2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 * This module implements parseable logging for all Samba VFS operations.
28 * You use it as follows:
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
49 * prefix: A macro expansion template prepended to the syslog entry.
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
67 #include "lib/param/loadparm.h"
68 #include "lib/util/bitmap.h"
69 #include "lib/util/tevent_unix.h"
70 #include "libcli/security/sddl.h"
71 #include "passdb/machine_sid.h"
73 static int vfs_full_audit_debug_level
= DBGC_VFS
;
75 struct vfs_full_audit_private_data
{
76 struct bitmap
*success_ops
;
77 struct bitmap
*failure_ops
;
85 #define DBGC_CLASS vfs_full_audit_debug_level
87 typedef enum _vfs_op_type
{
92 SMB_VFS_OP_CONNECT
= 0,
93 SMB_VFS_OP_DISCONNECT
,
97 SMB_VFS_OP_GET_SHADOW_COPY_DATA
,
99 SMB_VFS_OP_FS_CAPABILITIES
,
100 SMB_VFS_OP_GET_DFS_REFERRALS
,
102 /* Directory operations */
105 SMB_VFS_OP_FDOPENDIR
,
109 SMB_VFS_OP_REWINDDIR
,
114 /* File operations */
117 SMB_VFS_OP_CREATE_FILE
,
121 SMB_VFS_OP_PREAD_SEND
,
122 SMB_VFS_OP_PREAD_RECV
,
125 SMB_VFS_OP_PWRITE_SEND
,
126 SMB_VFS_OP_PWRITE_RECV
,
132 SMB_VFS_OP_FSYNC_SEND
,
133 SMB_VFS_OP_FSYNC_RECV
,
137 SMB_VFS_OP_GET_ALLOC_SIZE
,
147 SMB_VFS_OP_FTRUNCATE
,
148 SMB_VFS_OP_FALLOCATE
,
150 SMB_VFS_OP_KERNEL_FLOCK
,
151 SMB_VFS_OP_LINUX_SETLEASE
,
159 SMB_VFS_OP_FILE_ID_CREATE
,
160 SMB_VFS_OP_STREAMINFO
,
161 SMB_VFS_OP_GET_REAL_FILENAME
,
162 SMB_VFS_OP_CONNECTPATH
,
163 SMB_VFS_OP_BRL_LOCK_WINDOWS
,
164 SMB_VFS_OP_BRL_UNLOCK_WINDOWS
,
165 SMB_VFS_OP_BRL_CANCEL_WINDOWS
,
166 SMB_VFS_OP_STRICT_LOCK_CHECK
,
167 SMB_VFS_OP_TRANSLATE_NAME
,
169 SMB_VFS_OP_OFFLOAD_READ_SEND
,
170 SMB_VFS_OP_OFFLOAD_READ_RECV
,
171 SMB_VFS_OP_OFFLOAD_WRITE_SEND
,
172 SMB_VFS_OP_OFFLOAD_WRITE_RECV
,
173 SMB_VFS_OP_GET_COMPRESSION
,
174 SMB_VFS_OP_SET_COMPRESSION
,
175 SMB_VFS_OP_SNAP_CHECK_PATH
,
176 SMB_VFS_OP_SNAP_CREATE
,
177 SMB_VFS_OP_SNAP_DELETE
,
179 /* DOS attribute operations. */
180 SMB_VFS_OP_GET_DOS_ATTRIBUTES
,
181 SMB_VFS_OP_FGET_DOS_ATTRIBUTES
,
182 SMB_VFS_OP_SET_DOS_ATTRIBUTES
,
183 SMB_VFS_OP_FSET_DOS_ATTRIBUTES
,
185 /* NT ACL operations. */
187 SMB_VFS_OP_FGET_NT_ACL
,
188 SMB_VFS_OP_GET_NT_ACL
,
189 SMB_VFS_OP_FSET_NT_ACL
,
190 SMB_VFS_OP_AUDIT_FILE
,
192 /* POSIX ACL operations. */
194 SMB_VFS_OP_CHMOD_ACL
,
195 SMB_VFS_OP_FCHMOD_ACL
,
197 SMB_VFS_OP_SYS_ACL_GET_FILE
,
198 SMB_VFS_OP_SYS_ACL_GET_FD
,
199 SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE
,
200 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD
,
201 SMB_VFS_OP_SYS_ACL_SET_FILE
,
202 SMB_VFS_OP_SYS_ACL_SET_FD
,
203 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE
,
207 SMB_VFS_OP_FGETXATTR
,
208 SMB_VFS_OP_LISTXATTR
,
209 SMB_VFS_OP_FLISTXATTR
,
210 SMB_VFS_OP_REMOVEXATTR
,
211 SMB_VFS_OP_FREMOVEXATTR
,
213 SMB_VFS_OP_FSETXATTR
,
216 SMB_VFS_OP_AIO_FORCE
,
218 /* offline operations */
219 SMB_VFS_OP_IS_OFFLINE
,
220 SMB_VFS_OP_SET_OFFLINE
,
222 /* Durable handle operations. */
223 SMB_VFS_OP_DURABLE_COOKIE
,
224 SMB_VFS_OP_DURABLE_DISCONNECT
,
225 SMB_VFS_OP_DURABLE_RECONNECT
,
227 SMB_VFS_OP_READDIR_ATTR
,
229 /* This should always be last enum value */
234 /* The following array *must* be in the same order as defined in vfs_op_type */
240 { SMB_VFS_OP_CONNECT
, "connect" },
241 { SMB_VFS_OP_DISCONNECT
, "disconnect" },
242 { SMB_VFS_OP_DISK_FREE
, "disk_free" },
243 { SMB_VFS_OP_GET_QUOTA
, "get_quota" },
244 { SMB_VFS_OP_SET_QUOTA
, "set_quota" },
245 { SMB_VFS_OP_GET_SHADOW_COPY_DATA
, "get_shadow_copy_data" },
246 { SMB_VFS_OP_STATVFS
, "statvfs" },
247 { SMB_VFS_OP_FS_CAPABILITIES
, "fs_capabilities" },
248 { SMB_VFS_OP_GET_DFS_REFERRALS
, "get_dfs_referrals" },
249 { SMB_VFS_OP_OPENDIR
, "opendir" },
250 { SMB_VFS_OP_FDOPENDIR
, "fdopendir" },
251 { SMB_VFS_OP_READDIR
, "readdir" },
252 { SMB_VFS_OP_SEEKDIR
, "seekdir" },
253 { SMB_VFS_OP_TELLDIR
, "telldir" },
254 { SMB_VFS_OP_REWINDDIR
, "rewinddir" },
255 { SMB_VFS_OP_MKDIR
, "mkdir" },
256 { SMB_VFS_OP_RMDIR
, "rmdir" },
257 { SMB_VFS_OP_CLOSEDIR
, "closedir" },
258 { SMB_VFS_OP_OPEN
, "open" },
259 { SMB_VFS_OP_CREATE_FILE
, "create_file" },
260 { SMB_VFS_OP_CLOSE
, "close" },
261 { SMB_VFS_OP_READ
, "read" },
262 { SMB_VFS_OP_PREAD
, "pread" },
263 { SMB_VFS_OP_PREAD_SEND
, "pread_send" },
264 { SMB_VFS_OP_PREAD_RECV
, "pread_recv" },
265 { SMB_VFS_OP_WRITE
, "write" },
266 { SMB_VFS_OP_PWRITE
, "pwrite" },
267 { SMB_VFS_OP_PWRITE_SEND
, "pwrite_send" },
268 { SMB_VFS_OP_PWRITE_RECV
, "pwrite_recv" },
269 { SMB_VFS_OP_LSEEK
, "lseek" },
270 { SMB_VFS_OP_SENDFILE
, "sendfile" },
271 { SMB_VFS_OP_RECVFILE
, "recvfile" },
272 { SMB_VFS_OP_RENAME
, "rename" },
273 { SMB_VFS_OP_FSYNC
, "fsync" },
274 { SMB_VFS_OP_FSYNC_SEND
, "fsync_send" },
275 { SMB_VFS_OP_FSYNC_RECV
, "fsync_recv" },
276 { SMB_VFS_OP_STAT
, "stat" },
277 { SMB_VFS_OP_FSTAT
, "fstat" },
278 { SMB_VFS_OP_LSTAT
, "lstat" },
279 { SMB_VFS_OP_GET_ALLOC_SIZE
, "get_alloc_size" },
280 { SMB_VFS_OP_UNLINK
, "unlink" },
281 { SMB_VFS_OP_CHMOD
, "chmod" },
282 { SMB_VFS_OP_FCHMOD
, "fchmod" },
283 { SMB_VFS_OP_CHOWN
, "chown" },
284 { SMB_VFS_OP_FCHOWN
, "fchown" },
285 { SMB_VFS_OP_LCHOWN
, "lchown" },
286 { SMB_VFS_OP_CHDIR
, "chdir" },
287 { SMB_VFS_OP_GETWD
, "getwd" },
288 { SMB_VFS_OP_NTIMES
, "ntimes" },
289 { SMB_VFS_OP_FTRUNCATE
, "ftruncate" },
290 { SMB_VFS_OP_FALLOCATE
,"fallocate" },
291 { SMB_VFS_OP_LOCK
, "lock" },
292 { SMB_VFS_OP_KERNEL_FLOCK
, "kernel_flock" },
293 { SMB_VFS_OP_LINUX_SETLEASE
, "linux_setlease" },
294 { SMB_VFS_OP_GETLOCK
, "getlock" },
295 { SMB_VFS_OP_SYMLINK
, "symlink" },
296 { SMB_VFS_OP_READLINK
, "readlink" },
297 { SMB_VFS_OP_LINK
, "link" },
298 { SMB_VFS_OP_MKNOD
, "mknod" },
299 { SMB_VFS_OP_REALPATH
, "realpath" },
300 { SMB_VFS_OP_CHFLAGS
, "chflags" },
301 { SMB_VFS_OP_FILE_ID_CREATE
, "file_id_create" },
302 { SMB_VFS_OP_STREAMINFO
, "streaminfo" },
303 { SMB_VFS_OP_GET_REAL_FILENAME
, "get_real_filename" },
304 { SMB_VFS_OP_CONNECTPATH
, "connectpath" },
305 { SMB_VFS_OP_BRL_LOCK_WINDOWS
, "brl_lock_windows" },
306 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS
, "brl_unlock_windows" },
307 { SMB_VFS_OP_BRL_CANCEL_WINDOWS
, "brl_cancel_windows" },
308 { SMB_VFS_OP_STRICT_LOCK_CHECK
, "strict_lock_check" },
309 { SMB_VFS_OP_TRANSLATE_NAME
, "translate_name" },
310 { SMB_VFS_OP_FSCTL
, "fsctl" },
311 { SMB_VFS_OP_OFFLOAD_READ_SEND
, "offload_read_send" },
312 { SMB_VFS_OP_OFFLOAD_READ_RECV
, "offload_read_recv" },
313 { SMB_VFS_OP_OFFLOAD_WRITE_SEND
, "offload_write_send" },
314 { SMB_VFS_OP_OFFLOAD_WRITE_RECV
, "offload_write_recv" },
315 { SMB_VFS_OP_GET_COMPRESSION
, "get_compression" },
316 { SMB_VFS_OP_SET_COMPRESSION
, "set_compression" },
317 { SMB_VFS_OP_SNAP_CHECK_PATH
, "snap_check_path" },
318 { SMB_VFS_OP_SNAP_CREATE
, "snap_create" },
319 { SMB_VFS_OP_SNAP_DELETE
, "snap_delete" },
320 { SMB_VFS_OP_GET_DOS_ATTRIBUTES
, "get_dos_attributes" },
321 { SMB_VFS_OP_FGET_DOS_ATTRIBUTES
, "fget_dos_attributes" },
322 { SMB_VFS_OP_SET_DOS_ATTRIBUTES
, "set_dos_attributes" },
323 { SMB_VFS_OP_FSET_DOS_ATTRIBUTES
, "fset_dos_attributes" },
324 { SMB_VFS_OP_FGET_NT_ACL
, "fget_nt_acl" },
325 { SMB_VFS_OP_GET_NT_ACL
, "get_nt_acl" },
326 { SMB_VFS_OP_FSET_NT_ACL
, "fset_nt_acl" },
327 { SMB_VFS_OP_AUDIT_FILE
, "audit_file" },
328 { SMB_VFS_OP_CHMOD_ACL
, "chmod_acl" },
329 { SMB_VFS_OP_FCHMOD_ACL
, "fchmod_acl" },
330 { SMB_VFS_OP_SYS_ACL_GET_FILE
, "sys_acl_get_file" },
331 { SMB_VFS_OP_SYS_ACL_GET_FD
, "sys_acl_get_fd" },
332 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE
, "sys_acl_blob_get_file" },
333 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD
, "sys_acl_blob_get_fd" },
334 { SMB_VFS_OP_SYS_ACL_SET_FILE
, "sys_acl_set_file" },
335 { SMB_VFS_OP_SYS_ACL_SET_FD
, "sys_acl_set_fd" },
336 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE
, "sys_acl_delete_def_file" },
337 { SMB_VFS_OP_GETXATTR
, "getxattr" },
338 { SMB_VFS_OP_FGETXATTR
, "fgetxattr" },
339 { SMB_VFS_OP_LISTXATTR
, "listxattr" },
340 { SMB_VFS_OP_FLISTXATTR
, "flistxattr" },
341 { SMB_VFS_OP_REMOVEXATTR
, "removexattr" },
342 { SMB_VFS_OP_FREMOVEXATTR
, "fremovexattr" },
343 { SMB_VFS_OP_SETXATTR
, "setxattr" },
344 { SMB_VFS_OP_FSETXATTR
, "fsetxattr" },
345 { SMB_VFS_OP_AIO_FORCE
, "aio_force" },
346 { SMB_VFS_OP_IS_OFFLINE
, "is_offline" },
347 { SMB_VFS_OP_SET_OFFLINE
, "set_offline" },
348 { SMB_VFS_OP_DURABLE_COOKIE
, "durable_cookie" },
349 { SMB_VFS_OP_DURABLE_DISCONNECT
, "durable_disconnect" },
350 { SMB_VFS_OP_DURABLE_RECONNECT
, "durable_reconnect" },
351 { SMB_VFS_OP_READDIR_ATTR
, "readdir_attr" },
352 { SMB_VFS_OP_LAST
, NULL
}
355 static int audit_syslog_facility(vfs_handle_struct
*handle
)
357 static const struct enum_list enum_log_facilities
[] = {
358 { LOG_USER
, "USER" },
359 { LOG_LOCAL0
, "LOCAL0" },
360 { LOG_LOCAL1
, "LOCAL1" },
361 { LOG_LOCAL2
, "LOCAL2" },
362 { LOG_LOCAL3
, "LOCAL3" },
363 { LOG_LOCAL4
, "LOCAL4" },
364 { LOG_LOCAL5
, "LOCAL5" },
365 { LOG_LOCAL6
, "LOCAL6" },
366 { LOG_LOCAL7
, "LOCAL7" },
372 facility
= lp_parm_enum(SNUM(handle
->conn
), "full_audit", "facility", enum_log_facilities
, LOG_USER
);
377 static int audit_syslog_priority(vfs_handle_struct
*handle
)
379 static const struct enum_list enum_log_priorities
[] = {
380 { LOG_EMERG
, "EMERG" },
381 { LOG_ALERT
, "ALERT" },
382 { LOG_CRIT
, "CRIT" },
384 { LOG_WARNING
, "WARNING" },
385 { LOG_NOTICE
, "NOTICE" },
386 { LOG_INFO
, "INFO" },
387 { LOG_DEBUG
, "DEBUG" },
393 priority
= lp_parm_enum(SNUM(handle
->conn
), "full_audit", "priority",
394 enum_log_priorities
, LOG_NOTICE
);
395 if (priority
== -1) {
396 priority
= LOG_WARNING
;
402 static char *audit_prefix(TALLOC_CTX
*ctx
, connection_struct
*conn
)
407 prefix
= talloc_strdup(ctx
,
408 lp_parm_const_string(SNUM(conn
), "full_audit",
413 result
= talloc_sub_advanced(ctx
,
414 lp_servicename(talloc_tos(), SNUM(conn
)),
415 conn
->session_info
->unix_info
->unix_name
,
417 conn
->session_info
->unix_token
->gid
,
418 conn
->session_info
->unix_info
->sanitized_username
,
419 conn
->session_info
->info
->domain_name
,
425 static bool log_success(struct vfs_full_audit_private_data
*pd
, vfs_op_type op
)
427 if (pd
->success_ops
== NULL
) {
431 return bitmap_query(pd
->success_ops
, op
);
434 static bool log_failure(struct vfs_full_audit_private_data
*pd
, vfs_op_type op
)
436 if (pd
->failure_ops
== NULL
)
439 return bitmap_query(pd
->failure_ops
, op
);
442 static struct bitmap
*init_bitmap(TALLOC_CTX
*mem_ctx
, const char **ops
)
450 bm
= bitmap_talloc(mem_ctx
, SMB_VFS_OP_LAST
);
452 DEBUG(0, ("Could not alloc bitmap -- "
453 "defaulting to logging everything\n"));
457 for (; *ops
!= NULL
; ops
+= 1) {
462 if (strequal(*ops
, "all")) {
463 for (i
=0; i
<SMB_VFS_OP_LAST
; i
++) {
469 if (strequal(*ops
, "none")) {
479 for (i
=0; i
<SMB_VFS_OP_LAST
; i
++) {
480 if ((vfs_op_names
[i
].name
== NULL
)
481 || (vfs_op_names
[i
].type
!= i
)) {
482 smb_panic("vfs_full_audit.c: name table not "
483 "in sync with vfs_op_type enums\n");
485 if (strequal(op
, vfs_op_names
[i
].name
)) {
494 if (i
== SMB_VFS_OP_LAST
) {
495 DEBUG(0, ("Could not find opname %s, logging all\n",
504 static const char *audit_opname(vfs_op_type op
)
506 if (op
>= SMB_VFS_OP_LAST
)
507 return "INVALID VFS OP";
508 return vfs_op_names
[op
].name
;
511 static TALLOC_CTX
*tmp_do_log_ctx
;
513 * Get us a temporary talloc context usable just for DEBUG arguments
515 static TALLOC_CTX
*do_log_ctx(void)
517 if (tmp_do_log_ctx
== NULL
) {
518 tmp_do_log_ctx
= talloc_named_const(NULL
, 0, "do_log_ctx");
520 return tmp_do_log_ctx
;
523 static void do_log(vfs_op_type op
, bool success
, vfs_handle_struct
*handle
,
524 const char *format
, ...) PRINTF_ATTRIBUTE(4, 5);
526 static void do_log(vfs_op_type op
, bool success
, vfs_handle_struct
*handle
,
527 const char *format
, ...)
529 struct vfs_full_audit_private_data
*pd
;
531 char *audit_pre
= NULL
;
535 SMB_VFS_HANDLE_GET_DATA(handle
, pd
,
536 struct vfs_full_audit_private_data
,
539 if (success
&& (!log_success(pd
, op
)))
542 if (!success
&& (!log_failure(pd
, op
)))
546 fstrcpy(err_msg
, "ok");
548 fstr_sprintf(err_msg
, "fail (%s)", strerror(errno
));
550 va_start(ap
, format
);
551 op_msg
= talloc_vasprintf(talloc_tos(), format
, ap
);
558 audit_pre
= audit_prefix(talloc_tos(), handle
->conn
);
564 * Specify the facility to interoperate with other syslog
565 * callers (smbd for example).
567 priority
= pd
->syslog_priority
| pd
->syslog_facility
;
569 syslog(priority
, "%s|%s|%s|%s\n",
570 audit_pre
? audit_pre
: "",
571 audit_opname(op
), err_msg
, op_msg
);
573 DEBUG(1, ("%s|%s|%s|%s\n",
574 audit_pre
? audit_pre
: "",
575 audit_opname(op
), err_msg
, op_msg
));
578 TALLOC_FREE(audit_pre
);
580 TALLOC_FREE(tmp_do_log_ctx
);
584 * Return a string using the do_log_ctx()
586 static const char *smb_fname_str_do_log(const struct smb_filename
*smb_fname
)
591 if (smb_fname
== NULL
) {
594 status
= get_full_smb_filename(do_log_ctx(), smb_fname
, &fname
);
595 if (!NT_STATUS_IS_OK(status
)) {
602 * Return an fsp debug string using the do_log_ctx()
604 static const char *fsp_str_do_log(const struct files_struct
*fsp
)
606 return smb_fname_str_do_log(fsp
->fsp_name
);
609 /* Implementation of vfs_ops. Pass everything on to the default
610 operation but log event first. */
612 static int smb_full_audit_connect(vfs_handle_struct
*handle
,
613 const char *svc
, const char *user
)
616 struct vfs_full_audit_private_data
*pd
= NULL
;
618 result
= SMB_VFS_NEXT_CONNECT(handle
, svc
, user
);
623 pd
= talloc_zero(handle
, struct vfs_full_audit_private_data
);
625 SMB_VFS_NEXT_DISCONNECT(handle
);
629 pd
->syslog_facility
= audit_syslog_facility(handle
);
630 if (pd
->syslog_facility
== -1) {
631 DEBUG(1, ("%s: Unknown facility %s\n", __func__
,
632 lp_parm_const_string(SNUM(handle
->conn
),
633 "full_audit", "facility",
635 SMB_VFS_NEXT_DISCONNECT(handle
);
639 pd
->syslog_priority
= audit_syslog_priority(handle
);
641 pd
->log_secdesc
= lp_parm_bool(SNUM(handle
->conn
),
642 "full_audit", "log_secdesc", false);
644 pd
->do_syslog
= lp_parm_bool(SNUM(handle
->conn
),
645 "full_audit", "syslog", true);
649 openlog("smbd_audit", 0, pd
->syslog_facility
);
653 pd
->success_ops
= init_bitmap(
654 pd
, lp_parm_string_list(SNUM(handle
->conn
), "full_audit",
656 pd
->failure_ops
= init_bitmap(
657 pd
, lp_parm_string_list(SNUM(handle
->conn
), "full_audit",
660 /* Store the private data. */
661 SMB_VFS_HANDLE_SET_DATA(handle
, pd
, NULL
,
662 struct vfs_full_audit_private_data
, return -1);
664 do_log(SMB_VFS_OP_CONNECT
, True
, handle
,
670 static void smb_full_audit_disconnect(vfs_handle_struct
*handle
)
672 SMB_VFS_NEXT_DISCONNECT(handle
);
674 do_log(SMB_VFS_OP_DISCONNECT
, True
, handle
,
675 "%s", lp_servicename(talloc_tos(), SNUM(handle
->conn
)));
677 /* The bitmaps will be disconnected when the private
681 static uint64_t smb_full_audit_disk_free(vfs_handle_struct
*handle
,
682 const struct smb_filename
*smb_fname
,
689 result
= SMB_VFS_NEXT_DISK_FREE(handle
, smb_fname
, bsize
, dfree
, dsize
);
691 /* Don't have a reasonable notion of failure here */
693 do_log(SMB_VFS_OP_DISK_FREE
, True
, handle
, "%s", smb_fname
->base_name
);
698 static int smb_full_audit_get_quota(struct vfs_handle_struct
*handle
,
699 const struct smb_filename
*smb_fname
,
700 enum SMB_QUOTA_TYPE qtype
,
706 result
= SMB_VFS_NEXT_GET_QUOTA(handle
, smb_fname
, qtype
, id
, qt
);
708 do_log(SMB_VFS_OP_GET_QUOTA
, (result
>= 0), handle
, "%s",
709 smb_fname
->base_name
);
714 static int smb_full_audit_set_quota(struct vfs_handle_struct
*handle
,
715 enum SMB_QUOTA_TYPE qtype
, unid_t id
,
720 result
= SMB_VFS_NEXT_SET_QUOTA(handle
, qtype
, id
, qt
);
722 do_log(SMB_VFS_OP_SET_QUOTA
, (result
>= 0), handle
, "");
727 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct
*handle
,
728 struct files_struct
*fsp
,
729 struct shadow_copy_data
*shadow_copy_data
,
734 result
= SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle
, fsp
, shadow_copy_data
, labels
);
736 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA
, (result
>= 0), handle
, "");
741 static int smb_full_audit_statvfs(struct vfs_handle_struct
*handle
,
742 const struct smb_filename
*smb_fname
,
743 struct vfs_statvfs_struct
*statbuf
)
747 result
= SMB_VFS_NEXT_STATVFS(handle
, smb_fname
, statbuf
);
749 do_log(SMB_VFS_OP_STATVFS
, (result
>= 0), handle
, "");
754 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct
*handle
, enum timestamp_set_resolution
*p_ts_res
)
758 result
= SMB_VFS_NEXT_FS_CAPABILITIES(handle
, p_ts_res
);
760 do_log(SMB_VFS_OP_FS_CAPABILITIES
, true, handle
, "");
765 static NTSTATUS
smb_full_audit_get_dfs_referrals(
766 struct vfs_handle_struct
*handle
,
767 struct dfs_GetDFSReferral
*r
)
771 status
= SMB_VFS_NEXT_GET_DFS_REFERRALS(handle
, r
);
773 do_log(SMB_VFS_OP_GET_DFS_REFERRALS
, NT_STATUS_IS_OK(status
),
779 static NTSTATUS
smb_full_audit_snap_check_path(struct vfs_handle_struct
*handle
,
781 const char *service_path
,
786 status
= SMB_VFS_NEXT_SNAP_CHECK_PATH(handle
, mem_ctx
, service_path
,
788 do_log(SMB_VFS_OP_SNAP_CHECK_PATH
, NT_STATUS_IS_OK(status
),
794 static NTSTATUS
smb_full_audit_snap_create(struct vfs_handle_struct
*handle
,
796 const char *base_volume
,
804 status
= SMB_VFS_NEXT_SNAP_CREATE(handle
, mem_ctx
, base_volume
, tstamp
,
805 rw
, base_path
, snap_path
);
806 do_log(SMB_VFS_OP_SNAP_CREATE
, NT_STATUS_IS_OK(status
), handle
, "");
811 static NTSTATUS
smb_full_audit_snap_delete(struct vfs_handle_struct
*handle
,
818 status
= SMB_VFS_NEXT_SNAP_DELETE(handle
, mem_ctx
, base_path
,
820 do_log(SMB_VFS_OP_SNAP_DELETE
, NT_STATUS_IS_OK(status
), handle
, "");
825 static DIR *smb_full_audit_opendir(vfs_handle_struct
*handle
,
826 const struct smb_filename
*smb_fname
,
832 result
= SMB_VFS_NEXT_OPENDIR(handle
, smb_fname
, mask
, attr
);
834 do_log(SMB_VFS_OP_OPENDIR
, (result
!= NULL
), handle
, "%s",
835 smb_fname
->base_name
);
840 static DIR *smb_full_audit_fdopendir(vfs_handle_struct
*handle
,
841 files_struct
*fsp
, const char *mask
, uint32_t attr
)
845 result
= SMB_VFS_NEXT_FDOPENDIR(handle
, fsp
, mask
, attr
);
847 do_log(SMB_VFS_OP_FDOPENDIR
, (result
!= NULL
), handle
, "%s",
848 fsp_str_do_log(fsp
));
853 static struct dirent
*smb_full_audit_readdir(vfs_handle_struct
*handle
,
854 DIR *dirp
, SMB_STRUCT_STAT
*sbuf
)
856 struct dirent
*result
;
858 result
= SMB_VFS_NEXT_READDIR(handle
, dirp
, sbuf
);
860 /* This operation has no reasonable error condition
861 * (End of dir is also failure), so always succeed.
863 do_log(SMB_VFS_OP_READDIR
, True
, handle
, "");
868 static void smb_full_audit_seekdir(vfs_handle_struct
*handle
,
869 DIR *dirp
, long offset
)
871 SMB_VFS_NEXT_SEEKDIR(handle
, dirp
, offset
);
873 do_log(SMB_VFS_OP_SEEKDIR
, True
, handle
, "");
876 static long smb_full_audit_telldir(vfs_handle_struct
*handle
,
881 result
= SMB_VFS_NEXT_TELLDIR(handle
, dirp
);
883 do_log(SMB_VFS_OP_TELLDIR
, True
, handle
, "");
888 static void smb_full_audit_rewinddir(vfs_handle_struct
*handle
,
891 SMB_VFS_NEXT_REWINDDIR(handle
, dirp
);
893 do_log(SMB_VFS_OP_REWINDDIR
, True
, handle
, "");
896 static int smb_full_audit_mkdir(vfs_handle_struct
*handle
,
897 const struct smb_filename
*smb_fname
, mode_t mode
)
901 result
= SMB_VFS_NEXT_MKDIR(handle
, smb_fname
, mode
);
903 do_log(SMB_VFS_OP_MKDIR
, (result
>= 0), handle
, "%s",
904 smb_fname
->base_name
);
909 static int smb_full_audit_rmdir(vfs_handle_struct
*handle
,
910 const struct smb_filename
*smb_fname
)
914 result
= SMB_VFS_NEXT_RMDIR(handle
, smb_fname
);
916 do_log(SMB_VFS_OP_RMDIR
, (result
>= 0), handle
, "%s",
917 smb_fname
->base_name
);
922 static int smb_full_audit_closedir(vfs_handle_struct
*handle
,
927 result
= SMB_VFS_NEXT_CLOSEDIR(handle
, dirp
);
929 do_log(SMB_VFS_OP_CLOSEDIR
, (result
>= 0), handle
, "");
934 static int smb_full_audit_open(vfs_handle_struct
*handle
,
935 struct smb_filename
*smb_fname
,
936 files_struct
*fsp
, int flags
, mode_t mode
)
940 result
= SMB_VFS_NEXT_OPEN(handle
, smb_fname
, fsp
, flags
, mode
);
942 do_log(SMB_VFS_OP_OPEN
, (result
>= 0), handle
, "%s|%s",
943 ((flags
& O_WRONLY
) || (flags
& O_RDWR
))?"w":"r",
944 smb_fname_str_do_log(smb_fname
));
949 static NTSTATUS
smb_full_audit_create_file(vfs_handle_struct
*handle
,
950 struct smb_request
*req
,
951 uint16_t root_dir_fid
,
952 struct smb_filename
*smb_fname
,
953 uint32_t access_mask
,
954 uint32_t share_access
,
955 uint32_t create_disposition
,
956 uint32_t create_options
,
957 uint32_t file_attributes
,
958 uint32_t oplock_request
,
959 struct smb2_lease
*lease
,
960 uint64_t allocation_size
,
961 uint32_t private_flags
,
962 struct security_descriptor
*sd
,
963 struct ea_list
*ea_list
,
964 files_struct
**result_fsp
,
966 const struct smb2_create_blobs
*in_context_blobs
,
967 struct smb2_create_blobs
*out_context_blobs
)
970 const char* str_create_disposition
;
972 switch (create_disposition
) {
974 str_create_disposition
= "supersede";
976 case FILE_OVERWRITE_IF
:
977 str_create_disposition
= "overwrite_if";
980 str_create_disposition
= "open";
983 str_create_disposition
= "overwrite";
986 str_create_disposition
= "create";
989 str_create_disposition
= "open_if";
992 str_create_disposition
= "unknown";
995 result
= SMB_VFS_NEXT_CREATE_FILE(
998 root_dir_fid
, /* root_dir_fid */
999 smb_fname
, /* fname */
1000 access_mask
, /* access_mask */
1001 share_access
, /* share_access */
1002 create_disposition
, /* create_disposition*/
1003 create_options
, /* create_options */
1004 file_attributes
, /* file_attributes */
1005 oplock_request
, /* oplock_request */
1007 allocation_size
, /* allocation_size */
1010 ea_list
, /* ea_list */
1011 result_fsp
, /* result */
1013 in_context_blobs
, out_context_blobs
); /* create context */
1015 do_log(SMB_VFS_OP_CREATE_FILE
, (NT_STATUS_IS_OK(result
)), handle
,
1016 "0x%x|%s|%s|%s", access_mask
,
1017 create_options
& FILE_DIRECTORY_FILE
? "dir" : "file",
1018 str_create_disposition
, smb_fname_str_do_log(smb_fname
));
1023 static int smb_full_audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
)
1027 result
= SMB_VFS_NEXT_CLOSE(handle
, fsp
);
1029 do_log(SMB_VFS_OP_CLOSE
, (result
>= 0), handle
, "%s",
1030 fsp_str_do_log(fsp
));
1035 static ssize_t
smb_full_audit_read(vfs_handle_struct
*handle
, files_struct
*fsp
,
1036 void *data
, size_t n
)
1040 result
= SMB_VFS_NEXT_READ(handle
, fsp
, data
, n
);
1042 do_log(SMB_VFS_OP_READ
, (result
>= 0), handle
, "%s",
1043 fsp_str_do_log(fsp
));
1048 static ssize_t
smb_full_audit_pread(vfs_handle_struct
*handle
, files_struct
*fsp
,
1049 void *data
, size_t n
, off_t offset
)
1053 result
= SMB_VFS_NEXT_PREAD(handle
, fsp
, data
, n
, offset
);
1055 do_log(SMB_VFS_OP_PREAD
, (result
>= 0), handle
, "%s",
1056 fsp_str_do_log(fsp
));
1061 struct smb_full_audit_pread_state
{
1062 vfs_handle_struct
*handle
;
1065 struct vfs_aio_state vfs_aio_state
;
1068 static void smb_full_audit_pread_done(struct tevent_req
*subreq
);
1070 static struct tevent_req
*smb_full_audit_pread_send(
1071 struct vfs_handle_struct
*handle
, TALLOC_CTX
*mem_ctx
,
1072 struct tevent_context
*ev
, struct files_struct
*fsp
,
1073 void *data
, size_t n
, off_t offset
)
1075 struct tevent_req
*req
, *subreq
;
1076 struct smb_full_audit_pread_state
*state
;
1078 req
= tevent_req_create(mem_ctx
, &state
,
1079 struct smb_full_audit_pread_state
);
1081 do_log(SMB_VFS_OP_PREAD_SEND
, false, handle
, "%s",
1082 fsp_str_do_log(fsp
));
1085 state
->handle
= handle
;
1088 subreq
= SMB_VFS_NEXT_PREAD_SEND(state
, ev
, handle
, fsp
, data
,
1090 if (tevent_req_nomem(subreq
, req
)) {
1091 do_log(SMB_VFS_OP_PREAD_SEND
, false, handle
, "%s",
1092 fsp_str_do_log(fsp
));
1093 return tevent_req_post(req
, ev
);
1095 tevent_req_set_callback(subreq
, smb_full_audit_pread_done
, req
);
1097 do_log(SMB_VFS_OP_PREAD_SEND
, true, handle
, "%s", fsp_str_do_log(fsp
));
1101 static void smb_full_audit_pread_done(struct tevent_req
*subreq
)
1103 struct tevent_req
*req
= tevent_req_callback_data(
1104 subreq
, struct tevent_req
);
1105 struct smb_full_audit_pread_state
*state
= tevent_req_data(
1106 req
, struct smb_full_audit_pread_state
);
1108 state
->ret
= SMB_VFS_PREAD_RECV(subreq
, &state
->vfs_aio_state
);
1109 TALLOC_FREE(subreq
);
1110 tevent_req_done(req
);
1113 static ssize_t
smb_full_audit_pread_recv(struct tevent_req
*req
,
1114 struct vfs_aio_state
*vfs_aio_state
)
1116 struct smb_full_audit_pread_state
*state
= tevent_req_data(
1117 req
, struct smb_full_audit_pread_state
);
1119 if (tevent_req_is_unix_error(req
, &vfs_aio_state
->error
)) {
1120 do_log(SMB_VFS_OP_PREAD_RECV
, false, state
->handle
, "%s",
1121 fsp_str_do_log(state
->fsp
));
1125 do_log(SMB_VFS_OP_PREAD_RECV
, (state
->ret
>= 0), state
->handle
, "%s",
1126 fsp_str_do_log(state
->fsp
));
1128 *vfs_aio_state
= state
->vfs_aio_state
;
1132 static ssize_t
smb_full_audit_write(vfs_handle_struct
*handle
, files_struct
*fsp
,
1133 const void *data
, size_t n
)
1137 result
= SMB_VFS_NEXT_WRITE(handle
, fsp
, data
, n
);
1139 do_log(SMB_VFS_OP_WRITE
, (result
>= 0), handle
, "%s",
1140 fsp_str_do_log(fsp
));
1145 static ssize_t
smb_full_audit_pwrite(vfs_handle_struct
*handle
, files_struct
*fsp
,
1146 const void *data
, size_t n
,
1151 result
= SMB_VFS_NEXT_PWRITE(handle
, fsp
, data
, n
, offset
);
1153 do_log(SMB_VFS_OP_PWRITE
, (result
>= 0), handle
, "%s",
1154 fsp_str_do_log(fsp
));
1159 struct smb_full_audit_pwrite_state
{
1160 vfs_handle_struct
*handle
;
1163 struct vfs_aio_state vfs_aio_state
;
1166 static void smb_full_audit_pwrite_done(struct tevent_req
*subreq
);
1168 static struct tevent_req
*smb_full_audit_pwrite_send(
1169 struct vfs_handle_struct
*handle
, TALLOC_CTX
*mem_ctx
,
1170 struct tevent_context
*ev
, struct files_struct
*fsp
,
1171 const void *data
, size_t n
, off_t offset
)
1173 struct tevent_req
*req
, *subreq
;
1174 struct smb_full_audit_pwrite_state
*state
;
1176 req
= tevent_req_create(mem_ctx
, &state
,
1177 struct smb_full_audit_pwrite_state
);
1179 do_log(SMB_VFS_OP_PWRITE_SEND
, false, handle
, "%s",
1180 fsp_str_do_log(fsp
));
1183 state
->handle
= handle
;
1186 subreq
= SMB_VFS_NEXT_PWRITE_SEND(state
, ev
, handle
, fsp
, data
,
1188 if (tevent_req_nomem(subreq
, req
)) {
1189 do_log(SMB_VFS_OP_PWRITE_SEND
, false, handle
, "%s",
1190 fsp_str_do_log(fsp
));
1191 return tevent_req_post(req
, ev
);
1193 tevent_req_set_callback(subreq
, smb_full_audit_pwrite_done
, req
);
1195 do_log(SMB_VFS_OP_PWRITE_SEND
, true, handle
, "%s",
1196 fsp_str_do_log(fsp
));
1200 static void smb_full_audit_pwrite_done(struct tevent_req
*subreq
)
1202 struct tevent_req
*req
= tevent_req_callback_data(
1203 subreq
, struct tevent_req
);
1204 struct smb_full_audit_pwrite_state
*state
= tevent_req_data(
1205 req
, struct smb_full_audit_pwrite_state
);
1207 state
->ret
= SMB_VFS_PWRITE_RECV(subreq
, &state
->vfs_aio_state
);
1208 TALLOC_FREE(subreq
);
1209 tevent_req_done(req
);
1212 static ssize_t
smb_full_audit_pwrite_recv(struct tevent_req
*req
,
1213 struct vfs_aio_state
*vfs_aio_state
)
1215 struct smb_full_audit_pwrite_state
*state
= tevent_req_data(
1216 req
, struct smb_full_audit_pwrite_state
);
1218 if (tevent_req_is_unix_error(req
, &vfs_aio_state
->error
)) {
1219 do_log(SMB_VFS_OP_PWRITE_RECV
, false, state
->handle
, "%s",
1220 fsp_str_do_log(state
->fsp
));
1224 do_log(SMB_VFS_OP_PWRITE_RECV
, (state
->ret
>= 0), state
->handle
, "%s",
1225 fsp_str_do_log(state
->fsp
));
1227 *vfs_aio_state
= state
->vfs_aio_state
;
1231 static off_t
smb_full_audit_lseek(vfs_handle_struct
*handle
, files_struct
*fsp
,
1232 off_t offset
, int whence
)
1236 result
= SMB_VFS_NEXT_LSEEK(handle
, fsp
, offset
, whence
);
1238 do_log(SMB_VFS_OP_LSEEK
, (result
!= (ssize_t
)-1), handle
,
1239 "%s", fsp_str_do_log(fsp
));
1244 static ssize_t
smb_full_audit_sendfile(vfs_handle_struct
*handle
, int tofd
,
1245 files_struct
*fromfsp
,
1246 const DATA_BLOB
*hdr
, off_t offset
,
1251 result
= SMB_VFS_NEXT_SENDFILE(handle
, tofd
, fromfsp
, hdr
, offset
, n
);
1253 do_log(SMB_VFS_OP_SENDFILE
, (result
>= 0), handle
,
1254 "%s", fsp_str_do_log(fromfsp
));
1259 static ssize_t
smb_full_audit_recvfile(vfs_handle_struct
*handle
, int fromfd
,
1260 files_struct
*tofsp
,
1266 result
= SMB_VFS_NEXT_RECVFILE(handle
, fromfd
, tofsp
, offset
, n
);
1268 do_log(SMB_VFS_OP_RECVFILE
, (result
>= 0), handle
,
1269 "%s", fsp_str_do_log(tofsp
));
1274 static int smb_full_audit_rename(vfs_handle_struct
*handle
,
1275 const struct smb_filename
*smb_fname_src
,
1276 const struct smb_filename
*smb_fname_dst
)
1280 result
= SMB_VFS_NEXT_RENAME(handle
, smb_fname_src
, smb_fname_dst
);
1282 do_log(SMB_VFS_OP_RENAME
, (result
>= 0), handle
, "%s|%s",
1283 smb_fname_str_do_log(smb_fname_src
),
1284 smb_fname_str_do_log(smb_fname_dst
));
1289 static int smb_full_audit_fsync(vfs_handle_struct
*handle
, files_struct
*fsp
)
1293 result
= SMB_VFS_NEXT_FSYNC(handle
, fsp
);
1295 do_log(SMB_VFS_OP_FSYNC
, (result
>= 0), handle
, "%s",
1296 fsp_str_do_log(fsp
));
1301 struct smb_full_audit_fsync_state
{
1302 vfs_handle_struct
*handle
;
1305 struct vfs_aio_state vfs_aio_state
;
1308 static void smb_full_audit_fsync_done(struct tevent_req
*subreq
);
1310 static struct tevent_req
*smb_full_audit_fsync_send(
1311 struct vfs_handle_struct
*handle
, TALLOC_CTX
*mem_ctx
,
1312 struct tevent_context
*ev
, struct files_struct
*fsp
)
1314 struct tevent_req
*req
, *subreq
;
1315 struct smb_full_audit_fsync_state
*state
;
1317 req
= tevent_req_create(mem_ctx
, &state
,
1318 struct smb_full_audit_fsync_state
);
1320 do_log(SMB_VFS_OP_FSYNC_SEND
, false, handle
, "%s",
1321 fsp_str_do_log(fsp
));
1324 state
->handle
= handle
;
1327 subreq
= SMB_VFS_NEXT_FSYNC_SEND(state
, ev
, handle
, fsp
);
1328 if (tevent_req_nomem(subreq
, req
)) {
1329 do_log(SMB_VFS_OP_FSYNC_SEND
, false, handle
, "%s",
1330 fsp_str_do_log(fsp
));
1331 return tevent_req_post(req
, ev
);
1333 tevent_req_set_callback(subreq
, smb_full_audit_fsync_done
, req
);
1335 do_log(SMB_VFS_OP_FSYNC_SEND
, true, handle
, "%s", fsp_str_do_log(fsp
));
1339 static void smb_full_audit_fsync_done(struct tevent_req
*subreq
)
1341 struct tevent_req
*req
= tevent_req_callback_data(
1342 subreq
, struct tevent_req
);
1343 struct smb_full_audit_fsync_state
*state
= tevent_req_data(
1344 req
, struct smb_full_audit_fsync_state
);
1346 state
->ret
= SMB_VFS_FSYNC_RECV(subreq
, &state
->vfs_aio_state
);
1347 TALLOC_FREE(subreq
);
1348 tevent_req_done(req
);
1351 static int smb_full_audit_fsync_recv(struct tevent_req
*req
,
1352 struct vfs_aio_state
*vfs_aio_state
)
1354 struct smb_full_audit_fsync_state
*state
= tevent_req_data(
1355 req
, struct smb_full_audit_fsync_state
);
1357 if (tevent_req_is_unix_error(req
, &vfs_aio_state
->error
)) {
1358 do_log(SMB_VFS_OP_FSYNC_RECV
, false, state
->handle
, "%s",
1359 fsp_str_do_log(state
->fsp
));
1363 do_log(SMB_VFS_OP_FSYNC_RECV
, (state
->ret
>= 0), state
->handle
, "%s",
1364 fsp_str_do_log(state
->fsp
));
1366 *vfs_aio_state
= state
->vfs_aio_state
;
1370 static int smb_full_audit_stat(vfs_handle_struct
*handle
,
1371 struct smb_filename
*smb_fname
)
1375 result
= SMB_VFS_NEXT_STAT(handle
, smb_fname
);
1377 do_log(SMB_VFS_OP_STAT
, (result
>= 0), handle
, "%s",
1378 smb_fname_str_do_log(smb_fname
));
1383 static int smb_full_audit_fstat(vfs_handle_struct
*handle
, files_struct
*fsp
,
1384 SMB_STRUCT_STAT
*sbuf
)
1388 result
= SMB_VFS_NEXT_FSTAT(handle
, fsp
, sbuf
);
1390 do_log(SMB_VFS_OP_FSTAT
, (result
>= 0), handle
, "%s",
1391 fsp_str_do_log(fsp
));
1396 static int smb_full_audit_lstat(vfs_handle_struct
*handle
,
1397 struct smb_filename
*smb_fname
)
1401 result
= SMB_VFS_NEXT_LSTAT(handle
, smb_fname
);
1403 do_log(SMB_VFS_OP_LSTAT
, (result
>= 0), handle
, "%s",
1404 smb_fname_str_do_log(smb_fname
));
1409 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct
*handle
,
1410 files_struct
*fsp
, const SMB_STRUCT_STAT
*sbuf
)
1414 result
= SMB_VFS_NEXT_GET_ALLOC_SIZE(handle
, fsp
, sbuf
);
1416 do_log(SMB_VFS_OP_GET_ALLOC_SIZE
, (result
!= (uint64_t)-1), handle
,
1417 "%llu", (unsigned long long)result
);
1422 static int smb_full_audit_unlink(vfs_handle_struct
*handle
,
1423 const struct smb_filename
*smb_fname
)
1427 result
= SMB_VFS_NEXT_UNLINK(handle
, smb_fname
);
1429 do_log(SMB_VFS_OP_UNLINK
, (result
>= 0), handle
, "%s",
1430 smb_fname_str_do_log(smb_fname
));
1435 static int smb_full_audit_chmod(vfs_handle_struct
*handle
,
1436 const struct smb_filename
*smb_fname
,
1441 result
= SMB_VFS_NEXT_CHMOD(handle
, smb_fname
, mode
);
1443 do_log(SMB_VFS_OP_CHMOD
, (result
>= 0), handle
, "%s|%o",
1444 smb_fname
->base_name
,
1450 static int smb_full_audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
,
1455 result
= SMB_VFS_NEXT_FCHMOD(handle
, fsp
, mode
);
1457 do_log(SMB_VFS_OP_FCHMOD
, (result
>= 0), handle
,
1458 "%s|%o", fsp_str_do_log(fsp
), mode
);
1463 static int smb_full_audit_chown(vfs_handle_struct
*handle
,
1464 const struct smb_filename
*smb_fname
,
1470 result
= SMB_VFS_NEXT_CHOWN(handle
, smb_fname
, uid
, gid
);
1472 do_log(SMB_VFS_OP_CHOWN
, (result
>= 0), handle
, "%s|%ld|%ld",
1473 smb_fname
->base_name
, (long int)uid
, (long int)gid
);
1478 static int smb_full_audit_fchown(vfs_handle_struct
*handle
, files_struct
*fsp
,
1479 uid_t uid
, gid_t gid
)
1483 result
= SMB_VFS_NEXT_FCHOWN(handle
, fsp
, uid
, gid
);
1485 do_log(SMB_VFS_OP_FCHOWN
, (result
>= 0), handle
, "%s|%ld|%ld",
1486 fsp_str_do_log(fsp
), (long int)uid
, (long int)gid
);
1491 static int smb_full_audit_lchown(vfs_handle_struct
*handle
,
1492 const struct smb_filename
*smb_fname
,
1498 result
= SMB_VFS_NEXT_LCHOWN(handle
, smb_fname
, uid
, gid
);
1500 do_log(SMB_VFS_OP_LCHOWN
, (result
>= 0), handle
, "%s|%ld|%ld",
1501 smb_fname
->base_name
, (long int)uid
, (long int)gid
);
1506 static int smb_full_audit_chdir(vfs_handle_struct
*handle
,
1507 const struct smb_filename
*smb_fname
)
1511 result
= SMB_VFS_NEXT_CHDIR(handle
, smb_fname
);
1513 do_log(SMB_VFS_OP_CHDIR
, (result
>= 0), handle
, "chdir|%s",
1514 smb_fname
->base_name
);
1519 static struct smb_filename
*smb_full_audit_getwd(vfs_handle_struct
*handle
,
1522 struct smb_filename
*result
;
1524 result
= SMB_VFS_NEXT_GETWD(handle
, ctx
);
1526 do_log(SMB_VFS_OP_GETWD
, (result
!= NULL
), handle
, "%s",
1527 result
== NULL
? "" : result
->base_name
);
1532 static int smb_full_audit_ntimes(vfs_handle_struct
*handle
,
1533 const struct smb_filename
*smb_fname
,
1534 struct smb_file_time
*ft
)
1538 result
= SMB_VFS_NEXT_NTIMES(handle
, smb_fname
, ft
);
1540 do_log(SMB_VFS_OP_NTIMES
, (result
>= 0), handle
, "%s",
1541 smb_fname_str_do_log(smb_fname
));
1546 static int smb_full_audit_ftruncate(vfs_handle_struct
*handle
, files_struct
*fsp
,
1551 result
= SMB_VFS_NEXT_FTRUNCATE(handle
, fsp
, len
);
1553 do_log(SMB_VFS_OP_FTRUNCATE
, (result
>= 0), handle
,
1554 "%s", fsp_str_do_log(fsp
));
1559 static int smb_full_audit_fallocate(vfs_handle_struct
*handle
, files_struct
*fsp
,
1566 result
= SMB_VFS_NEXT_FALLOCATE(handle
, fsp
, mode
, offset
, len
);
1568 do_log(SMB_VFS_OP_FALLOCATE
, (result
>= 0), handle
,
1569 "%s", fsp_str_do_log(fsp
));
1574 static bool smb_full_audit_lock(vfs_handle_struct
*handle
, files_struct
*fsp
,
1575 int op
, off_t offset
, off_t count
, int type
)
1579 result
= SMB_VFS_NEXT_LOCK(handle
, fsp
, op
, offset
, count
, type
);
1581 do_log(SMB_VFS_OP_LOCK
, result
, handle
, "%s", fsp_str_do_log(fsp
));
1586 static int smb_full_audit_kernel_flock(struct vfs_handle_struct
*handle
,
1587 struct files_struct
*fsp
,
1588 uint32_t share_mode
, uint32_t access_mask
)
1592 result
= SMB_VFS_NEXT_KERNEL_FLOCK(handle
, fsp
, share_mode
, access_mask
);
1594 do_log(SMB_VFS_OP_KERNEL_FLOCK
, (result
>= 0), handle
, "%s",
1595 fsp_str_do_log(fsp
));
1600 static int smb_full_audit_linux_setlease(vfs_handle_struct
*handle
, files_struct
*fsp
,
1605 result
= SMB_VFS_NEXT_LINUX_SETLEASE(handle
, fsp
, leasetype
);
1607 do_log(SMB_VFS_OP_LINUX_SETLEASE
, (result
>= 0), handle
, "%s",
1608 fsp_str_do_log(fsp
));
1613 static bool smb_full_audit_getlock(vfs_handle_struct
*handle
, files_struct
*fsp
,
1614 off_t
*poffset
, off_t
*pcount
, int *ptype
, pid_t
*ppid
)
1618 result
= SMB_VFS_NEXT_GETLOCK(handle
, fsp
, poffset
, pcount
, ptype
, ppid
);
1620 do_log(SMB_VFS_OP_GETLOCK
, result
, handle
, "%s", fsp_str_do_log(fsp
));
1625 static int smb_full_audit_symlink(vfs_handle_struct
*handle
,
1626 const char *link_contents
,
1627 const struct smb_filename
*new_smb_fname
)
1631 result
= SMB_VFS_NEXT_SYMLINK(handle
, link_contents
, new_smb_fname
);
1633 do_log(SMB_VFS_OP_SYMLINK
, (result
>= 0), handle
,
1634 "%s|%s", link_contents
, new_smb_fname
->base_name
);
1639 static int smb_full_audit_readlink(vfs_handle_struct
*handle
,
1640 const struct smb_filename
*smb_fname
,
1646 result
= SMB_VFS_NEXT_READLINK(handle
, smb_fname
, buf
, bufsiz
);
1648 do_log(SMB_VFS_OP_READLINK
, (result
>= 0), handle
, "%s",
1649 smb_fname
->base_name
);
1654 static int smb_full_audit_link(vfs_handle_struct
*handle
,
1655 const struct smb_filename
*old_smb_fname
,
1656 const struct smb_filename
*new_smb_fname
)
1660 result
= SMB_VFS_NEXT_LINK(handle
, old_smb_fname
, new_smb_fname
);
1662 do_log(SMB_VFS_OP_LINK
, (result
>= 0), handle
,
1663 "%s|%s", old_smb_fname
->base_name
, new_smb_fname
->base_name
);
1668 static int smb_full_audit_mknod(vfs_handle_struct
*handle
,
1669 const struct smb_filename
*smb_fname
,
1675 result
= SMB_VFS_NEXT_MKNOD(handle
, smb_fname
, mode
, dev
);
1677 do_log(SMB_VFS_OP_MKNOD
, (result
>= 0), handle
, "%s",
1678 smb_fname
->base_name
);
1683 static struct smb_filename
*smb_full_audit_realpath(vfs_handle_struct
*handle
,
1685 const struct smb_filename
*smb_fname
)
1687 struct smb_filename
*result_fname
= NULL
;
1689 result_fname
= SMB_VFS_NEXT_REALPATH(handle
, ctx
, smb_fname
);
1691 do_log(SMB_VFS_OP_REALPATH
, (result_fname
!= NULL
), handle
, "%s",
1692 smb_fname
->base_name
);
1694 return result_fname
;
1697 static int smb_full_audit_chflags(vfs_handle_struct
*handle
,
1698 const struct smb_filename
*smb_fname
,
1703 result
= SMB_VFS_NEXT_CHFLAGS(handle
, smb_fname
, flags
);
1705 do_log(SMB_VFS_OP_CHFLAGS
, (result
!= 0), handle
, "%s",
1706 smb_fname
->base_name
);
1711 static struct file_id
smb_full_audit_file_id_create(struct vfs_handle_struct
*handle
,
1712 const SMB_STRUCT_STAT
*sbuf
)
1714 struct file_id id_zero
;
1715 struct file_id result
;
1717 ZERO_STRUCT(id_zero
);
1719 result
= SMB_VFS_NEXT_FILE_ID_CREATE(handle
, sbuf
);
1721 do_log(SMB_VFS_OP_FILE_ID_CREATE
,
1722 !file_id_equal(&id_zero
, &result
),
1723 handle
, "%s", file_id_string_tos(&result
));
1728 static NTSTATUS
smb_full_audit_streaminfo(vfs_handle_struct
*handle
,
1729 struct files_struct
*fsp
,
1730 const struct smb_filename
*smb_fname
,
1731 TALLOC_CTX
*mem_ctx
,
1732 unsigned int *pnum_streams
,
1733 struct stream_struct
**pstreams
)
1737 result
= SMB_VFS_NEXT_STREAMINFO(handle
, fsp
, smb_fname
, mem_ctx
,
1738 pnum_streams
, pstreams
);
1740 do_log(SMB_VFS_OP_STREAMINFO
, NT_STATUS_IS_OK(result
), handle
,
1741 "%s", smb_fname
->base_name
);
1746 static int smb_full_audit_get_real_filename(struct vfs_handle_struct
*handle
,
1749 TALLOC_CTX
*mem_ctx
,
1754 result
= SMB_VFS_NEXT_GET_REAL_FILENAME(handle
, path
, name
, mem_ctx
,
1757 do_log(SMB_VFS_OP_GET_REAL_FILENAME
, (result
== 0), handle
,
1758 "%s/%s->%s", path
, name
, (result
== 0) ? "" : *found_name
);
1763 static const char *smb_full_audit_connectpath(vfs_handle_struct
*handle
,
1764 const struct smb_filename
*smb_fname
)
1768 result
= SMB_VFS_NEXT_CONNECTPATH(handle
, smb_fname
);
1770 do_log(SMB_VFS_OP_CONNECTPATH
, result
!= NULL
, handle
,
1771 "%s", smb_fname
->base_name
);
1776 static NTSTATUS
smb_full_audit_brl_lock_windows(struct vfs_handle_struct
*handle
,
1777 struct byte_range_lock
*br_lck
,
1778 struct lock_struct
*plock
,
1783 result
= SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle
, br_lck
, plock
,
1786 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS
, NT_STATUS_IS_OK(result
), handle
,
1787 "%s:%llu-%llu. type=%d. blocking=%d",
1788 fsp_str_do_log(brl_fsp(br_lck
)),
1789 (unsigned long long)plock
->start
,
1790 (unsigned long long)plock
->size
,
1797 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct
*handle
,
1798 struct messaging_context
*msg_ctx
,
1799 struct byte_range_lock
*br_lck
,
1800 const struct lock_struct
*plock
)
1804 result
= SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle
, msg_ctx
, br_lck
,
1807 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS
, (result
== 0), handle
,
1808 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck
)),
1809 (unsigned long long)plock
->start
,
1810 (unsigned long long)plock
->size
,
1816 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct
*handle
,
1817 struct byte_range_lock
*br_lck
,
1818 struct lock_struct
*plock
)
1822 result
= SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle
, br_lck
, plock
);
1824 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS
, (result
== 0), handle
,
1825 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck
)),
1826 (unsigned long long)plock
->start
,
1827 (unsigned long long)plock
->size
,
1833 static bool smb_full_audit_strict_lock_check(struct vfs_handle_struct
*handle
,
1834 struct files_struct
*fsp
,
1835 struct lock_struct
*plock
)
1839 result
= SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle
, fsp
, plock
);
1841 do_log(SMB_VFS_OP_STRICT_LOCK_CHECK
, result
, handle
,
1842 "%s:%llu-%llu:%d", fsp_str_do_log(fsp
),
1843 (unsigned long long)plock
->start
,
1844 (unsigned long long)plock
->size
,
1850 static NTSTATUS
smb_full_audit_translate_name(struct vfs_handle_struct
*handle
,
1852 enum vfs_translate_direction direction
,
1853 TALLOC_CTX
*mem_ctx
,
1858 result
= SMB_VFS_NEXT_TRANSLATE_NAME(handle
, name
, direction
, mem_ctx
,
1861 do_log(SMB_VFS_OP_TRANSLATE_NAME
, NT_STATUS_IS_OK(result
), handle
, "");
1866 static NTSTATUS
smb_full_audit_fsctl(struct vfs_handle_struct
*handle
,
1867 struct files_struct
*fsp
,
1871 const uint8_t *_in_data
,
1873 uint8_t **_out_data
,
1874 uint32_t max_out_len
,
1879 result
= SMB_VFS_NEXT_FSCTL(handle
,
1890 do_log(SMB_VFS_OP_FSCTL
, NT_STATUS_IS_OK(result
), handle
, "");
1895 static struct tevent_req
*smb_full_audit_offload_read_send(
1896 TALLOC_CTX
*mem_ctx
,
1897 struct tevent_context
*ev
,
1898 struct vfs_handle_struct
*handle
,
1899 struct files_struct
*fsp
,
1905 struct tevent_req
*req
= NULL
;
1907 req
= SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx
, ev
, handle
, fsp
,
1908 fsctl
, ttl
, offset
, to_copy
);
1910 do_log(SMB_VFS_OP_OFFLOAD_READ_SEND
, req
, handle
, "");
1915 static NTSTATUS
smb_full_audit_offload_read_recv(
1916 struct tevent_req
*req
,
1917 struct vfs_handle_struct
*handle
,
1918 TALLOC_CTX
*mem_ctx
,
1919 DATA_BLOB
*_token_blob
)
1923 status
= SMB_VFS_NEXT_OFFLOAD_READ_RECV(req
, handle
, mem_ctx
,
1926 do_log(SMB_VFS_OP_OFFLOAD_READ_RECV
, NT_STATUS_IS_OK(status
), handle
, "");
1931 static struct tevent_req
*smb_full_audit_offload_write_send(struct vfs_handle_struct
*handle
,
1932 TALLOC_CTX
*mem_ctx
,
1933 struct tevent_context
*ev
,
1936 off_t transfer_offset
,
1937 struct files_struct
*dest_fsp
,
1941 struct tevent_req
*req
;
1943 req
= SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle
, mem_ctx
, ev
,
1944 fsctl
, token
, transfer_offset
,
1945 dest_fsp
, dest_off
, num
);
1947 do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND
, req
, handle
, "");
1952 static NTSTATUS
smb_full_audit_offload_write_recv(struct vfs_handle_struct
*handle
,
1953 struct tevent_req
*req
,
1958 result
= SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle
, req
, copied
);
1960 do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV
, NT_STATUS_IS_OK(result
), handle
, "");
1965 static NTSTATUS
smb_full_audit_get_compression(vfs_handle_struct
*handle
,
1966 TALLOC_CTX
*mem_ctx
,
1967 struct files_struct
*fsp
,
1968 struct smb_filename
*smb_fname
,
1969 uint16_t *_compression_fmt
)
1973 result
= SMB_VFS_NEXT_GET_COMPRESSION(handle
, mem_ctx
, fsp
, smb_fname
,
1976 do_log(SMB_VFS_OP_GET_COMPRESSION
, NT_STATUS_IS_OK(result
), handle
,
1978 (fsp
? fsp_str_do_log(fsp
) : smb_fname_str_do_log(smb_fname
)));
1983 static NTSTATUS
smb_full_audit_set_compression(vfs_handle_struct
*handle
,
1984 TALLOC_CTX
*mem_ctx
,
1985 struct files_struct
*fsp
,
1986 uint16_t compression_fmt
)
1990 result
= SMB_VFS_NEXT_SET_COMPRESSION(handle
, mem_ctx
, fsp
,
1993 do_log(SMB_VFS_OP_SET_COMPRESSION
, NT_STATUS_IS_OK(result
), handle
,
1994 "%s", fsp_str_do_log(fsp
));
1999 static NTSTATUS
smb_full_audit_readdir_attr(struct vfs_handle_struct
*handle
,
2000 const struct smb_filename
*fname
,
2001 TALLOC_CTX
*mem_ctx
,
2002 struct readdir_attr_data
**pattr_data
)
2006 status
= SMB_VFS_NEXT_READDIR_ATTR(handle
, fname
, mem_ctx
, pattr_data
);
2008 do_log(SMB_VFS_OP_READDIR_ATTR
, NT_STATUS_IS_OK(status
), handle
, "%s",
2009 smb_fname_str_do_log(fname
));
2014 static NTSTATUS
smb_full_audit_get_dos_attributes(
2015 struct vfs_handle_struct
*handle
,
2016 struct smb_filename
*smb_fname
,
2021 status
= SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle
,
2025 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES
,
2026 NT_STATUS_IS_OK(status
),
2029 smb_fname_str_do_log(smb_fname
));
2034 static NTSTATUS
smb_full_audit_fget_dos_attributes(
2035 struct vfs_handle_struct
*handle
,
2036 struct files_struct
*fsp
,
2041 status
= SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle
,
2045 do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES
,
2046 NT_STATUS_IS_OK(status
),
2049 fsp_str_do_log(fsp
));
2054 static NTSTATUS
smb_full_audit_set_dos_attributes(
2055 struct vfs_handle_struct
*handle
,
2056 const struct smb_filename
*smb_fname
,
2061 status
= SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle
,
2065 do_log(SMB_VFS_OP_SET_DOS_ATTRIBUTES
,
2066 NT_STATUS_IS_OK(status
),
2069 smb_fname_str_do_log(smb_fname
));
2074 static NTSTATUS
smb_full_audit_fset_dos_attributes(
2075 struct vfs_handle_struct
*handle
,
2076 struct files_struct
*fsp
,
2081 status
= SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle
,
2085 do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES
,
2086 NT_STATUS_IS_OK(status
),
2089 fsp_str_do_log(fsp
));
2094 static NTSTATUS
smb_full_audit_fget_nt_acl(vfs_handle_struct
*handle
, files_struct
*fsp
,
2095 uint32_t security_info
,
2096 TALLOC_CTX
*mem_ctx
,
2097 struct security_descriptor
**ppdesc
)
2101 result
= SMB_VFS_NEXT_FGET_NT_ACL(handle
, fsp
, security_info
,
2104 do_log(SMB_VFS_OP_FGET_NT_ACL
, NT_STATUS_IS_OK(result
), handle
,
2105 "%s", fsp_str_do_log(fsp
));
2110 static NTSTATUS
smb_full_audit_get_nt_acl(vfs_handle_struct
*handle
,
2111 const struct smb_filename
*smb_fname
,
2112 uint32_t security_info
,
2113 TALLOC_CTX
*mem_ctx
,
2114 struct security_descriptor
**ppdesc
)
2118 result
= SMB_VFS_NEXT_GET_NT_ACL(handle
, smb_fname
, security_info
,
2121 do_log(SMB_VFS_OP_GET_NT_ACL
, NT_STATUS_IS_OK(result
), handle
,
2122 "%s", smb_fname_str_do_log(smb_fname
));
2127 static NTSTATUS
smb_full_audit_fset_nt_acl(vfs_handle_struct
*handle
, files_struct
*fsp
,
2128 uint32_t security_info_sent
,
2129 const struct security_descriptor
*psd
)
2131 struct vfs_full_audit_private_data
*pd
;
2135 SMB_VFS_HANDLE_GET_DATA(handle
, pd
,
2136 struct vfs_full_audit_private_data
,
2137 return NT_STATUS_INTERNAL_ERROR
);
2139 if (pd
->log_secdesc
) {
2140 sd
= sddl_encode(talloc_tos(), psd
, get_global_sam_sid());
2143 result
= SMB_VFS_NEXT_FSET_NT_ACL(handle
, fsp
, security_info_sent
, psd
);
2145 do_log(SMB_VFS_OP_FSET_NT_ACL
, NT_STATUS_IS_OK(result
), handle
,
2146 "%s [%s]", fsp_str_do_log(fsp
), sd
? sd
: "");
2153 static NTSTATUS
smb_full_audit_audit_file(struct vfs_handle_struct
*handle
,
2154 struct smb_filename
*file
,
2155 struct security_acl
*sacl
,
2156 uint32_t access_requested
,
2157 uint32_t access_denied
)
2161 result
= SMB_VFS_NEXT_AUDIT_FILE(handle
,
2167 do_log(SMB_VFS_OP_AUDIT_FILE
, NT_STATUS_IS_OK(result
), handle
,
2168 "%s", smb_fname_str_do_log(file
));
2173 static int smb_full_audit_chmod_acl(vfs_handle_struct
*handle
,
2174 const struct smb_filename
*smb_fname
,
2179 result
= SMB_VFS_NEXT_CHMOD_ACL(handle
, smb_fname
, mode
);
2181 do_log(SMB_VFS_OP_CHMOD_ACL
, (result
>= 0), handle
,
2182 "%s|%o", smb_fname
->base_name
, mode
);
2187 static int smb_full_audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
,
2192 result
= SMB_VFS_NEXT_FCHMOD_ACL(handle
, fsp
, mode
);
2194 do_log(SMB_VFS_OP_FCHMOD_ACL
, (result
>= 0), handle
,
2195 "%s|%o", fsp_str_do_log(fsp
), mode
);
2200 static SMB_ACL_T
smb_full_audit_sys_acl_get_file(vfs_handle_struct
*handle
,
2201 const struct smb_filename
*smb_fname
,
2202 SMB_ACL_TYPE_T type
,
2203 TALLOC_CTX
*mem_ctx
)
2207 result
= SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle
, smb_fname
,
2210 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE
, (result
!= NULL
), handle
,
2211 "%s", smb_fname
->base_name
);
2216 static SMB_ACL_T
smb_full_audit_sys_acl_get_fd(vfs_handle_struct
*handle
,
2217 files_struct
*fsp
, TALLOC_CTX
*mem_ctx
)
2221 result
= SMB_VFS_NEXT_SYS_ACL_GET_FD(handle
, fsp
, mem_ctx
);
2223 do_log(SMB_VFS_OP_SYS_ACL_GET_FD
, (result
!= NULL
), handle
,
2224 "%s", fsp_str_do_log(fsp
));
2229 static int smb_full_audit_sys_acl_blob_get_file(vfs_handle_struct
*handle
,
2230 const struct smb_filename
*smb_fname
,
2231 TALLOC_CTX
*mem_ctx
,
2232 char **blob_description
,
2237 result
= SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle
, smb_fname
,
2238 mem_ctx
, blob_description
, blob
);
2240 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE
, (result
>= 0), handle
,
2241 "%s", smb_fname
->base_name
);
2246 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct
*handle
,
2248 TALLOC_CTX
*mem_ctx
,
2249 char **blob_description
,
2254 result
= SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle
, fsp
, mem_ctx
, blob_description
, blob
);
2256 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD
, (result
>= 0), handle
,
2257 "%s", fsp_str_do_log(fsp
));
2262 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct
*handle
,
2263 const struct smb_filename
*smb_fname
,
2264 SMB_ACL_TYPE_T acltype
,
2269 result
= SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle
, smb_fname
, acltype
,
2272 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE
, (result
>= 0), handle
,
2273 "%s", smb_fname
->base_name
);
2278 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct
*handle
, files_struct
*fsp
,
2283 result
= SMB_VFS_NEXT_SYS_ACL_SET_FD(handle
, fsp
, theacl
);
2285 do_log(SMB_VFS_OP_SYS_ACL_SET_FD
, (result
>= 0), handle
,
2286 "%s", fsp_str_do_log(fsp
));
2291 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct
*handle
,
2292 const struct smb_filename
*smb_fname
)
2296 result
= SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle
, smb_fname
);
2298 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE
, (result
>= 0), handle
,
2299 "%s", smb_fname
->base_name
);
2304 static ssize_t
smb_full_audit_getxattr(struct vfs_handle_struct
*handle
,
2305 const struct smb_filename
*smb_fname
,
2306 const char *name
, void *value
, size_t size
)
2310 result
= SMB_VFS_NEXT_GETXATTR(handle
, smb_fname
, name
, value
, size
);
2312 do_log(SMB_VFS_OP_GETXATTR
, (result
>= 0), handle
,
2313 "%s|%s", smb_fname
->base_name
, name
);
2318 static ssize_t
smb_full_audit_fgetxattr(struct vfs_handle_struct
*handle
,
2319 struct files_struct
*fsp
,
2320 const char *name
, void *value
, size_t size
)
2324 result
= SMB_VFS_NEXT_FGETXATTR(handle
, fsp
, name
, value
, size
);
2326 do_log(SMB_VFS_OP_FGETXATTR
, (result
>= 0), handle
,
2327 "%s|%s", fsp_str_do_log(fsp
), name
);
2332 static ssize_t
smb_full_audit_listxattr(struct vfs_handle_struct
*handle
,
2333 const struct smb_filename
*smb_fname
,
2339 result
= SMB_VFS_NEXT_LISTXATTR(handle
, smb_fname
, list
, size
);
2341 do_log(SMB_VFS_OP_LISTXATTR
, (result
>= 0), handle
, "%s",
2342 smb_fname
->base_name
);
2347 static ssize_t
smb_full_audit_flistxattr(struct vfs_handle_struct
*handle
,
2348 struct files_struct
*fsp
, char *list
,
2353 result
= SMB_VFS_NEXT_FLISTXATTR(handle
, fsp
, list
, size
);
2355 do_log(SMB_VFS_OP_FLISTXATTR
, (result
>= 0), handle
,
2356 "%s", fsp_str_do_log(fsp
));
2361 static int smb_full_audit_removexattr(struct vfs_handle_struct
*handle
,
2362 const struct smb_filename
*smb_fname
,
2367 result
= SMB_VFS_NEXT_REMOVEXATTR(handle
, smb_fname
, name
);
2369 do_log(SMB_VFS_OP_REMOVEXATTR
, (result
>= 0), handle
,
2370 "%s|%s", smb_fname
->base_name
, name
);
2375 static int smb_full_audit_fremovexattr(struct vfs_handle_struct
*handle
,
2376 struct files_struct
*fsp
,
2381 result
= SMB_VFS_NEXT_FREMOVEXATTR(handle
, fsp
, name
);
2383 do_log(SMB_VFS_OP_FREMOVEXATTR
, (result
>= 0), handle
,
2384 "%s|%s", fsp_str_do_log(fsp
), name
);
2389 static int smb_full_audit_setxattr(struct vfs_handle_struct
*handle
,
2390 const struct smb_filename
*smb_fname
,
2391 const char *name
, const void *value
, size_t size
,
2396 result
= SMB_VFS_NEXT_SETXATTR(handle
, smb_fname
, name
, value
, size
,
2399 do_log(SMB_VFS_OP_SETXATTR
, (result
>= 0), handle
,
2400 "%s|%s", smb_fname
->base_name
, name
);
2405 static int smb_full_audit_fsetxattr(struct vfs_handle_struct
*handle
,
2406 struct files_struct
*fsp
, const char *name
,
2407 const void *value
, size_t size
, int flags
)
2411 result
= SMB_VFS_NEXT_FSETXATTR(handle
, fsp
, name
, value
, size
, flags
);
2413 do_log(SMB_VFS_OP_FSETXATTR
, (result
>= 0), handle
,
2414 "%s|%s", fsp_str_do_log(fsp
), name
);
2419 static bool smb_full_audit_aio_force(struct vfs_handle_struct
*handle
,
2420 struct files_struct
*fsp
)
2424 result
= SMB_VFS_NEXT_AIO_FORCE(handle
, fsp
);
2425 do_log(SMB_VFS_OP_AIO_FORCE
, result
, handle
,
2426 "%s", fsp_str_do_log(fsp
));
2431 static NTSTATUS
smb_full_audit_durable_cookie(struct vfs_handle_struct
*handle
,
2432 struct files_struct
*fsp
,
2433 TALLOC_CTX
*mem_ctx
,
2438 result
= SMB_VFS_NEXT_DURABLE_COOKIE(handle
,
2443 do_log(SMB_VFS_OP_DURABLE_COOKIE
, NT_STATUS_IS_OK(result
), handle
,
2444 "%s", fsp_str_do_log(fsp
));
2449 static NTSTATUS
smb_full_audit_durable_disconnect(
2450 struct vfs_handle_struct
*handle
,
2451 struct files_struct
*fsp
,
2452 const DATA_BLOB old_cookie
,
2453 TALLOC_CTX
*mem_ctx
,
2454 DATA_BLOB
*new_cookie
)
2458 result
= SMB_VFS_NEXT_DURABLE_DISCONNECT(handle
,
2464 do_log(SMB_VFS_OP_DURABLE_DISCONNECT
, NT_STATUS_IS_OK(result
), handle
,
2465 "%s", fsp_str_do_log(fsp
));
2470 static NTSTATUS
smb_full_audit_durable_reconnect(
2471 struct vfs_handle_struct
*handle
,
2472 struct smb_request
*smb1req
,
2473 struct smbXsrv_open
*op
,
2474 const DATA_BLOB old_cookie
,
2475 TALLOC_CTX
*mem_ctx
,
2476 struct files_struct
**fsp
,
2477 DATA_BLOB
*new_cookie
)
2481 result
= SMB_VFS_NEXT_DURABLE_RECONNECT(handle
,
2489 do_log(SMB_VFS_OP_DURABLE_RECONNECT
,
2490 NT_STATUS_IS_OK(result
),
2497 static struct vfs_fn_pointers vfs_full_audit_fns
= {
2499 /* Disk operations */
2501 .connect_fn
= smb_full_audit_connect
,
2502 .disconnect_fn
= smb_full_audit_disconnect
,
2503 .disk_free_fn
= smb_full_audit_disk_free
,
2504 .get_quota_fn
= smb_full_audit_get_quota
,
2505 .set_quota_fn
= smb_full_audit_set_quota
,
2506 .get_shadow_copy_data_fn
= smb_full_audit_get_shadow_copy_data
,
2507 .statvfs_fn
= smb_full_audit_statvfs
,
2508 .fs_capabilities_fn
= smb_full_audit_fs_capabilities
,
2509 .get_dfs_referrals_fn
= smb_full_audit_get_dfs_referrals
,
2510 .opendir_fn
= smb_full_audit_opendir
,
2511 .fdopendir_fn
= smb_full_audit_fdopendir
,
2512 .readdir_fn
= smb_full_audit_readdir
,
2513 .seekdir_fn
= smb_full_audit_seekdir
,
2514 .telldir_fn
= smb_full_audit_telldir
,
2515 .rewind_dir_fn
= smb_full_audit_rewinddir
,
2516 .mkdir_fn
= smb_full_audit_mkdir
,
2517 .rmdir_fn
= smb_full_audit_rmdir
,
2518 .closedir_fn
= smb_full_audit_closedir
,
2519 .open_fn
= smb_full_audit_open
,
2520 .create_file_fn
= smb_full_audit_create_file
,
2521 .close_fn
= smb_full_audit_close
,
2522 .read_fn
= smb_full_audit_read
,
2523 .pread_fn
= smb_full_audit_pread
,
2524 .pread_send_fn
= smb_full_audit_pread_send
,
2525 .pread_recv_fn
= smb_full_audit_pread_recv
,
2526 .write_fn
= smb_full_audit_write
,
2527 .pwrite_fn
= smb_full_audit_pwrite
,
2528 .pwrite_send_fn
= smb_full_audit_pwrite_send
,
2529 .pwrite_recv_fn
= smb_full_audit_pwrite_recv
,
2530 .lseek_fn
= smb_full_audit_lseek
,
2531 .sendfile_fn
= smb_full_audit_sendfile
,
2532 .recvfile_fn
= smb_full_audit_recvfile
,
2533 .rename_fn
= smb_full_audit_rename
,
2534 .fsync_fn
= smb_full_audit_fsync
,
2535 .fsync_send_fn
= smb_full_audit_fsync_send
,
2536 .fsync_recv_fn
= smb_full_audit_fsync_recv
,
2537 .stat_fn
= smb_full_audit_stat
,
2538 .fstat_fn
= smb_full_audit_fstat
,
2539 .lstat_fn
= smb_full_audit_lstat
,
2540 .get_alloc_size_fn
= smb_full_audit_get_alloc_size
,
2541 .unlink_fn
= smb_full_audit_unlink
,
2542 .chmod_fn
= smb_full_audit_chmod
,
2543 .fchmod_fn
= smb_full_audit_fchmod
,
2544 .chown_fn
= smb_full_audit_chown
,
2545 .fchown_fn
= smb_full_audit_fchown
,
2546 .lchown_fn
= smb_full_audit_lchown
,
2547 .chdir_fn
= smb_full_audit_chdir
,
2548 .getwd_fn
= smb_full_audit_getwd
,
2549 .ntimes_fn
= smb_full_audit_ntimes
,
2550 .ftruncate_fn
= smb_full_audit_ftruncate
,
2551 .fallocate_fn
= smb_full_audit_fallocate
,
2552 .lock_fn
= smb_full_audit_lock
,
2553 .kernel_flock_fn
= smb_full_audit_kernel_flock
,
2554 .linux_setlease_fn
= smb_full_audit_linux_setlease
,
2555 .getlock_fn
= smb_full_audit_getlock
,
2556 .symlink_fn
= smb_full_audit_symlink
,
2557 .readlink_fn
= smb_full_audit_readlink
,
2558 .link_fn
= smb_full_audit_link
,
2559 .mknod_fn
= smb_full_audit_mknod
,
2560 .realpath_fn
= smb_full_audit_realpath
,
2561 .chflags_fn
= smb_full_audit_chflags
,
2562 .file_id_create_fn
= smb_full_audit_file_id_create
,
2563 .offload_read_send_fn
= smb_full_audit_offload_read_send
,
2564 .offload_read_recv_fn
= smb_full_audit_offload_read_recv
,
2565 .offload_write_send_fn
= smb_full_audit_offload_write_send
,
2566 .offload_write_recv_fn
= smb_full_audit_offload_write_recv
,
2567 .get_compression_fn
= smb_full_audit_get_compression
,
2568 .set_compression_fn
= smb_full_audit_set_compression
,
2569 .snap_check_path_fn
= smb_full_audit_snap_check_path
,
2570 .snap_create_fn
= smb_full_audit_snap_create
,
2571 .snap_delete_fn
= smb_full_audit_snap_delete
,
2572 .streaminfo_fn
= smb_full_audit_streaminfo
,
2573 .get_real_filename_fn
= smb_full_audit_get_real_filename
,
2574 .connectpath_fn
= smb_full_audit_connectpath
,
2575 .brl_lock_windows_fn
= smb_full_audit_brl_lock_windows
,
2576 .brl_unlock_windows_fn
= smb_full_audit_brl_unlock_windows
,
2577 .brl_cancel_windows_fn
= smb_full_audit_brl_cancel_windows
,
2578 .strict_lock_check_fn
= smb_full_audit_strict_lock_check
,
2579 .translate_name_fn
= smb_full_audit_translate_name
,
2580 .fsctl_fn
= smb_full_audit_fsctl
,
2581 .get_dos_attributes_fn
= smb_full_audit_get_dos_attributes
,
2582 .fget_dos_attributes_fn
= smb_full_audit_fget_dos_attributes
,
2583 .set_dos_attributes_fn
= smb_full_audit_set_dos_attributes
,
2584 .fset_dos_attributes_fn
= smb_full_audit_fset_dos_attributes
,
2585 .fget_nt_acl_fn
= smb_full_audit_fget_nt_acl
,
2586 .get_nt_acl_fn
= smb_full_audit_get_nt_acl
,
2587 .fset_nt_acl_fn
= smb_full_audit_fset_nt_acl
,
2588 .audit_file_fn
= smb_full_audit_audit_file
,
2589 .chmod_acl_fn
= smb_full_audit_chmod_acl
,
2590 .fchmod_acl_fn
= smb_full_audit_fchmod_acl
,
2591 .sys_acl_get_file_fn
= smb_full_audit_sys_acl_get_file
,
2592 .sys_acl_get_fd_fn
= smb_full_audit_sys_acl_get_fd
,
2593 .sys_acl_blob_get_file_fn
= smb_full_audit_sys_acl_blob_get_file
,
2594 .sys_acl_blob_get_fd_fn
= smb_full_audit_sys_acl_blob_get_fd
,
2595 .sys_acl_set_file_fn
= smb_full_audit_sys_acl_set_file
,
2596 .sys_acl_set_fd_fn
= smb_full_audit_sys_acl_set_fd
,
2597 .sys_acl_delete_def_file_fn
= smb_full_audit_sys_acl_delete_def_file
,
2598 .getxattr_fn
= smb_full_audit_getxattr
,
2599 .fgetxattr_fn
= smb_full_audit_fgetxattr
,
2600 .listxattr_fn
= smb_full_audit_listxattr
,
2601 .flistxattr_fn
= smb_full_audit_flistxattr
,
2602 .removexattr_fn
= smb_full_audit_removexattr
,
2603 .fremovexattr_fn
= smb_full_audit_fremovexattr
,
2604 .setxattr_fn
= smb_full_audit_setxattr
,
2605 .fsetxattr_fn
= smb_full_audit_fsetxattr
,
2606 .aio_force_fn
= smb_full_audit_aio_force
,
2607 .durable_cookie_fn
= smb_full_audit_durable_cookie
,
2608 .durable_disconnect_fn
= smb_full_audit_durable_disconnect
,
2609 .durable_reconnect_fn
= smb_full_audit_durable_reconnect
,
2610 .readdir_attr_fn
= smb_full_audit_readdir_attr
2615 NTSTATUS
vfs_full_audit_init(TALLOC_CTX
*ctx
)
2619 smb_vfs_assert_all_fns(&vfs_full_audit_fns
, "full_audit");
2621 ret
= smb_register_vfs(SMB_VFS_INTERFACE_VERSION
, "full_audit",
2622 &vfs_full_audit_fns
);
2624 if (!NT_STATUS_IS_OK(ret
))
2627 vfs_full_audit_debug_level
= debug_add_class("full_audit");
2628 if (vfs_full_audit_debug_level
== -1) {
2629 vfs_full_audit_debug_level
= DBGC_VFS
;
2630 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2633 DEBUG(10, ("vfs_full_audit: Debug class number of "
2634 "'full_audit': %d\n", vfs_full_audit_debug_level
));