?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix bug 7326 -- can't write with vfs_full_audit active
[Samba.git] / source3 / modules / vfs_full_audit.c
blobac7f7a3cc87d38efcbbdecf568f33f149e7f0dea
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61
62 static int vfs_full_audit_debug_level = DBGC_VFS;
63
64 struct vfs_full_audit_private_data {
65 struct bitmap *success_ops;
66 struct bitmap *failure_ops;
67 };
68
69 #undef DBGC_CLASS
70 #define DBGC_CLASS vfs_full_audit_debug_level
71
72 /* Function prototypes */
73
74 static int smb_full_audit_connect(vfs_handle_struct *handle,
75 const char *svc, const char *user);
76 static void smb_full_audit_disconnect(vfs_handle_struct *handle);
77 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
78 const char *path,
79 bool small_query, uint64_t *bsize,
80 uint64_t *dfree, uint64_t *dsize);
81 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
82 enum SMB_QUOTA_TYPE qtype, unid_t id,
83 SMB_DISK_QUOTA *qt);
84 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
85 enum SMB_QUOTA_TYPE qtype, unid_t id,
86 SMB_DISK_QUOTA *qt);
87 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
88 struct files_struct *fsp,
89 SHADOW_COPY_DATA *shadow_copy_data, bool labels);
90 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
91 const char *path,
92 struct vfs_statvfs_struct *statbuf);
93 static int smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle);
94 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
95 const char *fname, const char *mask, uint32 attr);
96 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
97 SMB_STRUCT_DIR *dirp,
98 SMB_STRUCT_STAT *sbuf);
99 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
100 SMB_STRUCT_DIR *dirp, long offset);
101 static long smb_full_audit_telldir(vfs_handle_struct *handle,
102 SMB_STRUCT_DIR *dirp);
103 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
104 SMB_STRUCT_DIR *dirp);
105 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
106 const char *path, mode_t mode);
107 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
108 const char *path);
109 static int smb_full_audit_closedir(vfs_handle_struct *handle,
110 SMB_STRUCT_DIR *dirp);
111 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
112 SMB_STRUCT_DIR *dirp);
113 static int smb_full_audit_open(vfs_handle_struct *handle,
114 const char *fname, files_struct *fsp, int flags, mode_t mode);
115 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
116 struct smb_request *req,
117 uint16_t root_dir_fid,
118 const char *fname,
119 uint32_t create_file_flags,
120 uint32_t access_mask,
121 uint32_t share_access,
122 uint32_t create_disposition,
123 uint32_t create_options,
124 uint32_t file_attributes,
125 uint32_t oplock_request,
126 uint64_t allocation_size,
127 struct security_descriptor *sd,
128 struct ea_list *ea_list,
129 files_struct **result,
130 int *pinfo,
131 SMB_STRUCT_STAT *psbuf);
132 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp);
133 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
134 void *data, size_t n);
135 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
136 void *data, size_t n, SMB_OFF_T offset);
137 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
138 const void *data, size_t n);
139 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
140 const void *data, size_t n,
141 SMB_OFF_T offset);
142 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
143 SMB_OFF_T offset, int whence);
144 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
145 files_struct *fromfsp,
146 const DATA_BLOB *hdr, SMB_OFF_T offset,
147 size_t n);
148 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
149 files_struct *tofsp,
150 SMB_OFF_T offset,
151 size_t n);
152 static int smb_full_audit_rename(vfs_handle_struct *handle,
153 const char *oldname, const char *newname);
154 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp);
155 static int smb_full_audit_stat(vfs_handle_struct *handle,
156 const char *fname, SMB_STRUCT_STAT *sbuf);
157 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
158 SMB_STRUCT_STAT *sbuf);
159 static int smb_full_audit_lstat(vfs_handle_struct *handle,
160 const char *path, SMB_STRUCT_STAT *sbuf);
161 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
162 files_struct *fsp, const SMB_STRUCT_STAT *sbuf);
163 static int smb_full_audit_unlink(vfs_handle_struct *handle,
164 const char *path);
165 static int smb_full_audit_chmod(vfs_handle_struct *handle,
166 const char *path, mode_t mode);
167 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
168 mode_t mode);
169 static int smb_full_audit_chown(vfs_handle_struct *handle,
170 const char *path, uid_t uid, gid_t gid);
171 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
172 uid_t uid, gid_t gid);
173 static int smb_full_audit_lchown(vfs_handle_struct *handle,
174 const char *path, uid_t uid, gid_t gid);
175 static int smb_full_audit_chdir(vfs_handle_struct *handle,
176 const char *path);
177 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
178 char *path);
179 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
180 const char *path, struct smb_file_time *ft);
181 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
182 SMB_OFF_T len);
183 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
184 int op, SMB_OFF_T offset, SMB_OFF_T count, int type);
185 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
186 struct files_struct *fsp,
187 uint32 share_mode);
188 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
189 int leasetype);
190 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
191 SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid);
192 static int smb_full_audit_symlink(vfs_handle_struct *handle,
193 const char *oldpath, const char *newpath);
194 static int smb_full_audit_readlink(vfs_handle_struct *handle,
195 const char *path, char *buf, size_t bufsiz);
196 static int smb_full_audit_link(vfs_handle_struct *handle,
197 const char *oldpath, const char *newpath);
198 static int smb_full_audit_mknod(vfs_handle_struct *handle,
199 const char *pathname, mode_t mode, SMB_DEV_T dev);
200 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
201 const char *path, char *resolved_path);
202 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
203 struct sys_notify_context *ctx,
204 struct notify_entry *e,
205 void (*callback)(struct sys_notify_context *ctx,
206 void *private_data,
207 struct notify_event *ev),
208 void *private_data, void *handle_p);
209 static int smb_full_audit_chflags(vfs_handle_struct *handle,
210 const char *path, unsigned int flags);
211 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
212 const SMB_STRUCT_STAT *sbuf);
213 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
214 struct files_struct *fsp,
215 const char *fname,
216 TALLOC_CTX *mem_ctx,
217 unsigned int *pnum_streams,
218 struct stream_struct **pstreams);
219 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
220 const char *path,
221 const char *name,
222 TALLOC_CTX *mem_ctx,
223 char **found_name);
224 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
225 struct byte_range_lock *br_lck,
226 struct lock_struct *plock,
227 bool blocking_lock,
228 struct blocking_lock_record *blr);
229 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
230 struct messaging_context *msg_ctx,
231 struct byte_range_lock *br_lck,
232 const struct lock_struct *plock);
233 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
234 struct byte_range_lock *br_lck,
235 struct lock_struct *plock,
236 struct blocking_lock_record *blr);
237 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
238 struct files_struct *fsp,
239 struct lock_struct *plock);
240 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
241 struct files_struct *fsp,
242 struct lock_struct *plock);
243 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
244 uint32 security_info,
245 SEC_DESC **ppdesc);
246 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
247 const char *name, uint32 security_info,
248 SEC_DESC **ppdesc);
249 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
250 uint32 security_info_sent,
251 const SEC_DESC *psd);
252 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
253 const char *path, mode_t mode);
254 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
255 mode_t mode);
256 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
257 SMB_ACL_T theacl, int entry_id,
258 SMB_ACL_ENTRY_T *entry_p);
259 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
260 SMB_ACL_ENTRY_T entry_d,
261 SMB_ACL_TAG_T *tag_type_p);
262 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
263 SMB_ACL_ENTRY_T entry_d,
264 SMB_ACL_PERMSET_T *permset_p);
265 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
266 SMB_ACL_ENTRY_T entry_d);
267 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
268 const char *path_p,
269 SMB_ACL_TYPE_T type);
270 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
271 files_struct *fsp);
272 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
273 SMB_ACL_PERMSET_T permset);
274 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
275 SMB_ACL_PERMSET_T permset,
276 SMB_ACL_PERM_T perm);
277 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
278 SMB_ACL_T theacl,
279 ssize_t *plen);
280 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
281 int count);
282 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
283 SMB_ACL_T *pacl,
284 SMB_ACL_ENTRY_T *pentry);
285 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
286 SMB_ACL_ENTRY_T entry,
287 SMB_ACL_TAG_T tagtype);
288 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
289 SMB_ACL_ENTRY_T entry,
290 void *qual);
291 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
292 SMB_ACL_ENTRY_T entry,
293 SMB_ACL_PERMSET_T permset);
294 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
295 SMB_ACL_T theacl );
296 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
297 const char *name, SMB_ACL_TYPE_T acltype,
298 SMB_ACL_T theacl);
299 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
300 SMB_ACL_T theacl);
301 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
302 const char *path);
303 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
304 SMB_ACL_PERMSET_T permset,
305 SMB_ACL_PERM_T perm);
306 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
307 char *text);
308 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
309 SMB_ACL_T posix_acl);
310 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
311 void *qualifier,
312 SMB_ACL_TAG_T tagtype);
313 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
314 const char *path,
315 const char *name, void *value, size_t size);
316 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
317 const char *path, const char *name,
318 void *value, size_t size);
319 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
320 struct files_struct *fsp,
321 const char *name, void *value, size_t size);
322 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
323 const char *path, char *list, size_t size);
324 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
325 const char *path, char *list, size_t size);
326 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
327 struct files_struct *fsp, char *list,
328 size_t size);
329 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
330 const char *path,
331 const char *name);
332 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
333 const char *path,
334 const char *name);
335 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
336 struct files_struct *fsp,
337 const char *name);
338 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
339 const char *path,
340 const char *name, const void *value, size_t size,
341 int flags);
342 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
343 const char *path,
344 const char *name, const void *value, size_t size,
345 int flags);
346 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
347 struct files_struct *fsp, const char *name,
348 const void *value, size_t size, int flags);
349
350 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
351 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
352 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
353 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
354 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
355 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb);
356 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts);
357 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
358 struct files_struct *fsp);
359
360 /* VFS operations */
361
362 static vfs_op_tuple audit_op_tuples[] = {
363
364 /* Disk operations */
365
366 {SMB_VFS_OP(smb_full_audit_connect), SMB_VFS_OP_CONNECT,
367 SMB_VFS_LAYER_LOGGER},
368 {SMB_VFS_OP(smb_full_audit_disconnect), SMB_VFS_OP_DISCONNECT,
369 SMB_VFS_LAYER_LOGGER},
370 {SMB_VFS_OP(smb_full_audit_disk_free), SMB_VFS_OP_DISK_FREE,
371 SMB_VFS_LAYER_LOGGER},
372 {SMB_VFS_OP(smb_full_audit_get_quota), SMB_VFS_OP_GET_QUOTA,
373 SMB_VFS_LAYER_LOGGER},
374 {SMB_VFS_OP(smb_full_audit_set_quota), SMB_VFS_OP_SET_QUOTA,
375 SMB_VFS_LAYER_LOGGER},
376 {SMB_VFS_OP(smb_full_audit_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,
377 SMB_VFS_LAYER_LOGGER},
378 {SMB_VFS_OP(smb_full_audit_statvfs), SMB_VFS_OP_STATVFS,
379 SMB_VFS_LAYER_LOGGER},
380 {SMB_VFS_OP(smb_full_audit_fs_capabilities), SMB_VFS_OP_FS_CAPABILITIES,
381 SMB_VFS_LAYER_LOGGER},
382
383 /* Directory operations */
384
385 {SMB_VFS_OP(smb_full_audit_opendir), SMB_VFS_OP_OPENDIR,
386 SMB_VFS_LAYER_LOGGER},
387 {SMB_VFS_OP(smb_full_audit_readdir), SMB_VFS_OP_READDIR,
388 SMB_VFS_LAYER_LOGGER},
389 {SMB_VFS_OP(smb_full_audit_seekdir), SMB_VFS_OP_SEEKDIR,
390 SMB_VFS_LAYER_LOGGER},
391 {SMB_VFS_OP(smb_full_audit_telldir), SMB_VFS_OP_TELLDIR,
392 SMB_VFS_LAYER_LOGGER},
393 {SMB_VFS_OP(smb_full_audit_rewinddir), SMB_VFS_OP_REWINDDIR,
394 SMB_VFS_LAYER_LOGGER},
395 {SMB_VFS_OP(smb_full_audit_mkdir), SMB_VFS_OP_MKDIR,
396 SMB_VFS_LAYER_LOGGER},
397 {SMB_VFS_OP(smb_full_audit_rmdir), SMB_VFS_OP_RMDIR,
398 SMB_VFS_LAYER_LOGGER},
399 {SMB_VFS_OP(smb_full_audit_closedir), SMB_VFS_OP_CLOSEDIR,
400 SMB_VFS_LAYER_LOGGER},
401 {SMB_VFS_OP(smb_full_audit_init_search_op), SMB_VFS_OP_INIT_SEARCH_OP,
402 SMB_VFS_LAYER_LOGGER},
403
404 /* File operations */
405
406 {SMB_VFS_OP(smb_full_audit_open), SMB_VFS_OP_OPEN,
407 SMB_VFS_LAYER_LOGGER},
408 {SMB_VFS_OP(smb_full_audit_create_file),SMB_VFS_OP_CREATE_FILE,
409 SMB_VFS_LAYER_LOGGER},
410 {SMB_VFS_OP(smb_full_audit_close), SMB_VFS_OP_CLOSE,
411 SMB_VFS_LAYER_LOGGER},
412 {SMB_VFS_OP(smb_full_audit_read), SMB_VFS_OP_READ,
413 SMB_VFS_LAYER_LOGGER},
414 {SMB_VFS_OP(smb_full_audit_pread), SMB_VFS_OP_PREAD,
415 SMB_VFS_LAYER_LOGGER},
416 {SMB_VFS_OP(smb_full_audit_write), SMB_VFS_OP_WRITE,
417 SMB_VFS_LAYER_LOGGER},
418 {SMB_VFS_OP(smb_full_audit_pwrite), SMB_VFS_OP_PWRITE,
419 SMB_VFS_LAYER_LOGGER},
420 {SMB_VFS_OP(smb_full_audit_lseek), SMB_VFS_OP_LSEEK,
421 SMB_VFS_LAYER_LOGGER},
422 {SMB_VFS_OP(smb_full_audit_sendfile), SMB_VFS_OP_SENDFILE,
423 SMB_VFS_LAYER_LOGGER},
424 {SMB_VFS_OP(smb_full_audit_recvfile), SMB_VFS_OP_RECVFILE,
425 SMB_VFS_LAYER_LOGGER},
426 {SMB_VFS_OP(smb_full_audit_rename), SMB_VFS_OP_RENAME,
427 SMB_VFS_LAYER_LOGGER},
428 {SMB_VFS_OP(smb_full_audit_fsync), SMB_VFS_OP_FSYNC,
429 SMB_VFS_LAYER_LOGGER},
430 {SMB_VFS_OP(smb_full_audit_stat), SMB_VFS_OP_STAT,
431 SMB_VFS_LAYER_LOGGER},
432 {SMB_VFS_OP(smb_full_audit_fstat), SMB_VFS_OP_FSTAT,
433 SMB_VFS_LAYER_LOGGER},
434 {SMB_VFS_OP(smb_full_audit_lstat), SMB_VFS_OP_LSTAT,
435 SMB_VFS_LAYER_LOGGER},
436 {SMB_VFS_OP(smb_full_audit_get_alloc_size), SMB_VFS_OP_GET_ALLOC_SIZE,
437 SMB_VFS_LAYER_LOGGER},
438 {SMB_VFS_OP(smb_full_audit_unlink), SMB_VFS_OP_UNLINK,
439 SMB_VFS_LAYER_LOGGER},
440 {SMB_VFS_OP(smb_full_audit_chmod), SMB_VFS_OP_CHMOD,
441 SMB_VFS_LAYER_LOGGER},
442 {SMB_VFS_OP(smb_full_audit_fchmod), SMB_VFS_OP_FCHMOD,
443 SMB_VFS_LAYER_LOGGER},
444 {SMB_VFS_OP(smb_full_audit_chown), SMB_VFS_OP_CHOWN,
445 SMB_VFS_LAYER_LOGGER},
446 {SMB_VFS_OP(smb_full_audit_fchown), SMB_VFS_OP_FCHOWN,
447 SMB_VFS_LAYER_LOGGER},
448 {SMB_VFS_OP(smb_full_audit_lchown), SMB_VFS_OP_LCHOWN,
449 SMB_VFS_LAYER_LOGGER},
450 {SMB_VFS_OP(smb_full_audit_chdir), SMB_VFS_OP_CHDIR,
451 SMB_VFS_LAYER_LOGGER},
452 {SMB_VFS_OP(smb_full_audit_getwd), SMB_VFS_OP_GETWD,
453 SMB_VFS_LAYER_LOGGER},
454 {SMB_VFS_OP(smb_full_audit_ntimes), SMB_VFS_OP_NTIMES,
455 SMB_VFS_LAYER_LOGGER},
456 {SMB_VFS_OP(smb_full_audit_ftruncate), SMB_VFS_OP_FTRUNCATE,
457 SMB_VFS_LAYER_LOGGER},
458 {SMB_VFS_OP(smb_full_audit_lock), SMB_VFS_OP_LOCK,
459 SMB_VFS_LAYER_LOGGER},
460 {SMB_VFS_OP(smb_full_audit_kernel_flock), SMB_VFS_OP_KERNEL_FLOCK,
461 SMB_VFS_LAYER_LOGGER},
462 {SMB_VFS_OP(smb_full_audit_linux_setlease), SMB_VFS_OP_LINUX_SETLEASE,
463 SMB_VFS_LAYER_LOGGER},
464 {SMB_VFS_OP(smb_full_audit_getlock), SMB_VFS_OP_GETLOCK,
465 SMB_VFS_LAYER_LOGGER},
466 {SMB_VFS_OP(smb_full_audit_symlink), SMB_VFS_OP_SYMLINK,
467 SMB_VFS_LAYER_LOGGER},
468 {SMB_VFS_OP(smb_full_audit_readlink), SMB_VFS_OP_READLINK,
469 SMB_VFS_LAYER_LOGGER},
470 {SMB_VFS_OP(smb_full_audit_link), SMB_VFS_OP_LINK,
471 SMB_VFS_LAYER_LOGGER},
472 {SMB_VFS_OP(smb_full_audit_mknod), SMB_VFS_OP_MKNOD,
473 SMB_VFS_LAYER_LOGGER},
474 {SMB_VFS_OP(smb_full_audit_realpath), SMB_VFS_OP_REALPATH,
475 SMB_VFS_LAYER_LOGGER},
476 {SMB_VFS_OP(smb_full_audit_notify_watch),SMB_VFS_OP_NOTIFY_WATCH,
477 SMB_VFS_LAYER_LOGGER},
478 {SMB_VFS_OP(smb_full_audit_chflags), SMB_VFS_OP_CHFLAGS,
479 SMB_VFS_LAYER_LOGGER},
480 {SMB_VFS_OP(smb_full_audit_file_id_create), SMB_VFS_OP_FILE_ID_CREATE,
481 SMB_VFS_LAYER_LOGGER},
482 {SMB_VFS_OP(smb_full_audit_streaminfo), SMB_VFS_OP_STREAMINFO,
483 SMB_VFS_LAYER_LOGGER},
484 {SMB_VFS_OP(smb_full_audit_get_real_filename), SMB_VFS_OP_GET_REAL_FILENAME,
485 SMB_VFS_LAYER_LOGGER},
486 {SMB_VFS_OP(smb_full_audit_brl_lock_windows), SMB_VFS_OP_BRL_LOCK_WINDOWS,
487 SMB_VFS_LAYER_LOGGER},
488 {SMB_VFS_OP(smb_full_audit_brl_unlock_windows), SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
489 SMB_VFS_LAYER_LOGGER},
490 {SMB_VFS_OP(smb_full_audit_brl_cancel_windows), SMB_VFS_OP_BRL_CANCEL_WINDOWS,
491 SMB_VFS_LAYER_LOGGER},
492 {SMB_VFS_OP(smb_full_audit_strict_lock), SMB_VFS_OP_STRICT_LOCK,
493 SMB_VFS_LAYER_LOGGER},
494 {SMB_VFS_OP(smb_full_audit_strict_unlock), SMB_VFS_OP_STRICT_UNLOCK,
495 SMB_VFS_LAYER_LOGGER},
496
497 /* NT ACL operations. */
498
499 {SMB_VFS_OP(smb_full_audit_fget_nt_acl), SMB_VFS_OP_FGET_NT_ACL,
500 SMB_VFS_LAYER_LOGGER},
501 {SMB_VFS_OP(smb_full_audit_get_nt_acl), SMB_VFS_OP_GET_NT_ACL,
502 SMB_VFS_LAYER_LOGGER},
503 {SMB_VFS_OP(smb_full_audit_fset_nt_acl), SMB_VFS_OP_FSET_NT_ACL,
504 SMB_VFS_LAYER_LOGGER},
505
506 /* POSIX ACL operations. */
507
508 {SMB_VFS_OP(smb_full_audit_chmod_acl), SMB_VFS_OP_CHMOD_ACL,
509 SMB_VFS_LAYER_LOGGER},
510 {SMB_VFS_OP(smb_full_audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL,
511 SMB_VFS_LAYER_LOGGER},
512 {SMB_VFS_OP(smb_full_audit_sys_acl_get_entry), SMB_VFS_OP_SYS_ACL_GET_ENTRY,
513 SMB_VFS_LAYER_LOGGER},
514 {SMB_VFS_OP(smb_full_audit_sys_acl_get_tag_type), SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,
515 SMB_VFS_LAYER_LOGGER},
516 {SMB_VFS_OP(smb_full_audit_sys_acl_get_permset), SMB_VFS_OP_SYS_ACL_GET_PERMSET,
517 SMB_VFS_LAYER_LOGGER},
518 {SMB_VFS_OP(smb_full_audit_sys_acl_get_qualifier), SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,
519 SMB_VFS_LAYER_LOGGER},
520 {SMB_VFS_OP(smb_full_audit_sys_acl_get_file), SMB_VFS_OP_SYS_ACL_GET_FILE,
521 SMB_VFS_LAYER_LOGGER},
522 {SMB_VFS_OP(smb_full_audit_sys_acl_get_fd), SMB_VFS_OP_SYS_ACL_GET_FD,
523 SMB_VFS_LAYER_LOGGER},
524 {SMB_VFS_OP(smb_full_audit_sys_acl_clear_perms), SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,
525 SMB_VFS_LAYER_LOGGER},
526 {SMB_VFS_OP(smb_full_audit_sys_acl_add_perm), SMB_VFS_OP_SYS_ACL_ADD_PERM,
527 SMB_VFS_LAYER_LOGGER},
528 {SMB_VFS_OP(smb_full_audit_sys_acl_to_text), SMB_VFS_OP_SYS_ACL_TO_TEXT,
529 SMB_VFS_LAYER_LOGGER},
530 {SMB_VFS_OP(smb_full_audit_sys_acl_init), SMB_VFS_OP_SYS_ACL_INIT,
531 SMB_VFS_LAYER_LOGGER},
532 {SMB_VFS_OP(smb_full_audit_sys_acl_create_entry), SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,
533 SMB_VFS_LAYER_LOGGER},
534 {SMB_VFS_OP(smb_full_audit_sys_acl_set_tag_type), SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,
535 SMB_VFS_LAYER_LOGGER},
536 {SMB_VFS_OP(smb_full_audit_sys_acl_set_qualifier), SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,
537 SMB_VFS_LAYER_LOGGER},
538 {SMB_VFS_OP(smb_full_audit_sys_acl_set_permset), SMB_VFS_OP_SYS_ACL_SET_PERMSET,
539 SMB_VFS_LAYER_LOGGER},
540 {SMB_VFS_OP(smb_full_audit_sys_acl_valid), SMB_VFS_OP_SYS_ACL_VALID,
541 SMB_VFS_LAYER_LOGGER},
542 {SMB_VFS_OP(smb_full_audit_sys_acl_set_file), SMB_VFS_OP_SYS_ACL_SET_FILE,
543 SMB_VFS_LAYER_LOGGER},
544 {SMB_VFS_OP(smb_full_audit_sys_acl_set_fd), SMB_VFS_OP_SYS_ACL_SET_FD,
545 SMB_VFS_LAYER_LOGGER},
546 {SMB_VFS_OP(smb_full_audit_sys_acl_delete_def_file), SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
547 SMB_VFS_LAYER_LOGGER},
548 {SMB_VFS_OP(smb_full_audit_sys_acl_get_perm), SMB_VFS_OP_SYS_ACL_GET_PERM,
549 SMB_VFS_LAYER_LOGGER},
550 {SMB_VFS_OP(smb_full_audit_sys_acl_free_text), SMB_VFS_OP_SYS_ACL_FREE_TEXT,
551 SMB_VFS_LAYER_LOGGER},
552 {SMB_VFS_OP(smb_full_audit_sys_acl_free_acl), SMB_VFS_OP_SYS_ACL_FREE_ACL,
553 SMB_VFS_LAYER_LOGGER},
554 {SMB_VFS_OP(smb_full_audit_sys_acl_free_qualifier), SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,
555 SMB_VFS_LAYER_LOGGER},
556
557 /* EA operations. */
558
559 {SMB_VFS_OP(smb_full_audit_getxattr), SMB_VFS_OP_GETXATTR,
560 SMB_VFS_LAYER_LOGGER},
561 {SMB_VFS_OP(smb_full_audit_lgetxattr), SMB_VFS_OP_LGETXATTR,
562 SMB_VFS_LAYER_LOGGER},
563 {SMB_VFS_OP(smb_full_audit_fgetxattr), SMB_VFS_OP_FGETXATTR,
564 SMB_VFS_LAYER_LOGGER},
565 {SMB_VFS_OP(smb_full_audit_listxattr), SMB_VFS_OP_LISTXATTR,
566 SMB_VFS_LAYER_LOGGER},
567 {SMB_VFS_OP(smb_full_audit_llistxattr), SMB_VFS_OP_LLISTXATTR,
568 SMB_VFS_LAYER_LOGGER},
569 {SMB_VFS_OP(smb_full_audit_flistxattr), SMB_VFS_OP_FLISTXATTR,
570 SMB_VFS_LAYER_LOGGER},
571 {SMB_VFS_OP(smb_full_audit_removexattr), SMB_VFS_OP_REMOVEXATTR,
572 SMB_VFS_LAYER_LOGGER},
573 {SMB_VFS_OP(smb_full_audit_lremovexattr), SMB_VFS_OP_LREMOVEXATTR,
574 SMB_VFS_LAYER_LOGGER},
575 {SMB_VFS_OP(smb_full_audit_fremovexattr), SMB_VFS_OP_FREMOVEXATTR,
576 SMB_VFS_LAYER_LOGGER},
577 {SMB_VFS_OP(smb_full_audit_setxattr), SMB_VFS_OP_SETXATTR,
578 SMB_VFS_LAYER_LOGGER},
579 {SMB_VFS_OP(smb_full_audit_lsetxattr), SMB_VFS_OP_LSETXATTR,
580 SMB_VFS_LAYER_LOGGER},
581 {SMB_VFS_OP(smb_full_audit_fsetxattr), SMB_VFS_OP_FSETXATTR,
582 SMB_VFS_LAYER_LOGGER},
583
584 {SMB_VFS_OP(smb_full_audit_aio_read), SMB_VFS_OP_AIO_READ,
585 SMB_VFS_LAYER_LOGGER},
586 {SMB_VFS_OP(smb_full_audit_aio_write), SMB_VFS_OP_AIO_WRITE,
587 SMB_VFS_LAYER_LOGGER},
588 {SMB_VFS_OP(smb_full_audit_aio_return), SMB_VFS_OP_AIO_RETURN,
589 SMB_VFS_LAYER_LOGGER},
590 {SMB_VFS_OP(smb_full_audit_aio_cancel), SMB_VFS_OP_AIO_CANCEL,
591 SMB_VFS_LAYER_LOGGER},
592 {SMB_VFS_OP(smb_full_audit_aio_error), SMB_VFS_OP_AIO_ERROR,
593 SMB_VFS_LAYER_LOGGER},
594 {SMB_VFS_OP(smb_full_audit_aio_fsync), SMB_VFS_OP_AIO_FSYNC,
595 SMB_VFS_LAYER_LOGGER},
596 {SMB_VFS_OP(smb_full_audit_aio_suspend),SMB_VFS_OP_AIO_SUSPEND,
597 SMB_VFS_LAYER_LOGGER},
598 {SMB_VFS_OP(smb_full_audit_aio_force),SMB_VFS_OP_AIO_FORCE,
599 SMB_VFS_LAYER_LOGGER},
600
601 /* Finish VFS operations definition */
602
603 {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP,
604 SMB_VFS_LAYER_NOOP}
605 };
606
607 /* The following array *must* be in the same order as defined in vfs.h */
608
609 static struct {
610 vfs_op_type type;
611 const char *name;
612 } vfs_op_names[] = {
613 { SMB_VFS_OP_CONNECT, "connect" },
614 { SMB_VFS_OP_DISCONNECT, "disconnect" },
615 { SMB_VFS_OP_DISK_FREE, "disk_free" },
616 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
617 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
618 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
619 { SMB_VFS_OP_STATVFS, "statvfs" },
620 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
621 { SMB_VFS_OP_OPENDIR, "opendir" },
622 { SMB_VFS_OP_READDIR, "readdir" },
623 { SMB_VFS_OP_SEEKDIR, "seekdir" },
624 { SMB_VFS_OP_TELLDIR, "telldir" },
625 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
626 { SMB_VFS_OP_MKDIR, "mkdir" },
627 { SMB_VFS_OP_RMDIR, "rmdir" },
628 { SMB_VFS_OP_CLOSEDIR, "closedir" },
629 { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
630 { SMB_VFS_OP_OPEN, "open" },
631 { SMB_VFS_OP_CREATE_FILE, "create_file" },
632 { SMB_VFS_OP_CLOSE, "close" },
633 { SMB_VFS_OP_READ, "read" },
634 { SMB_VFS_OP_PREAD, "pread" },
635 { SMB_VFS_OP_WRITE, "write" },
636 { SMB_VFS_OP_PWRITE, "pwrite" },
637 { SMB_VFS_OP_LSEEK, "lseek" },
638 { SMB_VFS_OP_SENDFILE, "sendfile" },
639 { SMB_VFS_OP_RECVFILE, "recvfile" },
640 { SMB_VFS_OP_RENAME, "rename" },
641 { SMB_VFS_OP_FSYNC, "fsync" },
642 { SMB_VFS_OP_STAT, "stat" },
643 { SMB_VFS_OP_FSTAT, "fstat" },
644 { SMB_VFS_OP_LSTAT, "lstat" },
645 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
646 { SMB_VFS_OP_UNLINK, "unlink" },
647 { SMB_VFS_OP_CHMOD, "chmod" },
648 { SMB_VFS_OP_FCHMOD, "fchmod" },
649 { SMB_VFS_OP_CHOWN, "chown" },
650 { SMB_VFS_OP_FCHOWN, "fchown" },
651 { SMB_VFS_OP_LCHOWN, "lchown" },
652 { SMB_VFS_OP_CHDIR, "chdir" },
653 { SMB_VFS_OP_GETWD, "getwd" },
654 { SMB_VFS_OP_NTIMES, "ntimes" },
655 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
656 { SMB_VFS_OP_LOCK, "lock" },
657 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
658 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
659 { SMB_VFS_OP_GETLOCK, "getlock" },
660 { SMB_VFS_OP_SYMLINK, "symlink" },
661 { SMB_VFS_OP_READLINK, "readlink" },
662 { SMB_VFS_OP_LINK, "link" },
663 { SMB_VFS_OP_MKNOD, "mknod" },
664 { SMB_VFS_OP_REALPATH, "realpath" },
665 { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
666 { SMB_VFS_OP_CHFLAGS, "chflags" },
667 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
668 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
669 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
670 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
671 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
672 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
673 { SMB_VFS_OP_STRICT_LOCK, "strict_lock" },
674 { SMB_VFS_OP_STRICT_UNLOCK, "strict_unlock" },
675 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
676 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
677 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
678 { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
679 { SMB_VFS_OP_FCHMOD_ACL, "fchmod_acl" },
680 { SMB_VFS_OP_SYS_ACL_GET_ENTRY, "sys_acl_get_entry" },
681 { SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, "sys_acl_get_tag_type" },
682 { SMB_VFS_OP_SYS_ACL_GET_PERMSET, "sys_acl_get_permset" },
683 { SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, "sys_acl_get_qualifier" },
684 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
685 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
686 { SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, "sys_acl_clear_perms" },
687 { SMB_VFS_OP_SYS_ACL_ADD_PERM, "sys_acl_add_perm" },
688 { SMB_VFS_OP_SYS_ACL_TO_TEXT, "sys_acl_to_text" },
689 { SMB_VFS_OP_SYS_ACL_INIT, "sys_acl_init" },
690 { SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, "sys_acl_create_entry" },
691 { SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, "sys_acl_set_tag_type" },
692 { SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, "sys_acl_set_qualifier" },
693 { SMB_VFS_OP_SYS_ACL_SET_PERMSET, "sys_acl_set_permset" },
694 { SMB_VFS_OP_SYS_ACL_VALID, "sys_acl_valid" },
695 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
696 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
697 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
698 { SMB_VFS_OP_SYS_ACL_GET_PERM, "sys_acl_get_perm" },
699 { SMB_VFS_OP_SYS_ACL_FREE_TEXT, "sys_acl_free_text" },
700 { SMB_VFS_OP_SYS_ACL_FREE_ACL, "sys_acl_free_acl" },
701 { SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, "sys_acl_free_qualifier" },
702 { SMB_VFS_OP_GETXATTR, "getxattr" },
703 { SMB_VFS_OP_LGETXATTR, "lgetxattr" },
704 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
705 { SMB_VFS_OP_LISTXATTR, "listxattr" },
706 { SMB_VFS_OP_LLISTXATTR, "llistxattr" },
707 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
708 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
709 { SMB_VFS_OP_LREMOVEXATTR, "lremovexattr" },
710 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
711 { SMB_VFS_OP_SETXATTR, "setxattr" },
712 { SMB_VFS_OP_LSETXATTR, "lsetxattr" },
713 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
714 { SMB_VFS_OP_AIO_READ, "aio_read" },
715 { SMB_VFS_OP_AIO_WRITE, "aio_write" },
716 { SMB_VFS_OP_AIO_RETURN,"aio_return" },
717 { SMB_VFS_OP_AIO_CANCEL,"aio_cancel" },
718 { SMB_VFS_OP_AIO_ERROR, "aio_error" },
719 { SMB_VFS_OP_AIO_FSYNC, "aio_fsync" },
720 { SMB_VFS_OP_AIO_SUSPEND,"aio_suspend" },
721 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
722 { SMB_VFS_OP_IS_OFFLINE, "aio_is_offline" },
723 { SMB_VFS_OP_SET_OFFLINE, "aio_set_offline" },
724 { SMB_VFS_OP_LAST, NULL }
725 };
726
727 static int audit_syslog_facility(vfs_handle_struct *handle)
728 {
729 static const struct enum_list enum_log_facilities[] = {
730 { LOG_USER, "USER" },
731 { LOG_LOCAL0, "LOCAL0" },
732 { LOG_LOCAL1, "LOCAL1" },
733 { LOG_LOCAL2, "LOCAL2" },
734 { LOG_LOCAL3, "LOCAL3" },
735 { LOG_LOCAL4, "LOCAL4" },
736 { LOG_LOCAL5, "LOCAL5" },
737 { LOG_LOCAL6, "LOCAL6" },
738 { LOG_LOCAL7, "LOCAL7" }
739 };
740
741 int facility;
742
743 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
744
745 return facility;
746 }
747
748 static int audit_syslog_priority(vfs_handle_struct *handle)
749 {
750 static const struct enum_list enum_log_priorities[] = {
751 { LOG_EMERG, "EMERG" },
752 { LOG_ALERT, "ALERT" },
753 { LOG_CRIT, "CRIT" },
754 { LOG_ERR, "ERR" },
755 { LOG_WARNING, "WARNING" },
756 { LOG_NOTICE, "NOTICE" },
757 { LOG_INFO, "INFO" },
758 { LOG_DEBUG, "DEBUG" }
759 };
760
761 int priority;
762
763 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
764 enum_log_priorities, LOG_NOTICE);
765 if (priority == -1) {
766 priority = LOG_WARNING;
767 }
768
769 return priority;
770 }
771
772 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
773 {
774 char *prefix = NULL;
775 char *result;
776
777 prefix = talloc_strdup(ctx,
778 lp_parm_const_string(SNUM(conn), "full_audit",
779 "prefix", "%u|%I"));
780 if (!prefix) {
781 return NULL;
782 }
783 result = talloc_sub_advanced(ctx,
784 lp_servicename(SNUM(conn)),
785 conn->server_info->unix_name,
786 conn->connectpath,
787 conn->server_info->utok.gid,
788 conn->server_info->sanitized_username,
789 pdb_get_domain(conn->server_info->sam_account),
790 prefix);
791 TALLOC_FREE(prefix);
792 return result;
793 }
794
795 static bool log_success(vfs_handle_struct *handle, vfs_op_type op)
796 {
797 struct vfs_full_audit_private_data *pd = NULL;
798
799 SMB_VFS_HANDLE_GET_DATA(handle, pd,
800 struct vfs_full_audit_private_data,
801 return True);
802
803 if (pd->success_ops == NULL) {
804 return True;
805 }
806
807 return bitmap_query(pd->success_ops, op);
808 }
809
810 static bool log_failure(vfs_handle_struct *handle, vfs_op_type op)
811 {
812 struct vfs_full_audit_private_data *pd = NULL;
813
814 SMB_VFS_HANDLE_GET_DATA(handle, pd,
815 struct vfs_full_audit_private_data,
816 return True);
817
818 if (pd->failure_ops == NULL)
819 return True;
820
821 return bitmap_query(pd->failure_ops, op);
822 }
823
824 static void init_bitmap(struct bitmap **bm, const char **ops)
825 {
826 bool log_all = False;
827
828 if (*bm != NULL)
829 return;
830
831 *bm = bitmap_allocate(SMB_VFS_OP_LAST);
832
833 if (*bm == NULL) {
834 DEBUG(0, ("Could not alloc bitmap -- "
835 "defaulting to logging everything\n"));
836 return;
837 }
838
839 while (*ops != NULL) {
840 int i;
841 bool found = False;
842
843 if (strequal(*ops, "all")) {
844 log_all = True;
845 break;
846 }
847
848 if (strequal(*ops, "none")) {
849 break;
850 }
851
852 for (i=0; i<SMB_VFS_OP_LAST; i++) {
853 if (vfs_op_names[i].name == NULL) {
854 smb_panic("vfs_full_audit.c: name table not "
855 "in sync with vfs.h\n");
856 }
857
858 if (strequal(*ops, vfs_op_names[i].name)) {
859 bitmap_set(*bm, i);
860 found = True;
861 }
862 }
863 if (!found) {
864 DEBUG(0, ("Could not find opname %s, logging all\n",
865 *ops));
866 log_all = True;
867 break;
868 }
869 ops += 1;
870 }
871
872 if (log_all) {
873 /* The query functions default to True */
874 bitmap_free(*bm);
875 *bm = NULL;
876 }
877 }
878
879 static const char *audit_opname(vfs_op_type op)
880 {
881 if (op >= SMB_VFS_OP_LAST)
882 return "INVALID VFS OP";
883 return vfs_op_names[op].name;
884 }
885
886 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
887 const char *format, ...)
888 {
889 fstring err_msg;
890 char *audit_pre = NULL;
891 va_list ap;
892 char *op_msg = NULL;
893
894 if (success && (!log_success(handle, op)))
895 return;
896
897 if (!success && (!log_failure(handle, op)))
898 return;
899
900 if (success)
901 fstrcpy(err_msg, "ok");
902 else
903 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
904
905 va_start(ap, format);
906 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
907 va_end(ap);
908
909 if (!op_msg) {
910 return;
911 }
912
913 audit_pre = audit_prefix(talloc_tos(), handle->conn);
914 syslog(audit_syslog_priority(handle), "%s|%s|%s|%s\n",
915 audit_pre ? audit_pre : "",
916 audit_opname(op), err_msg, op_msg);
917
918 TALLOC_FREE(audit_pre);
919 TALLOC_FREE(op_msg);
920
921 return;
922 }
923
924 /* Free function for the private data. */
925
926 static void free_private_data(void **p_data)
927 {
928 struct vfs_full_audit_private_data *pd = *(struct vfs_full_audit_private_data **)p_data;
929
930 if (pd->success_ops) {
931 bitmap_free(pd->success_ops);
932 }
933 if (pd->failure_ops) {
934 bitmap_free(pd->failure_ops);
935 }
936 SAFE_FREE(pd);
937 *p_data = NULL;
938 }
939
940 /* Implementation of vfs_ops. Pass everything on to the default
941 operation but log event first. */
942
943 static int smb_full_audit_connect(vfs_handle_struct *handle,
944 const char *svc, const char *user)
945 {
946 int result;
947 struct vfs_full_audit_private_data *pd = NULL;
948 const char *none[] = { NULL };
949 const char *all [] = { "all" };
950
951 if (!handle) {
952 return -1;
953 }
954
955 pd = SMB_MALLOC_P(struct vfs_full_audit_private_data);
956 if (!pd) {
957 return -1;
958 }
959 ZERO_STRUCTP(pd);
960
961 openlog("smbd_audit", 0, audit_syslog_facility(handle));
962
963 init_bitmap(&pd->success_ops,
964 lp_parm_string_list(SNUM(handle->conn), "full_audit", "success",
965 none));
966 init_bitmap(&pd->failure_ops,
967 lp_parm_string_list(SNUM(handle->conn), "full_audit", "failure",
968 all));
969
970 /* Store the private data. */
971 SMB_VFS_HANDLE_SET_DATA(handle, pd, free_private_data,
972 struct vfs_full_audit_private_data, return -1);
973
974 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
975
976 do_log(SMB_VFS_OP_CONNECT, True, handle,
977 "%s", svc);
978
979 return result;
980 }
981
982 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
983 {
984 SMB_VFS_NEXT_DISCONNECT(handle);
985
986 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
987 "%s", lp_servicename(SNUM(handle->conn)));
988
989 /* The bitmaps will be disconnected when the private
990 data is deleted. */
991
992 return;
993 }
994
995 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
996 const char *path,
997 bool small_query, uint64_t *bsize,
998 uint64_t *dfree, uint64_t *dsize)
999 {
1000 uint64_t result;
1001
1002 result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
1003 dfree, dsize);
1004
1005 /* Don't have a reasonable notion of failure here */
1006
1007 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
1008
1009 return result;
1010 }
1011
1012 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
1013 enum SMB_QUOTA_TYPE qtype, unid_t id,
1014 SMB_DISK_QUOTA *qt)
1015 {
1016 int result;
1017
1018 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
1019
1020 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
1021
1022 return result;
1023 }
1024
1025
1026 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
1027 enum SMB_QUOTA_TYPE qtype, unid_t id,
1028 SMB_DISK_QUOTA *qt)
1029 {
1030 int result;
1031
1032 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
1033
1034 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
1035
1036 return result;
1037 }
1038
1039 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
1040 struct files_struct *fsp,
1041 SHADOW_COPY_DATA *shadow_copy_data, bool labels)
1042 {
1043 int result;
1044
1045 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
1046
1047 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
1048
1049 return result;
1050 }
1051
1052 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
1053 const char *path,
1054 struct vfs_statvfs_struct *statbuf)
1055 {
1056 int result;
1057
1058 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
1059
1060 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
1061
1062 return result;
1063 }
1064
1065 static int smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle)
1066 {
1067 int result;
1068
1069 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle);
1070
1071 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
1072
1073 return result;
1074 }
1075
1076 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
1077 const char *fname, const char *mask, uint32 attr)
1078 {
1079 SMB_STRUCT_DIR *result;
1080
1081 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
1082
1083 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
1084
1085 return result;
1086 }
1087
1088 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
1089 SMB_STRUCT_DIR *dirp, SMB_STRUCT_STAT *sbuf)
1090 {
1091 SMB_STRUCT_DIRENT *result;
1092
1093 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
1094
1095 /* This operation has no reasonable error condition
1096 * (End of dir is also failure), so always succeed.
1097 */
1098 do_log(SMB_VFS_OP_READDIR, True, handle, "");
1099
1100 return result;
1101 }
1102
1103 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
1104 SMB_STRUCT_DIR *dirp, long offset)
1105 {
1106 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
1107
1108 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
1109 return;
1110 }
1111
1112 static long smb_full_audit_telldir(vfs_handle_struct *handle,
1113 SMB_STRUCT_DIR *dirp)
1114 {
1115 long result;
1116
1117 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
1118
1119 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
1120
1121 return result;
1122 }
1123
1124 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
1125 SMB_STRUCT_DIR *dirp)
1126 {
1127 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
1128
1129 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
1130 return;
1131 }
1132
1133 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
1134 const char *path, mode_t mode)
1135 {
1136 int result;
1137
1138 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
1139
1140 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
1141
1142 return result;
1143 }
1144
1145 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
1146 const char *path)
1147 {
1148 int result;
1149
1150 result = SMB_VFS_NEXT_RMDIR(handle, path);
1151
1152 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
1153
1154 return result;
1155 }
1156
1157 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1158 SMB_STRUCT_DIR *dirp)
1159 {
1160 int result;
1161
1162 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1163
1164 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1165
1166 return result;
1167 }
1168
1169 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
1170 SMB_STRUCT_DIR *dirp)
1171 {
1172 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
1173
1174 do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
1175 return;
1176 }
1177
1178 static int smb_full_audit_open(vfs_handle_struct *handle,
1179 const char *fname, files_struct *fsp, int flags, mode_t mode)
1180 {
1181 int result;
1182
1183 result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
1184
1185 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
1186 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1187 fname);
1188
1189 return result;
1190 }
1191
1192 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1193 struct smb_request *req,
1194 uint16_t root_dir_fid,
1195 const char *fname,
1196 uint32_t create_file_flags,
1197 uint32_t access_mask,
1198 uint32_t share_access,
1199 uint32_t create_disposition,
1200 uint32_t create_options,
1201 uint32_t file_attributes,
1202 uint32_t oplock_request,
1203 uint64_t allocation_size,
1204 struct security_descriptor *sd,
1205 struct ea_list *ea_list,
1206 files_struct **result_fsp,
1207 int *pinfo,
1208 SMB_STRUCT_STAT *psbuf)
1209 {
1210 NTSTATUS result;
1211
1212 result = SMB_VFS_NEXT_CREATE_FILE(
1213 handle, /* handle */
1214 req, /* req */
1215 root_dir_fid, /* root_dir_fid */
1216 fname, /* fname */
1217 create_file_flags, /* create_file_flags */
1218 access_mask, /* access_mask */
1219 share_access, /* share_access */
1220 create_disposition, /* create_disposition*/
1221 create_options, /* create_options */
1222 file_attributes, /* file_attributes */
1223 oplock_request, /* oplock_request */
1224 allocation_size, /* allocation_size */
1225 sd, /* sd */
1226 ea_list, /* ea_list */
1227 result_fsp, /* result */
1228 pinfo, /* pinfo */
1229 psbuf); /* psbuf */
1230
1231 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle, "0x%x|%s",
1232 access_mask, fname);
1233
1234 return result;
1235 }
1236
1237 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1238 {
1239 int result;
1240
1241 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1242
1243 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s", fsp->fsp_name);
1244
1245 return result;
1246 }
1247
1248 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
1249 void *data, size_t n)
1250 {
1251 ssize_t result;
1252
1253 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
1254
1255 do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s", fsp->fsp_name);
1256
1257 return result;
1258 }
1259
1260 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1261 void *data, size_t n, SMB_OFF_T offset)
1262 {
1263 ssize_t result;
1264
1265 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1266
1267 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s", fsp->fsp_name);
1268
1269 return result;
1270 }
1271
1272 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
1273 const void *data, size_t n)
1274 {
1275 ssize_t result;
1276
1277 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
1278
1279 do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1280
1281 return result;
1282 }
1283
1284 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1285 const void *data, size_t n,
1286 SMB_OFF_T offset)
1287 {
1288 ssize_t result;
1289
1290 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1291
1292 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1293
1294 return result;
1295 }
1296
1297 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1298 SMB_OFF_T offset, int whence)
1299 {
1300 ssize_t result;
1301
1302 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1303
1304 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1305 "%s", fsp->fsp_name);
1306
1307 return result;
1308 }
1309
1310 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1311 files_struct *fromfsp,
1312 const DATA_BLOB *hdr, SMB_OFF_T offset,
1313 size_t n)
1314 {
1315 ssize_t result;
1316
1317 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1318
1319 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1320 "%s", fromfsp->fsp_name);
1321
1322 return result;
1323 }
1324
1325 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1326 files_struct *tofsp,
1327 SMB_OFF_T offset,
1328 size_t n)
1329 {
1330 ssize_t result;
1331
1332 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1333
1334 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1335 "%s", tofsp->fsp_name);
1336
1337 return result;
1338 }
1339
1340 static int smb_full_audit_rename(vfs_handle_struct *handle,
1341 const char *oldname, const char *newname)
1342 {
1343 int result;
1344
1345 result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
1346
1347 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s", oldname, newname);
1348
1349 return result;
1350 }
1351
1352 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1353 {
1354 int result;
1355
1356 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1357
1358 do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s", fsp->fsp_name);
1359
1360 return result;
1361 }
1362
1363 static int smb_full_audit_stat(vfs_handle_struct *handle,
1364 const char *fname, SMB_STRUCT_STAT *sbuf)
1365 {
1366 int result;
1367
1368 result = SMB_VFS_NEXT_STAT(handle, fname, sbuf);
1369
1370 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s", fname);
1371
1372 return result;
1373 }
1374
1375 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1376 SMB_STRUCT_STAT *sbuf)
1377 {
1378 int result;
1379
1380 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1381
1382 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s", fsp->fsp_name);
1383
1384 return result;
1385 }
1386
1387 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1388 const char *path, SMB_STRUCT_STAT *sbuf)
1389 {
1390 int result;
1391
1392 result = SMB_VFS_NEXT_LSTAT(handle, path, sbuf);
1393
1394 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s", path);
1395
1396 return result;
1397 }
1398
1399 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1400 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1401 {
1402 uint64_t result;
1403
1404 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1405
1406 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle, "%llu", result);
1407
1408 return result;
1409 }
1410
1411 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1412 const char *path)
1413 {
1414 int result;
1415
1416 result = SMB_VFS_NEXT_UNLINK(handle, path);
1417
1418 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s", path);
1419
1420 return result;
1421 }
1422
1423 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1424 const char *path, mode_t mode)
1425 {
1426 int result;
1427
1428 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1429
1430 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1431
1432 return result;
1433 }
1434
1435 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1436 mode_t mode)
1437 {
1438 int result;
1439
1440 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1441
1442 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1443 "%s|%o", fsp->fsp_name, mode);
1444
1445 return result;
1446 }
1447
1448 static int smb_full_audit_chown(vfs_handle_struct *handle,
1449 const char *path, uid_t uid, gid_t gid)
1450 {
1451 int result;
1452
1453 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1454
1455 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1456 path, (long int)uid, (long int)gid);
1457
1458 return result;
1459 }
1460
1461 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1462 uid_t uid, gid_t gid)
1463 {
1464 int result;
1465
1466 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1467
1468 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1469 fsp->fsp_name, (long int)uid, (long int)gid);
1470
1471 return result;
1472 }
1473
1474 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1475 const char *path, uid_t uid, gid_t gid)
1476 {
1477 int result;
1478
1479 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1480
1481 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1482 path, (long int)uid, (long int)gid);
1483
1484 return result;
1485 }
1486
1487 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1488 const char *path)
1489 {
1490 int result;
1491
1492 result = SMB_VFS_NEXT_CHDIR(handle, path);
1493
1494 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1495
1496 return result;
1497 }
1498
1499 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
1500 char *path)
1501 {
1502 char *result;
1503
1504 result = SMB_VFS_NEXT_GETWD(handle, path);
1505
1506 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s", path);
1507
1508 return result;
1509 }
1510
1511 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1512 const char *path, struct smb_file_time *ft)
1513 {
1514 int result;
1515
1516 result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1517
1518 do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s", path);
1519
1520 return result;
1521 }
1522
1523 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1524 SMB_OFF_T len)
1525 {
1526 int result;
1527
1528 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1529
1530 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1531 "%s", fsp->fsp_name);
1532
1533 return result;
1534 }
1535
1536 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1537 int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1538 {
1539 bool result;
1540
1541 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1542
1543 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp->fsp_name);
1544
1545 return result;
1546 }
1547
1548 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1549 struct files_struct *fsp,
1550 uint32 share_mode)
1551 {
1552 int result;
1553
1554 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode);
1555
1556 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1557 fsp->fsp_name);
1558
1559 return result;
1560 }
1561
1562 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1563 int leasetype)
1564 {
1565 int result;
1566
1567 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1568
1569 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1570 fsp->fsp_name);
1571
1572 return result;
1573 }
1574
1575 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1576 SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid)
1577 {
1578 bool result;
1579
1580 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1581
1582 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp->fsp_name);
1583
1584 return result;
1585 }
1586
1587 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1588 const char *oldpath, const char *newpath)
1589 {
1590 int result;
1591
1592 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1593
1594 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1595 "%s|%s", oldpath, newpath);
1596
1597 return result;
1598 }
1599
1600 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1601 const char *path, char *buf, size_t bufsiz)
1602 {
1603 int result;
1604
1605 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1606
1607 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1608
1609 return result;
1610 }
1611
1612 static int smb_full_audit_link(vfs_handle_struct *handle,
1613 const char *oldpath, const char *newpath)
1614 {
1615 int result;
1616
1617 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1618
1619 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1620 "%s|%s", oldpath, newpath);
1621
1622 return result;
1623 }
1624
1625 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1626 const char *pathname, mode_t mode, SMB_DEV_T dev)
1627 {
1628 int result;
1629
1630 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1631
1632 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1633
1634 return result;
1635 }
1636
1637 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1638 const char *path, char *resolved_path)
1639 {
1640 char *result;
1641
1642 result = SMB_VFS_NEXT_REALPATH(handle, path, resolved_path);
1643
1644 do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1645
1646 return result;
1647 }
1648
1649 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1650 struct sys_notify_context *ctx,
1651 struct notify_entry *e,
1652 void (*callback)(struct sys_notify_context *ctx,
1653 void *private_data,
1654 struct notify_event *ev),
1655 void *private_data, void *handle_p)
1656 {
1657 NTSTATUS result;
1658
1659 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback, private_data, handle_p);
1660
1661 do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1662
1663 return result;
1664 }
1665
1666 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1667 const char *path, unsigned int flags)
1668 {
1669 int result;
1670
1671 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1672
1673 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1674
1675 return result;
1676 }
1677
1678 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1679 const SMB_STRUCT_STAT *sbuf)
1680 {
1681 struct file_id id_zero;
1682 struct file_id result;
1683
1684 ZERO_STRUCT(id_zero);
1685
1686 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1687
1688 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1689 !file_id_equal(&id_zero, &result),
1690 handle, "%s", file_id_string_tos(&result));
1691
1692 return result;
1693 }
1694
1695 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1696 struct files_struct *fsp,
1697 const char *fname,
1698 TALLOC_CTX *mem_ctx,
1699 unsigned int *pnum_streams,
1700 struct stream_struct **pstreams)
1701 {
1702 NTSTATUS result;
1703
1704 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1705 pnum_streams, pstreams);
1706
1707 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1708 "%s", fname);
1709
1710 return result;
1711 }
1712
1713 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1714 const char *path,
1715 const char *name,
1716 TALLOC_CTX *mem_ctx,
1717 char **found_name)
1718 {
1719 int result;
1720
1721 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1722 found_name);
1723
1724 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1725 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1726
1727 return result;
1728 }
1729
1730 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1731 struct byte_range_lock *br_lck,
1732 struct lock_struct *plock,
1733 bool blocking_lock,
1734 struct blocking_lock_record *blr)
1735 {
1736 NTSTATUS result;
1737
1738 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1739 blocking_lock, blr);
1740
1741 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1742 "%s:%llu-%llu. type=%d. blocking=%d", br_lck->fsp->fsp_name,
1743 plock->start, plock->size, plock->lock_type, blocking_lock );
1744
1745 return result;
1746 }
1747
1748 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1749 struct messaging_context *msg_ctx,
1750 struct byte_range_lock *br_lck,
1751 const struct lock_struct *plock)
1752 {
1753 bool result;
1754
1755 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1756 plock);
1757
1758 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1759 "%s:%llu-%llu:%d", br_lck->fsp->fsp_name, plock->start,
1760 plock->size, plock->lock_type);
1761
1762 return result;
1763 }
1764
1765 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1766 struct byte_range_lock *br_lck,
1767 struct lock_struct *plock,
1768 struct blocking_lock_record *blr)
1769 {
1770 bool result;
1771
1772 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock, blr);
1773
1774 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1775 "%s:%llu-%llu:%d", br_lck->fsp->fsp_name, plock->start,
1776 plock->size);
1777
1778 return result;
1779 }
1780
1781 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
1782 struct files_struct *fsp,
1783 struct lock_struct *plock)
1784 {
1785 bool result;
1786
1787 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1788
1789 do_log(SMB_VFS_OP_STRICT_LOCK, result, handle,
1790 "%s:%llu-%llu:%d", fsp->fsp_name, plock->start,
1791 plock->size);
1792
1793 return result;
1794 }
1795
1796 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
1797 struct files_struct *fsp,
1798 struct lock_struct *plock)
1799 {
1800 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1801
1802 do_log(SMB_VFS_OP_STRICT_UNLOCK, true, handle,
1803 "%s:%llu-%llu:%d", fsp->fsp_name, plock->start,
1804 plock->size);
1805
1806 return;
1807 }
1808
1809 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1810 uint32 security_info,
1811 SEC_DESC **ppdesc)
1812 {
1813 NTSTATUS result;
1814
1815 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1816
1817 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1818 "%s", fsp->fsp_name);
1819
1820 return result;
1821 }
1822
1823 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1824 const char *name,
1825 uint32 security_info,
1826 SEC_DESC **ppdesc)
1827 {
1828 NTSTATUS result;
1829
1830 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1831
1832 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1833 "%s", name);
1834
1835 return result;
1836 }
1837
1838 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1839 uint32 security_info_sent,
1840 const SEC_DESC *psd)
1841 {
1842 NTSTATUS result;
1843
1844 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1845
1846 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle, "%s", fsp->fsp_name);
1847
1848 return result;
1849 }
1850
1851 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1852 const char *path, mode_t mode)
1853 {
1854 int result;
1855
1856 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1857
1858 do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1859 "%s|%o", path, mode);
1860
1861 return result;
1862 }
1863
1864 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1865 mode_t mode)
1866 {
1867 int result;
1868
1869 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1870
1871 do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1872 "%s|%o", fsp->fsp_name, mode);
1873
1874 return result;
1875 }
1876
1877 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1878
1879 SMB_ACL_T theacl, int entry_id,
1880 SMB_ACL_ENTRY_T *entry_p)
1881 {
1882 int result;
1883
1884 result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1885 entry_p);
1886
1887 do_log(SMB_VFS_OP_SYS_ACL_GET_ENTRY, (result >= 0), handle,
1888 "");
1889
1890 return result;
1891 }
1892
1893 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1894
1895 SMB_ACL_ENTRY_T entry_d,
1896 SMB_ACL_TAG_T *tag_type_p)
1897 {
1898 int result;
1899
1900 result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1901 tag_type_p);
1902
1903 do_log(SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, (result >= 0), handle,
1904 "");
1905
1906 return result;
1907 }
1908
1909 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1910
1911 SMB_ACL_ENTRY_T entry_d,
1912 SMB_ACL_PERMSET_T *permset_p)
1913 {
1914 int result;
1915
1916 result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1917 permset_p);
1918
1919 do_log(SMB_VFS_OP_SYS_ACL_GET_PERMSET, (result >= 0), handle,
1920 "");
1921
1922 return result;
1923 }
1924
1925 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1926
1927 SMB_ACL_ENTRY_T entry_d)
1928 {
1929 void *result;
1930
1931 result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1932
1933 do_log(SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, (result != NULL), handle,
1934 "");
1935
1936 return result;
1937 }
1938
1939 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1940 const char *path_p,
1941 SMB_ACL_TYPE_T type)
1942 {
1943 SMB_ACL_T result;
1944
1945 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1946
1947 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1948 "%s", path_p);
1949
1950 return result;
1951 }
1952
1953 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1954 files_struct *fsp)
1955 {
1956 SMB_ACL_T result;
1957
1958 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1959
1960 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1961 "%s", fsp->fsp_name);
1962
1963 return result;
1964 }
1965
1966 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1967
1968 SMB_ACL_PERMSET_T permset)
1969 {
1970 int result;
1971
1972 result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1973
1974 do_log(SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, (result >= 0), handle,
1975 "");
1976
1977 return result;
1978 }
1979
1980 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1981
1982 SMB_ACL_PERMSET_T permset,
1983 SMB_ACL_PERM_T perm)
1984 {
1985 int result;
1986
1987 result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1988
1989 do_log(SMB_VFS_OP_SYS_ACL_ADD_PERM, (result >= 0), handle,
1990 "");
1991
1992 return result;
1993 }
1994
1995 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
1996 SMB_ACL_T theacl,
1997 ssize_t *plen)
1998 {
1999 char * result;
2000
2001 result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
2002
2003 do_log(SMB_VFS_OP_SYS_ACL_TO_TEXT, (result != NULL), handle,
2004 "");
2005
2006 return result;
2007 }
2008
2009 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
2010
2011 int count)
2012 {
2013 SMB_ACL_T result;
2014
2015 result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
2016
2017 do_log(SMB_VFS_OP_SYS_ACL_INIT, (result != NULL), handle,
2018 "");
2019
2020 return result;
2021 }
2022
2023 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
2024 SMB_ACL_T *pacl,
2025 SMB_ACL_ENTRY_T *pentry)
2026 {
2027 int result;
2028
2029 result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
2030
2031 do_log(SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, (result >= 0), handle,
2032 "");
2033
2034 return result;
2035 }
2036
2037 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
2038
2039 SMB_ACL_ENTRY_T entry,
2040 SMB_ACL_TAG_T tagtype)
2041 {
2042 int result;
2043
2044 result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
2045 tagtype);
2046
2047 do_log(SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, (result >= 0), handle,
2048 "");
2049
2050 return result;
2051 }
2052
2053 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
2054
2055 SMB_ACL_ENTRY_T entry,
2056 void *qual)
2057 {
2058 int result;
2059
2060 result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
2061
2062 do_log(SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, (result >= 0), handle,
2063 "");
2064
2065 return result;
2066 }
2067
2068 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
2069
2070 SMB_ACL_ENTRY_T entry,
2071 SMB_ACL_PERMSET_T permset)
2072 {
2073 int result;
2074
2075 result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
2076
2077 do_log(SMB_VFS_OP_SYS_ACL_SET_PERMSET, (result >= 0), handle,
2078 "");
2079
2080 return result;
2081 }
2082
2083 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
2084
2085 SMB_ACL_T theacl )
2086 {
2087 int result;
2088
2089 result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
2090
2091 do_log(SMB_VFS_OP_SYS_ACL_VALID, (result >= 0), handle,
2092 "");
2093
2094 return result;
2095 }
2096
2097 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
2098
2099 const char *name, SMB_ACL_TYPE_T acltype,
2100 SMB_ACL_T theacl)
2101 {
2102 int result;
2103
2104 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
2105 theacl);
2106
2107 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
2108 "%s", name);
2109
2110 return result;
2111 }
2112
2113 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
2114 SMB_ACL_T theacl)
2115 {
2116 int result;
2117
2118 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2119
2120 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2121 "%s", fsp->fsp_name);
2122
2123 return result;
2124 }
2125
2126 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2127
2128 const char *path)
2129 {
2130 int result;
2131
2132 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2133
2134 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2135 "%s", path);
2136
2137 return result;
2138 }
2139
2140 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
2141
2142 SMB_ACL_PERMSET_T permset,
2143 SMB_ACL_PERM_T perm)
2144 {
2145 int result;
2146
2147 result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
2148
2149 do_log(SMB_VFS_OP_SYS_ACL_GET_PERM, (result >= 0), handle,
2150 "");
2151
2152 return result;
2153 }
2154
2155 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
2156
2157 char *text)
2158 {
2159 int result;
2160
2161 result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
2162
2163 do_log(SMB_VFS_OP_SYS_ACL_FREE_TEXT, (result >= 0), handle,
2164 "");
2165
2166 return result;
2167 }
2168
2169 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
2170
2171 SMB_ACL_T posix_acl)
2172 {
2173 int result;
2174
2175 result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
2176
2177 do_log(SMB_VFS_OP_SYS_ACL_FREE_ACL, (result >= 0), handle,
2178 "");
2179
2180 return result;
2181 }
2182
2183 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
2184 void *qualifier,
2185 SMB_ACL_TAG_T tagtype)
2186 {
2187 int result;
2188
2189 result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
2190 tagtype);
2191
2192 do_log(SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, (result >= 0), handle,
2193 "");
2194
2195 return result;
2196 }
2197
2198 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2199 const char *path,
2200 const char *name, void *value, size_t size)
2201 {
2202 ssize_t result;
2203
2204 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2205
2206 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2207 "%s|%s", path, name);
2208
2209 return result;
2210 }
2211
2212 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
2213 const char *path, const char *name,
2214 void *value, size_t size)
2215 {
2216 ssize_t result;
2217
2218 result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
2219
2220 do_log(SMB_VFS_OP_LGETXATTR, (result >= 0), handle,
2221 "%s|%s", path, name);
2222
2223 return result;
2224 }
2225
2226 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2227 struct files_struct *fsp,
2228 const char *name, void *value, size_t size)
2229 {
2230 ssize_t result;
2231
2232 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2233
2234 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2235 "%s|%s", fsp->fsp_name, name);
2236
2237 return result;
2238 }
2239
2240 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2241 const char *path, char *list, size_t size)
2242 {
2243 ssize_t result;
2244
2245 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2246
2247 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
2248
2249 return result;
2250 }
2251
2252 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
2253 const char *path, char *list, size_t size)
2254 {
2255 ssize_t result;
2256
2257 result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2258
2259 do_log(SMB_VFS_OP_LLISTXATTR, (result >= 0), handle, "%s", path);
2260
2261 return result;
2262 }
2263
2264 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2265 struct files_struct *fsp, char *list,
2266 size_t size)
2267 {
2268 ssize_t result;
2269
2270 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2271
2272 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2273 "%s", fsp->fsp_name);
2274
2275 return result;
2276 }
2277
2278 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2279 const char *path,
2280 const char *name)
2281 {
2282 int result;
2283
2284 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2285
2286 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2287 "%s|%s", path, name);
2288
2289 return result;
2290 }
2291
2292 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
2293 const char *path,
2294 const char *name)
2295 {
2296 int result;
2297
2298 result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2299
2300 do_log(SMB_VFS_OP_LREMOVEXATTR, (result >= 0), handle,
2301 "%s|%s", path, name);
2302
2303 return result;
2304 }
2305
2306 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2307 struct files_struct *fsp,
2308 const char *name)
2309 {
2310 int result;
2311
2312 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2313
2314 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2315 "%s|%s", fsp->fsp_name, name);
2316
2317 return result;
2318 }
2319
2320 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2321 const char *path,
2322 const char *name, const void *value, size_t size,
2323 int flags)
2324 {
2325 int result;
2326
2327 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2328 flags);
2329
2330 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2331 "%s|%s", path, name);
2332
2333 return result;
2334 }
2335
2336 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
2337 const char *path,
2338 const char *name, const void *value, size_t size,
2339 int flags)
2340 {
2341 int result;
2342
2343 result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2344 flags);
2345
2346 do_log(SMB_VFS_OP_LSETXATTR, (result >= 0), handle,
2347 "%s|%s", path, name);
2348
2349 return result;
2350 }
2351
2352 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2353 struct files_struct *fsp, const char *name,
2354 const void *value, size_t size, int flags)
2355 {
2356 int result;
2357
2358 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2359
2360 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2361 "%s|%s", fsp->fsp_name, name);
2362
2363 return result;
2364 }
2365
2366 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2367 {
2368 int result;
2369
2370 result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2371 do_log(SMB_VFS_OP_AIO_READ, (result >= 0), handle,
2372 "%s", fsp->fsp_name);
2373
2374 return result;
2375 }
2376
2377 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2378 {
2379 int result;
2380
2381 result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2382 do_log(SMB_VFS_OP_AIO_WRITE, (result >= 0), handle,
2383 "%s", fsp->fsp_name);
2384
2385 return result;
2386 }
2387
2388 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2389 {
2390 int result;
2391
2392 result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2393 do_log(SMB_VFS_OP_AIO_RETURN, (result >= 0), handle,
2394 "%s", fsp->fsp_name);
2395
2396 return result;
2397 }
2398
2399 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2400 {
2401 int result;
2402
2403 result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2404 do_log(SMB_VFS_OP_AIO_CANCEL, (result >= 0), handle,
2405 "%s", fsp->fsp_name);
2406
2407 return result;
2408 }
2409
2410 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2411 {
2412 int result;
2413
2414 result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2415 do_log(SMB_VFS_OP_AIO_ERROR, (result >= 0), handle,
2416 "%s", fsp->fsp_name);
2417
2418 return result;
2419 }
2420
2421 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb)
2422 {
2423 int result;
2424
2425 result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2426 do_log(SMB_VFS_OP_AIO_FSYNC, (result >= 0), handle,
2427 "%s", fsp->fsp_name);
2428
2429 return result;
2430 }
2431
2432 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts)
2433 {
2434 int result;
2435
2436 result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2437 do_log(SMB_VFS_OP_AIO_SUSPEND, (result >= 0), handle,
2438 "%s", fsp->fsp_name);
2439
2440 return result;
2441 }
2442
2443 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2444 struct files_struct *fsp)
2445 {
2446 bool result;
2447
2448 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2449 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2450 "%s", fsp->fsp_name);
2451
2452 return result;
2453 }
2454
2455 NTSTATUS vfs_full_audit_init(void);
2456 NTSTATUS vfs_full_audit_init(void)
2457 {
2458 NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2459 "full_audit", audit_op_tuples);
2460
2461 if (!NT_STATUS_IS_OK(ret))
2462 return ret;
2463
2464 vfs_full_audit_debug_level = debug_add_class("full_audit");
2465 if (vfs_full_audit_debug_level == -1) {
2466 vfs_full_audit_debug_level = DBGC_VFS;
2467 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2468 "class!\n"));
2469 } else {
2470 DEBUG(10, ("vfs_full_audit: Debug class number of "
2471 "'full_audit': %d\n", vfs_full_audit_debug_level));
2472 }
2473
2474 return ret;
2475 }
Samba GIT mirror