod
= audit_chmod
,
350 .fchmod
= audit_fchmod
,
351 .chmod_acl
= audit_chmod_acl
,
352 .fchmod_acl
= audit_fchmod_acl
,
355 NTSTATUS
vfs_extd_audit_init(void)
357 NTSTATUS ret
= smb_register_vfs(SMB_VFS_INTERFACE_VERSION
,
358 "extd_audit", &vfs_extd_audit_fns
);
360 if (!NT_STATUS_IS_OK(ret
))
363 vfs_extd_audit_debug_level
= debug_add_class("extd_audit");
364 if (vfs_extd_audit_debug_level
== -1) {
365 vfs_extd_audit_debug_level
= DBGC_VFS
;
366 DEBUG(0, ("vfs_extd_audit: Couldn't register custom debugging class!\n"));
368 DEBUG(10, ("vfs_extd_audit: Debug class number of 'extd_audit': %d\n", vfs_extd_audit_debug_level
));