?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
CVE-2023-0614 ldb: Centralise checking for inaccessible matches
[Samba.git] / source3 / modules / vfs_full_audit.c
blob5903849931ee2c64541826d842b7d7adb1da1d60
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir create_file
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|/tmp
42 * smbd_audit: nobody|192.168.234.1|create_file|fail (No such file or directory)|0x1|file|open|/ts/doesNotExist
43 * smbd_audit: nobody|192.168.234.1|open|ok|w|/tmp/file.txt
44 * smbd_audit: nobody|192.168.234.1|create_file|ok|0x3|file|open|/tmp/file.txt
45 *
46 * where "nobody" is the connected username and "192.168.234.1" is the
47 * client's IP address.
48 *
49 * Options:
50 *
51 * prefix: A macro expansion template prepended to the syslog entry.
52 *
53 * success: A list of VFS operations for which a successful completion should
54 * be logged. Defaults to no logging at all. The special operation "all" logs
55 * - you guessed it - everything.
56 *
57 * failure: A list of VFS operations for which failure to complete should be
58 * logged. Defaults to logging everything.
59 */
60
61
62 #include "includes.h"
63 #include "system/filesys.h"
64 #include "system/syslog.h"
65 #include "smbd/smbd.h"
66 #include "../librpc/gen_ndr/ndr_netlogon.h"
67 #include "auth.h"
68 #include "ntioctl.h"
69 #include "lib/param/loadparm.h"
70 #include "lib/util/bitmap.h"
71 #include "lib/util/tevent_unix.h"
72 #include "libcli/security/sddl.h"
73 #include "passdb/machine_sid.h"
74 #include "lib/util/tevent_ntstatus.h"
75 #include "lib/util/string_wrappers.h"
76 #include "source3/lib/substitute.h"
77
78 static int vfs_full_audit_debug_level = DBGC_VFS;
79
80 struct vfs_full_audit_private_data {
81 struct bitmap *success_ops;
82 struct bitmap *failure_ops;
83 int syslog_facility;
84 int syslog_priority;
85 bool log_secdesc;
86 bool do_syslog;
87 };
88
89 #undef DBGC_CLASS
90 #define DBGC_CLASS vfs_full_audit_debug_level
91
92 typedef enum _vfs_op_type {
93 SMB_VFS_OP_NOOP = -1,
94
95 /* Disk operations */
96
97 SMB_VFS_OP_CONNECT = 0,
98 SMB_VFS_OP_DISCONNECT,
99 SMB_VFS_OP_DISK_FREE,
100 SMB_VFS_OP_GET_QUOTA,
101 SMB_VFS_OP_SET_QUOTA,
102 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
103 SMB_VFS_OP_STATVFS,
104 SMB_VFS_OP_FS_CAPABILITIES,
105 SMB_VFS_OP_GET_DFS_REFERRALS,
106 SMB_VFS_OP_CREATE_DFS_PATHAT,
107 SMB_VFS_OP_READ_DFS_PATHAT,
108
109 /* Directory operations */
110
111 SMB_VFS_OP_FDOPENDIR,
112 SMB_VFS_OP_READDIR,
113 SMB_VFS_OP_SEEKDIR,
114 SMB_VFS_OP_TELLDIR,
115 SMB_VFS_OP_REWINDDIR,
116 SMB_VFS_OP_MKDIRAT,
117 SMB_VFS_OP_CLOSEDIR,
118
119 /* File operations */
120
121 SMB_VFS_OP_OPEN,
122 SMB_VFS_OP_OPENAT,
123 SMB_VFS_OP_CREATE_FILE,
124 SMB_VFS_OP_CLOSE,
125 SMB_VFS_OP_READ,
126 SMB_VFS_OP_PREAD,
127 SMB_VFS_OP_PREAD_SEND,
128 SMB_VFS_OP_PREAD_RECV,
129 SMB_VFS_OP_WRITE,
130 SMB_VFS_OP_PWRITE,
131 SMB_VFS_OP_PWRITE_SEND,
132 SMB_VFS_OP_PWRITE_RECV,
133 SMB_VFS_OP_LSEEK,
134 SMB_VFS_OP_SENDFILE,
135 SMB_VFS_OP_RECVFILE,
136 SMB_VFS_OP_RENAMEAT,
137 SMB_VFS_OP_FSYNC,
138 SMB_VFS_OP_FSYNC_SEND,
139 SMB_VFS_OP_FSYNC_RECV,
140 SMB_VFS_OP_STAT,
141 SMB_VFS_OP_FSTAT,
142 SMB_VFS_OP_LSTAT,
143 SMB_VFS_OP_GET_ALLOC_SIZE,
144 SMB_VFS_OP_UNLINKAT,
145 SMB_VFS_OP_FCHMOD,
146 SMB_VFS_OP_FCHOWN,
147 SMB_VFS_OP_LCHOWN,
148 SMB_VFS_OP_CHDIR,
149 SMB_VFS_OP_GETWD,
150 SMB_VFS_OP_NTIMES,
151 SMB_VFS_OP_FNTIMES,
152 SMB_VFS_OP_FTRUNCATE,
153 SMB_VFS_OP_FALLOCATE,
154 SMB_VFS_OP_LOCK,
155 SMB_VFS_OP_FILESYSTEM_SHAREMODE,
156 SMB_VFS_OP_FCNTL,
157 SMB_VFS_OP_LINUX_SETLEASE,
158 SMB_VFS_OP_GETLOCK,
159 SMB_VFS_OP_SYMLINKAT,
160 SMB_VFS_OP_READLINKAT,
161 SMB_VFS_OP_LINKAT,
162 SMB_VFS_OP_MKNODAT,
163 SMB_VFS_OP_REALPATH,
164 SMB_VFS_OP_FCHFLAGS,
165 SMB_VFS_OP_FILE_ID_CREATE,
166 SMB_VFS_OP_FS_FILE_ID,
167 SMB_VFS_OP_FSTREAMINFO,
168 SMB_VFS_OP_GET_REAL_FILENAME,
169 SMB_VFS_OP_CONNECTPATH,
170 SMB_VFS_OP_BRL_LOCK_WINDOWS,
171 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
172 SMB_VFS_OP_STRICT_LOCK_CHECK,
173 SMB_VFS_OP_TRANSLATE_NAME,
174 SMB_VFS_OP_PARENT_PATHNAME,
175 SMB_VFS_OP_FSCTL,
176 SMB_VFS_OP_OFFLOAD_READ_SEND,
177 SMB_VFS_OP_OFFLOAD_READ_RECV,
178 SMB_VFS_OP_OFFLOAD_WRITE_SEND,
179 SMB_VFS_OP_OFFLOAD_WRITE_RECV,
180 SMB_VFS_OP_FGET_COMPRESSION,
181 SMB_VFS_OP_SET_COMPRESSION,
182 SMB_VFS_OP_SNAP_CHECK_PATH,
183 SMB_VFS_OP_SNAP_CREATE,
184 SMB_VFS_OP_SNAP_DELETE,
185
186 /* DOS attribute operations. */
187 SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
188 SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
189 SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
190 SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
191
192 /* NT ACL operations. */
193
194 SMB_VFS_OP_FGET_NT_ACL,
195 SMB_VFS_OP_FSET_NT_ACL,
196 SMB_VFS_OP_AUDIT_FILE,
197
198 /* POSIX ACL operations. */
199
200 SMB_VFS_OP_SYS_ACL_GET_FD,
201 SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
202 SMB_VFS_OP_SYS_ACL_SET_FD,
203 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD,
204
205 /* EA operations. */
206 SMB_VFS_OP_GETXATTRAT_SEND,
207 SMB_VFS_OP_GETXATTRAT_RECV,
208 SMB_VFS_OP_FGETXATTR,
209 SMB_VFS_OP_FLISTXATTR,
210 SMB_VFS_OP_REMOVEXATTR,
211 SMB_VFS_OP_FREMOVEXATTR,
212 SMB_VFS_OP_FSETXATTR,
213
214 /* aio operations */
215 SMB_VFS_OP_AIO_FORCE,
216
217 /* offline operations */
218 SMB_VFS_OP_IS_OFFLINE,
219 SMB_VFS_OP_SET_OFFLINE,
220
221 /* Durable handle operations. */
222 SMB_VFS_OP_DURABLE_COOKIE,
223 SMB_VFS_OP_DURABLE_DISCONNECT,
224 SMB_VFS_OP_DURABLE_RECONNECT,
225
226 SMB_VFS_OP_FREADDIR_ATTR,
227
228 /* This should always be last enum value */
229
230 SMB_VFS_OP_LAST
231 } vfs_op_type;
232
233 /* The following array *must* be in the same order as defined in vfs_op_type */
234
235 static struct {
236 vfs_op_type type;
237 const char *name;
238 } vfs_op_names[] = {
239 { SMB_VFS_OP_CONNECT, "connect" },
240 { SMB_VFS_OP_DISCONNECT, "disconnect" },
241 { SMB_VFS_OP_DISK_FREE, "disk_free" },
242 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
243 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
244 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
245 { SMB_VFS_OP_STATVFS, "statvfs" },
246 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
247 { SMB_VFS_OP_GET_DFS_REFERRALS, "get_dfs_referrals" },
248 { SMB_VFS_OP_CREATE_DFS_PATHAT, "create_dfs_pathat" },
249 { SMB_VFS_OP_READ_DFS_PATHAT, "read_dfs_pathat" },
250 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
251 { SMB_VFS_OP_READDIR, "readdir" },
252 { SMB_VFS_OP_SEEKDIR, "seekdir" },
253 { SMB_VFS_OP_TELLDIR, "telldir" },
254 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
255 { SMB_VFS_OP_MKDIRAT, "mkdirat" },
256 { SMB_VFS_OP_CLOSEDIR, "closedir" },
257 { SMB_VFS_OP_OPEN, "open" },
258 { SMB_VFS_OP_OPENAT, "openat" },
259 { SMB_VFS_OP_CREATE_FILE, "create_file" },
260 { SMB_VFS_OP_CLOSE, "close" },
261 { SMB_VFS_OP_READ, "read" },
262 { SMB_VFS_OP_PREAD, "pread" },
263 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
264 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
265 { SMB_VFS_OP_WRITE, "write" },
266 { SMB_VFS_OP_PWRITE, "pwrite" },
267 { SMB_VFS_OP_PWRITE_SEND, "pwrite_send" },
268 { SMB_VFS_OP_PWRITE_RECV, "pwrite_recv" },
269 { SMB_VFS_OP_LSEEK, "lseek" },
270 { SMB_VFS_OP_SENDFILE, "sendfile" },
271 { SMB_VFS_OP_RECVFILE, "recvfile" },
272 { SMB_VFS_OP_RENAMEAT, "renameat" },
273 { SMB_VFS_OP_FSYNC, "fsync" },
274 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
275 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
276 { SMB_VFS_OP_STAT, "stat" },
277 { SMB_VFS_OP_FSTAT, "fstat" },
278 { SMB_VFS_OP_LSTAT, "lstat" },
279 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
280 { SMB_VFS_OP_UNLINKAT, "unlinkat" },
281 { SMB_VFS_OP_FCHMOD, "fchmod" },
282 { SMB_VFS_OP_FCHOWN, "fchown" },
283 { SMB_VFS_OP_LCHOWN, "lchown" },
284 { SMB_VFS_OP_CHDIR, "chdir" },
285 { SMB_VFS_OP_GETWD, "getwd" },
286 { SMB_VFS_OP_NTIMES, "ntimes" },
287 { SMB_VFS_OP_FNTIMES, "fntimes" },
288 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
289 { SMB_VFS_OP_FALLOCATE,"fallocate" },
290 { SMB_VFS_OP_LOCK, "lock" },
291 { SMB_VFS_OP_FILESYSTEM_SHAREMODE, "filesystem_sharemode" },
292 { SMB_VFS_OP_FCNTL, "fcntl" },
293 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
294 { SMB_VFS_OP_GETLOCK, "getlock" },
295 { SMB_VFS_OP_SYMLINKAT, "symlinkat" },
296 { SMB_VFS_OP_READLINKAT,"readlinkat" },
297 { SMB_VFS_OP_LINKAT, "linkat" },
298 { SMB_VFS_OP_MKNODAT, "mknodat" },
299 { SMB_VFS_OP_REALPATH, "realpath" },
300 { SMB_VFS_OP_FCHFLAGS, "fchflags" },
301 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
302 { SMB_VFS_OP_FS_FILE_ID, "fs_file_id" },
303 { SMB_VFS_OP_FSTREAMINFO, "fstreaminfo" },
304 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
305 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
306 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
307 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
308 { SMB_VFS_OP_STRICT_LOCK_CHECK, "strict_lock_check" },
309 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
310 { SMB_VFS_OP_PARENT_PATHNAME, "parent_pathname" },
311 { SMB_VFS_OP_FSCTL, "fsctl" },
312 { SMB_VFS_OP_OFFLOAD_READ_SEND, "offload_read_send" },
313 { SMB_VFS_OP_OFFLOAD_READ_RECV, "offload_read_recv" },
314 { SMB_VFS_OP_OFFLOAD_WRITE_SEND, "offload_write_send" },
315 { SMB_VFS_OP_OFFLOAD_WRITE_RECV, "offload_write_recv" },
316 { SMB_VFS_OP_FGET_COMPRESSION, "fget_compression" },
317 { SMB_VFS_OP_SET_COMPRESSION, "set_compression" },
318 { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
319 { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
320 { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
321 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND, "get_dos_attributes_send" },
322 { SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV, "get_dos_attributes_recv" },
323 { SMB_VFS_OP_FGET_DOS_ATTRIBUTES, "fget_dos_attributes" },
324 { SMB_VFS_OP_FSET_DOS_ATTRIBUTES, "fset_dos_attributes" },
325 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
326 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
327 { SMB_VFS_OP_AUDIT_FILE, "audit_file" },
328 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
329 { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, "sys_acl_blob_get_fd" },
330 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
331 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD, "sys_acl_delete_def_fd" },
332 { SMB_VFS_OP_GETXATTRAT_SEND, "getxattrat_send" },
333 { SMB_VFS_OP_GETXATTRAT_RECV, "getxattrat_recv" },
334 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
335 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
336 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
337 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
338 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
339 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
340 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
341 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
342 { SMB_VFS_OP_DURABLE_COOKIE, "durable_cookie" },
343 { SMB_VFS_OP_DURABLE_DISCONNECT, "durable_disconnect" },
344 { SMB_VFS_OP_DURABLE_RECONNECT, "durable_reconnect" },
345 { SMB_VFS_OP_FREADDIR_ATTR, "freaddir_attr" },
346 { SMB_VFS_OP_LAST, NULL }
347 };
348
349 static int audit_syslog_facility(vfs_handle_struct *handle)
350 {
351 static const struct enum_list enum_log_facilities[] = {
352 #ifdef LOG_AUTH
353 { LOG_AUTH, "AUTH" },
354 #endif
355 #ifdef LOG_AUTHPRIV
356 { LOG_AUTHPRIV, "AUTHPRIV" },
357 #endif
358 #ifdef LOG_AUDIT
359 { LOG_AUDIT, "AUDIT" },
360 #endif
361 #ifdef LOG_CONSOLE
362 { LOG_CONSOLE, "CONSOLE" },
363 #endif
364 #ifdef LOG_CRON
365 { LOG_CRON, "CRON" },
366 #endif
367 #ifdef LOG_DAEMON
368 { LOG_DAEMON, "DAEMON" },
369 #endif
370 #ifdef LOG_FTP
371 { LOG_FTP, "FTP" },
372 #endif
373 #ifdef LOG_INSTALL
374 { LOG_INSTALL, "INSTALL" },
375 #endif
376 #ifdef LOG_KERN
377 { LOG_KERN, "KERN" },
378 #endif
379 #ifdef LOG_LAUNCHD
380 { LOG_LAUNCHD, "LAUNCHD" },
381 #endif
382 #ifdef LOG_LFMT
383 { LOG_LFMT, "LFMT" },
384 #endif
385 #ifdef LOG_LPR
386 { LOG_LPR, "LPR" },
387 #endif
388 #ifdef LOG_MAIL
389 { LOG_MAIL, "MAIL" },
390 #endif
391 #ifdef LOG_MEGASAFE
392 { LOG_MEGASAFE, "MEGASAFE" },
393 #endif
394 #ifdef LOG_NETINFO
395 { LOG_NETINFO, "NETINFO" },
396 #endif
397 #ifdef LOG_NEWS
398 { LOG_NEWS, "NEWS" },
399 #endif
400 #ifdef LOG_NFACILITIES
401 { LOG_NFACILITIES, "NFACILITIES" },
402 #endif
403 #ifdef LOG_NTP
404 { LOG_NTP, "NTP" },
405 #endif
406 #ifdef LOG_RAS
407 { LOG_RAS, "RAS" },
408 #endif
409 #ifdef LOG_REMOTEAUTH
410 { LOG_REMOTEAUTH, "REMOTEAUTH" },
411 #endif
412 #ifdef LOG_SECURITY
413 { LOG_SECURITY, "SECURITY" },
414 #endif
415 #ifdef LOG_SYSLOG
416 { LOG_SYSLOG, "SYSLOG" },
417 #endif
418 #ifdef LOG_USER
419 { LOG_USER, "USER" },
420 #endif
421 #ifdef LOG_UUCP
422 { LOG_UUCP, "UUCP" },
423 #endif
424 { LOG_LOCAL0, "LOCAL0" },
425 { LOG_LOCAL1, "LOCAL1" },
426 { LOG_LOCAL2, "LOCAL2" },
427 { LOG_LOCAL3, "LOCAL3" },
428 { LOG_LOCAL4, "LOCAL4" },
429 { LOG_LOCAL5, "LOCAL5" },
430 { LOG_LOCAL6, "LOCAL6" },
431 { LOG_LOCAL7, "LOCAL7" },
432 { -1, NULL }
433 };
434
435 int facility;
436
437 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
438
439 return facility;
440 }
441
442 static int audit_syslog_priority(vfs_handle_struct *handle)
443 {
444 static const struct enum_list enum_log_priorities[] = {
445 { LOG_EMERG, "EMERG" },
446 { LOG_ALERT, "ALERT" },
447 { LOG_CRIT, "CRIT" },
448 { LOG_ERR, "ERR" },
449 { LOG_WARNING, "WARNING" },
450 { LOG_NOTICE, "NOTICE" },
451 { LOG_INFO, "INFO" },
452 { LOG_DEBUG, "DEBUG" },
453 { -1, NULL }
454 };
455
456 int priority;
457
458 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
459 enum_log_priorities, LOG_NOTICE);
460 if (priority == -1) {
461 priority = LOG_WARNING;
462 }
463
464 return priority;
465 }
466
467 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
468 {
469 const struct loadparm_substitution *lp_sub =
470 loadparm_s3_global_substitution();
471 char *prefix = NULL;
472 char *result;
473
474 prefix = talloc_strdup(ctx,
475 lp_parm_const_string(SNUM(conn), "full_audit",
476 "prefix", "%u|%I"));
477 if (!prefix) {
478 return NULL;
479 }
480 result = talloc_sub_full(ctx,
481 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
482 conn->session_info->unix_info->unix_name,
483 conn->connectpath,
484 conn->session_info->unix_token->gid,
485 conn->session_info->unix_info->sanitized_username,
486 conn->session_info->info->domain_name,
487 prefix);
488 TALLOC_FREE(prefix);
489 return result;
490 }
491
492 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
493 {
494 if (pd->success_ops == NULL) {
495 return True;
496 }
497
498 return bitmap_query(pd->success_ops, op);
499 }
500
501 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
502 {
503 if (pd->failure_ops == NULL)
504 return True;
505
506 return bitmap_query(pd->failure_ops, op);
507 }
508
509 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
510 {
511 struct bitmap *bm;
512
513 if (ops == NULL) {
514 return NULL;
515 }
516
517 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
518 if (bm == NULL) {
519 DEBUG(0, ("Could not alloc bitmap -- "
520 "defaulting to logging everything\n"));
521 return NULL;
522 }
523
524 for (; *ops != NULL; ops += 1) {
525 int i;
526 bool neg = false;
527 const char *op;
528
529 if (strequal(*ops, "all")) {
530 for (i=0; i<SMB_VFS_OP_LAST; i++) {
531 bitmap_set(bm, i);
532 }
533 continue;
534 }
535
536 if (strequal(*ops, "none")) {
537 break;
538 }
539
540 op = ops[0];
541 if (op[0] == '!') {
542 neg = true;
543 op += 1;
544 }
545
546 for (i=0; i<SMB_VFS_OP_LAST; i++) {
547 if ((vfs_op_names[i].name == NULL)
548 || (vfs_op_names[i].type != i)) {
549 smb_panic("vfs_full_audit.c: name table not "
550 "in sync with vfs_op_type enums\n");
551 }
552 if (strequal(op, vfs_op_names[i].name)) {
553 if (neg) {
554 bitmap_clear(bm, i);
555 } else {
556 bitmap_set(bm, i);
557 }
558 break;
559 }
560 }
561 if (i == SMB_VFS_OP_LAST) {
562 DEBUG(0, ("Could not find opname %s, logging all\n",
563 *ops));
564 TALLOC_FREE(bm);
565 return NULL;
566 }
567 }
568 return bm;
569 }
570
571 static const char *audit_opname(vfs_op_type op)
572 {
573 if (op >= SMB_VFS_OP_LAST)
574 return "INVALID VFS OP";
575 return vfs_op_names[op].name;
576 }
577
578 static TALLOC_CTX *tmp_do_log_ctx;
579 /*
580 * Get us a temporary talloc context usable just for DEBUG arguments
581 */
582 static TALLOC_CTX *do_log_ctx(void)
583 {
584 if (tmp_do_log_ctx == NULL) {
585 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
586 }
587 return tmp_do_log_ctx;
588 }
589
590 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
591 const char *format, ...) PRINTF_ATTRIBUTE(4, 5);
592
593 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
594 const char *format, ...)
595 {
596 struct vfs_full_audit_private_data *pd;
597 fstring err_msg;
598 char *audit_pre = NULL;
599 va_list ap;
600 char *op_msg = NULL;
601
602 SMB_VFS_HANDLE_GET_DATA(handle, pd,
603 struct vfs_full_audit_private_data,
604 return;);
605
606 if (success && (!log_success(pd, op)))
607 goto out;
608
609 if (!success && (!log_failure(pd, op)))
610 goto out;
611
612 if (success)
613 fstrcpy(err_msg, "ok");
614 else
615 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
616
617 va_start(ap, format);
618 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
619 va_end(ap);
620
621 if (!op_msg) {
622 goto out;
623 }
624
625 audit_pre = audit_prefix(talloc_tos(), handle->conn);
626
627 if (pd->do_syslog) {
628 int priority;
629
630 /*
631 * Specify the facility to interoperate with other syslog
632 * callers (smbd for example).
633 */
634 priority = pd->syslog_priority | pd->syslog_facility;
635
636 syslog(priority, "%s|%s|%s|%s\n",
637 audit_pre ? audit_pre : "",
638 audit_opname(op), err_msg, op_msg);
639 } else {
640 DEBUG(1, ("%s|%s|%s|%s\n",
641 audit_pre ? audit_pre : "",
642 audit_opname(op), err_msg, op_msg));
643 }
644 out:
645 TALLOC_FREE(audit_pre);
646 TALLOC_FREE(op_msg);
647 TALLOC_FREE(tmp_do_log_ctx);
648 }
649
650 /**
651 * Return a string using the do_log_ctx()
652 */
653 static const char *smb_fname_str_do_log(struct connection_struct *conn,
654 const struct smb_filename *smb_fname)
655 {
656 char *fname = NULL;
657 NTSTATUS status;
658
659 if (smb_fname == NULL) {
660 return "";
661 }
662
663 if (smb_fname->base_name[0] != '/') {
664 char *abs_name = NULL;
665 struct smb_filename *fname_copy = cp_smb_filename(
666 do_log_ctx(),
667 smb_fname);
668 if (fname_copy == NULL) {
669 return "";
670 }
671
672 if (!ISDOT(smb_fname->base_name)) {
673 abs_name = talloc_asprintf(do_log_ctx(),
674 "%s/%s",
675 conn->cwd_fsp->fsp_name->base_name,
676 smb_fname->base_name);
677 } else {
678 abs_name = talloc_strdup(do_log_ctx(),
679 conn->cwd_fsp->fsp_name->base_name);
680 }
681 if (abs_name == NULL) {
682 return "";
683 }
684 fname_copy->base_name = abs_name;
685 smb_fname = fname_copy;
686 }
687
688 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
689 if (!NT_STATUS_IS_OK(status)) {
690 return "";
691 }
692 return fname;
693 }
694
695 /**
696 * Return an fsp debug string using the do_log_ctx()
697 */
698 static const char *fsp_str_do_log(const struct files_struct *fsp)
699 {
700 return smb_fname_str_do_log(fsp->conn, fsp->fsp_name);
701 }
702
703 /* Implementation of vfs_ops. Pass everything on to the default
704 operation but log event first. */
705
706 static int smb_full_audit_connect(vfs_handle_struct *handle,
707 const char *svc, const char *user)
708 {
709 int result;
710 const char *none[] = { "none" };
711 struct vfs_full_audit_private_data *pd = NULL;
712
713 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
714 if (result < 0) {
715 return result;
716 }
717
718 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
719 if (!pd) {
720 SMB_VFS_NEXT_DISCONNECT(handle);
721 return -1;
722 }
723
724 pd->syslog_facility = audit_syslog_facility(handle);
725 if (pd->syslog_facility == -1) {
726 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
727 lp_parm_const_string(SNUM(handle->conn),
728 "full_audit", "facility",
729 "USER")));
730 SMB_VFS_NEXT_DISCONNECT(handle);
731 return -1;
732 }
733
734 pd->syslog_priority = audit_syslog_priority(handle);
735
736 pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
737 "full_audit", "log_secdesc", false);
738
739 pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
740 "full_audit", "syslog", true);
741
742 #ifdef WITH_SYSLOG
743 if (pd->do_syslog) {
744 openlog("smbd_audit", 0, pd->syslog_facility);
745 }
746 #endif
747
748 pd->success_ops = init_bitmap(
749 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
750 "success", none));
751 pd->failure_ops = init_bitmap(
752 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
753 "failure", none));
754
755 /* Store the private data. */
756 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
757 struct vfs_full_audit_private_data, return -1);
758
759 do_log(SMB_VFS_OP_CONNECT, True, handle,
760 "%s", svc);
761
762 return 0;
763 }
764
765 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
766 {
767 const struct loadparm_substitution *lp_sub =
768 loadparm_s3_global_substitution();
769
770 SMB_VFS_NEXT_DISCONNECT(handle);
771
772 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
773 "%s", lp_servicename(talloc_tos(), lp_sub, SNUM(handle->conn)));
774
775 /* The bitmaps will be disconnected when the private
776 data is deleted. */
777 }
778
779 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
780 const struct smb_filename *smb_fname,
781 uint64_t *bsize,
782 uint64_t *dfree,
783 uint64_t *dsize)
784 {
785 uint64_t result;
786
787 result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
788
789 /* Don't have a reasonable notion of failure here */
790
791 do_log(SMB_VFS_OP_DISK_FREE,
792 True,
793 handle,
794 "%s",
795 smb_fname_str_do_log(handle->conn, smb_fname));
796
797 return result;
798 }
799
800 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
801 const struct smb_filename *smb_fname,
802 enum SMB_QUOTA_TYPE qtype,
803 unid_t id,
804 SMB_DISK_QUOTA *qt)
805 {
806 int result;
807
808 result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
809
810 do_log(SMB_VFS_OP_GET_QUOTA,
811 (result >= 0),
812 handle,
813 "%s",
814 smb_fname_str_do_log(handle->conn, smb_fname));
815
816 return result;
817 }
818
819 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
820 enum SMB_QUOTA_TYPE qtype, unid_t id,
821 SMB_DISK_QUOTA *qt)
822 {
823 int result;
824
825 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
826
827 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
828
829 return result;
830 }
831
832 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
833 struct files_struct *fsp,
834 struct shadow_copy_data *shadow_copy_data,
835 bool labels)
836 {
837 int result;
838
839 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
840
841 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
842
843 return result;
844 }
845
846 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
847 const struct smb_filename *smb_fname,
848 struct vfs_statvfs_struct *statbuf)
849 {
850 int result;
851
852 result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
853
854 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
855
856 return result;
857 }
858
859 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
860 {
861 int result;
862
863 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
864
865 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
866
867 return result;
868 }
869
870 static NTSTATUS smb_full_audit_get_dfs_referrals(
871 struct vfs_handle_struct *handle,
872 struct dfs_GetDFSReferral *r)
873 {
874 NTSTATUS status;
875
876 status = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
877
878 do_log(SMB_VFS_OP_GET_DFS_REFERRALS, NT_STATUS_IS_OK(status),
879 handle, "");
880
881 return status;
882 }
883
884 static NTSTATUS smb_full_audit_create_dfs_pathat(struct vfs_handle_struct *handle,
885 struct files_struct *dirfsp,
886 const struct smb_filename *smb_fname,
887 const struct referral *reflist,
888 size_t referral_count)
889 {
890 NTSTATUS status;
891 struct smb_filename *full_fname = NULL;
892
893 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
894 dirfsp,
895 smb_fname);
896 if (full_fname == NULL) {
897 return NT_STATUS_NO_MEMORY;
898 }
899
900 status = SMB_VFS_NEXT_CREATE_DFS_PATHAT(handle,
901 dirfsp,
902 smb_fname,
903 reflist,
904 referral_count);
905
906 do_log(SMB_VFS_OP_CREATE_DFS_PATHAT,
907 NT_STATUS_IS_OK(status),
908 handle,
909 "%s",
910 smb_fname_str_do_log(handle->conn, full_fname));
911
912 TALLOC_FREE(full_fname);
913 return status;
914 }
915
916 static NTSTATUS smb_full_audit_read_dfs_pathat(struct vfs_handle_struct *handle,
917 TALLOC_CTX *mem_ctx,
918 struct files_struct *dirfsp,
919 struct smb_filename *smb_fname,
920 struct referral **ppreflist,
921 size_t *preferral_count)
922 {
923 struct smb_filename *full_fname = NULL;
924 NTSTATUS status;
925
926 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
927 dirfsp,
928 smb_fname);
929 if (full_fname == NULL) {
930 return NT_STATUS_NO_MEMORY;
931 }
932
933 status = SMB_VFS_NEXT_READ_DFS_PATHAT(handle,
934 mem_ctx,
935 dirfsp,
936 smb_fname,
937 ppreflist,
938 preferral_count);
939
940 do_log(SMB_VFS_OP_READ_DFS_PATHAT,
941 NT_STATUS_IS_OK(status),
942 handle,
943 "%s",
944 smb_fname_str_do_log(handle->conn, full_fname));
945
946 TALLOC_FREE(full_fname);
947 return status;
948 }
949
950 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
951 TALLOC_CTX *mem_ctx,
952 const char *service_path,
953 char **base_volume)
954 {
955 NTSTATUS status;
956
957 status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
958 base_volume);
959 do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
960 handle, "");
961
962 return status;
963 }
964
965 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
966 TALLOC_CTX *mem_ctx,
967 const char *base_volume,
968 time_t *tstamp,
969 bool rw,
970 char **base_path,
971 char **snap_path)
972 {
973 NTSTATUS status;
974
975 status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
976 rw, base_path, snap_path);
977 do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
978
979 return status;
980 }
981
982 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
983 TALLOC_CTX *mem_ctx,
984 char *base_path,
985 char *snap_path)
986 {
987 NTSTATUS status;
988
989 status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
990 snap_path);
991 do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
992
993 return status;
994 }
995
996 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
997 files_struct *fsp, const char *mask, uint32_t attr)
998 {
999 DIR *result;
1000
1001 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
1002
1003 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
1004 fsp_str_do_log(fsp));
1005
1006 return result;
1007 }
1008
1009 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
1010 struct files_struct *dirfsp,
1011 DIR *dirp,
1012 SMB_STRUCT_STAT *sbuf)
1013 {
1014 struct dirent *result;
1015
1016 result = SMB_VFS_NEXT_READDIR(handle, dirfsp, dirp, sbuf);
1017
1018 /* This operation has no reasonable error condition
1019 * (End of dir is also failure), so always succeed.
1020 */
1021 do_log(SMB_VFS_OP_READDIR, True, handle, "");
1022
1023 return result;
1024 }
1025
1026 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
1027 DIR *dirp, long offset)
1028 {
1029 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
1030
1031 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
1032 }
1033
1034 static long smb_full_audit_telldir(vfs_handle_struct *handle,
1035 DIR *dirp)
1036 {
1037 long result;
1038
1039 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
1040
1041 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
1042
1043 return result;
1044 }
1045
1046 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
1047 DIR *dirp)
1048 {
1049 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
1050
1051 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
1052 }
1053
1054 static int smb_full_audit_mkdirat(vfs_handle_struct *handle,
1055 struct files_struct *dirfsp,
1056 const struct smb_filename *smb_fname,
1057 mode_t mode)
1058 {
1059 struct smb_filename *full_fname = NULL;
1060 int result;
1061
1062 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1063 dirfsp,
1064 smb_fname);
1065 if (full_fname == NULL) {
1066 errno = ENOMEM;
1067 return -1;
1068 }
1069
1070 result = SMB_VFS_NEXT_MKDIRAT(handle,
1071 dirfsp,
1072 smb_fname,
1073 mode);
1074
1075 do_log(SMB_VFS_OP_MKDIRAT,
1076 (result >= 0),
1077 handle,
1078 "%s",
1079 smb_fname_str_do_log(handle->conn, full_fname));
1080
1081 TALLOC_FREE(full_fname);
1082
1083 return result;
1084 }
1085
1086 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1087 DIR *dirp)
1088 {
1089 int result;
1090
1091 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1092
1093 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1094
1095 return result;
1096 }
1097
1098 static int smb_full_audit_openat(vfs_handle_struct *handle,
1099 const struct files_struct *dirfsp,
1100 const struct smb_filename *smb_fname,
1101 struct files_struct *fsp,
1102 int flags,
1103 mode_t mode)
1104 {
1105 int result;
1106
1107 result = SMB_VFS_NEXT_OPENAT(handle, dirfsp, smb_fname, fsp, flags, mode);
1108
1109 do_log(SMB_VFS_OP_OPENAT, (result >= 0), handle, "%s|%s",
1110 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1111 fsp_str_do_log(fsp));
1112
1113 return result;
1114 }
1115
1116 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1117 struct smb_request *req,
1118 struct smb_filename *smb_fname,
1119 uint32_t access_mask,
1120 uint32_t share_access,
1121 uint32_t create_disposition,
1122 uint32_t create_options,
1123 uint32_t file_attributes,
1124 uint32_t oplock_request,
1125 const struct smb2_lease *lease,
1126 uint64_t allocation_size,
1127 uint32_t private_flags,
1128 struct security_descriptor *sd,
1129 struct ea_list *ea_list,
1130 files_struct **result_fsp,
1131 int *pinfo,
1132 const struct smb2_create_blobs *in_context_blobs,
1133 struct smb2_create_blobs *out_context_blobs)
1134 {
1135 NTSTATUS result;
1136 const char* str_create_disposition;
1137
1138 switch (create_disposition) {
1139 case FILE_SUPERSEDE:
1140 str_create_disposition = "supersede";
1141 break;
1142 case FILE_OVERWRITE_IF:
1143 str_create_disposition = "overwrite_if";
1144 break;
1145 case FILE_OPEN:
1146 str_create_disposition = "open";
1147 break;
1148 case FILE_OVERWRITE:
1149 str_create_disposition = "overwrite";
1150 break;
1151 case FILE_CREATE:
1152 str_create_disposition = "create";
1153 break;
1154 case FILE_OPEN_IF:
1155 str_create_disposition = "open_if";
1156 break;
1157 default:
1158 str_create_disposition = "unknown";
1159 }
1160
1161 result = SMB_VFS_NEXT_CREATE_FILE(
1162 handle, /* handle */
1163 req, /* req */
1164 smb_fname, /* fname */
1165 access_mask, /* access_mask */
1166 share_access, /* share_access */
1167 create_disposition, /* create_disposition*/
1168 create_options, /* create_options */
1169 file_attributes, /* file_attributes */
1170 oplock_request, /* oplock_request */
1171 lease, /* lease */
1172 allocation_size, /* allocation_size */
1173 private_flags,
1174 sd, /* sd */
1175 ea_list, /* ea_list */
1176 result_fsp, /* result */
1177 pinfo, /* pinfo */
1178 in_context_blobs, out_context_blobs); /* create context */
1179
1180 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
1181 "0x%x|%s|%s|%s", access_mask,
1182 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
1183 str_create_disposition,
1184 smb_fname_str_do_log(handle->conn, smb_fname));
1185
1186 return result;
1187 }
1188
1189 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1190 {
1191 int result;
1192
1193 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1194
1195 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
1196 fsp_str_do_log(fsp));
1197
1198 return result;
1199 }
1200
1201 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1202 void *data, size_t n, off_t offset)
1203 {
1204 ssize_t result;
1205
1206 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1207
1208 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1209 fsp_str_do_log(fsp));
1210
1211 return result;
1212 }
1213
1214 struct smb_full_audit_pread_state {
1215 vfs_handle_struct *handle;
1216 files_struct *fsp;
1217 ssize_t ret;
1218 struct vfs_aio_state vfs_aio_state;
1219 };
1220
1221 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1222
1223 static struct tevent_req *smb_full_audit_pread_send(
1224 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1225 struct tevent_context *ev, struct files_struct *fsp,
1226 void *data, size_t n, off_t offset)
1227 {
1228 struct tevent_req *req, *subreq;
1229 struct smb_full_audit_pread_state *state;
1230
1231 req = tevent_req_create(mem_ctx, &state,
1232 struct smb_full_audit_pread_state);
1233 if (req == NULL) {
1234 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1235 fsp_str_do_log(fsp));
1236 return NULL;
1237 }
1238 state->handle = handle;
1239 state->fsp = fsp;
1240
1241 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1242 n, offset);
1243 if (tevent_req_nomem(subreq, req)) {
1244 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1245 fsp_str_do_log(fsp));
1246 return tevent_req_post(req, ev);
1247 }
1248 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1249
1250 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1251 return req;
1252 }
1253
1254 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1255 {
1256 struct tevent_req *req = tevent_req_callback_data(
1257 subreq, struct tevent_req);
1258 struct smb_full_audit_pread_state *state = tevent_req_data(
1259 req, struct smb_full_audit_pread_state);
1260
1261 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
1262 TALLOC_FREE(subreq);
1263 tevent_req_done(req);
1264 }
1265
1266 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req,
1267 struct vfs_aio_state *vfs_aio_state)
1268 {
1269 struct smb_full_audit_pread_state *state = tevent_req_data(
1270 req, struct smb_full_audit_pread_state);
1271
1272 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1273 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1274 fsp_str_do_log(state->fsp));
1275 return -1;
1276 }
1277
1278 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1279 fsp_str_do_log(state->fsp));
1280
1281 *vfs_aio_state = state->vfs_aio_state;
1282 return state->ret;
1283 }
1284
1285 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1286 const void *data, size_t n,
1287 off_t offset)
1288 {
1289 ssize_t result;
1290
1291 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1292
1293 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1294 fsp_str_do_log(fsp));
1295
1296 return result;
1297 }
1298
1299 struct smb_full_audit_pwrite_state {
1300 vfs_handle_struct *handle;
1301 files_struct *fsp;
1302 ssize_t ret;
1303 struct vfs_aio_state vfs_aio_state;
1304 };
1305
1306 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1307
1308 static struct tevent_req *smb_full_audit_pwrite_send(
1309 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1310 struct tevent_context *ev, struct files_struct *fsp,
1311 const void *data, size_t n, off_t offset)
1312 {
1313 struct tevent_req *req, *subreq;
1314 struct smb_full_audit_pwrite_state *state;
1315
1316 req = tevent_req_create(mem_ctx, &state,
1317 struct smb_full_audit_pwrite_state);
1318 if (req == NULL) {
1319 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1320 fsp_str_do_log(fsp));
1321 return NULL;
1322 }
1323 state->handle = handle;
1324 state->fsp = fsp;
1325
1326 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1327 n, offset);
1328 if (tevent_req_nomem(subreq, req)) {
1329 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1330 fsp_str_do_log(fsp));
1331 return tevent_req_post(req, ev);
1332 }
1333 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1334
1335 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1336 fsp_str_do_log(fsp));
1337 return req;
1338 }
1339
1340 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1341 {
1342 struct tevent_req *req = tevent_req_callback_data(
1343 subreq, struct tevent_req);
1344 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1345 req, struct smb_full_audit_pwrite_state);
1346
1347 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
1348 TALLOC_FREE(subreq);
1349 tevent_req_done(req);
1350 }
1351
1352 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req,
1353 struct vfs_aio_state *vfs_aio_state)
1354 {
1355 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1356 req, struct smb_full_audit_pwrite_state);
1357
1358 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1359 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1360 fsp_str_do_log(state->fsp));
1361 return -1;
1362 }
1363
1364 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1365 fsp_str_do_log(state->fsp));
1366
1367 *vfs_aio_state = state->vfs_aio_state;
1368 return state->ret;
1369 }
1370
1371 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1372 off_t offset, int whence)
1373 {
1374 ssize_t result;
1375
1376 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1377
1378 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1379 "%s", fsp_str_do_log(fsp));
1380
1381 return result;
1382 }
1383
1384 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1385 files_struct *fromfsp,
1386 const DATA_BLOB *hdr, off_t offset,
1387 size_t n)
1388 {
1389 ssize_t result;
1390
1391 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1392
1393 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1394 "%s", fsp_str_do_log(fromfsp));
1395
1396 return result;
1397 }
1398
1399 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1400 files_struct *tofsp,
1401 off_t offset,
1402 size_t n)
1403 {
1404 ssize_t result;
1405
1406 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1407
1408 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1409 "%s", fsp_str_do_log(tofsp));
1410
1411 return result;
1412 }
1413
1414 static int smb_full_audit_renameat(vfs_handle_struct *handle,
1415 files_struct *srcfsp,
1416 const struct smb_filename *smb_fname_src,
1417 files_struct *dstfsp,
1418 const struct smb_filename *smb_fname_dst)
1419 {
1420 int result;
1421 int saved_errno;
1422 struct smb_filename *full_fname_src = NULL;
1423 struct smb_filename *full_fname_dst = NULL;
1424
1425 full_fname_src = full_path_from_dirfsp_atname(talloc_tos(),
1426 srcfsp,
1427 smb_fname_src);
1428 if (full_fname_src == NULL) {
1429 errno = ENOMEM;
1430 return -1;
1431 }
1432 full_fname_dst = full_path_from_dirfsp_atname(talloc_tos(),
1433 dstfsp,
1434 smb_fname_dst);
1435 if (full_fname_dst == NULL) {
1436 TALLOC_FREE(full_fname_src);
1437 errno = ENOMEM;
1438 return -1;
1439 }
1440
1441 result = SMB_VFS_NEXT_RENAMEAT(handle,
1442 srcfsp,
1443 smb_fname_src,
1444 dstfsp,
1445 smb_fname_dst);
1446
1447 if (result == -1) {
1448 saved_errno = errno;
1449 }
1450 do_log(SMB_VFS_OP_RENAMEAT, (result >= 0), handle, "%s|%s",
1451 smb_fname_str_do_log(handle->conn, full_fname_src),
1452 smb_fname_str_do_log(handle->conn, full_fname_dst));
1453
1454 TALLOC_FREE(full_fname_src);
1455 TALLOC_FREE(full_fname_dst);
1456
1457 if (result == -1) {
1458 errno = saved_errno;
1459 }
1460 return result;
1461 }
1462
1463 struct smb_full_audit_fsync_state {
1464 vfs_handle_struct *handle;
1465 files_struct *fsp;
1466 int ret;
1467 struct vfs_aio_state vfs_aio_state;
1468 };
1469
1470 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1471
1472 static struct tevent_req *smb_full_audit_fsync_send(
1473 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1474 struct tevent_context *ev, struct files_struct *fsp)
1475 {
1476 struct tevent_req *req, *subreq;
1477 struct smb_full_audit_fsync_state *state;
1478
1479 req = tevent_req_create(mem_ctx, &state,
1480 struct smb_full_audit_fsync_state);
1481 if (req == NULL) {
1482 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1483 fsp_str_do_log(fsp));
1484 return NULL;
1485 }
1486 state->handle = handle;
1487 state->fsp = fsp;
1488
1489 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1490 if (tevent_req_nomem(subreq, req)) {
1491 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1492 fsp_str_do_log(fsp));
1493 return tevent_req_post(req, ev);
1494 }
1495 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1496
1497 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1498 return req;
1499 }
1500
1501 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1502 {
1503 struct tevent_req *req = tevent_req_callback_data(
1504 subreq, struct tevent_req);
1505 struct smb_full_audit_fsync_state *state = tevent_req_data(
1506 req, struct smb_full_audit_fsync_state);
1507
1508 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1509 TALLOC_FREE(subreq);
1510 tevent_req_done(req);
1511 }
1512
1513 static int smb_full_audit_fsync_recv(struct tevent_req *req,
1514 struct vfs_aio_state *vfs_aio_state)
1515 {
1516 struct smb_full_audit_fsync_state *state = tevent_req_data(
1517 req, struct smb_full_audit_fsync_state);
1518
1519 if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1520 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1521 fsp_str_do_log(state->fsp));
1522 return -1;
1523 }
1524
1525 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1526 fsp_str_do_log(state->fsp));
1527
1528 *vfs_aio_state = state->vfs_aio_state;
1529 return state->ret;
1530 }
1531
1532 static int smb_full_audit_stat(vfs_handle_struct *handle,
1533 struct smb_filename *smb_fname)
1534 {
1535 int result;
1536
1537 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1538
1539 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1540 smb_fname_str_do_log(handle->conn, smb_fname));
1541
1542 return result;
1543 }
1544
1545 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1546 SMB_STRUCT_STAT *sbuf)
1547 {
1548 int result;
1549
1550 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1551
1552 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1553 fsp_str_do_log(fsp));
1554
1555 return result;
1556 }
1557
1558 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1559 struct smb_filename *smb_fname)
1560 {
1561 int result;
1562
1563 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1564
1565 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1566 smb_fname_str_do_log(handle->conn, smb_fname));
1567
1568 return result;
1569 }
1570
1571 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1572 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1573 {
1574 uint64_t result;
1575
1576 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1577
1578 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1579 "%llu", (unsigned long long)result);
1580
1581 return result;
1582 }
1583
1584 static int smb_full_audit_unlinkat(vfs_handle_struct *handle,
1585 struct files_struct *dirfsp,
1586 const struct smb_filename *smb_fname,
1587 int flags)
1588 {
1589 struct smb_filename *full_fname = NULL;
1590 int result;
1591
1592 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1593 dirfsp,
1594 smb_fname);
1595 if (full_fname == NULL) {
1596 return -1;
1597 }
1598
1599 result = SMB_VFS_NEXT_UNLINKAT(handle,
1600 dirfsp,
1601 smb_fname,
1602 flags);
1603
1604 do_log(SMB_VFS_OP_UNLINKAT, (result >= 0), handle, "%s",
1605 smb_fname_str_do_log(handle->conn, full_fname));
1606
1607 TALLOC_FREE(full_fname);
1608 return result;
1609 }
1610
1611 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1612 mode_t mode)
1613 {
1614 int result;
1615
1616 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1617
1618 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1619 "%s|%o", fsp_str_do_log(fsp), mode);
1620
1621 return result;
1622 }
1623
1624 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1625 uid_t uid, gid_t gid)
1626 {
1627 int result;
1628
1629 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1630
1631 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1632 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1633
1634 return result;
1635 }
1636
1637 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1638 const struct smb_filename *smb_fname,
1639 uid_t uid,
1640 gid_t gid)
1641 {
1642 int result;
1643
1644 result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1645
1646 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1647 smb_fname->base_name, (long int)uid, (long int)gid);
1648
1649 return result;
1650 }
1651
1652 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1653 const struct smb_filename *smb_fname)
1654 {
1655 int result;
1656
1657 result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1658
1659 do_log(SMB_VFS_OP_CHDIR,
1660 (result >= 0),
1661 handle,
1662 "chdir|%s",
1663 smb_fname_str_do_log(handle->conn, smb_fname));
1664
1665 return result;
1666 }
1667
1668 static struct smb_filename *smb_full_audit_getwd(vfs_handle_struct *handle,
1669 TALLOC_CTX *ctx)
1670 {
1671 struct smb_filename *result;
1672
1673 result = SMB_VFS_NEXT_GETWD(handle, ctx);
1674
1675 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1676 result == NULL? "" : result->base_name);
1677
1678 return result;
1679 }
1680
1681 static int smb_full_audit_fntimes(vfs_handle_struct *handle,
1682 files_struct *fsp,
1683 struct smb_file_time *ft)
1684 {
1685 int result;
1686 time_t create_time = convert_timespec_to_time_t(ft->create_time);
1687 time_t atime = convert_timespec_to_time_t(ft->atime);
1688 time_t mtime = convert_timespec_to_time_t(ft->mtime);
1689 time_t ctime = convert_timespec_to_time_t(ft->ctime);
1690 const char *create_time_str = "";
1691 const char *atime_str = "";
1692 const char *mtime_str = "";
1693 const char *ctime_str = "";
1694 TALLOC_CTX *frame = talloc_stackframe();
1695
1696 if (frame == NULL) {
1697 errno = ENOMEM;
1698 return -1;
1699 }
1700
1701 result = SMB_VFS_NEXT_FNTIMES(handle, fsp, ft);
1702
1703 if (create_time > 0) {
1704 create_time_str = timestring(frame, create_time);
1705 }
1706 if (atime > 0) {
1707 atime_str = timestring(frame, atime);
1708 }
1709 if (mtime > 0) {
1710 mtime_str = timestring(frame, mtime);
1711 }
1712 if (ctime > 0) {
1713 ctime_str = timestring(frame, ctime);
1714 }
1715
1716 do_log(SMB_VFS_OP_FNTIMES,
1717 (result >= 0),
1718 handle,
1719 "%s|%s|%s|%s|%s",
1720 fsp_str_do_log(fsp),
1721 create_time_str,
1722 atime_str,
1723 mtime_str,
1724 ctime_str);
1725
1726 TALLOC_FREE(frame);
1727
1728 return result;
1729 }
1730
1731 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1732 off_t len)
1733 {
1734 int result;
1735
1736 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1737
1738 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1739 "%s", fsp_str_do_log(fsp));
1740
1741 return result;
1742 }
1743
1744 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1745 uint32_t mode,
1746 off_t offset,
1747 off_t len)
1748 {
1749 int result;
1750
1751 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1752
1753 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1754 "%s", fsp_str_do_log(fsp));
1755
1756 return result;
1757 }
1758
1759 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1760 int op, off_t offset, off_t count, int type)
1761 {
1762 bool result;
1763
1764 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1765
1766 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1767
1768 return result;
1769 }
1770
1771 static int smb_full_audit_filesystem_sharemode(struct vfs_handle_struct *handle,
1772 struct files_struct *fsp,
1773 uint32_t share_access,
1774 uint32_t access_mask)
1775 {
1776 int result;
1777
1778 result = SMB_VFS_NEXT_FILESYSTEM_SHAREMODE(handle,
1779 fsp,
1780 share_access,
1781 access_mask);
1782
1783 do_log(SMB_VFS_OP_FILESYSTEM_SHAREMODE, (result >= 0), handle, "%s",
1784 fsp_str_do_log(fsp));
1785
1786 return result;
1787 }
1788
1789 static int smb_full_audit_fcntl(struct vfs_handle_struct *handle,
1790 struct files_struct *fsp,
1791 int cmd, va_list cmd_arg)
1792 {
1793 void *arg;
1794 va_list dup_cmd_arg;
1795 int result;
1796
1797 va_copy(dup_cmd_arg, cmd_arg);
1798 arg = va_arg(dup_cmd_arg, void *);
1799 result = SMB_VFS_NEXT_FCNTL(handle, fsp, cmd, arg);
1800 va_end(dup_cmd_arg);
1801
1802 do_log(SMB_VFS_OP_FCNTL, (result >= 0), handle, "%s",
1803 fsp_str_do_log(fsp));
1804
1805 return result;
1806 }
1807
1808 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1809 int leasetype)
1810 {
1811 int result;
1812
1813 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1814
1815 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1816 fsp_str_do_log(fsp));
1817
1818 return result;
1819 }
1820
1821 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1822 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1823 {
1824 bool result;
1825
1826 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1827
1828 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1829
1830 return result;
1831 }
1832
1833 static int smb_full_audit_symlinkat(vfs_handle_struct *handle,
1834 const struct smb_filename *link_contents,
1835 struct files_struct *dirfsp,
1836 const struct smb_filename *new_smb_fname)
1837 {
1838 struct smb_filename *full_fname = NULL;
1839 int result;
1840
1841 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1842 dirfsp,
1843 new_smb_fname);
1844 if (full_fname == NULL) {
1845 return -1;
1846 }
1847
1848 result = SMB_VFS_NEXT_SYMLINKAT(handle,
1849 link_contents,
1850 dirfsp,
1851 new_smb_fname);
1852
1853 do_log(SMB_VFS_OP_SYMLINKAT,
1854 (result >= 0),
1855 handle,
1856 "%s|%s",
1857 link_contents->base_name,
1858 smb_fname_str_do_log(handle->conn, full_fname));
1859
1860 TALLOC_FREE(full_fname);
1861
1862 return result;
1863 }
1864
1865 static int smb_full_audit_readlinkat(vfs_handle_struct *handle,
1866 const struct files_struct *dirfsp,
1867 const struct smb_filename *smb_fname,
1868 char *buf,
1869 size_t bufsiz)
1870 {
1871 struct smb_filename *full_fname = NULL;
1872 int result;
1873
1874 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1875 dirfsp,
1876 smb_fname);
1877 if (full_fname == NULL) {
1878 return -1;
1879 }
1880
1881 result = SMB_VFS_NEXT_READLINKAT(handle,
1882 dirfsp,
1883 smb_fname,
1884 buf,
1885 bufsiz);
1886
1887 do_log(SMB_VFS_OP_READLINKAT,
1888 (result >= 0),
1889 handle,
1890 "%s",
1891 smb_fname_str_do_log(handle->conn, full_fname));
1892
1893 TALLOC_FREE(full_fname);
1894
1895 return result;
1896 }
1897
1898 static int smb_full_audit_linkat(vfs_handle_struct *handle,
1899 files_struct *srcfsp,
1900 const struct smb_filename *old_smb_fname,
1901 files_struct *dstfsp,
1902 const struct smb_filename *new_smb_fname,
1903 int flags)
1904 {
1905 struct smb_filename *old_full_fname = NULL;
1906 struct smb_filename *new_full_fname = NULL;
1907 int result;
1908
1909 old_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1910 srcfsp,
1911 old_smb_fname);
1912 if (old_full_fname == NULL) {
1913 return -1;
1914 }
1915 new_full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1916 dstfsp,
1917 new_smb_fname);
1918 if (new_full_fname == NULL) {
1919 TALLOC_FREE(old_full_fname);
1920 return -1;
1921 }
1922 result = SMB_VFS_NEXT_LINKAT(handle,
1923 srcfsp,
1924 old_smb_fname,
1925 dstfsp,
1926 new_smb_fname,
1927 flags);
1928
1929 do_log(SMB_VFS_OP_LINKAT,
1930 (result >= 0),
1931 handle,
1932 "%s|%s",
1933 smb_fname_str_do_log(handle->conn, old_full_fname),
1934 smb_fname_str_do_log(handle->conn, new_full_fname));
1935
1936 TALLOC_FREE(old_full_fname);
1937 TALLOC_FREE(new_full_fname);
1938
1939 return result;
1940 }
1941
1942 static int smb_full_audit_mknodat(vfs_handle_struct *handle,
1943 files_struct *dirfsp,
1944 const struct smb_filename *smb_fname,
1945 mode_t mode,
1946 SMB_DEV_T dev)
1947 {
1948 struct smb_filename *full_fname = NULL;
1949 int result;
1950
1951 full_fname = full_path_from_dirfsp_atname(talloc_tos(),
1952 dirfsp,
1953 smb_fname);
1954 if (full_fname == NULL) {
1955 return -1;
1956 }
1957
1958 result = SMB_VFS_NEXT_MKNODAT(handle,
1959 dirfsp,
1960 smb_fname,
1961 mode,
1962 dev);
1963
1964 do_log(SMB_VFS_OP_MKNODAT,
1965 (result >= 0),
1966 handle,
1967 "%s",
1968 smb_fname_str_do_log(handle->conn, full_fname));
1969
1970 TALLOC_FREE(full_fname);
1971
1972 return result;
1973 }
1974
1975 static struct smb_filename *smb_full_audit_realpath(vfs_handle_struct *handle,
1976 TALLOC_CTX *ctx,
1977 const struct smb_filename *smb_fname)
1978 {
1979 struct smb_filename *result_fname = NULL;
1980
1981 result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1982
1983 do_log(SMB_VFS_OP_REALPATH,
1984 (result_fname != NULL),
1985 handle,
1986 "%s",
1987 smb_fname_str_do_log(handle->conn, smb_fname));
1988
1989 return result_fname;
1990 }
1991
1992 static int smb_full_audit_fchflags(vfs_handle_struct *handle,
1993 struct files_struct *fsp,
1994 unsigned int flags)
1995 {
1996 int result;
1997
1998 result = SMB_VFS_NEXT_FCHFLAGS(handle, fsp, flags);
1999
2000 do_log(SMB_VFS_OP_FCHFLAGS,
2001 (result != 0),
2002 handle,
2003 "%s",
2004 smb_fname_str_do_log(handle->conn, fsp->fsp_name));
2005
2006 return result;
2007 }
2008
2009 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
2010 const SMB_STRUCT_STAT *sbuf)
2011 {
2012 struct file_id id_zero = { 0 };
2013 struct file_id result;
2014 struct file_id_buf idbuf;
2015
2016 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
2017
2018 do_log(SMB_VFS_OP_FILE_ID_CREATE,
2019 !file_id_equal(&id_zero, &result),
2020 handle,
2021 "%s",
2022 file_id_str_buf(result, &idbuf));
2023
2024 return result;
2025 }
2026
2027 static uint64_t smb_full_audit_fs_file_id(struct vfs_handle_struct *handle,
2028 const SMB_STRUCT_STAT *sbuf)
2029 {
2030 uint64_t result;
2031
2032 result = SMB_VFS_NEXT_FS_FILE_ID(handle, sbuf);
2033
2034 do_log(SMB_VFS_OP_FS_FILE_ID,
2035 result != 0,
2036 handle, "%" PRIu64, result);
2037
2038 return result;
2039 }
2040
2041 static NTSTATUS smb_full_audit_fstreaminfo(vfs_handle_struct *handle,
2042 struct files_struct *fsp,
2043 TALLOC_CTX *mem_ctx,
2044 unsigned int *pnum_streams,
2045 struct stream_struct **pstreams)
2046 {
2047 NTSTATUS result;
2048
2049 result = SMB_VFS_NEXT_FSTREAMINFO(handle, fsp, mem_ctx,
2050 pnum_streams, pstreams);
2051
2052 do_log(SMB_VFS_OP_FSTREAMINFO,
2053 NT_STATUS_IS_OK(result),
2054 handle,
2055 "%s",
2056 smb_fname_str_do_log(handle->conn, fsp->fsp_name));
2057
2058 return result;
2059 }
2060
2061 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
2062 const struct smb_filename *path,
2063 const char *name,
2064 TALLOC_CTX *mem_ctx,
2065 char **found_name)
2066 {
2067 int result;
2068
2069 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
2070 found_name);
2071
2072 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
2073 "%s/%s->%s",
2074 path->base_name, name, (result == 0) ? *found_name : "");
2075
2076 return result;
2077 }
2078
2079 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
2080 const struct smb_filename *smb_fname)
2081 {
2082 const char *result;
2083
2084 result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
2085
2086 do_log(SMB_VFS_OP_CONNECTPATH,
2087 result != NULL,
2088 handle,
2089 "%s",
2090 smb_fname_str_do_log(handle->conn, smb_fname));
2091
2092 return result;
2093 }
2094
2095 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
2096 struct byte_range_lock *br_lck,
2097 struct lock_struct *plock)
2098 {
2099 NTSTATUS result;
2100
2101 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock);
2102
2103 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
2104 "%s:%llu-%llu. type=%d.",
2105 fsp_str_do_log(brl_fsp(br_lck)),
2106 (unsigned long long)plock->start,
2107 (unsigned long long)plock->size,
2108 plock->lock_type);
2109
2110 return result;
2111 }
2112
2113 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
2114 struct byte_range_lock *br_lck,
2115 const struct lock_struct *plock)
2116 {
2117 bool result;
2118
2119 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, br_lck, plock);
2120
2121 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
2122 "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
2123 (unsigned long long)plock->start,
2124 (unsigned long long)plock->size,
2125 plock->lock_type);
2126
2127 return result;
2128 }
2129
2130 static bool smb_full_audit_strict_lock_check(struct vfs_handle_struct *handle,
2131 struct files_struct *fsp,
2132 struct lock_struct *plock)
2133 {
2134 bool result;
2135
2136 result = SMB_VFS_NEXT_STRICT_LOCK_CHECK(handle, fsp, plock);
2137
2138 do_log(SMB_VFS_OP_STRICT_LOCK_CHECK, result, handle,
2139 "%s:%llu-%llu:%d", fsp_str_do_log(fsp),
2140 (unsigned long long)plock->start,
2141 (unsigned long long)plock->size,
2142 plock->lock_type);
2143
2144 return result;
2145 }
2146
2147 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
2148 const char *name,
2149 enum vfs_translate_direction direction,
2150 TALLOC_CTX *mem_ctx,
2151 char **mapped_name)
2152 {
2153 NTSTATUS result;
2154
2155 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
2156 mapped_name);
2157
2158 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
2159
2160 return result;
2161 }
2162
2163 static NTSTATUS smb_full_audit_parent_pathname(struct vfs_handle_struct *handle,
2164 TALLOC_CTX *mem_ctx,
2165 const struct smb_filename *smb_fname_in,
2166 struct smb_filename **parent_dir_out,
2167 struct smb_filename **atname_out)
2168 {
2169 NTSTATUS result;
2170
2171 result = SMB_VFS_NEXT_PARENT_PATHNAME(handle,
2172 mem_ctx,
2173 smb_fname_in,
2174 parent_dir_out,
2175 atname_out);
2176 do_log(SMB_VFS_OP_CONNECTPATH,
2177 NT_STATUS_IS_OK(result),
2178 handle,
2179 "%s",
2180 smb_fname_str_do_log(handle->conn, smb_fname_in));
2181
2182 return result;
2183 }
2184
2185 static NTSTATUS smb_full_audit_fsctl(struct vfs_handle_struct *handle,
2186 struct files_struct *fsp,
2187 TALLOC_CTX *ctx,
2188 uint32_t function,
2189 uint16_t req_flags,
2190 const uint8_t *_in_data,
2191 uint32_t in_len,
2192 uint8_t **_out_data,
2193 uint32_t max_out_len,
2194 uint32_t *out_len)
2195 {
2196 NTSTATUS result;
2197
2198 result = SMB_VFS_NEXT_FSCTL(handle,
2199 fsp,
2200 ctx,
2201 function,
2202 req_flags,
2203 _in_data,
2204 in_len,
2205 _out_data,
2206 max_out_len,
2207 out_len);
2208
2209 do_log(SMB_VFS_OP_FSCTL, NT_STATUS_IS_OK(result), handle, "");
2210
2211 return result;
2212 }
2213
2214 static struct tevent_req *smb_full_audit_offload_read_send(
2215 TALLOC_CTX *mem_ctx,
2216 struct tevent_context *ev,
2217 struct vfs_handle_struct *handle,
2218 struct files_struct *fsp,
2219 uint32_t fsctl,
2220 uint32_t ttl,
2221 off_t offset,
2222 size_t to_copy)
2223 {
2224 struct tevent_req *req = NULL;
2225
2226 req = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev, handle, fsp,
2227 fsctl, ttl, offset, to_copy);
2228
2229 do_log(SMB_VFS_OP_OFFLOAD_READ_SEND, req, handle, "");
2230
2231 return req;
2232 }
2233
2234 static NTSTATUS smb_full_audit_offload_read_recv(
2235 struct tevent_req *req,
2236 struct vfs_handle_struct *handle,
2237 TALLOC_CTX *mem_ctx,
2238 uint32_t *flags,
2239 uint64_t *xferlen,
2240 DATA_BLOB *_token_blob)
2241 {
2242 NTSTATUS status;
2243
2244 status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(req, handle, mem_ctx,
2245 flags, xferlen, _token_blob);
2246
2247 do_log(SMB_VFS_OP_OFFLOAD_READ_RECV, NT_STATUS_IS_OK(status), handle, "");
2248
2249 return status;
2250 }
2251
2252 static struct tevent_req *smb_full_audit_offload_write_send(struct vfs_handle_struct *handle,
2253 TALLOC_CTX *mem_ctx,
2254 struct tevent_context *ev,
2255 uint32_t fsctl,
2256 DATA_BLOB *token,
2257 off_t transfer_offset,
2258 struct files_struct *dest_fsp,
2259 off_t dest_off,
2260 off_t num)
2261 {
2262 struct tevent_req *req;
2263
2264 req = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, mem_ctx, ev,
2265 fsctl, token, transfer_offset,
2266 dest_fsp, dest_off, num);
2267
2268 do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND, req, handle, "");
2269
2270 return req;
2271 }
2272
2273 static NTSTATUS smb_full_audit_offload_write_recv(struct vfs_handle_struct *handle,
2274 struct tevent_req *req,
2275 off_t *copied)
2276 {
2277 NTSTATUS result;
2278
2279 result = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle, req, copied);
2280
2281 do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV, NT_STATUS_IS_OK(result), handle, "");
2282
2283 return result;
2284 }
2285
2286 static NTSTATUS smb_full_audit_fget_compression(vfs_handle_struct *handle,
2287 TALLOC_CTX *mem_ctx,
2288 struct files_struct *fsp,
2289 uint16_t *_compression_fmt)
2290 {
2291 NTSTATUS result;
2292
2293 result = SMB_VFS_NEXT_FGET_COMPRESSION(handle, mem_ctx, fsp,
2294 _compression_fmt);
2295
2296 do_log(SMB_VFS_OP_FGET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2297 "%s",
2298 fsp_str_do_log(fsp));
2299
2300 return result;
2301 }
2302
2303 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
2304 TALLOC_CTX *mem_ctx,
2305 struct files_struct *fsp,
2306 uint16_t compression_fmt)
2307 {
2308 NTSTATUS result;
2309
2310 result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2311 compression_fmt);
2312
2313 do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2314 "%s", fsp_str_do_log(fsp));
2315
2316 return result;
2317 }
2318
2319 static NTSTATUS smb_full_audit_freaddir_attr(struct vfs_handle_struct *handle,
2320 struct files_struct *fsp,
2321 TALLOC_CTX *mem_ctx,
2322 struct readdir_attr_data **pattr_data)
2323 {
2324 NTSTATUS status;
2325
2326 status = SMB_VFS_NEXT_FREADDIR_ATTR(handle, fsp, mem_ctx, pattr_data);
2327
2328 do_log(SMB_VFS_OP_FREADDIR_ATTR,
2329 NT_STATUS_IS_OK(status),
2330 handle,
2331 "%s",
2332 fsp_str_do_log(fsp));
2333
2334 return status;
2335 }
2336
2337 struct smb_full_audit_get_dos_attributes_state {
2338 struct vfs_aio_state aio_state;
2339 vfs_handle_struct *handle;
2340 files_struct *dir_fsp;
2341 const struct smb_filename *smb_fname;
2342 uint32_t dosmode;
2343 };
2344
2345 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq);
2346
2347 static struct tevent_req *smb_full_audit_get_dos_attributes_send(
2348 TALLOC_CTX *mem_ctx,
2349 struct tevent_context *ev,
2350 struct vfs_handle_struct *handle,
2351 files_struct *dir_fsp,
2352 struct smb_filename *smb_fname)
2353 {
2354 struct tevent_req *req = NULL;
2355 struct smb_full_audit_get_dos_attributes_state *state = NULL;
2356 struct tevent_req *subreq = NULL;
2357
2358 req = tevent_req_create(mem_ctx, &state,
2359 struct smb_full_audit_get_dos_attributes_state);
2360 if (req == NULL) {
2361 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2362 false,
2363 handle,
2364 "%s/%s",
2365 fsp_str_do_log(dir_fsp),
2366 smb_fname->base_name);
2367 return NULL;
2368 }
2369 *state = (struct smb_full_audit_get_dos_attributes_state) {
2370 .handle = handle,
2371 .dir_fsp = dir_fsp,
2372 .smb_fname = smb_fname,
2373 };
2374
2375 subreq = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_SEND(mem_ctx,
2376 ev,
2377 handle,
2378 dir_fsp,
2379 smb_fname);
2380 if (tevent_req_nomem(subreq, req)) {
2381 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2382 false,
2383 handle,
2384 "%s/%s",
2385 fsp_str_do_log(dir_fsp),
2386 smb_fname->base_name);
2387 return tevent_req_post(req, ev);
2388 }
2389 tevent_req_set_callback(subreq,
2390 smb_full_audit_get_dos_attributes_done,
2391 req);
2392
2393 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_SEND,
2394 true,
2395 handle,
2396 "%s/%s",
2397 fsp_str_do_log(dir_fsp),
2398 smb_fname->base_name);
2399
2400 return req;
2401 }
2402
2403 static void smb_full_audit_get_dos_attributes_done(struct tevent_req *subreq)
2404 {
2405 struct tevent_req *req =
2406 tevent_req_callback_data(subreq,
2407 struct tevent_req);
2408 struct smb_full_audit_get_dos_attributes_state *state =
2409 tevent_req_data(req,
2410 struct smb_full_audit_get_dos_attributes_state);
2411 NTSTATUS status;
2412
2413 status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES_RECV(subreq,
2414 &state->aio_state,
2415 &state->dosmode);
2416 TALLOC_FREE(subreq);
2417 if (tevent_req_nterror(req, status)) {
2418 return;
2419 }
2420
2421 tevent_req_done(req);
2422 return;
2423 }
2424
2425 static NTSTATUS smb_full_audit_get_dos_attributes_recv(struct tevent_req *req,
2426 struct vfs_aio_state *aio_state,
2427 uint32_t *dosmode)
2428 {
2429 struct smb_full_audit_get_dos_attributes_state *state =
2430 tevent_req_data(req,
2431 struct smb_full_audit_get_dos_attributes_state);
2432 NTSTATUS status;
2433
2434 if (tevent_req_is_nterror(req, &status)) {
2435 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2436 false,
2437 state->handle,
2438 "%s/%s",
2439 fsp_str_do_log(state->dir_fsp),
2440 state->smb_fname->base_name);
2441 tevent_req_received(req);
2442 return status;
2443 }
2444
2445 do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES_RECV,
2446 true,
2447 state->handle,
2448 "%s/%s",
2449 fsp_str_do_log(state->dir_fsp),
2450 state->smb_fname->base_name);
2451
2452 *aio_state = state->aio_state;
2453 *dosmode = state->dosmode;
2454 tevent_req_received(req);
2455 return NT_STATUS_OK;
2456 }
2457
2458 static NTSTATUS smb_full_audit_fget_dos_attributes(
2459 struct vfs_handle_struct *handle,
2460 struct files_struct *fsp,
2461 uint32_t *dosmode)
2462 {
2463 NTSTATUS status;
2464
2465 status = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
2466 fsp,
2467 dosmode);
2468
2469 do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
2470 NT_STATUS_IS_OK(status),
2471 handle,
2472 "%s",
2473 fsp_str_do_log(fsp));
2474
2475 return status;
2476 }
2477
2478 static NTSTATUS smb_full_audit_fset_dos_attributes(
2479 struct vfs_handle_struct *handle,
2480 struct files_struct *fsp,
2481 uint32_t dosmode)
2482 {
2483 NTSTATUS status;
2484
2485 status = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2486 fsp,
2487 dosmode);
2488
2489 do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
2490 NT_STATUS_IS_OK(status),
2491 handle,
2492 "%s",
2493 fsp_str_do_log(fsp));
2494
2495 return status;
2496 }
2497
2498 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2499 uint32_t security_info,
2500 TALLOC_CTX *mem_ctx,
2501 struct security_descriptor **ppdesc)
2502 {
2503 NTSTATUS result;
2504
2505 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2506 mem_ctx, ppdesc);
2507
2508 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2509 "%s", fsp_str_do_log(fsp));
2510
2511 return result;
2512 }
2513
2514 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2515 uint32_t security_info_sent,
2516 const struct security_descriptor *psd)
2517 {
2518 struct vfs_full_audit_private_data *pd;
2519 NTSTATUS result;
2520 char *sd = NULL;
2521
2522 SMB_VFS_HANDLE_GET_DATA(handle, pd,
2523 struct vfs_full_audit_private_data,
2524 return NT_STATUS_INTERNAL_ERROR);
2525
2526 if (pd->log_secdesc) {
2527 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
2528 }
2529
2530 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
2531
2532 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2533 "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
2534
2535 TALLOC_FREE(sd);
2536
2537 return result;
2538 }
2539
2540 static NTSTATUS smb_full_audit_audit_file(struct vfs_handle_struct *handle,
2541 struct smb_filename *file,
2542 struct security_acl *sacl,
2543 uint32_t access_requested,
2544 uint32_t access_denied)
2545 {
2546 NTSTATUS result;
2547
2548 result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2549 file,
2550 sacl,
2551 access_requested,
2552 access_denied);
2553
2554 do_log(SMB_VFS_OP_AUDIT_FILE, NT_STATUS_IS_OK(result), handle,
2555 "%s",
2556 smb_fname_str_do_log(handle->conn, file));
2557
2558 return result;
2559 }
2560
2561 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2562 files_struct *fsp,
2563 SMB_ACL_TYPE_T type,
2564 TALLOC_CTX *mem_ctx)
2565 {
2566 SMB_ACL_T result;
2567
2568 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle,
2569 fsp,
2570 type,
2571 mem_ctx);
2572
2573 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2574 "%s", fsp_str_do_log(fsp));
2575
2576 return result;
2577 }
2578
2579 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2580 files_struct *fsp,
2581 TALLOC_CTX *mem_ctx,
2582 char **blob_description,
2583 DATA_BLOB *blob)
2584 {
2585 int result;
2586
2587 result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2588
2589 do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2590 "%s", fsp_str_do_log(fsp));
2591
2592 return result;
2593 }
2594
2595 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2596 struct files_struct *fsp,
2597 SMB_ACL_TYPE_T type,
2598 SMB_ACL_T theacl)
2599 {
2600 int result;
2601
2602 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, type, theacl);
2603
2604 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2605 "%s", fsp_str_do_log(fsp));
2606
2607 return result;
2608 }
2609
2610 static int smb_full_audit_sys_acl_delete_def_fd(vfs_handle_struct *handle,
2611 struct files_struct *fsp)
2612 {
2613 int result;
2614
2615 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FD(handle, fsp);
2616
2617 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FD,
2618 (result >= 0),
2619 handle,
2620 "%s",
2621 fsp_str_do_log(fsp));
2622
2623 return result;
2624 }
2625
2626 struct smb_full_audit_getxattrat_state {
2627 struct vfs_aio_state aio_state;
2628 vfs_handle_struct *handle;
2629 files_struct *dir_fsp;
2630 const struct smb_filename *smb_fname;
2631 const char *xattr_name;
2632 ssize_t xattr_size;
2633 uint8_t *xattr_value;
2634 };
2635
2636 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq);
2637
2638 static struct tevent_req *smb_full_audit_getxattrat_send(
2639 TALLOC_CTX *mem_ctx,
2640 struct tevent_context *ev,
2641 struct vfs_handle_struct *handle,
2642 files_struct *dir_fsp,
2643 const struct smb_filename *smb_fname,
2644 const char *xattr_name,
2645 size_t alloc_hint)
2646 {
2647 struct tevent_req *req = NULL;
2648 struct tevent_req *subreq = NULL;
2649 struct smb_full_audit_getxattrat_state *state = NULL;
2650
2651 req = tevent_req_create(mem_ctx, &state,
2652 struct smb_full_audit_getxattrat_state);
2653 if (req == NULL) {
2654 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2655 false,
2656 handle,
2657 "%s/%s|%s",
2658 fsp_str_do_log(dir_fsp),
2659 smb_fname->base_name,
2660 xattr_name);
2661 return NULL;
2662 }
2663 *state = (struct smb_full_audit_getxattrat_state) {
2664 .handle = handle,
2665 .dir_fsp = dir_fsp,
2666 .smb_fname = smb_fname,
2667 .xattr_name = xattr_name,
2668 };
2669
2670 subreq = SMB_VFS_NEXT_GETXATTRAT_SEND(state,
2671 ev,
2672 handle,
2673 dir_fsp,
2674 smb_fname,
2675 xattr_name,
2676 alloc_hint);
2677 if (tevent_req_nomem(subreq, req)) {
2678 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2679 false,
2680 handle,
2681 "%s/%s|%s",
2682 fsp_str_do_log(dir_fsp),
2683 smb_fname->base_name,
2684 xattr_name);
2685 return tevent_req_post(req, ev);
2686 }
2687 tevent_req_set_callback(subreq, smb_full_audit_getxattrat_done, req);
2688
2689 do_log(SMB_VFS_OP_GETXATTRAT_SEND,
2690 true,
2691 handle,
2692 "%s/%s|%s",
2693 fsp_str_do_log(dir_fsp),
2694 smb_fname->base_name,
2695 xattr_name);
2696
2697 return req;
2698 }
2699
2700 static void smb_full_audit_getxattrat_done(struct tevent_req *subreq)
2701 {
2702 struct tevent_req *req = tevent_req_callback_data(
2703 subreq, struct tevent_req);
2704 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2705 req, struct smb_full_audit_getxattrat_state);
2706
2707 state->xattr_size = SMB_VFS_NEXT_GETXATTRAT_RECV(subreq,
2708 &state->aio_state,
2709 state,
2710 &state->xattr_value);
2711 TALLOC_FREE(subreq);
2712 if (state->xattr_size == -1) {
2713 tevent_req_error(req, state->aio_state.error);
2714 return;
2715 }
2716
2717 tevent_req_done(req);
2718 }
2719
2720 static ssize_t smb_full_audit_getxattrat_recv(struct tevent_req *req,
2721 struct vfs_aio_state *aio_state,
2722 TALLOC_CTX *mem_ctx,
2723 uint8_t **xattr_value)
2724 {
2725 struct smb_full_audit_getxattrat_state *state = tevent_req_data(
2726 req, struct smb_full_audit_getxattrat_state);
2727 ssize_t xattr_size;
2728
2729 if (tevent_req_is_unix_error(req, &aio_state->error)) {
2730 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2731 false,
2732 state->handle,
2733 "%s/%s|%s",
2734 fsp_str_do_log(state->dir_fsp),
2735 state->smb_fname->base_name,
2736 state->xattr_name);
2737 tevent_req_received(req);
2738 return -1;
2739 }
2740
2741 do_log(SMB_VFS_OP_GETXATTRAT_RECV,
2742 true,
2743 state->handle,
2744 "%s/%s|%s",
2745 fsp_str_do_log(state->dir_fsp),
2746 state->smb_fname->base_name,
2747 state->xattr_name);
2748
2749 *aio_state = state->aio_state;
2750 xattr_size = state->xattr_size;
2751 if (xattr_value != NULL) {
2752 *xattr_value = talloc_move(mem_ctx, &state->xattr_value);
2753 }
2754
2755 tevent_req_received(req);
2756 return xattr_size;
2757 }
2758
2759 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2760 struct files_struct *fsp,
2761 const char *name, void *value, size_t size)
2762 {
2763 ssize_t result;
2764
2765 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2766
2767 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2768 "%s|%s", fsp_str_do_log(fsp), name);
2769
2770 return result;
2771 }
2772
2773 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2774 struct files_struct *fsp, char *list,
2775 size_t size)
2776 {
2777 ssize_t result;
2778
2779 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2780
2781 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2782 "%s", fsp_str_do_log(fsp));
2783
2784 return result;
2785 }
2786
2787 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2788 struct files_struct *fsp,
2789 const char *name)
2790 {
2791 int result;
2792
2793 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2794
2795 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2796 "%s|%s", fsp_str_do_log(fsp), name);
2797
2798 return result;
2799 }
2800
2801 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2802 struct files_struct *fsp, const char *name,
2803 const void *value, size_t size, int flags)
2804 {
2805 int result;
2806
2807 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2808
2809 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2810 "%s|%s", fsp_str_do_log(fsp), name);
2811
2812 return result;
2813 }
2814
2815 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2816 struct files_struct *fsp)
2817 {
2818 bool result;
2819
2820 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2821 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2822 "%s", fsp_str_do_log(fsp));
2823
2824 return result;
2825 }
2826
2827 static NTSTATUS smb_full_audit_durable_cookie(struct vfs_handle_struct *handle,
2828 struct files_struct *fsp,
2829 TALLOC_CTX *mem_ctx,
2830 DATA_BLOB *cookie)
2831 {
2832 NTSTATUS result;
2833
2834 result = SMB_VFS_NEXT_DURABLE_COOKIE(handle,
2835 fsp,
2836 mem_ctx,
2837 cookie);
2838
2839 do_log(SMB_VFS_OP_DURABLE_COOKIE, NT_STATUS_IS_OK(result), handle,
2840 "%s", fsp_str_do_log(fsp));
2841
2842 return result;
2843 }
2844
2845 static NTSTATUS smb_full_audit_durable_disconnect(
2846 struct vfs_handle_struct *handle,
2847 struct files_struct *fsp,
2848 const DATA_BLOB old_cookie,
2849 TALLOC_CTX *mem_ctx,
2850 DATA_BLOB *new_cookie)
2851 {
2852 NTSTATUS result;
2853
2854 result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle,
2855 fsp,
2856 old_cookie,
2857 mem_ctx,
2858 new_cookie);
2859
2860 do_log(SMB_VFS_OP_DURABLE_DISCONNECT, NT_STATUS_IS_OK(result), handle,
2861 "%s", fsp_str_do_log(fsp));
2862
2863 return result;
2864 }
2865
2866 static NTSTATUS smb_full_audit_durable_reconnect(
2867 struct vfs_handle_struct *handle,
2868 struct smb_request *smb1req,
2869 struct smbXsrv_open *op,
2870 const DATA_BLOB old_cookie,
2871 TALLOC_CTX *mem_ctx,
2872 struct files_struct **fsp,
2873 DATA_BLOB *new_cookie)
2874 {
2875 NTSTATUS result;
2876
2877 result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle,
2878 smb1req,
2879 op,
2880 old_cookie,
2881 mem_ctx,
2882 fsp,
2883 new_cookie);
2884
2885 do_log(SMB_VFS_OP_DURABLE_RECONNECT,
2886 NT_STATUS_IS_OK(result),
2887 handle,
2888 "");
2889
2890 return result;
2891 }
2892
2893 static struct vfs_fn_pointers vfs_full_audit_fns = {
2894
2895 /* Disk operations */
2896
2897 .connect_fn = smb_full_audit_connect,
2898 .disconnect_fn = smb_full_audit_disconnect,
2899 .disk_free_fn = smb_full_audit_disk_free,
2900 .get_quota_fn = smb_full_audit_get_quota,
2901 .set_quota_fn = smb_full_audit_set_quota,
2902 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2903 .statvfs_fn = smb_full_audit_statvfs,
2904 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2905 .get_dfs_referrals_fn = smb_full_audit_get_dfs_referrals,
2906 .create_dfs_pathat_fn = smb_full_audit_create_dfs_pathat,
2907 .read_dfs_pathat_fn = smb_full_audit_read_dfs_pathat,
2908 .fdopendir_fn = smb_full_audit_fdopendir,
2909 .readdir_fn = smb_full_audit_readdir,
2910 .seekdir_fn = smb_full_audit_seekdir,
2911 .telldir_fn = smb_full_audit_telldir,
2912 .rewind_dir_fn = smb_full_audit_rewinddir,
2913 .mkdirat_fn = smb_full_audit_mkdirat,
2914 .closedir_fn = smb_full_audit_closedir,
2915 .openat_fn = smb_full_audit_openat,
2916 .create_file_fn = smb_full_audit_create_file,
2917 .close_fn = smb_full_audit_close,
2918 .pread_fn = smb_full_audit_pread,
2919 .pread_send_fn = smb_full_audit_pread_send,
2920 .pread_recv_fn = smb_full_audit_pread_recv,
2921 .pwrite_fn = smb_full_audit_pwrite,
2922 .pwrite_send_fn = smb_full_audit_pwrite_send,
2923 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2924 .lseek_fn = smb_full_audit_lseek,
2925 .sendfile_fn = smb_full_audit_sendfile,
2926 .recvfile_fn = smb_full_audit_recvfile,
2927 .renameat_fn = smb_full_audit_renameat,
2928 .fsync_send_fn = smb_full_audit_fsync_send,
2929 .fsync_recv_fn = smb_full_audit_fsync_recv,
2930 .stat_fn = smb_full_audit_stat,
2931 .fstat_fn = smb_full_audit_fstat,
2932 .lstat_fn = smb_full_audit_lstat,
2933 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2934 .unlinkat_fn = smb_full_audit_unlinkat,
2935 .fchmod_fn = smb_full_audit_fchmod,
2936 .fchown_fn = smb_full_audit_fchown,
2937 .lchown_fn = smb_full_audit_lchown,
2938 .chdir_fn = smb_full_audit_chdir,
2939 .getwd_fn = smb_full_audit_getwd,
2940 .fntimes_fn = smb_full_audit_fntimes,
2941 .ftruncate_fn = smb_full_audit_ftruncate,
2942 .fallocate_fn = smb_full_audit_fallocate,
2943 .lock_fn = smb_full_audit_lock,
2944 .filesystem_sharemode_fn = smb_full_audit_filesystem_sharemode,
2945 .fcntl_fn = smb_full_audit_fcntl,
2946 .linux_setlease_fn = smb_full_audit_linux_setlease,
2947 .getlock_fn = smb_full_audit_getlock,
2948 .symlinkat_fn = smb_full_audit_symlinkat,
2949 .readlinkat_fn = smb_full_audit_readlinkat,
2950 .linkat_fn = smb_full_audit_linkat,
2951 .mknodat_fn = smb_full_audit_mknodat,
2952 .realpath_fn = smb_full_audit_realpath,
2953 .fchflags_fn = smb_full_audit_fchflags,
2954 .file_id_create_fn = smb_full_audit_file_id_create,
2955 .fs_file_id_fn = smb_full_audit_fs_file_id,
2956 .offload_read_send_fn = smb_full_audit_offload_read_send,
2957 .offload_read_recv_fn = smb_full_audit_offload_read_recv,
2958 .offload_write_send_fn = smb_full_audit_offload_write_send,
2959 .offload_write_recv_fn = smb_full_audit_offload_write_recv,
2960 .fget_compression_fn = smb_full_audit_fget_compression,
2961 .set_compression_fn = smb_full_audit_set_compression,
2962 .snap_check_path_fn = smb_full_audit_snap_check_path,
2963 .snap_create_fn = smb_full_audit_snap_create,
2964 .snap_delete_fn = smb_full_audit_snap_delete,
2965 .fstreaminfo_fn = smb_full_audit_fstreaminfo,
2966 .get_real_filename_fn = smb_full_audit_get_real_filename,
2967 .connectpath_fn = smb_full_audit_connectpath,
2968 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2969 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2970 .strict_lock_check_fn = smb_full_audit_strict_lock_check,
2971 .translate_name_fn = smb_full_audit_translate_name,
2972 .parent_pathname_fn = smb_full_audit_parent_pathname,
2973 .fsctl_fn = smb_full_audit_fsctl,
2974 .get_dos_attributes_send_fn = smb_full_audit_get_dos_attributes_send,
2975 .get_dos_attributes_recv_fn = smb_full_audit_get_dos_attributes_recv,
2976 .fget_dos_attributes_fn = smb_full_audit_fget_dos_attributes,
2977 .fset_dos_attributes_fn = smb_full_audit_fset_dos_attributes,
2978 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2979 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2980 .audit_file_fn = smb_full_audit_audit_file,
2981 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2982 .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2983 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2984 .sys_acl_delete_def_fd_fn = smb_full_audit_sys_acl_delete_def_fd,
2985 .getxattrat_send_fn = smb_full_audit_getxattrat_send,
2986 .getxattrat_recv_fn = smb_full_audit_getxattrat_recv,
2987 .fgetxattr_fn = smb_full_audit_fgetxattr,
2988 .flistxattr_fn = smb_full_audit_flistxattr,
2989 .fremovexattr_fn = smb_full_audit_fremovexattr,
2990 .fsetxattr_fn = smb_full_audit_fsetxattr,
2991 .aio_force_fn = smb_full_audit_aio_force,
2992 .durable_cookie_fn = smb_full_audit_durable_cookie,
2993 .durable_disconnect_fn = smb_full_audit_durable_disconnect,
2994 .durable_reconnect_fn = smb_full_audit_durable_reconnect,
2995 .freaddir_attr_fn = smb_full_audit_freaddir_attr,
2996 };
2997
2998 static_decl_vfs;
2999 NTSTATUS vfs_full_audit_init(TALLOC_CTX *ctx)
3000 {
3001 NTSTATUS ret;
3002
3003 smb_vfs_assert_all_fns(&vfs_full_audit_fns, "full_audit");
3004
3005 ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "full_audit",
3006 &vfs_full_audit_fns);
3007
3008 if (!NT_STATUS_IS_OK(ret))
3009 return ret;
3010
3011 vfs_full_audit_debug_level = debug_add_class("full_audit");
3012 if (vfs_full_audit_debug_level == -1) {
3013 vfs_full_audit_debug_level = DBGC_VFS;
3014 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
3015 "class!\n"));
3016 } else {
3017 DEBUG(10, ("vfs_full_audit: Debug class number of "
3018 "'full_audit': %d\n", vfs_full_audit_debug_level));
3019 }
3020
3021 return ret;
3022 }
Samba GIT mirror