?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
selftest:Samba4: report when samba is started and ready
[Samba.git] / source3 / modules / vfs_full_audit.c
blobfcfb024d493a6a7721139ef83834e34664f1d3ee
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
65 #include "auth.h"
66 #include "ntioctl.h"
67 #include "lib/param/loadparm.h"
68 #include "lib/util/bitmap.h"
69 #include "lib/util/tevent_unix.h"
70 #include "libcli/security/sddl.h"
71 #include "passdb/machine_sid.h"
72 #include "lib/util/tevent_ntstatus.h"
73
74 static int vfs_full_audit_debug_level = DBGC_VFS;
75
76 struct vfs_full_audit_private_data {
77 struct bitmap *success_ops;
78 struct bitmap *failure_ops;
79 int syslog_facility;
80 int syslog_priority;
81 bool log_secdesc;
82 bool do_syslog;
83 };
84
85 #undef DBGC_CLASS
86 #define DBGC_CLASS vfs_full_audit_debug_level
87
88 typedef enum _vfs_op_type {
89 SMB_VFS_OP_NOOP = -1,
90
91 /* Disk operations */
92
93 SMB_VFS_OP_CONNECT = 0,
94 SMB_VFS_OP_DISCONNECT,
95 SMB_VFS_OP_DISK_FREE,
96 SMB_VFS_OP_GET_QUOTA,
97 SMB_VFS_OP_SET_QUOTA,
98 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
99 SMB_VFS_OP_STATVFS,
100 SMB_VFS_OP_FS_CAPABILITIES,
101 SMB_VFS_OP_GET_DFS_REFERRALS,
102
103 /* Directory operations */
104
105 SMB_VFS_OP_OPENDIR,
106 SMB_VFS_OP_FDOPENDIR,
107 SMB_VFS_OP_READDIR,
108 SMB_VFS_OP_SEEKDIR,
109 SMB_VFS_OP_TELLDIR,
110 SMB_VFS_OP_REWINDDIR,
111 SMB_VFS_OP_MKDIR,
112 SMB_VFS_OP_RMDIR,
113 SMB_VFS_OP_CLOSEDIR,
114
115 /* File operations */
116
117 SMB_VFS_OP_OPEN,
118 SMB_VFS_OP_CREATE_FILE,
119 SMB_VFS_OP_CLOSE,
120 SMB_VFS_OP_READ,
121 SMB_VFS_OP_PREAD,
122 SMB_VFS_OP_PREAD_SEND,
123 SMB_VFS_OP_PREAD_RECV,
124 SMB_VFS_OP_WRITE,
125 SMB_VFS_OP_PWRITE,
126 SMB_VFS_OP_PWRITE_SEND,
127 SMB_VFS_OP_PWRITE_RECV,
128 SMB_VFS_OP_LSEEK,
129 SMB_VFS_OP_SENDFILE,
130 SMB_VFS_OP_RECVFILE,
131 SMB_VFS_OP_RENAME,
132 SMB_VFS_OP_FSYNC,
133 SMB_VFS_OP_FSYNC_SEND,
134 SMB_VFS_OP_FSYNC_RECV,
135 SMB_VFS_OP_STAT,
136 SMB_VFS_OP_FSTAT,
137 SMB_VFS_OP_LSTAT,
138 SMB_VFS_OP_GET_ALLOC_SIZE,
139 SMB_VFS_OP_UNLINK,
140 SMB_VFS_OP_CHMOD,
141 SMB_VFS_OP_FCHMOD,
142 SMB_VFS_OP_CHOWN,
143 SMB_VFS_OP_FCHOWN,
144 SMB_VFS_OP_LCHOWN,
145 SMB_VFS_OP_CHDIR,
146 SMB_VFS_OP_GETWD,
147 SMB_VFS_OP_NTIMES,
148 SMB_VFS_OP_FTRUNCATE,
149 SMB_VFS_OP_FALLOCATE,
150 SMB_VFS_OP_LOCK,
151 SMB_VFS_OP_KERNEL_FLOCK,
152 SMB_VFS_OP_LINUX_SETLEASE,
153 SMB_VFS_OP_GETLOCK,
154 SMB_VFS_OP_SYMLINK,
155 SMB_VFS_OP_READLINK,
156 SMB_VFS_OP_LINK,
157 SMB_VFS_OP_MKNOD,
158 SMB_VFS_OP_REALPATH,
159 SMB_VFS_OP_CHFLAGS,
160 SMB_VFS_OP_FILE_ID_CREATE,
161 SMB_VFS_OP_STREAMINFO,
162 SMB_VFS_OP_GET_REAL_FILENAME,
163 SMB_VFS_OP_CONNECTPATH,
164 SMB_VFS_OP_BRL_LOCK_WINDOWS,
165 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
166 SMB_VFS_OP_BRL_CANCEL_WINDOWS,
167 SMB_VFS_OP_STRICT_LOCK_CHECK,
168 SMB_VFS_OP_TRANSLATE_NAME,
169 SMB_VFS_OP_FSCTL,
170 SMB_VFS_OP_OFFLOAD_READ_SEND,
171 SMB_VFS_OP_OFFLOAD_READ_RECV,
172 SMB_VFS_OP_OFFLOAD_WRITE_SEND,
173 SMB_VFS_OP_OFFLOAD_WRITE_RECV,
174 SMB_VFS_OP_GET_COMPRESSION,
175 SMB_VFS_OP_SET_COMPRESSION,
176 SMB_VFS_OP_SNAP_CHECK_PATH,
177 SMB_VFS_OP_SNAP_CREATE,
178 SMB_VFS_OP_SNAP_DELETE,
179
180 /* DOS attribute operations. */
181 SMB_VFS_OP_GET_DOS_ATTRIBUTES,
182 SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
183 SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
184 SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
185 SMB_VFS_OP_SET_DOS_ATTRIBUTES,
186 SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
187
188 /* NT ACL operations. */
189
190 SMB_VFS_OP_FGET_NT_ACL,
191 SMB_VFS_OP_GET_NT_ACL,
192 SMB_VFS_OP_FSET_NT_ACL,
193 SMB_VFS_OP_AUDIT_FILE,
194
195 /* POSIX ACL operations. */
196
197 SMB_VFS_OP_SYS_ACL_GET_FILE,
198 SMB_VFS_OP_SYS_ACL_GET_FD,
199 SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE,
200 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
201 SMB_VFS_OP_SYS_ACL_SET_FILE,
202 SMB_VFS_OP_SYS_ACL_SET_FD,
203 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
204
205 /* EA operations. */
206 SMB_VFS_OP_GETXATTR,
207 SMB_VFS_OP_GETXATTRAT_SEND,
208 SMB_VFS_OP_GETXATTRAT_RECV,
209 SMB_VFS_OP_FGETXATTR,
210 SMB_VFS_OP_LISTXATTR,
211 SMB_VFS_OP_FLISTXATTR,
212 SMB_VFS_OP_REMOVEXATTR,
213 SMB_VFS_OP_FREMOVEXATTR,
214 SMB_VFS_OP_SETXATTR,
215 SMB_VFS_OP_FSETXATTR,
216
217 /* aio operations */
218 SMB_VFS_OP_AIO_FORCE,
219
220 /* offline operations */
221 SMB_VFS_OP_IS_OFFLINE,
222 SMB_VFS_OP_SET_OFFLINE,
223
224 /* Durable handle operations. */
225 SMB_VFS_OP_DURABLE_COOKIE,
226 SMB_VFS_OP_DURABLE_DISCONNECT,
227 SMB_VFS_OP_DURABLE_RECONNECT,
228
229 SMB_VFS_OP_READDIR_ATTR,
230
231 /* This should always be last enum value */
232
233 SMB_VFS_OP_LAST
234 } vfs_op_type;
235
236 /* The following array *must* be in the same order as defined in vfs_op_type */
237
238 static struct {
239 vfs_op_type type;
240 const char *name;
241 } vfs_op_names[] = {
242 { SMB_VFS_OP_CONNECT, "connect" },
243 { SMB_VFS_OP_DISCONNECT, "disconnect" },
244 { SMB_VFS_OP_DISK_FREE, "disk_free" },
245 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
246 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
247 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
248 { SMB_VFS_OP_STATVFS, "statvfs" },
249 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
250 { SMB_VFS_OP_GET_DFS_REFERRALS, "get_dfs_referrals" },
251 { SMB_VFS_OP_OPENDIR, "opendir" },
252 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
253 { SMB_VFS_OP_READDIR, "readdir" },
254 { SMB_VFS_OP_SEEKDIR, "seekdir" },
255 { SMB_VFS_OP_TELLDIR, "telldir" },
256 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
257 { SMB_VFS_OP_MKDIR, "mkdir" },
258 { SMB_VFS_OP_RMDIR, "rmdir" },
259 { SMB_VFS_OP_CLOSEDIR, "closedir" },
260 { SMB_VFS_OP_OPEN, "open" },
261 { SMB_VFS_OP_CREATE_FILE, "create_file" },
262 { SMB_VFS_OP_CLOSE, "close" },
263 { SMB_VFS_OP_READ, "read" },
264 { SMB_VFS_OP_PREAD, "pread" },
265 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
266 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
267 { SMB_VFS_OP_WRITE, "write" },
268 { SMB_VFS_OP_PWRITE, "pwrite" },
269 { SMB_VFS_OP_PWRITE_SEND, "pwrite_send" },
270 { SMB_VFS_OP_PWRITE_RECV, "pwrite_recv" },
271 { SMB_VFS_OP_LSEEK, "lseek" },
272 { SMB_VFS_OP_SENDFILE, "sendfile" },
273 { SMB_VFS_OP_RECVFILE, "recvfile" },
274 { SMB_VFS_OP_RENAME, "rename" },
275 { SMB_VFS_OP_FSYNC, "fsync" },
276 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
277 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
278 { SMB_VFS_OP_STAT, "stat" },
279 { SMB_VFS_OP_FSTAT, "fstat" },
280 { SMB_VFS_OP_LSTAT, "lstat" },
281 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
282 { SMB_VFS_OP_UNLINK, "unlink" },
283 { SMB_VFS_OP_CHMOD, "chmod" },
284 { SMB_VFS_OP_FCHMOD, "fchmod" },
285 { SMB_VFS_OP_CHOWN, "chown" },
286 { SMB_VFS_OP_FCHOWN, "fchown" },
287 { SMB_VFS_OP_LCHOWN, "lchown" },
288 { SMB_VFS_OP_CHDIR, "chdir" },
289 { SMB_VFS_OP_GETWD, "getwd" },
290 { SMB_VFS_OP_NTIMES, "ntimes" },
291 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
292 { SMB_VFS_OP_FALLOCATE,"fallocate" },
293 { SMB_VFS_OP_LOCK, "lock" },
294 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
295 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
296 { SMB_VFS_OP_GETLOCK, "getlock" },
297 { SMB_VFS_OP_SYMLINK, "symlink" },
298 { SMB_VFS_OP_READLINK, "readlink" },
299 { SMB_VFS_OP_LINK, "link" },
300 { SMB_VFS_OP_MKNOD, "mknod" },
301 { SMB_VFS_OP_REALPATH, "realpath" },
302 { SMB_VFS_OP_CHFLAGS, "chflags" },
303 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
304 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
305 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
306 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
307 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
308 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
309 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
310 { SMB_VFS_OP_STRICT_LOCK_CHECK, "strict_lock_check" },
311 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
312 { SMB_VFS_OP_FSCTL, "fsctl" },
313 { SMB_VFS_OP_OFFLOAD_READ_SEND, "offload_read_send" },
314 { SMB_VFS_OP_OFFLOAD_READ_RECV, "offload_read_recv" },
315 { SMB_VFS_OP_OFFLOAD_WRITE_SEND, "offload_write_send" },
316 { SMB_VFS_OP_OFFLOAD_WRITE_RECV, "offload_write_recv" },
317 { SMB_VFS_OP_GET_COMPRESSION, "get_compression" },
318 { SMB_VFS_OP_SET_COMPRESSION, "set_compression" },
319 { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
320 { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
321 { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
322 { SMB_VFS_OP_GET_DOS_ATTRIBUTES, "get_dos_attributes" },
323 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND, "get_dos_attributes_send" },
324 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV, "get_dos_attributes_recv" },
325 { SMB_VFS_OP_FGET_DOS_ATTRIBUTES, "fget_dos_attributes" },
326 { SMB_VFS_OP_SET_DOS_ATTRIBUTES, "set_dos_attributes" },
327 { SMB_VFS_OP_FSET_DOS_ATTRIBUTES, "fset_dos_attributes" },
328 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
329 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
330 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
331 { SMB_VFS_OP_AUDIT_FILE, "audit_file" },
332 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
333 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
334 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, "sys_acl_blob_get_file" },
335 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, "sys_acl_blob_get_fd" },
336 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
337 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
338 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
339 { SMB_VFS_OP_GETXATTR, "getxattr" },
340 { SMB_VFS_OP_GETXATTRAT_SEND, "getxattrat_send" },
341 { SMB_VFS_OP_GETXATTRAT_RECV, "getxattrat_recv" },
342 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
343 { SMB_VFS_OP_LISTXATTR, "listxattr" },
344 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
345 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
346 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
347 { SMB_VFS_OP_SETXATTR, "setxattr" },
348 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
349 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
350 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
351 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
352 { SMB_VFS_OP_DURABLE_COOKIE, "durable_cookie" },
353 { SMB_VFS_OP_DURABLE_DISCONNECT, "durable_disconnect" },
354 { SMB_VFS_OP_DURABLE_RECONNECT, "durable_reconnect" },
355 { SMB_VFS_OP_READDIR_ATTR, "readdir_attr" },
356 { SMB_VFS_OP_LAST, NULL }
357 };
358
359 static int audit_syslog_facility(vfs_handle_struct *handle)
360 {
361 static const struct enum_list enum_log_facilities[] = {
362 #ifdef LOG_AUTH
363 { LOG_AUTH, "AUTH" },
364 #endif
365 #ifdef LOG_AUTHPRIV
366 { LOG_AUTHPRIV, "AUTHPRIV" },
367 #endif
368 #ifdef LOG_AUDIT
369 { LOG_AUDIT, "AUDIT" },
370 #endif
371 #ifdef LOG_CONSOLE
372 { LOG_CONSOLE, "CONSOLE" },
373 #endif
374 #ifdef LOG_CRON
375 { LOG_CRON, "CRON" },
376 #endif
377 #ifdef LOG_DAEMON
378 { LOG_DAEMON, "DAEMON" },
379 #endif
380 #ifdef LOG_FTP
381 { LOG_FTP, "FTP" },
382 #endif
383 #ifdef LOG_INSTALL
384 { LOG_INSTALL, "INSTALL" },
385 #endif
386 #ifdef LOG_KERN
387 { LOG_KERN, "KERN" },
388 #endif
389 #ifdef LOG_LAUNCHD
390 { LOG_LAUNCHD, "LAUNCHD" },
391 #endif
392 #ifdef LOG_LFMT
393 { LOG_LFMT, "LFMT" },
394 #endif
395 #ifdef LOG_LPR
396 { LOG_LPR, "LPR" },
397 #endif
398 #ifdef LOG_MAIL
399 { LOG_MAIL, "MAIL" },
400 #endif
401 #ifdef LOG_MEGASAFE
402 { LOG_MEGASAFE, "MEGASAFE" },
403 #endif
404 #ifdef LOG_NETINFO
405 { LOG_NETINFO, "NETINFO" },
406 #endif
407 #ifdef LOG_NEWS
408 { LOG_NEWS, "NEWS" },
409 #endif
410 #ifdef LOG_NFACILITIES
411 { LOG_NFACILITIES, "NFACILITIES" },
412 #endif
413 #ifdef LOG_NTP
414 { LOG_NTP, "NTP" },
415 #endif
416 #ifdef LOG_RAS
417 { LOG_RAS, "RAS" },
418 #endif
419 #ifdef LOG_REMOTEAUTH
420 { LOG_REMOTEAUTH, "REMOTEAUTH" },
421 #endif
422 #ifdef LOG_SECURITY
423 { LOG_SECURITY, "SECURITY" },
424 #endif
425 #ifdef LOG_SYSLOG
426 { LOG_SYSLOG, "SYSLOG" },
427 #endif
428 #ifdef LOG_USER
429 { LOG_USER, "USER" },
430 #endif
431 #ifdef LOG_UUCP
432 { LOG_UUCP, "UUCP" },
433 #endif
434 { LOG_LOCAL0, "LOCAL0" },
435 { LOG_LOCAL1, "LOCAL1" },
436 { LOG_LOCAL2, "LOCAL2" },
437 { LOG_LOCAL3, "LOCAL3" },
438 { LOG_LOCAL4, "LOCAL4" },
439 { LOG_LOCAL5, "LOCAL5" },
440 { LOG_LOCAL6, "LOCAL6" },
441 { LOG_LOCAL7, "LOCAL7" },
442 { -1, NULL }
443 };
444
445 int facility;
446
447 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
448
449 return facility;
450 }
451
452 static int audit_syslog_priority(vfs_handle_struct *handle)
453 {
454 static const struct enum_list enum_log_priorities[] = {
455 { LOG_EMERG, "EMERG" },
456 { LOG_ALERT, "ALERT" },
457 { LOG_CRIT, "CRIT" },
458 { LOG_ERR, "ERR" },
459 { LOG_WARNING, "WARNING" },
460 { LOG_NOTICE, "NOTICE" },
461 { LOG_INFO, "INFO" },
462 { LOG_DEBUG, "DEBUG" },
463 { -1, NULL }
464 };
465
466 int priority;
467
468 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
469 enum_log_priorities, LOG_NOTICE);
470 if (priority == -1) {
471 priority = LOG_WARNING;
472 }
473
474 return priority;
475 }
476
477 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
478 {
479 char *prefix = NULL;
480 char *result;
481
482 prefix = talloc_strdup(ctx,
483 lp_parm_const_string(SNUM(conn), "full_audit",
484 "prefix", "%u|%I"));
485 if (!prefix) {
486 return NULL;
487 }
488 result = talloc_sub_advanced(ctx,
489 lp_servicename(talloc_tos(), SNUM(conn)),
490 conn->session_info->unix_info->unix_name,
491 conn->connectpath,
492 conn->session_info->unix_token->gid,
493 conn->session_info->unix_info->sanitized_username,
494 conn->session_info->info->domain_name,
495 prefix);
496 TALLOC_FREE(prefix);
497 return result;
498 }
499
500 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
501 {
502 if (pd->success_ops == NULL) {
503 return True;
504 }
505
506 return bitmap_query(pd->success_ops, op);
507 }
508
509 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
510 {
511 if (pd->failure_ops == NULL)
512 return True;
513
514 return bitmap_query(pd->failure_ops, op);
515 }
516
517 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
518 {
519 struct bitmap *bm;
520
521 if (ops == NULL) {
522 return NULL;
523 }
524
525 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
526 if (bm == NULL) {
527 DEBUG(0, ("Could not alloc bitmap -- "
528 "defaulting to logging everything\n"));
529 return NULL;
530 }
531
532 for (; *ops != NULL; ops += 1) {
533 int i;
534 bool neg = false;
535 const char *op;
536
537 if (strequal(*ops, "all")) {
538 for (i=0; i<SMB_VFS_OP_LAST; i++) {
539 bitmap_set(bm, i);
540 }
541 continue;
542 }
543
544 if (strequal(*ops, "none")) {
545 break;
546 }
547
548 op = ops[0];
549 if (op[0] == '!') {
550 neg = true;
551 op += 1;
552 }
553
554 for (i=0; i<SMB_VFS_OP_LAST; i++) {
555 if ((vfs_op_names[i].name == NULL)
556 || (vfs_op_names[i].type != i)) {
557 smb_panic("vfs_full_audit.c: name table not "
558 "in sync with vfs_op_type enums\n");
559 }
560 if (strequal(op, vfs_op_names[i].name)) {
561 if (neg) {
562 bitmap_clear(bm, i);
563 } else {
564 bitmap_set(bm, i);
565 }
566 break;
567 }
568 }
569 if (i == SMB_VFS_OP_LAST) {
570 DEBUG(0, ("Could not find opname %s, logging all\n",
571 *ops));
572 TALLOC_FREE(bm);
573 return NULL;
574 }
575 }
576 return bm;
577 }
578
579 static const char *audit_opname(vfs_op_type op)
580 {
581 if (op >= SMB_VFS_OP_LAST)
582 return "INVALID VFS OP";
583 return vfs_op_names[op].name;
584 }
585
586 static TALLOC_CTX *tmp_do_log_ctx;
587 /*
588 * Get us a temporary talloc context usable just for DEBUG arguments
589 */
590 static TALLOC_CTX *do_log_ctx(void)
591 {
592 if (tmp_do_log_ctx == NULL) {
593 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
594 }
595 return tmp_do_log_ctx;
596 }
597
598 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
599 const char *format, ...) PRINTF_ATTRIBUTE(4, 5);
600
601 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
602 const char *format, ...)
603 {
604 struct vfs_full_audit_private_data *pd;
605 fstring err_msg;
606 char *audit_pre = NULL;
607 va_list ap;
608 char *op_msg = NULL;
609
610 SMB_VFS_HANDLE_GET_DATA(handle, pd,
611 struct vfs_full_audit_private_data,
612 return;);
613
614 if (success && (!log_success(pd, op)))
615 goto out;
616
617 if (!success && (!log_failure(pd, op)))
618 goto out;
619
620 if (success)
621 fstrcpy(err_msg, "ok");
622 else
623 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
624
625 va_start(ap, format);
626 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
627 va_end(ap);
628
629 if (!op_msg) {
630 goto out;
631 }
632
633 audit_pre = audit_prefix(talloc_tos(), handle->conn);
634
635 if (pd->do_syslog) {
636 int priority;
637
638 /*
639 * Specify the facility to interoperate with other syslog
640 * callers (smbd for example).
641 */
642 priority = pd->syslog_priority | pd->syslog_facility;
643
644 syslog(priority, "%s|%s|%s|%s\n",
645 audit_pre ? audit_pre : "",
646 audit_opname(op), err_msg, op_msg);
647 } else {
648 DEBUG(1, ("%s|%s|%s|%s\n",
649 audit_pre ? audit_pre : "",
650 audit_opname(op), err_msg, op_msg));
651 }
652 out:
653 TALLOC_FREE(audit_pre);
654 TALLOC_FREE(op_msg);
655 TALLOC_FREE(tmp_do_log_ctx);
656 }
657
658 /**
659 * Return a string using the do_log_ctx()
660 */
661 static const char *smb_fname_str_do_log(const struct smb_filename *cwd,
662 const struct smb_filename *smb_fname)
663 {
664 char *fname = NULL;
665 NTSTATUS status;
666
667 if (smb_fname == NULL) {
668 return "";
669 }
670
671 if (smb_fname->base_name[0] != '/') {
672 char *abs_name = NULL;
673 struct smb_filename *fname_copy = cp_smb_filename(
674 do_log_ctx(),
675 smb_fname);
676 if (fname_copy == NULL) {
677 return "";
678 }
679
680 if (!ISDOT(smb_fname->base_name)) {
681 abs_name = talloc_asprintf(do_log_ctx(),
682 "%s/%s",
683 cwd->base_name,
684 smb_fname->base_name);
685 } else {
686 abs_name = talloc_strdup(do_log_ctx(),
687 cwd->base_name);
688 }
689 if (abs_name == NULL) {
690 return "";
691 }
692 fname_copy->base_name = abs_name;
693 smb_fname = fname_copy;
694 }
695
696 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
697 if (!NT_STATUS_IS_OK(status)) {
698 return "";
699 }
700 return fname;
701 }
702
703 /**
704 * Return an fsp debug string using the do_log_ctx()
705 */
706 static const char *fsp_str_do_log(const struct files_struct *fsp)
707 {
708 return smb_fname_str_do_log(fsp->conn->cwd_fname, fsp->fsp_name);
709 }
710
711 /* Implementation of vfs_ops. Pass everything on to the default
712 operation but log event first. */
713
714 static int smb_full_audit_connect(vfs_handle_struct *handle,
715 const char *svc, const char *user)
716 {
717 int result;
718 const char *none[] = { "none" };
719 struct vfs_full_audit_private_data *pd = NULL;
720
721 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
722 if (result < 0) {
723 return result;
724 }
725
726 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
727 if (!pd) {
728 SMB_VFS_NEXT_DISCONNECT(handle);
729 return -1;
730 }
731
732 pd->syslog_facility = audit_syslog_facility(handle);
733 if (pd->syslog_facility == -1) {
734 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
735 lp_parm_const_string(SNUM(handle->conn),
736 "full_audit", "facility",
737 "USER")));
738 SMB_VFS_NEXT_DISCONNECT(handle);
739 return -1;
740 }
741
742 pd->syslog_priority = audit_syslog_priority(handle);
743
744 pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
745 "full_audit", "log_secdesc", false);
746
747 pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
748 "full_audit", "syslog", true);
749
750 #ifdef WITH_SYSLOG
751 if (pd->do_syslog) {
752 openlog("smbd_audit", 0, pd->syslog_facility);
753 }
754 #endif
755
756 pd->success_ops = init_bitmap(
757 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
758 "success", none));
759 pd->failure_ops = init_bitmap(
760 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
761 "failure", none));
762
763 /* Store the private data. */
764 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
765 struct vfs_full_audit_private_data, return -1);
766
767 do_log(SMB_VFS_OP_CONNECT, True, handle,
768 "%s", svc);
769
770 return 0;
771 }
772
773 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
774 {
775 SMB_VFS_NEXT_DISCONNECT(handle);
776
777 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
778 "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
779
780 /* The bitmaps will be disconnected when the private
781 data is deleted. */
782 }
783
784 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
785 const struct smb_filename *smb_fname,
786 uint64_t *bsize,
787 uint64_t *dfree,
788 uint64_t *dsize)
789 {
790 uint64_t result;
791
792 result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
793
794 /* Don't have a reasonable notion of failure here */
795
796 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", smb_fname->base_name);
797
798 return result;
799 }
800
801 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
802 const struct smb_filename *smb_fname,
803 enum SMB_QUOTA_TYPE qtype,
804 unid_t id,
805 SMB_DISK_QUOTA *qt)
806 {
807 int result;
808
809 result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
810
811 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "%s",
812 smb_fname->base_name);
813
814 return result;
815 }
816
817 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
818 enum SMB_QUOTA_TYPE qtype, unid_t id,
819 SMB_DISK_QUOTA *qt)
820 {
821 int result;
822
823 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
824
825 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
826
827 return result;
828 }
829
830 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
831 struct files_struct *fsp,
832 struct shadow_copy_data *shadow_copy_data,
833 bool labels)
834 {
835 int result;
836
837 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
838
839 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
840
841 return result;
842 }
843
844 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
845 const struct smb_filename *smb_fname,
846 struct vfs_statvfs_struct *statbuf)
847 {
848 int result;
849
850 result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
851
852 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
853
854 return result;
855 }
856
857 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
858 {
859 int result;
860
861 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
862
863 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
864
865 return result;
866 }
867
868 static NTSTATUS smb_full_audit_get_dfs_referrals(
869 struct vfs_handle_struct *handle,
870 struct dfs_GetDFSReferral *r)
871 {
872 NTSTATUS status;
873
874 status = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
875
876 do_log(SMB_VFS_OP_GET_DFS_REFERRALS, NT_STATUS_IS_OK(status),
877 handle, "");
878
879 return status;
880 }
881
882 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
883 TALLOC_CTX *mem_ctx,
884 const char *service_path,
885 char **base_volume)
886 {
887 NTSTATUS status;
888
889 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
890 base_volume);
891 do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
892 handle, "");
893
894 return status;
895 }
896
897 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
898 TALLOC_CTX *mem_ctx,
899 const char *base_volume,
900 time_t *tstamp,
901 bool rw,
902 char **base_path,
903 char **snap_path)
904 {
905 NTSTATUS status;
906
907 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
908 rw, base_path, snap_path);
909 do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
910
911 return status;
912 }
913
914 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
915 TALLOC_CTX *mem_ctx,
916 char *base_path,
917 char *snap_path)
918 {
919 NTSTATUS status;
920
921 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
922 snap_path);
923 do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
924
925 return status;
926 }
927
928 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
929 const struct smb_filename *smb_fname,
930 const char *mask,
931 uint32_t attr)
932 {
933 DIR *result;
934
935 result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
936
937 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s",
938 smb_fname->base_name);
939
940 return result;
941 }
942
943 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
944 files_struct *fsp, const char *mask, uint32_t attr)
945 {
946 DIR *result;
947
948 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
949
950 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
951 fsp_str_do_log(fsp));
952
953 return result;
954 }
955
956 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
957 DIR *dirp, SMB_STRUCT_STAT *sbuf)
958 {
959 struct dirent *result;
960
961 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
962
963 /* This operation has no reasonable error condition
964 * (End of dir is also failure), so always succeed.
965 */
966 do_log(SMB_VFS_OP_READDIR, True, handle, "");
967
968 return result;
969 }
970
971 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
972 DIR *dirp, long offset)
973 {
974 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
975
976 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
977 }
978
979 static long smb_full_audit_telldir(vfs_handle_struct *handle,
980 DIR *dirp)
981 {
982 long result;
983
984 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
985
986 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
987
988 return result;
989 }
990
991 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
992 DIR *dirp)
993 {
994 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
995
996 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
997 }
998
999 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
1000 const struct smb_filename *smb_fname, mode_t mode)
1001 {
1002 int result;
1003
1004 result = SMB_VFS_NEXT_MKDIR(handle, smb_fname, mode);
1005
1006 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s",
1007 smb_fname->base_name);
1008
1009 return result;
1010 }
1011
1012 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
1013 const struct smb_filename *smb_fname)
1014 {
1015 int result;
1016
1017 result = SMB_VFS_NEXT_RMDIR(handle, smb_fname);
1018
1019 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s",
1020 smb_fname->base_name);
1021
1022 return result;
1023 }
1024
1025 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1026 DIR *dirp)
1027 {
1028 int result;
1029
1030 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1031
1032 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1033
1034 return result;
1035 }
1036
1037 static int smb_full_audit_open(vfs_handle_struct *handle,
1038 struct smb_filename *smb_fname,
1039 files_struct *fsp, int flags, mode_t mode)
1040 {
1041 int result;
1042
1043 result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
1044
1045 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
1046 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1047 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1048
1049 return result;
1050 }
1051
1052 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1053 struct smb_request *req,
1054 uint16_t root_dir_fid,
1055 struct smb_filename *smb_fname,
1056 uint32_t access_mask,
1057 uint32_t share_access,
1058 uint32_t create_disposition,
1059 uint32_t create_options,
1060 uint32_t file_attributes,
1061 uint32_t oplock_request,
1062 struct smb2_lease *lease,
1063 uint64_t allocation_size,
1064 uint32_t private_flags,
1065 struct security_descriptor *sd,
1066 struct ea_list *ea_list,
1067 files_struct **result_fsp,
1068 int *pinfo,
1069 const struct smb2_create_blobs *in_context_blobs,
1070 struct smb2_create_blobs *out_context_blobs)
1071 {
1072 NTSTATUS result;
1073 const char* str_create_disposition;
1074
1075 switch (create_disposition) {
1076 case FILE_SUPERSEDE:
1077 str_create_disposition = "supersede";
1078 break;
1079 case FILE_OVERWRITE_IF:
1080 str_create_disposition = "overwrite_if";
1081 break;
1082 case FILE_OPEN:
1083 str_create_disposition = "open";
1084 break;
1085 case FILE_OVERWRITE:
1086 str_create_disposition = "overwrite";
1087 break;
1088 case FILE_CREATE:
1089 str_create_disposition = "create";
1090 break;
1091 case FILE_OPEN_IF:
1092 str_create_disposition = "open_if";
1093 break;
1094 default:
1095 str_create_disposition = "unknown";
1096 }
1097
1098 result = SMB_VFS_NEXT_CREATE_FILE(
1099 handle, /* handle */
1100 req, /* req */
1101 root_dir_fid, /* root_dir_fid */
1102 smb_fname, /* fname */
1103 access_mask, /* access_mask */
1104 share_access, /* share_access */
1105 create_disposition, /* create_disposition*/
1106 create_options, /* create_options */
1107 file_attributes, /* file_attributes */
1108 oplock_request, /* oplock_request */
1109 lease, /* lease */
1110 allocation_size, /* allocation_size */
1111 private_flags,
1112 sd, /* sd */
1113 ea_list, /* ea_list */
1114 result_fsp, /* result */
1115 pinfo, /* pinfo */
1116 in_context_blobs, out_context_blobs); /* create context */
1117
1118 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
1119 "0x%x|%s|%s|%s", access_mask,
1120 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
1121 str_create_disposition,
1122 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1123
1124 return result;
1125 }
1126
1127 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1128 {
1129 int result;
1130
1131 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1132
1133 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
1134 fsp_str_do_log(fsp));
1135
1136 return result;
1137 }
1138
1139 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1140 void *data, size_t n, off_t offset)
1141 {
1142 ssize_t result;
1143
1144 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1145
1146 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1147 fsp_str_do_log(fsp));
1148
1149 return result;
1150 }
1151
1152 struct smb_full_audit_pread_state {
1153 vfs_handle_struct *handle;
1154 files_struct *fsp;
1155 ssize_t ret;
1156 struct vfs_aio_state vfs_aio_state;
1157 };
1158
1159 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1160
1161 static struct tevent_req *smb_full_audit_pread_send(
1162 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1163 struct tevent_context *ev, struct files_struct *fsp,
1164 void *data, size_t n, off_t offset)
1165 {
1166 struct tevent_req *req, *subreq;
1167 struct smb_full_audit_pread_state *state;
1168
1169 req = tevent_req_create(mem_ctx, &state,
1170 struct smb_full_audit_pread_state);
1171 if (req == NULL) {
1172 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1173 fsp_str_do_log(fsp));
1174 return NULL;
1175 }
1176 state->handle = handle;
1177 state->fsp = fsp;
1178
1179 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1180 n, offset);
1181 if (tevent_req_nomem(subreq, req)) {
1182 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1183 fsp_str_do_log(fsp));
1184 return tevent_req_post(req, ev);
1185 }
1186 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1187
1188 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1189 return req;
1190 }
1191
1192 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1193 {
1194 struct tevent_req *req = tevent_req_callback_data(
1195 subreq, struct tevent_req);
1196 struct smb_full_audit_pread_state *state = tevent_req_data(
1197 req, struct smb_full_audit_pread_state);
1198
1199 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
1200 TALLOC_FREE(subreq);
1201 tevent_req_done(req);
1202 }
1203
1204 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req,
1205 struct vfs_aio_state *vfs_aio_state)
1206 {
1207 struct smb_full_audit_pread_state *state = tevent_req_data(
1208 req, struct smb_full_audit_pread_state);
1209
1210 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1211 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1212 fsp_str_do_log(state->fsp));
1213 return -1;
1214 }
1215
1216 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1217 fsp_str_do_log(state->fsp));
1218
1219 *vfs_aio_state = state->vfs_aio_state;
1220 return state->ret;
1221 }
1222
1223 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1224 const void *data, size_t n,
1225 off_t offset)
1226 {
1227 ssize_t result;
1228
1229 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1230
1231 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1232 fsp_str_do_log(fsp));
1233
1234 return result;
1235 }
1236
1237 struct smb_full_audit_pwrite_state {
1238 vfs_handle_struct *handle;
1239 files_struct *fsp;
1240 ssize_t ret;
1241 struct vfs_aio_state vfs_aio_state;
1242 };
1243
1244 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1245
1246 static struct tevent_req *smb_full_audit_pwrite_send(
1247 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1248 struct tevent_context *ev, struct files_struct *fsp,
1249 const void *data, size_t n, off_t offset)
1250 {
1251 struct tevent_req *req, *subreq;
1252 struct smb_full_audit_pwrite_state *state;
1253
1254 req = tevent_req_create(mem_ctx, &state,
1255 struct smb_full_audit_pwrite_state);
1256 if (req == NULL) {
1257 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1258 fsp_str_do_log(fsp));
1259 return NULL;
1260 }
1261 state->handle = handle;
1262 state->fsp = fsp;
1263
1264 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1265 n, offset);
1266 if (tevent_req_nomem(subreq, req)) {
1267 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1268 fsp_str_do_log(fsp));
1269 return tevent_req_post(req, ev);
1270 }
1271 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1272
1273 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1274 fsp_str_do_log(fsp));
1275 return req;
1276 }
1277
1278 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1279 {
1280 struct tevent_req *req = tevent_req_callback_data(
1281 subreq, struct tevent_req);
1282 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1283 req, struct smb_full_audit_pwrite_state);
1284
1285 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
1286 TALLOC_FREE(subreq);
1287 tevent_req_done(req);
1288 }
1289
1290 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req,
1291 struct vfs_aio_state *vfs_aio_state)
1292 {
1293 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1294 req, struct smb_full_audit_pwrite_state);
1295
1296 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1297 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1298 fsp_str_do_log(state->fsp));
1299 return -1;
1300 }
1301
1302 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1303 fsp_str_do_log(state->fsp));
1304
1305 *vfs_aio_state = state->vfs_aio_state;
1306 return state->ret;
1307 }
1308
1309 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1310 off_t offset, int whence)
1311 {
1312 ssize_t result;
1313
1314 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1315
1316 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1317 "%s", fsp_str_do_log(fsp));
1318
1319 return result;
1320 }
1321
1322 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1323 files_struct *fromfsp,
1324 const DATA_BLOB *hdr, off_t offset,
1325 size_t n)
1326 {
1327 ssize_t result;
1328
1329 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1330
1331 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1332 "%s", fsp_str_do_log(fromfsp));
1333
1334 return result;
1335 }
1336
1337 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1338 files_struct *tofsp,
1339 off_t offset,
1340 size_t n)
1341 {
1342 ssize_t result;
1343
1344 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1345
1346 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1347 "%s", fsp_str_do_log(tofsp));
1348
1349 return result;
1350 }
1351
1352 static int smb_full_audit_rename(vfs_handle_struct *handle,
1353 const struct smb_filename *smb_fname_src,
1354 const struct smb_filename *smb_fname_dst)
1355 {
1356 int result;
1357
1358 result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1359
1360 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1361 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname_src),
1362 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname_dst));
1363
1364 return result;
1365 }
1366
1367 struct smb_full_audit_fsync_state {
1368 vfs_handle_struct *handle;
1369 files_struct *fsp;
1370 int ret;
1371 struct vfs_aio_state vfs_aio_state;
1372 };
1373
1374 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1375
1376 static struct tevent_req *smb_full_audit_fsync_send(
1377 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1378 struct tevent_context *ev, struct files_struct *fsp)
1379 {
1380 struct tevent_req *req, *subreq;
1381 struct smb_full_audit_fsync_state *state;
1382
1383 req = tevent_req_create(mem_ctx, &state,
1384 struct smb_full_audit_fsync_state);
1385 if (req == NULL) {
1386 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1387 fsp_str_do_log(fsp));
1388 return NULL;
1389 }
1390 state->handle = handle;
1391 state->fsp = fsp;
1392
1393 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1394 if (tevent_req_nomem(subreq, req)) {
1395 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1396 fsp_str_do_log(fsp));
1397 return tevent_req_post(req, ev);
1398 }
1399 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1400
1401 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1402 return req;
1403 }
1404
1405 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1406 {
1407 struct tevent_req *req = tevent_req_callback_data(
1408 subreq, struct tevent_req);
1409 struct smb_full_audit_fsync_state *state = tevent_req_data(
1410 req, struct smb_full_audit_fsync_state);
1411
1412 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1413 TALLOC_FREE(subreq);
1414 tevent_req_done(req);
1415 }
1416
1417 static int smb_full_audit_fsync_recv(struct tevent_req *req,
1418 struct vfs_aio_state *vfs_aio_state)
1419 {
1420 struct smb_full_audit_fsync_state *state = tevent_req_data(
1421 req, struct smb_full_audit_fsync_state);
1422
1423 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1424 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1425 fsp_str_do_log(state->fsp));
1426 return -1;
1427 }
1428
1429 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1430 fsp_str_do_log(state->fsp));
1431
1432 *vfs_aio_state = state->vfs_aio_state;
1433 return state->ret;
1434 }
1435
1436 static int smb_full_audit_stat(vfs_handle_struct *handle,
1437 struct smb_filename *smb_fname)
1438 {
1439 int result;
1440
1441 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1442
1443 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1444 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1445
1446 return result;
1447 }
1448
1449 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1450 SMB_STRUCT_STAT *sbuf)
1451 {
1452 int result;
1453
1454 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1455
1456 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1457 fsp_str_do_log(fsp));
1458
1459 return result;
1460 }
1461
1462 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1463 struct smb_filename *smb_fname)
1464 {
1465 int result;
1466
1467 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1468
1469 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1470 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1471
1472 return result;
1473 }
1474
1475 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1476 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1477 {
1478 uint64_t result;
1479
1480 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1481
1482 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1483 "%llu", (unsigned long long)result);
1484
1485 return result;
1486 }
1487
1488 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1489 const struct smb_filename *smb_fname)
1490 {
1491 int result;
1492
1493 result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1494
1495 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1496 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
1497
1498 return result;
1499 }
1500
1501 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1502 const struct smb_filename *smb_fname,
1503 mode_t mode)
1504 {
1505 int result;
1506
1507 result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1508
1509 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o",
1510 smb_fname->base_name,
1511 mode);
1512
1513 return result;
1514 }
1515
1516 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1517 mode_t mode)
1518 {
1519 int result;
1520
1521 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1522
1523 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1524 "%s|%o", fsp_str_do_log(fsp), mode);
1525
1526 return result;
1527 }
1528
1529 static int smb_full_audit_chown(vfs_handle_struct *handle,
1530 const struct smb_filename *smb_fname,
1531 uid_t uid,
1532 gid_t gid)
1533 {
1534 int result;
1535
1536 result = SMB_VFS_NEXT_CHOWN(handle, smb_fname, uid, gid);
1537
1538 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1539 smb_fname->base_name, (long int)uid, (long int)gid);
1540
1541 return result;
1542 }
1543
1544 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1545 uid_t uid, gid_t gid)
1546 {
1547 int result;
1548
1549 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1550
1551 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1552 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1553
1554 return result;
1555 }
1556
1557 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1558 const struct smb_filename *smb_fname,
1559 uid_t uid,
1560 gid_t gid)
1561 {
1562 int result;
1563
1564 result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1565
1566 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1567 smb_fname->base_name, (long int)uid, (long int)gid);
1568
1569 return result;
1570 }
1571
1572 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1573 const struct smb_filename *smb_fname)
1574 {
1575 int result;
1576
1577 result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1578
1579 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s",
1580 smb_fname->base_name);
1581
1582 return result;
1583 }
1584
1585 static struct smb_filename *smb_full_audit_getwd(vfs_handle_struct *handle,
1586 TALLOC_CTX *ctx)
1587 {
1588 struct smb_filename *result;
1589
1590 result = SMB_VFS_NEXT_GETWD(handle, ctx);
1591
1592 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1593 result == NULL? "" : result->base_name);
1594
1595 return result;
1596 }
1597
1598 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1599 const struct smb_filename *smb_fname,
1600 struct smb_file_time *ft)
1601 {
1602 int result;
1603 time_t create_time = convert_timespec_to_time_t(ft->create_time);
1604 time_t atime = convert_timespec_to_time_t(ft->atime);
1605 time_t mtime = convert_timespec_to_time_t(ft->mtime);
1606 time_t ctime = convert_timespec_to_time_t(ft->ctime);
1607 const char *create_time_str = "";
1608 const char *atime_str = "";
1609 const char *mtime_str = "";
1610 const char *ctime_str = "";
1611 TALLOC_CTX *frame = talloc_stackframe();
1612
1613 result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1614
1615 if (create_time > 0) {
1616 create_time_str = timestring(frame, create_time);
1617 }
1618 if (atime > 0) {
1619 atime_str = timestring(frame, atime);
1620 }
1621 if (mtime > 0) {
1622 mtime_str = timestring(frame, mtime);
1623 }
1624 if (ctime > 0) {
1625 ctime_str = timestring(frame, ctime);
1626 }
1627
1628 do_log(SMB_VFS_OP_NTIMES,
1629 (result >= 0),
1630 handle,
1631 "%s|%s|%s|%s|%s",
1632 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname),
1633 create_time_str,
1634 atime_str,
1635 mtime_str,
1636 ctime_str);
1637
1638 TALLOC_FREE(frame);
1639
1640 return result;
1641 }
1642
1643 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1644 off_t len)
1645 {
1646 int result;
1647
1648 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1649
1650 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1651 "%s", fsp_str_do_log(fsp));
1652
1653 return result;
1654 }
1655
1656 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1657 uint32_t mode,
1658 off_t offset,
1659 off_t len)
1660 {
1661 int result;
1662
1663 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1664
1665 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1666 "%s", fsp_str_do_log(fsp));
1667
1668 return result;
1669 }
1670
1671 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1672 int op, off_t offset, off_t count, int type)
1673 {
1674 bool result;
1675
1676 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1677
1678 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1679
1680 return result;
1681 }
1682
1683 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1684 struct files_struct *fsp,
1685 uint32_t share_mode, uint32_t access_mask)
1686 {
1687 int result;
1688
1689 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1690
1691 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1692 fsp_str_do_log(fsp));
1693
1694 return result;
1695 }
1696
1697 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1698 int leasetype)
1699 {
1700 int result;
1701
1702 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1703
1704 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1705 fsp_str_do_log(fsp));
1706
1707 return result;
1708 }
1709
1710 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1711 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1712 {
1713 bool result;
1714
1715 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1716
1717 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1718
1719 return result;
1720 }
1721
1722 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1723 const char *link_contents,
1724 const struct smb_filename *new_smb_fname)
1725 {
1726 int result;
1727
1728 result = SMB_VFS_NEXT_SYMLINK(handle, link_contents, new_smb_fname);
1729
1730 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1731 "%s|%s", link_contents, new_smb_fname->base_name);
1732
1733 return result;
1734 }
1735
1736 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1737 const struct smb_filename *smb_fname,
1738 char *buf,
1739 size_t bufsiz)
1740 {
1741 int result;
1742
1743 result = SMB_VFS_NEXT_READLINK(handle, smb_fname, buf, bufsiz);
1744
1745 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s",
1746 smb_fname->base_name);
1747
1748 return result;
1749 }
1750
1751 static int smb_full_audit_link(vfs_handle_struct *handle,
1752 const struct smb_filename *old_smb_fname,
1753 const struct smb_filename *new_smb_fname)
1754 {
1755 int result;
1756
1757 result = SMB_VFS_NEXT_LINK(handle, old_smb_fname, new_smb_fname);
1758
1759 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1760 "%s|%s", old_smb_fname->base_name, new_smb_fname->base_name);
1761
1762 return result;
1763 }
1764
1765 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1766 const struct smb_filename *smb_fname,
1767 mode_t mode,
1768 SMB_DEV_T dev)
1769 {
1770 int result;
1771
1772 result = SMB_VFS_NEXT_MKNOD(handle, smb_fname, mode, dev);
1773
1774 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s",
1775 smb_fname->base_name);
1776
1777 return result;
1778 }
1779
1780 static struct smb_filename *smb_full_audit_realpath(vfs_handle_struct *handle,
1781 TALLOC_CTX *ctx,
1782 const struct smb_filename *smb_fname)
1783 {
1784 struct smb_filename *result_fname = NULL;
1785
1786 result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1787
1788 do_log(SMB_VFS_OP_REALPATH, (result_fname != NULL), handle, "%s",
1789 smb_fname->base_name);
1790
1791 return result_fname;
1792 }
1793
1794 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1795 const struct smb_filename *smb_fname,
1796 unsigned int flags)
1797 {
1798 int result;
1799
1800 result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1801
1802 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s",
1803 smb_fname->base_name);
1804
1805 return result;
1806 }
1807
1808 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1809 const SMB_STRUCT_STAT *sbuf)
1810 {
1811 struct file_id id_zero;
1812 struct file_id result;
1813
1814 ZERO_STRUCT(id_zero);
1815
1816 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1817
1818 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1819 !file_id_equal(&id_zero, &result),
1820 handle, "%s", file_id_string_tos(&result));
1821
1822 return result;
1823 }
1824
1825 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1826 struct files_struct *fsp,
1827 const struct smb_filename *smb_fname,
1828 TALLOC_CTX *mem_ctx,
1829 unsigned int *pnum_streams,
1830 struct stream_struct **pstreams)
1831 {
1832 NTSTATUS result;
1833
1834 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1835 pnum_streams, pstreams);
1836
1837 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1838 "%s", smb_fname->base_name);
1839
1840 return result;
1841 }
1842
1843 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1844 const char *path,
1845 const char *name,
1846 TALLOC_CTX *mem_ctx,
1847 char **found_name)
1848 {
1849 int result;
1850
1851 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1852 found_name);
1853
1854 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1855 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1856
1857 return result;
1858 }
1859
1860 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1861 const struct smb_filename *smb_fname)
1862 {
1863 const char *result;
1864
1865 result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1866
1867 do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1868 "%s", smb_fname->base_name);
1869
1870 return result;
1871 }
1872
1873 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1874 struct byte_range_lock *br_lck,
1875 struct lock_struct *plock,
1876 bool blocking_lock)
1877 {
1878 NTSTATUS result;
1879
1880 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1881 blocking_lock);
1882
1883 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1884 "%s:%llu-%llu. type=%d. blocking=%d",
1885 fsp_str_do_log(brl_fsp(br_lck)),
1886 (unsigned long long)plock->start,
1887 (unsigned long long)plock->size,
1888 plock->lock_type,
1889 blocking_lock);
1890
1891 return result;
1892 }
1893
1894 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1895 struct messaging_context *msg_ctx,
1896 struct byte_range_lock *br_lck,
1897 const struct lock_struct *plock)
1898 {
1899 bool result;
1900
1901 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1902 plock);
1903
1904 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1905 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1906 (unsigned long long)plock->start,
1907 (unsigned long long)plock->size,
1908 plock->lock_type);
1909
1910 return result;
1911 }
1912
1913 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1914 struct byte_range_lock *br_lck,
1915 struct lock_struct *plock)
1916 {
1917 bool result;
1918
1919 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1920
1921 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1922 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1923 (unsigned long long)plock->start,
1924 (unsigned long long)plock->size,
1925 plock->lock_type);
1926
1927 return result;
1928 }
1929
1930 static bool smb_full_audit_strict_lock_check(struct vfs_handle_struct *handle,
1931 struct files_struct *fsp,
1932 struct lock_struct *plock)
1933 {
1934 bool result;
1935
1936 result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
1937
1938 do_log(SMB_VFS_OP_STRICT_LOCK_CHECK, result, handle,
1939 "%s:%llu-%llu:%d", fsp_str_do_log(fsp),
1940 (unsigned long long)plock->start,
1941 (unsigned long long)plock->size,
1942 plock->lock_type);
1943
1944 return result;
1945 }
1946
1947 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1948 const char *name,
1949 enum vfs_translate_direction direction,
1950 TALLOC_CTX *mem_ctx,
1951 char **mapped_name)
1952 {
1953 NTSTATUS result;
1954
1955 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1956 mapped_name);
1957
1958 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1959
1960 return result;
1961 }
1962
1963 static NTSTATUS smb_full_audit_fsctl(struct vfs_handle_struct *handle,
1964 struct files_struct *fsp,
1965 TALLOC_CTX *ctx,
1966 uint32_t function,
1967 uint16_t req_flags,
1968 const uint8_t *_in_data,
1969 uint32_t in_len,
1970 uint8_t **_out_data,
1971 uint32_t max_out_len,
1972 uint32_t *out_len)
1973 {
1974 NTSTATUS result;
1975
1976 result = SMB_VFS_NEXT_FSCTL(handle,
1977 fsp,
1978 ctx,
1979 function,
1980 req_flags,
1981 _in_data,
1982 in_len,
1983 _out_data,
1984 max_out_len,
1985 out_len);
1986
1987 do_log(SMB_VFS_OP_FSCTL, NT_STATUS_IS_OK(result), handle, "");
1988
1989 return result;
1990 }
1991
1992 static struct tevent_req *smb_full_audit_offload_read_send(
1993 TALLOC_CTX *mem_ctx,
1994 struct tevent_context *ev,
1995 struct vfs_handle_struct *handle,
1996 struct files_struct *fsp,
1997 uint32_t fsctl,
1998 uint32_t ttl,
1999 off_t offset,
2000 size_t to_copy)
2001 {
2002 struct tevent_req *req = NULL;
2003
2004 req = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev, handle, fsp,
2005 fsctl, ttl, offset, to_copy);
2006
2007 do_log(SMB_VFS_OP_OFFLOAD_READ_SEND, req, handle, "");
2008
2009 return req;
2010 }
2011
2012 static NTSTATUS smb_full_audit_offload_read_recv(
2013 struct tevent_req *req,
2014 struct vfs_handle_struct *handle,
2015 TALLOC_CTX *mem_ctx,
2016 DATA_BLOB *_token_blob)
2017 {
2018 NTSTATUS status;
2019
2020 status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(req, handle, mem_ctx,
2021 _token_blob);
2022
2023 do_log(SMB_VFS_OP_OFFLOAD_READ_RECV, NT_STATUS_IS_OK(status), handle, "");
2024
2025 return status;
2026 }
2027
2028 static struct tevent_req *smb_full_audit_offload_write_send(struct vfs_handle_struct *handle,
2029 TALLOC_CTX *mem_ctx,
2030 struct tevent_context *ev,
2031 uint32_t fsctl,
2032 DATA_BLOB *token,
2033 off_t transfer_offset,
2034 struct files_struct *dest_fsp,
2035 off_t dest_off,
2036 off_t num)
2037 {
2038 struct tevent_req *req;
2039
2040 req = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, mem_ctx, ev,
2041 fsctl, token, transfer_offset,
2042 dest_fsp, dest_off, num);
2043
2044 do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND, req, handle, "");
2045
2046 return req;
2047 }
2048
2049 static NTSTATUS smb_full_audit_offload_write_recv(struct vfs_handle_struct *handle,
2050 struct tevent_req *req,
2051 off_t *copied)
2052 {
2053 NTSTATUS result;
2054
2055 result = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle, req, copied);
2056
2057 do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV, NT_STATUS_IS_OK(result), handle, "");
2058
2059 return result;
2060 }
2061
2062 static NTSTATUS smb_full_audit_get_compression(vfs_handle_struct *handle,
2063 TALLOC_CTX *mem_ctx,
2064 struct files_struct *fsp,
2065 struct smb_filename *smb_fname,
2066 uint16_t *_compression_fmt)
2067 {
2068 NTSTATUS result;
2069
2070 result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
2071 _compression_fmt);
2072
2073 do_log(SMB_VFS_OP_GET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2074 "%s",
2075 (fsp ? fsp_str_do_log(fsp) :
2076 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname)));
2077
2078 return result;
2079 }
2080
2081 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
2082 TALLOC_CTX *mem_ctx,
2083 struct files_struct *fsp,
2084 uint16_t compression_fmt)
2085 {
2086 NTSTATUS result;
2087
2088 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2089 compression_fmt);
2090
2091 do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2092 "%s", fsp_str_do_log(fsp));
2093
2094 return result;
2095 }
2096
2097 static NTSTATUS smb_full_audit_readdir_attr(struct vfs_handle_struct *handle,
2098 const struct smb_filename *fname,
2099 TALLOC_CTX *mem_ctx,
2100 struct readdir_attr_data **pattr_data)
2101 {
2102 NTSTATUS status;
2103
2104 status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2105
2106 do_log(SMB_VFS_OP_READDIR_ATTR, NT_STATUS_IS_OK(status), handle, "%s",
2107 smb_fname_str_do_log(handle->conn->cwd_fname, fname));
2108
2109 return status;
2110 }
2111
2112 static NTSTATUS smb_full_audit_get_dos_attributes(
2113 struct vfs_handle_struct *handle,
2114 struct smb_filename *smb_fname,
2115 uint32_t *dosmode)
2116 {
2117 NTSTATUS status;
2118
2119 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
2120 smb_fname,
2121 dosmode);
2122
2123 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES,
2124 NT_STATUS_IS_OK(status),
2125 handle,
2126 "%s",
2127 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2128
2129 return status;
2130 }
2131
2132 struct smb_full_audit_get_dos_attributes_state {
2133 struct vfs_aio_state aio_state;
2134 vfs_handle_struct *handle;
2135 files_struct *dir_fsp;
2136 const struct smb_filename *smb_fname;
2137 uint32_t dosmode;
2138 };
2139
2140 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq);
2141
2142 static struct tevent_req *smb_full_audit_get_dos_attributes_send(
2143 TALLOC_CTX *mem_ctx,
2144 struct tevent_context *ev,
2145 struct vfs_handle_struct *handle,
2146 files_struct *dir_fsp,
2147 struct smb_filename *smb_fname)
2148 {
2149 struct tevent_req *req = NULL;
2150 struct smb_full_audit_get_dos_attributes_state *state = NULL;
2151 struct tevent_req *subreq = NULL;
2152
2153 req = tevent_req_create(mem_ctx, &state,
2154 struct smb_full_audit_get_dos_attributes_state);
2155 if (req == NULL) {
2156 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2157 false,
2158 handle,
2159 "%s/%s",
2160 fsp_str_do_log(dir_fsp),
2161 smb_fname->base_name);
2162 return NULL;
2163 }
2164 *state = (struct smb_full_audit_get_dos_attributes_state) {
2165 .handle = handle,
2166 .dir_fsp = dir_fsp,
2167 .smb_fname = smb_fname,
2168 };
2169
2170 subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
2171 ev,
2172 handle,
2173 dir_fsp,
2174 smb_fname);
2175 if (tevent_req_nomem(subreq, req)) {
2176 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2177 false,
2178 handle,
2179 "%s/%s",
2180 fsp_str_do_log(dir_fsp),
2181 smb_fname->base_name);
2182 return tevent_req_post(req, ev);
2183 }
2184 tevent_req_set_callback(subreq,
2185 smb_full_audit_get_dos_attributes_done,
2186 req);
2187
2188 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2189 true,
2190 handle,
2191 "%s/%s",
2192 fsp_str_do_log(dir_fsp),
2193 smb_fname->base_name);
2194
2195 return req;
2196 }
2197
2198 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq)
2199 {
2200 struct tevent_req *req =
2201 tevent_req_callback_data(subreq,
2202 struct tevent_req);
2203 struct smb_full_audit_get_dos_attributes_state *state =
2204 tevent_req_data(req,
2205 struct smb_full_audit_get_dos_attributes_state);
2206 NTSTATUS status;
2207
2208 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
2209 &state->aio_state,
2210 &state->dosmode);
2211 TALLOC_FREE(subreq);
2212 if (tevent_req_nterror(req, status)) {
2213 return;
2214 }
2215
2216 tevent_req_done(req);
2217 return;
2218 }
2219
2220 static NTSTATUS smb_full_audit_get_dos_attributes_recv(struct tevent_req *req,
2221 struct vfs_aio_state *aio_state,
2222 uint32_t *dosmode)
2223 {
2224 struct smb_full_audit_get_dos_attributes_state *state =
2225 tevent_req_data(req,
2226 struct smb_full_audit_get_dos_attributes_state);
2227 NTSTATUS status;
2228
2229 if (tevent_req_is_nterror(req, &status)) {
2230 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2231 false,
2232 state->handle,
2233 "%s/%s",
2234 fsp_str_do_log(state->dir_fsp),
2235 state->smb_fname->base_name);
2236 tevent_req_received(req);
2237 return status;
2238 }
2239
2240 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2241 true,
2242 state->handle,
2243 "%s/%s",
2244 fsp_str_do_log(state->dir_fsp),
2245 state->smb_fname->base_name);
2246
2247 *aio_state = state->aio_state;
2248 *dosmode = state->dosmode;
2249 tevent_req_received(req);
2250 return NT_STATUS_OK;
2251 }
2252
2253 static NTSTATUS smb_full_audit_fget_dos_attributes(
2254 struct vfs_handle_struct *handle,
2255 struct files_struct *fsp,
2256 uint32_t *dosmode)
2257 {
2258 NTSTATUS status;
2259
2260 status = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
2261 fsp,
2262 dosmode);
2263
2264 do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
2265 NT_STATUS_IS_OK(status),
2266 handle,
2267 "%s",
2268 fsp_str_do_log(fsp));
2269
2270 return status;
2271 }
2272
2273 static NTSTATUS smb_full_audit_set_dos_attributes(
2274 struct vfs_handle_struct *handle,
2275 const struct smb_filename *smb_fname,
2276 uint32_t dosmode)
2277 {
2278 NTSTATUS status;
2279
2280 status = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
2281 smb_fname,
2282 dosmode);
2283
2284 do_log(SMB_VFS_OP_SET_DOS_ATTRIBUTES,
2285 NT_STATUS_IS_OK(status),
2286 handle,
2287 "%s",
2288 smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2289
2290 return status;
2291 }
2292
2293 static NTSTATUS smb_full_audit_fset_dos_attributes(
2294 struct vfs_handle_struct *handle,
2295 struct files_struct *fsp,
2296 uint32_t dosmode)
2297 {
2298 NTSTATUS status;
2299
2300 status = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2301 fsp,
2302 dosmode);
2303
2304 do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
2305 NT_STATUS_IS_OK(status),
2306 handle,
2307 "%s",
2308 fsp_str_do_log(fsp));
2309
2310 return status;
2311 }
2312
2313 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2314 uint32_t security_info,
2315 TALLOC_CTX *mem_ctx,
2316 struct security_descriptor **ppdesc)
2317 {
2318 NTSTATUS result;
2319
2320 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2321 mem_ctx, ppdesc);
2322
2323 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2324 "%s", fsp_str_do_log(fsp));
2325
2326 return result;
2327 }
2328
2329 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
2330 const struct smb_filename *smb_fname,
2331 uint32_t security_info,
2332 TALLOC_CTX *mem_ctx,
2333 struct security_descriptor **ppdesc)
2334 {
2335 NTSTATUS result;
2336
2337 result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2338 mem_ctx, ppdesc);
2339
2340 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2341 "%s", smb_fname_str_do_log(handle->conn->cwd_fname, smb_fname));
2342
2343 return result;
2344 }
2345
2346 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2347 uint32_t security_info_sent,
2348 const struct security_descriptor *psd)
2349 {
2350 struct vfs_full_audit_private_data *pd;
2351 NTSTATUS result;
2352 char *sd = NULL;
2353
2354 SMB_VFS_HANDLE_GET_DATA(handle, pd,
2355 struct vfs_full_audit_private_data,
2356 return NT_STATUS_INTERNAL_ERROR);
2357
2358 if (pd->log_secdesc) {
2359 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
2360 }
2361
2362 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
2363
2364 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2365 "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
2366
2367 TALLOC_FREE(sd);
2368
2369 return result;
2370 }
2371
2372 static NTSTATUS smb_full_audit_audit_file(struct vfs_handle_struct *handle,
2373 struct smb_filename *file,
2374 struct security_acl *sacl,
2375 uint32_t access_requested,
2376 uint32_t access_denied)
2377 {
2378 NTSTATUS result;
2379
2380 result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2381 file,
2382 sacl,
2383 access_requested,
2384 access_denied);
2385
2386 do_log(SMB_VFS_OP_AUDIT_FILE, NT_STATUS_IS_OK(result), handle,
2387 "%s",
2388 smb_fname_str_do_log(handle->conn->cwd_fname, file));
2389
2390 return result;
2391 }
2392
2393 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
2394 const struct smb_filename *smb_fname,
2395 SMB_ACL_TYPE_T type,
2396 TALLOC_CTX *mem_ctx)
2397 {
2398 SMB_ACL_T result;
2399
2400 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2401 type, mem_ctx);
2402
2403 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
2404 "%s", smb_fname->base_name);
2405
2406 return result;
2407 }
2408
2409 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2410 files_struct *fsp, TALLOC_CTX *mem_ctx)
2411 {
2412 SMB_ACL_T result;
2413
2414 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2415
2416 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2417 "%s", fsp_str_do_log(fsp));
2418
2419 return result;
2420 }
2421
2422 static int smb_full_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2423 const struct smb_filename *smb_fname,
2424 TALLOC_CTX *mem_ctx,
2425 char **blob_description,
2426 DATA_BLOB *blob)
2427 {
2428 int result;
2429
2430 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2431 mem_ctx, blob_description, blob);
2432
2433 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, (result >= 0), handle,
2434 "%s", smb_fname->base_name);
2435
2436 return result;
2437 }
2438
2439 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2440 files_struct *fsp,
2441 TALLOC_CTX *mem_ctx,
2442 char **blob_description,
2443 DATA_BLOB *blob)
2444 {
2445 int result;
2446
2447 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2448
2449 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2450 "%s", fsp_str_do_log(fsp));
2451
2452 return result;
2453 }
2454
2455 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
2456 const struct smb_filename *smb_fname,
2457 SMB_ACL_TYPE_T acltype,
2458 SMB_ACL_T theacl)
2459 {
2460 int result;
2461
2462 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2463 theacl);
2464
2465 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
2466 "%s", smb_fname->base_name);
2467
2468 return result;
2469 }
2470
2471 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
2472 SMB_ACL_T theacl)
2473 {
2474 int result;
2475
2476 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2477
2478 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2479 "%s", fsp_str_do_log(fsp));
2480
2481 return result;
2482 }
2483
2484 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2485 const struct smb_filename *smb_fname)
2486 {
2487 int result;
2488
2489 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2490
2491 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2492 "%s", smb_fname->base_name);
2493
2494 return result;
2495 }
2496
2497 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2498 const struct smb_filename *smb_fname,
2499 const char *name, void *value, size_t size)
2500 {
2501 ssize_t result;
2502
2503 result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2504
2505 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2506 "%s|%s", smb_fname->base_name, name);
2507
2508 return result;
2509 }
2510
2511 struct smb_full_audit_getxattrat_state {
2512 struct vfs_aio_state aio_state;
2513 vfs_handle_struct *handle;
2514 files_struct *dir_fsp;
2515 const struct smb_filename *smb_fname;
2516 const char *xattr_name;
2517 ssize_t xattr_size;
2518 uint8_t *xattr_value;
2519 };
2520
2521 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq);
2522
2523 static struct tevent_req *smb_full_audit_getxattrat_send(
2524 TALLOC_CTX *mem_ctx,
2525 struct tevent_context *ev,
2526 struct vfs_handle_struct *handle,
2527 files_struct *dir_fsp,
2528 const struct smb_filename *smb_fname,
2529 const char *xattr_name,
2530 size_t alloc_hint)
2531 {
2532 struct tevent_req *req = NULL;
2533 struct tevent_req *subreq = NULL;
2534 struct smb_full_audit_getxattrat_state *state = NULL;
2535
2536 req = tevent_req_create(mem_ctx, &state,
2537 struct smb_full_audit_getxattrat_state);
2538 if (req == NULL) {
2539 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2540 false,
2541 handle,
2542 "%s/%s|%s",
2543 fsp_str_do_log(dir_fsp),
2544 smb_fname->base_name,
2545 xattr_name);
2546 return NULL;
2547 }
2548 *state = (struct smb_full_audit_getxattrat_state) {
2549 .handle = handle,
2550 .dir_fsp = dir_fsp,
2551 .smb_fname = smb_fname,
2552 .xattr_name = xattr_name,
2553 };
2554
2555 subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2556 ev,
2557 handle,
2558 dir_fsp,
2559 smb_fname,
2560 xattr_name,
2561 alloc_hint);
2562 if (tevent_req_nomem(subreq, req)) {
2563 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2564 false,
2565 handle,
2566 "%s/%s|%s",
2567 fsp_str_do_log(dir_fsp),
2568 smb_fname->base_name,
2569 xattr_name);
2570 return tevent_req_post(req, ev);
2571 }
2572 tevent_req_set_callback(subreq, smb_full_audit_getxattrat_done, req);
2573
2574 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2575 true,
2576 handle,
2577 "%s/%s|%s",
2578 fsp_str_do_log(dir_fsp),
2579 smb_fname->base_name,
2580 xattr_name);
2581
2582 return req;
2583 }
2584
2585 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq)
2586 {
2587 struct tevent_req *req = tevent_req_callback_data(
2588 subreq, struct tevent_req);
2589 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2590 req, struct smb_full_audit_getxattrat_state);
2591
2592 state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2593 &state->aio_state,
2594 state,
2595 &state->xattr_value);
2596 TALLOC_FREE(subreq);
2597 if (state->xattr_size == -1) {
2598 tevent_req_error(req, state->aio_state.error);
2599 return;
2600 }
2601
2602 tevent_req_done(req);
2603 }
2604
2605 static ssize_t smb_full_audit_getxattrat_recv(struct tevent_req *req,
2606 struct vfs_aio_state *aio_state,
2607 TALLOC_CTX *mem_ctx,
2608 uint8_t **xattr_value)
2609 {
2610 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2611 req, struct smb_full_audit_getxattrat_state);
2612 ssize_t xattr_size;
2613
2614 if (tevent_req_is_unix_error(req, &aio_state->error)) {
2615 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2616 false,
2617 state->handle,
2618 "%s/%s|%s",
2619 fsp_str_do_log(state->dir_fsp),
2620 state->smb_fname->base_name,
2621 state->xattr_name);
2622 tevent_req_received(req);
2623 return -1;
2624 }
2625
2626 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2627 true,
2628 state->handle,
2629 "%s/%s|%s",
2630 fsp_str_do_log(state->dir_fsp),
2631 state->smb_fname->base_name,
2632 state->xattr_name);
2633
2634 *aio_state = state->aio_state;
2635 xattr_size = state->xattr_size;
2636 if (xattr_value != NULL) {
2637 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2638 }
2639
2640 tevent_req_received(req);
2641 return xattr_size;
2642 }
2643
2644 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2645 struct files_struct *fsp,
2646 const char *name, void *value, size_t size)
2647 {
2648 ssize_t result;
2649
2650 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2651
2652 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2653 "%s|%s", fsp_str_do_log(fsp), name);
2654
2655 return result;
2656 }
2657
2658 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2659 const struct smb_filename *smb_fname,
2660 char *list,
2661 size_t size)
2662 {
2663 ssize_t result;
2664
2665 result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2666
2667 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s",
2668 smb_fname->base_name);
2669
2670 return result;
2671 }
2672
2673 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2674 struct files_struct *fsp, char *list,
2675 size_t size)
2676 {
2677 ssize_t result;
2678
2679 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2680
2681 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2682 "%s", fsp_str_do_log(fsp));
2683
2684 return result;
2685 }
2686
2687 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2688 const struct smb_filename *smb_fname,
2689 const char *name)
2690 {
2691 int result;
2692
2693 result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2694
2695 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2696 "%s|%s", smb_fname->base_name, name);
2697
2698 return result;
2699 }
2700
2701 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2702 struct files_struct *fsp,
2703 const char *name)
2704 {
2705 int result;
2706
2707 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2708
2709 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2710 "%s|%s", fsp_str_do_log(fsp), name);
2711
2712 return result;
2713 }
2714
2715 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2716 const struct smb_filename *smb_fname,
2717 const char *name, const void *value, size_t size,
2718 int flags)
2719 {
2720 int result;
2721
2722 result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2723 flags);
2724
2725 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2726 "%s|%s", smb_fname->base_name, name);
2727
2728 return result;
2729 }
2730
2731 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2732 struct files_struct *fsp, const char *name,
2733 const void *value, size_t size, int flags)
2734 {
2735 int result;
2736
2737 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2738
2739 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2740 "%s|%s", fsp_str_do_log(fsp), name);
2741
2742 return result;
2743 }
2744
2745 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2746 struct files_struct *fsp)
2747 {
2748 bool result;
2749
2750 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2751 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2752 "%s", fsp_str_do_log(fsp));
2753
2754 return result;
2755 }
2756
2757 static NTSTATUS smb_full_audit_durable_cookie(struct vfs_handle_struct *handle,
2758 struct files_struct *fsp,
2759 TALLOC_CTX *mem_ctx,
2760 DATA_BLOB *cookie)
2761 {
2762 NTSTATUS result;
2763
2764 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle,
2765 fsp,
2766 mem_ctx,
2767 cookie);
2768
2769 do_log(SMB_VFS_OP_DURABLE_COOKIE, NT_STATUS_IS_OK(result), handle,
2770 "%s", fsp_str_do_log(fsp));
2771
2772 return result;
2773 }
2774
2775 static NTSTATUS smb_full_audit_durable_disconnect(
2776 struct vfs_handle_struct *handle,
2777 struct files_struct *fsp,
2778 const DATA_BLOB old_cookie,
2779 TALLOC_CTX *mem_ctx,
2780 DATA_BLOB *new_cookie)
2781 {
2782 NTSTATUS result;
2783
2784 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle,
2785 fsp,
2786 old_cookie,
2787 mem_ctx,
2788 new_cookie);
2789
2790 do_log(SMB_VFS_OP_DURABLE_DISCONNECT, NT_STATUS_IS_OK(result), handle,
2791 "%s", fsp_str_do_log(fsp));
2792
2793 return result;
2794 }
2795
2796 static NTSTATUS smb_full_audit_durable_reconnect(
2797 struct vfs_handle_struct *handle,
2798 struct smb_request *smb1req,
2799 struct smbXsrv_open *op,
2800 const DATA_BLOB old_cookie,
2801 TALLOC_CTX *mem_ctx,
2802 struct files_struct **fsp,
2803 DATA_BLOB *new_cookie)
2804 {
2805 NTSTATUS result;
2806
2807 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle,
2808 smb1req,
2809 op,
2810 old_cookie,
2811 mem_ctx,
2812 fsp,
2813 new_cookie);
2814
2815 do_log(SMB_VFS_OP_DURABLE_RECONNECT,
2816 NT_STATUS_IS_OK(result),
2817 handle,
2818 "");
2819
2820 return result;
2821 }
2822
2823 static struct vfs_fn_pointers vfs_full_audit_fns = {
2824
2825 /* Disk operations */
2826
2827 .connect_fn = smb_full_audit_connect,
2828 .disconnect_fn = smb_full_audit_disconnect,
2829 .disk_free_fn = smb_full_audit_disk_free,
2830 .get_quota_fn = smb_full_audit_get_quota,
2831 .set_quota_fn = smb_full_audit_set_quota,
2832 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2833 .statvfs_fn = smb_full_audit_statvfs,
2834 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2835 .get_dfs_referrals_fn = smb_full_audit_get_dfs_referrals,
2836 .opendir_fn = smb_full_audit_opendir,
2837 .fdopendir_fn = smb_full_audit_fdopendir,
2838 .readdir_fn = smb_full_audit_readdir,
2839 .seekdir_fn = smb_full_audit_seekdir,
2840 .telldir_fn = smb_full_audit_telldir,
2841 .rewind_dir_fn = smb_full_audit_rewinddir,
2842 .mkdir_fn = smb_full_audit_mkdir,
2843 .rmdir_fn = smb_full_audit_rmdir,
2844 .closedir_fn = smb_full_audit_closedir,
2845 .open_fn = smb_full_audit_open,
2846 .create_file_fn = smb_full_audit_create_file,
2847 .close_fn = smb_full_audit_close,
2848 .pread_fn = smb_full_audit_pread,
2849 .pread_send_fn = smb_full_audit_pread_send,
2850 .pread_recv_fn = smb_full_audit_pread_recv,
2851 .pwrite_fn = smb_full_audit_pwrite,
2852 .pwrite_send_fn = smb_full_audit_pwrite_send,
2853 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2854 .lseek_fn = smb_full_audit_lseek,
2855 .sendfile_fn = smb_full_audit_sendfile,
2856 .recvfile_fn = smb_full_audit_recvfile,
2857 .rename_fn = smb_full_audit_rename,
2858 .fsync_send_fn = smb_full_audit_fsync_send,
2859 .fsync_recv_fn = smb_full_audit_fsync_recv,
2860 .stat_fn = smb_full_audit_stat,
2861 .fstat_fn = smb_full_audit_fstat,
2862 .lstat_fn = smb_full_audit_lstat,
2863 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2864 .unlink_fn = smb_full_audit_unlink,
2865 .chmod_fn = smb_full_audit_chmod,
2866 .fchmod_fn = smb_full_audit_fchmod,
2867 .chown_fn = smb_full_audit_chown,
2868 .fchown_fn = smb_full_audit_fchown,
2869 .lchown_fn = smb_full_audit_lchown,
2870 .chdir_fn = smb_full_audit_chdir,
2871 .getwd_fn = smb_full_audit_getwd,
2872 .ntimes_fn = smb_full_audit_ntimes,
2873 .ftruncate_fn = smb_full_audit_ftruncate,
2874 .fallocate_fn = smb_full_audit_fallocate,
2875 .lock_fn = smb_full_audit_lock,
2876 .kernel_flock_fn = smb_full_audit_kernel_flock,
2877 .linux_setlease_fn = smb_full_audit_linux_setlease,
2878 .getlock_fn = smb_full_audit_getlock,
2879 .symlink_fn = smb_full_audit_symlink,
2880 .readlink_fn = smb_full_audit_readlink,
2881 .link_fn = smb_full_audit_link,
2882 .mknod_fn = smb_full_audit_mknod,
2883 .realpath_fn = smb_full_audit_realpath,
2884 .chflags_fn = smb_full_audit_chflags,
2885 .file_id_create_fn = smb_full_audit_file_id_create,
2886 .offload_read_send_fn = smb_full_audit_offload_read_send,
2887 .offload_read_recv_fn = smb_full_audit_offload_read_recv,
2888 .offload_write_send_fn = smb_full_audit_offload_write_send,
2889 .offload_write_recv_fn = smb_full_audit_offload_write_recv,
2890 .get_compression_fn = smb_full_audit_get_compression,
2891 .set_compression_fn = smb_full_audit_set_compression,
2892 .snap_check_path_fn = smb_full_audit_snap_check_path,
2893 .snap_create_fn = smb_full_audit_snap_create,
2894 .snap_delete_fn = smb_full_audit_snap_delete,
2895 .streaminfo_fn = smb_full_audit_streaminfo,
2896 .get_real_filename_fn = smb_full_audit_get_real_filename,
2897 .connectpath_fn = smb_full_audit_connectpath,
2898 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2899 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2900 .brl_cancel_windows_fn = smb_full_audit_brl_cancel_windows,
2901 .strict_lock_check_fn = smb_full_audit_strict_lock_check,
2902 .translate_name_fn = smb_full_audit_translate_name,
2903 .fsctl_fn = smb_full_audit_fsctl,
2904 .get_dos_attributes_fn = smb_full_audit_get_dos_attributes,
2905 .get_dos_attributes_send_fn = smb_full_audit_get_dos_attributes_send,
2906 .get_dos_attributes_recv_fn = smb_full_audit_get_dos_attributes_recv,
2907 .fget_dos_attributes_fn = smb_full_audit_fget_dos_attributes,
2908 .set_dos_attributes_fn = smb_full_audit_set_dos_attributes,
2909 .fset_dos_attributes_fn = smb_full_audit_fset_dos_attributes,
2910 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2911 .get_nt_acl_fn = smb_full_audit_get_nt_acl,
2912 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2913 .audit_file_fn = smb_full_audit_audit_file,
2914 .sys_acl_get_file_fn = smb_full_audit_sys_acl_get_file,
2915 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2916 .sys_acl_blob_get_file_fn = smb_full_audit_sys_acl_blob_get_file,
2917 .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2918 .sys_acl_set_file_fn = smb_full_audit_sys_acl_set_file,
2919 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2920 .sys_acl_delete_def_file_fn = smb_full_audit_sys_acl_delete_def_file,
2921 .getxattr_fn = smb_full_audit_getxattr,
2922 .getxattrat_send_fn = smb_full_audit_getxattrat_send,
2923 .getxattrat_recv_fn = smb_full_audit_getxattrat_recv,
2924 .fgetxattr_fn = smb_full_audit_fgetxattr,
2925 .listxattr_fn = smb_full_audit_listxattr,
2926 .flistxattr_fn = smb_full_audit_flistxattr,
2927 .removexattr_fn = smb_full_audit_removexattr,
2928 .fremovexattr_fn = smb_full_audit_fremovexattr,
2929 .setxattr_fn = smb_full_audit_setxattr,
2930 .fsetxattr_fn = smb_full_audit_fsetxattr,
2931 .aio_force_fn = smb_full_audit_aio_force,
2932 .durable_cookie_fn = smb_full_audit_durable_cookie,
2933 .durable_disconnect_fn = smb_full_audit_durable_disconnect,
2934 .durable_reconnect_fn = smb_full_audit_durable_reconnect,
2935 .readdir_attr_fn = smb_full_audit_readdir_attr
2936
2937 };
2938
2939 static_decl_vfs;
2940 NTSTATUS vfs_full_audit_init(TALLOC_CTX *ctx)
2941 {
2942 NTSTATUS ret;
2943
2944 smb_vfs_assert_all_fns(&vfs_full_audit_fns, "full_audit");
2945
2946 ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "full_audit",
2947 &vfs_full_audit_fns);
2948
2949 if (!NT_STATUS_IS_OK(ret))
2950 return ret;
2951
2952 vfs_full_audit_debug_level = debug_add_class("full_audit");
2953 if (vfs_full_audit_debug_level == -1) {
2954 vfs_full_audit_debug_level = DBGC_VFS;
2955 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2956 "class!\n"));
2957 } else {
2958 DEBUG(10, ("vfs_full_audit: Debug class number of "
2959 "'full_audit': %d\n", vfs_full_audit_debug_level));
2960 }
2961
2962 return ret;
2963 }
Samba GIT mirror