?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
printing: explicitly clear PUBLISHED attribute
[Samba.git] / source3 / modules / vfs_full_audit.c
blob17713f076068a516f65bd99993c9bcf6b4e9a374
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
65 #include "auth.h"
66 #include "ntioctl.h"
67
68 static int vfs_full_audit_debug_level = DBGC_VFS;
69
70 struct vfs_full_audit_private_data {
71 struct bitmap *success_ops;
72 struct bitmap *failure_ops;
73 };
74
75 #undef DBGC_CLASS
76 #define DBGC_CLASS vfs_full_audit_debug_level
77
78 typedef enum _vfs_op_type {
79 SMB_VFS_OP_NOOP = -1,
80
81 /* Disk operations */
82
83 SMB_VFS_OP_CONNECT = 0,
84 SMB_VFS_OP_DISCONNECT,
85 SMB_VFS_OP_DISK_FREE,
86 SMB_VFS_OP_GET_QUOTA,
87 SMB_VFS_OP_SET_QUOTA,
88 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
89 SMB_VFS_OP_STATVFS,
90 SMB_VFS_OP_FS_CAPABILITIES,
91
92 /* Directory operations */
93
94 SMB_VFS_OP_OPENDIR,
95 SMB_VFS_OP_FDOPENDIR,
96 SMB_VFS_OP_READDIR,
97 SMB_VFS_OP_SEEKDIR,
98 SMB_VFS_OP_TELLDIR,
99 SMB_VFS_OP_REWINDDIR,
100 SMB_VFS_OP_MKDIR,
101 SMB_VFS_OP_RMDIR,
102 SMB_VFS_OP_CLOSEDIR,
103 SMB_VFS_OP_INIT_SEARCH_OP,
104
105 /* File operations */
106
107 SMB_VFS_OP_OPEN,
108 SMB_VFS_OP_CREATE_FILE,
109 SMB_VFS_OP_CLOSE,
110 SMB_VFS_OP_READ,
111 SMB_VFS_OP_PREAD,
112 SMB_VFS_OP_WRITE,
113 SMB_VFS_OP_PWRITE,
114 SMB_VFS_OP_LSEEK,
115 SMB_VFS_OP_SENDFILE,
116 SMB_VFS_OP_RECVFILE,
117 SMB_VFS_OP_RENAME,
118 SMB_VFS_OP_FSYNC,
119 SMB_VFS_OP_STAT,
120 SMB_VFS_OP_FSTAT,
121 SMB_VFS_OP_LSTAT,
122 SMB_VFS_OP_GET_ALLOC_SIZE,
123 SMB_VFS_OP_UNLINK,
124 SMB_VFS_OP_CHMOD,
125 SMB_VFS_OP_FCHMOD,
126 SMB_VFS_OP_CHOWN,
127 SMB_VFS_OP_FCHOWN,
128 SMB_VFS_OP_LCHOWN,
129 SMB_VFS_OP_CHDIR,
130 SMB_VFS_OP_GETWD,
131 SMB_VFS_OP_NTIMES,
132 SMB_VFS_OP_FTRUNCATE,
133 SMB_VFS_OP_FALLOCATE,
134 SMB_VFS_OP_LOCK,
135 SMB_VFS_OP_KERNEL_FLOCK,
136 SMB_VFS_OP_LINUX_SETLEASE,
137 SMB_VFS_OP_GETLOCK,
138 SMB_VFS_OP_SYMLINK,
139 SMB_VFS_OP_READLINK,
140 SMB_VFS_OP_LINK,
141 SMB_VFS_OP_MKNOD,
142 SMB_VFS_OP_REALPATH,
143 SMB_VFS_OP_NOTIFY_WATCH,
144 SMB_VFS_OP_CHFLAGS,
145 SMB_VFS_OP_FILE_ID_CREATE,
146 SMB_VFS_OP_STREAMINFO,
147 SMB_VFS_OP_GET_REAL_FILENAME,
148 SMB_VFS_OP_CONNECTPATH,
149 SMB_VFS_OP_BRL_LOCK_WINDOWS,
150 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
151 SMB_VFS_OP_BRL_CANCEL_WINDOWS,
152 SMB_VFS_OP_STRICT_LOCK,
153 SMB_VFS_OP_STRICT_UNLOCK,
154 SMB_VFS_OP_TRANSLATE_NAME,
155
156 /* NT ACL operations. */
157
158 SMB_VFS_OP_FGET_NT_ACL,
159 SMB_VFS_OP_GET_NT_ACL,
160 SMB_VFS_OP_FSET_NT_ACL,
161
162 /* POSIX ACL operations. */
163
164 SMB_VFS_OP_CHMOD_ACL,
165 SMB_VFS_OP_FCHMOD_ACL,
166
167 SMB_VFS_OP_SYS_ACL_GET_ENTRY,
168 SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,
169 SMB_VFS_OP_SYS_ACL_GET_PERMSET,
170 SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,
171 SMB_VFS_OP_SYS_ACL_GET_FILE,
172 SMB_VFS_OP_SYS_ACL_GET_FD,
173 SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,
174 SMB_VFS_OP_SYS_ACL_ADD_PERM,
175 SMB_VFS_OP_SYS_ACL_TO_TEXT,
176 SMB_VFS_OP_SYS_ACL_INIT,
177 SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,
178 SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,
179 SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,
180 SMB_VFS_OP_SYS_ACL_SET_PERMSET,
181 SMB_VFS_OP_SYS_ACL_VALID,
182 SMB_VFS_OP_SYS_ACL_SET_FILE,
183 SMB_VFS_OP_SYS_ACL_SET_FD,
184 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
185 SMB_VFS_OP_SYS_ACL_GET_PERM,
186 SMB_VFS_OP_SYS_ACL_FREE_TEXT,
187 SMB_VFS_OP_SYS_ACL_FREE_ACL,
188 SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,
189
190 /* EA operations. */
191 SMB_VFS_OP_GETXATTR,
192 SMB_VFS_OP_LGETXATTR,
193 SMB_VFS_OP_FGETXATTR,
194 SMB_VFS_OP_LISTXATTR,
195 SMB_VFS_OP_LLISTXATTR,
196 SMB_VFS_OP_FLISTXATTR,
197 SMB_VFS_OP_REMOVEXATTR,
198 SMB_VFS_OP_LREMOVEXATTR,
199 SMB_VFS_OP_FREMOVEXATTR,
200 SMB_VFS_OP_SETXATTR,
201 SMB_VFS_OP_LSETXATTR,
202 SMB_VFS_OP_FSETXATTR,
203
204 /* aio operations */
205 SMB_VFS_OP_AIO_READ,
206 SMB_VFS_OP_AIO_WRITE,
207 SMB_VFS_OP_AIO_RETURN,
208 SMB_VFS_OP_AIO_CANCEL,
209 SMB_VFS_OP_AIO_ERROR,
210 SMB_VFS_OP_AIO_FSYNC,
211 SMB_VFS_OP_AIO_SUSPEND,
212 SMB_VFS_OP_AIO_FORCE,
213
214 /* offline operations */
215 SMB_VFS_OP_IS_OFFLINE,
216 SMB_VFS_OP_SET_OFFLINE,
217
218 /* This should always be last enum value */
219
220 SMB_VFS_OP_LAST
221 } vfs_op_type;
222
223 /* The following array *must* be in the same order as defined in vfs.h */
224
225 static struct {
226 vfs_op_type type;
227 const char *name;
228 } vfs_op_names[] = {
229 { SMB_VFS_OP_CONNECT, "connect" },
230 { SMB_VFS_OP_DISCONNECT, "disconnect" },
231 { SMB_VFS_OP_DISK_FREE, "disk_free" },
232 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
233 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
234 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
235 { SMB_VFS_OP_STATVFS, "statvfs" },
236 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
237 { SMB_VFS_OP_OPENDIR, "opendir" },
238 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
239 { SMB_VFS_OP_READDIR, "readdir" },
240 { SMB_VFS_OP_SEEKDIR, "seekdir" },
241 { SMB_VFS_OP_TELLDIR, "telldir" },
242 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
243 { SMB_VFS_OP_MKDIR, "mkdir" },
244 { SMB_VFS_OP_RMDIR, "rmdir" },
245 { SMB_VFS_OP_CLOSEDIR, "closedir" },
246 { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
247 { SMB_VFS_OP_OPEN, "open" },
248 { SMB_VFS_OP_CREATE_FILE, "create_file" },
249 { SMB_VFS_OP_CLOSE, "close" },
250 { SMB_VFS_OP_READ, "read" },
251 { SMB_VFS_OP_PREAD, "pread" },
252 { SMB_VFS_OP_WRITE, "write" },
253 { SMB_VFS_OP_PWRITE, "pwrite" },
254 { SMB_VFS_OP_LSEEK, "lseek" },
255 { SMB_VFS_OP_SENDFILE, "sendfile" },
256 { SMB_VFS_OP_RECVFILE, "recvfile" },
257 { SMB_VFS_OP_RENAME, "rename" },
258 { SMB_VFS_OP_FSYNC, "fsync" },
259 { SMB_VFS_OP_STAT, "stat" },
260 { SMB_VFS_OP_FSTAT, "fstat" },
261 { SMB_VFS_OP_LSTAT, "lstat" },
262 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
263 { SMB_VFS_OP_UNLINK, "unlink" },
264 { SMB_VFS_OP_CHMOD, "chmod" },
265 { SMB_VFS_OP_FCHMOD, "fchmod" },
266 { SMB_VFS_OP_CHOWN, "chown" },
267 { SMB_VFS_OP_FCHOWN, "fchown" },
268 { SMB_VFS_OP_LCHOWN, "lchown" },
269 { SMB_VFS_OP_CHDIR, "chdir" },
270 { SMB_VFS_OP_GETWD, "getwd" },
271 { SMB_VFS_OP_NTIMES, "ntimes" },
272 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
273 { SMB_VFS_OP_FALLOCATE,"fallocate" },
274 { SMB_VFS_OP_LOCK, "lock" },
275 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
276 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
277 { SMB_VFS_OP_GETLOCK, "getlock" },
278 { SMB_VFS_OP_SYMLINK, "symlink" },
279 { SMB_VFS_OP_READLINK, "readlink" },
280 { SMB_VFS_OP_LINK, "link" },
281 { SMB_VFS_OP_MKNOD, "mknod" },
282 { SMB_VFS_OP_REALPATH, "realpath" },
283 { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
284 { SMB_VFS_OP_CHFLAGS, "chflags" },
285 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
286 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
287 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
288 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
289 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
290 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
291 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
292 { SMB_VFS_OP_STRICT_LOCK, "strict_lock" },
293 { SMB_VFS_OP_STRICT_UNLOCK, "strict_unlock" },
294 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
295 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
296 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
297 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
298 { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
299 { SMB_VFS_OP_FCHMOD_ACL, "fchmod_acl" },
300 { SMB_VFS_OP_SYS_ACL_GET_ENTRY, "sys_acl_get_entry" },
301 { SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, "sys_acl_get_tag_type" },
302 { SMB_VFS_OP_SYS_ACL_GET_PERMSET, "sys_acl_get_permset" },
303 { SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, "sys_acl_get_qualifier" },
304 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
305 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
306 { SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, "sys_acl_clear_perms" },
307 { SMB_VFS_OP_SYS_ACL_ADD_PERM, "sys_acl_add_perm" },
308 { SMB_VFS_OP_SYS_ACL_TO_TEXT, "sys_acl_to_text" },
309 { SMB_VFS_OP_SYS_ACL_INIT, "sys_acl_init" },
310 { SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, "sys_acl_create_entry" },
311 { SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, "sys_acl_set_tag_type" },
312 { SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, "sys_acl_set_qualifier" },
313 { SMB_VFS_OP_SYS_ACL_SET_PERMSET, "sys_acl_set_permset" },
314 { SMB_VFS_OP_SYS_ACL_VALID, "sys_acl_valid" },
315 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
316 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
317 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
318 { SMB_VFS_OP_SYS_ACL_GET_PERM, "sys_acl_get_perm" },
319 { SMB_VFS_OP_SYS_ACL_FREE_TEXT, "sys_acl_free_text" },
320 { SMB_VFS_OP_SYS_ACL_FREE_ACL, "sys_acl_free_acl" },
321 { SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, "sys_acl_free_qualifier" },
322 { SMB_VFS_OP_GETXATTR, "getxattr" },
323 { SMB_VFS_OP_LGETXATTR, "lgetxattr" },
324 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
325 { SMB_VFS_OP_LISTXATTR, "listxattr" },
326 { SMB_VFS_OP_LLISTXATTR, "llistxattr" },
327 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
328 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
329 { SMB_VFS_OP_LREMOVEXATTR, "lremovexattr" },
330 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
331 { SMB_VFS_OP_SETXATTR, "setxattr" },
332 { SMB_VFS_OP_LSETXATTR, "lsetxattr" },
333 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
334 { SMB_VFS_OP_AIO_READ, "aio_read" },
335 { SMB_VFS_OP_AIO_WRITE, "aio_write" },
336 { SMB_VFS_OP_AIO_RETURN,"aio_return" },
337 { SMB_VFS_OP_AIO_CANCEL,"aio_cancel" },
338 { SMB_VFS_OP_AIO_ERROR, "aio_error" },
339 { SMB_VFS_OP_AIO_FSYNC, "aio_fsync" },
340 { SMB_VFS_OP_AIO_SUSPEND,"aio_suspend" },
341 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
342 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
343 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
344 { SMB_VFS_OP_LAST, NULL }
345 };
346
347 static int audit_syslog_facility(vfs_handle_struct *handle)
348 {
349 static const struct enum_list enum_log_facilities[] = {
350 { LOG_USER, "USER" },
351 { LOG_LOCAL0, "LOCAL0" },
352 { LOG_LOCAL1, "LOCAL1" },
353 { LOG_LOCAL2, "LOCAL2" },
354 { LOG_LOCAL3, "LOCAL3" },
355 { LOG_LOCAL4, "LOCAL4" },
356 { LOG_LOCAL5, "LOCAL5" },
357 { LOG_LOCAL6, "LOCAL6" },
358 { LOG_LOCAL7, "LOCAL7" }
359 };
360
361 int facility;
362
363 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
364
365 return facility;
366 }
367
368 static int audit_syslog_priority(vfs_handle_struct *handle)
369 {
370 static const struct enum_list enum_log_priorities[] = {
371 { LOG_EMERG, "EMERG" },
372 { LOG_ALERT, "ALERT" },
373 { LOG_CRIT, "CRIT" },
374 { LOG_ERR, "ERR" },
375 { LOG_WARNING, "WARNING" },
376 { LOG_NOTICE, "NOTICE" },
377 { LOG_INFO, "INFO" },
378 { LOG_DEBUG, "DEBUG" }
379 };
380
381 int priority;
382
383 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
384 enum_log_priorities, LOG_NOTICE);
385 if (priority == -1) {
386 priority = LOG_WARNING;
387 }
388
389 return priority;
390 }
391
392 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
393 {
394 char *prefix = NULL;
395 char *result;
396
397 prefix = talloc_strdup(ctx,
398 lp_parm_const_string(SNUM(conn), "full_audit",
399 "prefix", "%u|%I"));
400 if (!prefix) {
401 return NULL;
402 }
403 result = talloc_sub_advanced(ctx,
404 lp_servicename(SNUM(conn)),
405 conn->session_info->unix_name,
406 conn->connectpath,
407 conn->session_info->utok.gid,
408 conn->session_info->sanitized_username,
409 conn->session_info->info3->base.domain.string,
410 prefix);
411 TALLOC_FREE(prefix);
412 return result;
413 }
414
415 static bool log_success(vfs_handle_struct *handle, vfs_op_type op)
416 {
417 struct vfs_full_audit_private_data *pd = NULL;
418
419 SMB_VFS_HANDLE_GET_DATA(handle, pd,
420 struct vfs_full_audit_private_data,
421 return True);
422
423 if (pd->success_ops == NULL) {
424 return True;
425 }
426
427 return bitmap_query(pd->success_ops, op);
428 }
429
430 static bool log_failure(vfs_handle_struct *handle, vfs_op_type op)
431 {
432 struct vfs_full_audit_private_data *pd = NULL;
433
434 SMB_VFS_HANDLE_GET_DATA(handle, pd,
435 struct vfs_full_audit_private_data,
436 return True);
437
438 if (pd->failure_ops == NULL)
439 return True;
440
441 return bitmap_query(pd->failure_ops, op);
442 }
443
444 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
445 {
446 struct bitmap *bm;
447
448 if (ops == NULL) {
449 return NULL;
450 }
451
452 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
453 if (bm == NULL) {
454 DEBUG(0, ("Could not alloc bitmap -- "
455 "defaulting to logging everything\n"));
456 return NULL;
457 }
458
459 for (; *ops != NULL; ops += 1) {
460 int i;
461 bool neg = false;
462 const char *op;
463
464 if (strequal(*ops, "all")) {
465 for (i=0; i<SMB_VFS_OP_LAST; i++) {
466 bitmap_set(bm, i);
467 }
468 continue;
469 }
470
471 if (strequal(*ops, "none")) {
472 break;
473 }
474
475 op = ops[0];
476 if (op[0] == '!') {
477 neg = true;
478 op += 1;
479 }
480
481 for (i=0; i<SMB_VFS_OP_LAST; i++) {
482 if (vfs_op_names[i].name == NULL) {
483 smb_panic("vfs_full_audit.c: name table not "
484 "in sync with vfs.h\n");
485 }
486 if (strequal(op, vfs_op_names[i].name)) {
487 if (neg) {
488 bitmap_clear(bm, i);
489 } else {
490 bitmap_set(bm, i);
491 }
492 break;
493 }
494 }
495 if (i == SMB_VFS_OP_LAST) {
496 DEBUG(0, ("Could not find opname %s, logging all\n",
497 *ops));
498 TALLOC_FREE(bm);
499 return NULL;
500 }
501 }
502 return bm;
503 }
504
505 static const char *audit_opname(vfs_op_type op)
506 {
507 if (op >= SMB_VFS_OP_LAST)
508 return "INVALID VFS OP";
509 return vfs_op_names[op].name;
510 }
511
512 static TALLOC_CTX *tmp_do_log_ctx;
513 /*
514 * Get us a temporary talloc context usable just for DEBUG arguments
515 */
516 static TALLOC_CTX *do_log_ctx(void)
517 {
518 if (tmp_do_log_ctx == NULL) {
519 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
520 }
521 return tmp_do_log_ctx;
522 }
523
524 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
525 const char *format, ...)
526 {
527 fstring err_msg;
528 char *audit_pre = NULL;
529 va_list ap;
530 char *op_msg = NULL;
531 int priority;
532
533 if (success && (!log_success(handle, op)))
534 goto out;
535
536 if (!success && (!log_failure(handle, op)))
537 goto out;
538
539 if (success)
540 fstrcpy(err_msg, "ok");
541 else
542 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
543
544 va_start(ap, format);
545 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
546 va_end(ap);
547
548 if (!op_msg) {
549 goto out;
550 }
551
552 /*
553 * Specify the facility to interoperate with other syslog callers
554 * (smbd for example).
555 */
556 priority = audit_syslog_priority(handle) |
557 audit_syslog_facility(handle);
558
559 audit_pre = audit_prefix(talloc_tos(), handle->conn);
560 syslog(priority, "%s|%s|%s|%s\n",
561 audit_pre ? audit_pre : "",
562 audit_opname(op), err_msg, op_msg);
563
564 out:
565 TALLOC_FREE(audit_pre);
566 TALLOC_FREE(op_msg);
567 TALLOC_FREE(tmp_do_log_ctx);
568
569 return;
570 }
571
572 /**
573 * Return a string using the do_log_ctx()
574 */
575 static const char *smb_fname_str_do_log(const struct smb_filename *smb_fname)
576 {
577 char *fname = NULL;
578 NTSTATUS status;
579
580 if (smb_fname == NULL) {
581 return "";
582 }
583 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
584 if (!NT_STATUS_IS_OK(status)) {
585 return "";
586 }
587 return fname;
588 }
589
590 /**
591 * Return an fsp debug string using the do_log_ctx()
592 */
593 static const char *fsp_str_do_log(const struct files_struct *fsp)
594 {
595 return smb_fname_str_do_log(fsp->fsp_name);
596 }
597
598 /* Implementation of vfs_ops. Pass everything on to the default
599 operation but log event first. */
600
601 static int smb_full_audit_connect(vfs_handle_struct *handle,
602 const char *svc, const char *user)
603 {
604 int result;
605 struct vfs_full_audit_private_data *pd = NULL;
606
607 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
608 if (result < 0) {
609 return result;
610 }
611
612 pd = TALLOC_ZERO_P(handle, struct vfs_full_audit_private_data);
613 if (!pd) {
614 SMB_VFS_NEXT_DISCONNECT(handle);
615 return -1;
616 }
617
618 #ifndef WITH_SYSLOG
619 openlog("smbd_audit", 0, audit_syslog_facility(handle));
620 #endif
621
622 pd->success_ops = init_bitmap(
623 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
624 "success", NULL));
625 pd->failure_ops = init_bitmap(
626 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
627 "failure", NULL));
628
629 /* Store the private data. */
630 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
631 struct vfs_full_audit_private_data, return -1);
632
633 do_log(SMB_VFS_OP_CONNECT, True, handle,
634 "%s", svc);
635
636 return 0;
637 }
638
639 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
640 {
641 SMB_VFS_NEXT_DISCONNECT(handle);
642
643 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
644 "%s", lp_servicename(SNUM(handle->conn)));
645
646 /* The bitmaps will be disconnected when the private
647 data is deleted. */
648
649 return;
650 }
651
652 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
653 const char *path,
654 bool small_query, uint64_t *bsize,
655 uint64_t *dfree, uint64_t *dsize)
656 {
657 uint64_t result;
658
659 result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
660 dfree, dsize);
661
662 /* Don't have a reasonable notion of failure here */
663
664 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
665
666 return result;
667 }
668
669 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
670 enum SMB_QUOTA_TYPE qtype, unid_t id,
671 SMB_DISK_QUOTA *qt)
672 {
673 int result;
674
675 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
676
677 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
678
679 return result;
680 }
681
682
683 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
684 enum SMB_QUOTA_TYPE qtype, unid_t id,
685 SMB_DISK_QUOTA *qt)
686 {
687 int result;
688
689 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
690
691 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
692
693 return result;
694 }
695
696 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
697 struct files_struct *fsp,
698 struct shadow_copy_data *shadow_copy_data,
699 bool labels)
700 {
701 int result;
702
703 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
704
705 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
706
707 return result;
708 }
709
710 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
711 const char *path,
712 struct vfs_statvfs_struct *statbuf)
713 {
714 int result;
715
716 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
717
718 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
719
720 return result;
721 }
722
723 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
724 {
725 int result;
726
727 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
728
729 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
730
731 return result;
732 }
733
734 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
735 const char *fname, const char *mask, uint32 attr)
736 {
737 SMB_STRUCT_DIR *result;
738
739 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
740
741 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
742
743 return result;
744 }
745
746 static SMB_STRUCT_DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
747 files_struct *fsp, const char *mask, uint32 attr)
748 {
749 SMB_STRUCT_DIR *result;
750
751 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
752
753 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
754 fsp_str_do_log(fsp));
755
756 return result;
757 }
758
759 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
760 SMB_STRUCT_DIR *dirp, SMB_STRUCT_STAT *sbuf)
761 {
762 SMB_STRUCT_DIRENT *result;
763
764 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
765
766 /* This operation has no reasonable error condition
767 * (End of dir is also failure), so always succeed.
768 */
769 do_log(SMB_VFS_OP_READDIR, True, handle, "");
770
771 return result;
772 }
773
774 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
775 SMB_STRUCT_DIR *dirp, long offset)
776 {
777 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
778
779 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
780 return;
781 }
782
783 static long smb_full_audit_telldir(vfs_handle_struct *handle,
784 SMB_STRUCT_DIR *dirp)
785 {
786 long result;
787
788 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
789
790 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
791
792 return result;
793 }
794
795 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
796 SMB_STRUCT_DIR *dirp)
797 {
798 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
799
800 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
801 return;
802 }
803
804 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
805 const char *path, mode_t mode)
806 {
807 int result;
808
809 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
810
811 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
812
813 return result;
814 }
815
816 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
817 const char *path)
818 {
819 int result;
820
821 result = SMB_VFS_NEXT_RMDIR(handle, path);
822
823 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
824
825 return result;
826 }
827
828 static int smb_full_audit_closedir(vfs_handle_struct *handle,
829 SMB_STRUCT_DIR *dirp)
830 {
831 int result;
832
833 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
834
835 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
836
837 return result;
838 }
839
840 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
841 SMB_STRUCT_DIR *dirp)
842 {
843 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
844
845 do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
846 return;
847 }
848
849 static int smb_full_audit_open(vfs_handle_struct *handle,
850 struct smb_filename *smb_fname,
851 files_struct *fsp, int flags, mode_t mode)
852 {
853 int result;
854
855 result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
856
857 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
858 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
859 smb_fname_str_do_log(smb_fname));
860
861 return result;
862 }
863
864 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
865 struct smb_request *req,
866 uint16_t root_dir_fid,
867 struct smb_filename *smb_fname,
868 uint32_t access_mask,
869 uint32_t share_access,
870 uint32_t create_disposition,
871 uint32_t create_options,
872 uint32_t file_attributes,
873 uint32_t oplock_request,
874 uint64_t allocation_size,
875 uint32_t private_flags,
876 struct security_descriptor *sd,
877 struct ea_list *ea_list,
878 files_struct **result_fsp,
879 int *pinfo)
880 {
881 NTSTATUS result;
882 const char* str_create_disposition;
883
884 switch (create_disposition) {
885 case FILE_SUPERSEDE:
886 str_create_disposition = "supersede";
887 break;
888 case FILE_OVERWRITE_IF:
889 str_create_disposition = "overwrite_if";
890 break;
891 case FILE_OPEN:
892 str_create_disposition = "open";
893 break;
894 case FILE_OVERWRITE:
895 str_create_disposition = "overwrite";
896 break;
897 case FILE_CREATE:
898 str_create_disposition = "create";
899 break;
900 case FILE_OPEN_IF:
901 str_create_disposition = "open_if";
902 break;
903 default:
904 str_create_disposition = "unknown";
905 }
906
907 result = SMB_VFS_NEXT_CREATE_FILE(
908 handle, /* handle */
909 req, /* req */
910 root_dir_fid, /* root_dir_fid */
911 smb_fname, /* fname */
912 access_mask, /* access_mask */
913 share_access, /* share_access */
914 create_disposition, /* create_disposition*/
915 create_options, /* create_options */
916 file_attributes, /* file_attributes */
917 oplock_request, /* oplock_request */
918 allocation_size, /* allocation_size */
919 private_flags,
920 sd, /* sd */
921 ea_list, /* ea_list */
922 result_fsp, /* result */
923 pinfo); /* pinfo */
924
925 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
926 "0x%x|%s|%s|%s", access_mask,
927 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
928 str_create_disposition, smb_fname_str_do_log(smb_fname));
929
930 return result;
931 }
932
933 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
934 {
935 int result;
936
937 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
938
939 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
940 fsp_str_do_log(fsp));
941
942 return result;
943 }
944
945 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
946 void *data, size_t n)
947 {
948 ssize_t result;
949
950 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
951
952 do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s",
953 fsp_str_do_log(fsp));
954
955 return result;
956 }
957
958 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
959 void *data, size_t n, SMB_OFF_T offset)
960 {
961 ssize_t result;
962
963 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
964
965 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
966 fsp_str_do_log(fsp));
967
968 return result;
969 }
970
971 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
972 const void *data, size_t n)
973 {
974 ssize_t result;
975
976 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
977
978 do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s",
979 fsp_str_do_log(fsp));
980
981 return result;
982 }
983
984 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
985 const void *data, size_t n,
986 SMB_OFF_T offset)
987 {
988 ssize_t result;
989
990 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
991
992 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
993 fsp_str_do_log(fsp));
994
995 return result;
996 }
997
998 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
999 SMB_OFF_T offset, int whence)
1000 {
1001 ssize_t result;
1002
1003 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1004
1005 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1006 "%s", fsp_str_do_log(fsp));
1007
1008 return result;
1009 }
1010
1011 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1012 files_struct *fromfsp,
1013 const DATA_BLOB *hdr, SMB_OFF_T offset,
1014 size_t n)
1015 {
1016 ssize_t result;
1017
1018 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1019
1020 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1021 "%s", fsp_str_do_log(fromfsp));
1022
1023 return result;
1024 }
1025
1026 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1027 files_struct *tofsp,
1028 SMB_OFF_T offset,
1029 size_t n)
1030 {
1031 ssize_t result;
1032
1033 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1034
1035 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1036 "%s", fsp_str_do_log(tofsp));
1037
1038 return result;
1039 }
1040
1041 static int smb_full_audit_rename(vfs_handle_struct *handle,
1042 const struct smb_filename *smb_fname_src,
1043 const struct smb_filename *smb_fname_dst)
1044 {
1045 int result;
1046
1047 result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1048
1049 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1050 smb_fname_str_do_log(smb_fname_src),
1051 smb_fname_str_do_log(smb_fname_dst));
1052
1053 return result;
1054 }
1055
1056 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1057 {
1058 int result;
1059
1060 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1061
1062 do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s",
1063 fsp_str_do_log(fsp));
1064
1065 return result;
1066 }
1067
1068 static int smb_full_audit_stat(vfs_handle_struct *handle,
1069 struct smb_filename *smb_fname)
1070 {
1071 int result;
1072
1073 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1074
1075 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1076 smb_fname_str_do_log(smb_fname));
1077
1078 return result;
1079 }
1080
1081 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1082 SMB_STRUCT_STAT *sbuf)
1083 {
1084 int result;
1085
1086 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1087
1088 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1089 fsp_str_do_log(fsp));
1090
1091 return result;
1092 }
1093
1094 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1095 struct smb_filename *smb_fname)
1096 {
1097 int result;
1098
1099 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1100
1101 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1102 smb_fname_str_do_log(smb_fname));
1103
1104 return result;
1105 }
1106
1107 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1108 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1109 {
1110 uint64_t result;
1111
1112 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1113
1114 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1115 "%llu", result);
1116
1117 return result;
1118 }
1119
1120 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1121 const struct smb_filename *smb_fname)
1122 {
1123 int result;
1124
1125 result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1126
1127 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1128 smb_fname_str_do_log(smb_fname));
1129
1130 return result;
1131 }
1132
1133 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1134 const char *path, mode_t mode)
1135 {
1136 int result;
1137
1138 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1139
1140 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1141
1142 return result;
1143 }
1144
1145 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1146 mode_t mode)
1147 {
1148 int result;
1149
1150 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1151
1152 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1153 "%s|%o", fsp_str_do_log(fsp), mode);
1154
1155 return result;
1156 }
1157
1158 static int smb_full_audit_chown(vfs_handle_struct *handle,
1159 const char *path, uid_t uid, gid_t gid)
1160 {
1161 int result;
1162
1163 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1164
1165 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1166 path, (long int)uid, (long int)gid);
1167
1168 return result;
1169 }
1170
1171 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1172 uid_t uid, gid_t gid)
1173 {
1174 int result;
1175
1176 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1177
1178 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1179 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1180
1181 return result;
1182 }
1183
1184 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1185 const char *path, uid_t uid, gid_t gid)
1186 {
1187 int result;
1188
1189 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1190
1191 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1192 path, (long int)uid, (long int)gid);
1193
1194 return result;
1195 }
1196
1197 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1198 const char *path)
1199 {
1200 int result;
1201
1202 result = SMB_VFS_NEXT_CHDIR(handle, path);
1203
1204 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1205
1206 return result;
1207 }
1208
1209 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
1210 char *path)
1211 {
1212 char *result;
1213
1214 result = SMB_VFS_NEXT_GETWD(handle, path);
1215
1216 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s", path);
1217
1218 return result;
1219 }
1220
1221 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1222 const struct smb_filename *smb_fname,
1223 struct smb_file_time *ft)
1224 {
1225 int result;
1226
1227 result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1228
1229 do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s",
1230 smb_fname_str_do_log(smb_fname));
1231
1232 return result;
1233 }
1234
1235 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1236 SMB_OFF_T len)
1237 {
1238 int result;
1239
1240 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1241
1242 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1243 "%s", fsp_str_do_log(fsp));
1244
1245 return result;
1246 }
1247
1248 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1249 enum vfs_fallocate_mode mode,
1250 SMB_OFF_T offset,
1251 SMB_OFF_T len)
1252 {
1253 int result;
1254
1255 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1256
1257 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1258 "%s", fsp_str_do_log(fsp));
1259
1260 return result;
1261 }
1262
1263 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1264 int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1265 {
1266 bool result;
1267
1268 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1269
1270 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1271
1272 return result;
1273 }
1274
1275 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1276 struct files_struct *fsp,
1277 uint32 share_mode, uint32 access_mask)
1278 {
1279 int result;
1280
1281 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1282
1283 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1284 fsp_str_do_log(fsp));
1285
1286 return result;
1287 }
1288
1289 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1290 int leasetype)
1291 {
1292 int result;
1293
1294 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1295
1296 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1297 fsp_str_do_log(fsp));
1298
1299 return result;
1300 }
1301
1302 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1303 SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid)
1304 {
1305 bool result;
1306
1307 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1308
1309 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1310
1311 return result;
1312 }
1313
1314 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1315 const char *oldpath, const char *newpath)
1316 {
1317 int result;
1318
1319 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1320
1321 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1322 "%s|%s", oldpath, newpath);
1323
1324 return result;
1325 }
1326
1327 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1328 const char *path, char *buf, size_t bufsiz)
1329 {
1330 int result;
1331
1332 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1333
1334 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1335
1336 return result;
1337 }
1338
1339 static int smb_full_audit_link(vfs_handle_struct *handle,
1340 const char *oldpath, const char *newpath)
1341 {
1342 int result;
1343
1344 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1345
1346 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1347 "%s|%s", oldpath, newpath);
1348
1349 return result;
1350 }
1351
1352 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1353 const char *pathname, mode_t mode, SMB_DEV_T dev)
1354 {
1355 int result;
1356
1357 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1358
1359 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1360
1361 return result;
1362 }
1363
1364 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1365 const char *path)
1366 {
1367 char *result;
1368
1369 result = SMB_VFS_NEXT_REALPATH(handle, path);
1370
1371 do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1372
1373 return result;
1374 }
1375
1376 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1377 struct sys_notify_context *ctx,
1378 struct notify_entry *e,
1379 void (*callback)(struct sys_notify_context *ctx,
1380 void *private_data,
1381 struct notify_event *ev),
1382 void *private_data, void *handle_p)
1383 {
1384 NTSTATUS result;
1385
1386 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback, private_data, handle_p);
1387
1388 do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1389
1390 return result;
1391 }
1392
1393 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1394 const char *path, unsigned int flags)
1395 {
1396 int result;
1397
1398 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1399
1400 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1401
1402 return result;
1403 }
1404
1405 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1406 const SMB_STRUCT_STAT *sbuf)
1407 {
1408 struct file_id id_zero;
1409 struct file_id result;
1410
1411 ZERO_STRUCT(id_zero);
1412
1413 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1414
1415 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1416 !file_id_equal(&id_zero, &result),
1417 handle, "%s", file_id_string_tos(&result));
1418
1419 return result;
1420 }
1421
1422 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1423 struct files_struct *fsp,
1424 const char *fname,
1425 TALLOC_CTX *mem_ctx,
1426 unsigned int *pnum_streams,
1427 struct stream_struct **pstreams)
1428 {
1429 NTSTATUS result;
1430
1431 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1432 pnum_streams, pstreams);
1433
1434 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1435 "%s", fname);
1436
1437 return result;
1438 }
1439
1440 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1441 const char *path,
1442 const char *name,
1443 TALLOC_CTX *mem_ctx,
1444 char **found_name)
1445 {
1446 int result;
1447
1448 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1449 found_name);
1450
1451 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1452 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1453
1454 return result;
1455 }
1456
1457 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1458 const char *fname)
1459 {
1460 const char *result;
1461
1462 result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1463
1464 do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1465 "%s", fname);
1466
1467 return result;
1468 }
1469
1470 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1471 struct byte_range_lock *br_lck,
1472 struct lock_struct *plock,
1473 bool blocking_lock,
1474 struct blocking_lock_record *blr)
1475 {
1476 NTSTATUS result;
1477
1478 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1479 blocking_lock, blr);
1480
1481 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1482 "%s:%llu-%llu. type=%d. blocking=%d", fsp_str_do_log(br_lck->fsp),
1483 plock->start, plock->size, plock->lock_type, blocking_lock );
1484
1485 return result;
1486 }
1487
1488 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1489 struct messaging_context *msg_ctx,
1490 struct byte_range_lock *br_lck,
1491 const struct lock_struct *plock)
1492 {
1493 bool result;
1494
1495 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1496 plock);
1497
1498 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1499 "%s:%llu-%llu:%d", fsp_str_do_log(br_lck->fsp), plock->start,
1500 plock->size, plock->lock_type);
1501
1502 return result;
1503 }
1504
1505 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1506 struct byte_range_lock *br_lck,
1507 struct lock_struct *plock,
1508 struct blocking_lock_record *blr)
1509 {
1510 bool result;
1511
1512 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock, blr);
1513
1514 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1515 "%s:%llu-%llu:%d", fsp_str_do_log(br_lck->fsp), plock->start,
1516 plock->size);
1517
1518 return result;
1519 }
1520
1521 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
1522 struct files_struct *fsp,
1523 struct lock_struct *plock)
1524 {
1525 bool result;
1526
1527 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1528
1529 do_log(SMB_VFS_OP_STRICT_LOCK, result, handle,
1530 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1531 plock->size);
1532
1533 return result;
1534 }
1535
1536 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
1537 struct files_struct *fsp,
1538 struct lock_struct *plock)
1539 {
1540 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1541
1542 do_log(SMB_VFS_OP_STRICT_UNLOCK, true, handle,
1543 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1544 plock->size);
1545
1546 return;
1547 }
1548
1549 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1550 const char *name,
1551 enum vfs_translate_direction direction,
1552 TALLOC_CTX *mem_ctx,
1553 char **mapped_name)
1554 {
1555 NTSTATUS result;
1556
1557 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1558 mapped_name);
1559
1560 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1561
1562 return result;
1563 }
1564
1565 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1566 uint32 security_info,
1567 struct security_descriptor **ppdesc)
1568 {
1569 NTSTATUS result;
1570
1571 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1572
1573 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1574 "%s", fsp_str_do_log(fsp));
1575
1576 return result;
1577 }
1578
1579 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1580 const char *name,
1581 uint32 security_info,
1582 struct security_descriptor **ppdesc)
1583 {
1584 NTSTATUS result;
1585
1586 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1587
1588 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1589 "%s", name);
1590
1591 return result;
1592 }
1593
1594 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1595 uint32 security_info_sent,
1596 const struct security_descriptor *psd)
1597 {
1598 NTSTATUS result;
1599
1600 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1601
1602 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle, "%s",
1603 fsp_str_do_log(fsp));
1604
1605 return result;
1606 }
1607
1608 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1609 const char *path, mode_t mode)
1610 {
1611 int result;
1612
1613 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1614
1615 do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1616 "%s|%o", path, mode);
1617
1618 return result;
1619 }
1620
1621 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1622 mode_t mode)
1623 {
1624 int result;
1625
1626 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1627
1628 do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1629 "%s|%o", fsp_str_do_log(fsp), mode);
1630
1631 return result;
1632 }
1633
1634 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1635
1636 SMB_ACL_T theacl, int entry_id,
1637 SMB_ACL_ENTRY_T *entry_p)
1638 {
1639 int result;
1640
1641 result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1642 entry_p);
1643
1644 do_log(SMB_VFS_OP_SYS_ACL_GET_ENTRY, (result >= 0), handle,
1645 "");
1646
1647 return result;
1648 }
1649
1650 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1651
1652 SMB_ACL_ENTRY_T entry_d,
1653 SMB_ACL_TAG_T *tag_type_p)
1654 {
1655 int result;
1656
1657 result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1658 tag_type_p);
1659
1660 do_log(SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, (result >= 0), handle,
1661 "");
1662
1663 return result;
1664 }
1665
1666 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1667
1668 SMB_ACL_ENTRY_T entry_d,
1669 SMB_ACL_PERMSET_T *permset_p)
1670 {
1671 int result;
1672
1673 result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1674 permset_p);
1675
1676 do_log(SMB_VFS_OP_SYS_ACL_GET_PERMSET, (result >= 0), handle,
1677 "");
1678
1679 return result;
1680 }
1681
1682 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1683
1684 SMB_ACL_ENTRY_T entry_d)
1685 {
1686 void *result;
1687
1688 result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1689
1690 do_log(SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, (result != NULL), handle,
1691 "");
1692
1693 return result;
1694 }
1695
1696 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1697 const char *path_p,
1698 SMB_ACL_TYPE_T type)
1699 {
1700 SMB_ACL_T result;
1701
1702 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1703
1704 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1705 "%s", path_p);
1706
1707 return result;
1708 }
1709
1710 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1711 files_struct *fsp)
1712 {
1713 SMB_ACL_T result;
1714
1715 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1716
1717 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1718 "%s", fsp_str_do_log(fsp));
1719
1720 return result;
1721 }
1722
1723 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1724
1725 SMB_ACL_PERMSET_T permset)
1726 {
1727 int result;
1728
1729 result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1730
1731 do_log(SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, (result >= 0), handle,
1732 "");
1733
1734 return result;
1735 }
1736
1737 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1738
1739 SMB_ACL_PERMSET_T permset,
1740 SMB_ACL_PERM_T perm)
1741 {
1742 int result;
1743
1744 result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1745
1746 do_log(SMB_VFS_OP_SYS_ACL_ADD_PERM, (result >= 0), handle,
1747 "");
1748
1749 return result;
1750 }
1751
1752 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
1753 SMB_ACL_T theacl,
1754 ssize_t *plen)
1755 {
1756 char * result;
1757
1758 result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
1759
1760 do_log(SMB_VFS_OP_SYS_ACL_TO_TEXT, (result != NULL), handle,
1761 "");
1762
1763 return result;
1764 }
1765
1766 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
1767
1768 int count)
1769 {
1770 SMB_ACL_T result;
1771
1772 result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
1773
1774 do_log(SMB_VFS_OP_SYS_ACL_INIT, (result != NULL), handle,
1775 "");
1776
1777 return result;
1778 }
1779
1780 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1781 SMB_ACL_T *pacl,
1782 SMB_ACL_ENTRY_T *pentry)
1783 {
1784 int result;
1785
1786 result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
1787
1788 do_log(SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, (result >= 0), handle,
1789 "");
1790
1791 return result;
1792 }
1793
1794 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1795
1796 SMB_ACL_ENTRY_T entry,
1797 SMB_ACL_TAG_T tagtype)
1798 {
1799 int result;
1800
1801 result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
1802 tagtype);
1803
1804 do_log(SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, (result >= 0), handle,
1805 "");
1806
1807 return result;
1808 }
1809
1810 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1811
1812 SMB_ACL_ENTRY_T entry,
1813 void *qual)
1814 {
1815 int result;
1816
1817 result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
1818
1819 do_log(SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, (result >= 0), handle,
1820 "");
1821
1822 return result;
1823 }
1824
1825 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1826
1827 SMB_ACL_ENTRY_T entry,
1828 SMB_ACL_PERMSET_T permset)
1829 {
1830 int result;
1831
1832 result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
1833
1834 do_log(SMB_VFS_OP_SYS_ACL_SET_PERMSET, (result >= 0), handle,
1835 "");
1836
1837 return result;
1838 }
1839
1840 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
1841
1842 SMB_ACL_T theacl )
1843 {
1844 int result;
1845
1846 result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
1847
1848 do_log(SMB_VFS_OP_SYS_ACL_VALID, (result >= 0), handle,
1849 "");
1850
1851 return result;
1852 }
1853
1854 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
1855
1856 const char *name, SMB_ACL_TYPE_T acltype,
1857 SMB_ACL_T theacl)
1858 {
1859 int result;
1860
1861 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1862 theacl);
1863
1864 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
1865 "%s", name);
1866
1867 return result;
1868 }
1869
1870 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
1871 SMB_ACL_T theacl)
1872 {
1873 int result;
1874
1875 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1876
1877 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
1878 "%s", fsp_str_do_log(fsp));
1879
1880 return result;
1881 }
1882
1883 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1884
1885 const char *path)
1886 {
1887 int result;
1888
1889 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
1890
1891 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
1892 "%s", path);
1893
1894 return result;
1895 }
1896
1897 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
1898
1899 SMB_ACL_PERMSET_T permset,
1900 SMB_ACL_PERM_T perm)
1901 {
1902 int result;
1903
1904 result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
1905
1906 do_log(SMB_VFS_OP_SYS_ACL_GET_PERM, (result >= 0), handle,
1907 "");
1908
1909 return result;
1910 }
1911
1912 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
1913
1914 char *text)
1915 {
1916 int result;
1917
1918 result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
1919
1920 do_log(SMB_VFS_OP_SYS_ACL_FREE_TEXT, (result >= 0), handle,
1921 "");
1922
1923 return result;
1924 }
1925
1926 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
1927
1928 SMB_ACL_T posix_acl)
1929 {
1930 int result;
1931
1932 result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
1933
1934 do_log(SMB_VFS_OP_SYS_ACL_FREE_ACL, (result >= 0), handle,
1935 "");
1936
1937 return result;
1938 }
1939
1940 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
1941 void *qualifier,
1942 SMB_ACL_TAG_T tagtype)
1943 {
1944 int result;
1945
1946 result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
1947 tagtype);
1948
1949 do_log(SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, (result >= 0), handle,
1950 "");
1951
1952 return result;
1953 }
1954
1955 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
1956 const char *path,
1957 const char *name, void *value, size_t size)
1958 {
1959 ssize_t result;
1960
1961 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
1962
1963 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
1964 "%s|%s", path, name);
1965
1966 return result;
1967 }
1968
1969 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
1970 const char *path, const char *name,
1971 void *value, size_t size)
1972 {
1973 ssize_t result;
1974
1975 result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
1976
1977 do_log(SMB_VFS_OP_LGETXATTR, (result >= 0), handle,
1978 "%s|%s", path, name);
1979
1980 return result;
1981 }
1982
1983 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
1984 struct files_struct *fsp,
1985 const char *name, void *value, size_t size)
1986 {
1987 ssize_t result;
1988
1989 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
1990
1991 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
1992 "%s|%s", fsp_str_do_log(fsp), name);
1993
1994 return result;
1995 }
1996
1997 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
1998 const char *path, char *list, size_t size)
1999 {
2000 ssize_t result;
2001
2002 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2003
2004 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
2005
2006 return result;
2007 }
2008
2009 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
2010 const char *path, char *list, size_t size)
2011 {
2012 ssize_t result;
2013
2014 result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2015
2016 do_log(SMB_VFS_OP_LLISTXATTR, (result >= 0), handle, "%s", path);
2017
2018 return result;
2019 }
2020
2021 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2022 struct files_struct *fsp, char *list,
2023 size_t size)
2024 {
2025 ssize_t result;
2026
2027 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2028
2029 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2030 "%s", fsp_str_do_log(fsp));
2031
2032 return result;
2033 }
2034
2035 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2036 const char *path,
2037 const char *name)
2038 {
2039 int result;
2040
2041 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2042
2043 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2044 "%s|%s", path, name);
2045
2046 return result;
2047 }
2048
2049 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
2050 const char *path,
2051 const char *name)
2052 {
2053 int result;
2054
2055 result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2056
2057 do_log(SMB_VFS_OP_LREMOVEXATTR, (result >= 0), handle,
2058 "%s|%s", path, name);
2059
2060 return result;
2061 }
2062
2063 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2064 struct files_struct *fsp,
2065 const char *name)
2066 {
2067 int result;
2068
2069 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2070
2071 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2072 "%s|%s", fsp_str_do_log(fsp), name);
2073
2074 return result;
2075 }
2076
2077 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2078 const char *path,
2079 const char *name, const void *value, size_t size,
2080 int flags)
2081 {
2082 int result;
2083
2084 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2085 flags);
2086
2087 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2088 "%s|%s", path, name);
2089
2090 return result;
2091 }
2092
2093 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
2094 const char *path,
2095 const char *name, const void *value, size_t size,
2096 int flags)
2097 {
2098 int result;
2099
2100 result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2101 flags);
2102
2103 do_log(SMB_VFS_OP_LSETXATTR, (result >= 0), handle,
2104 "%s|%s", path, name);
2105
2106 return result;
2107 }
2108
2109 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2110 struct files_struct *fsp, const char *name,
2111 const void *value, size_t size, int flags)
2112 {
2113 int result;
2114
2115 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2116
2117 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2118 "%s|%s", fsp_str_do_log(fsp), name);
2119
2120 return result;
2121 }
2122
2123 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2124 {
2125 int result;
2126
2127 result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2128 do_log(SMB_VFS_OP_AIO_READ, (result >= 0), handle,
2129 "%s", fsp_str_do_log(fsp));
2130
2131 return result;
2132 }
2133
2134 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2135 {
2136 int result;
2137
2138 result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2139 do_log(SMB_VFS_OP_AIO_WRITE, (result >= 0), handle,
2140 "%s", fsp_str_do_log(fsp));
2141
2142 return result;
2143 }
2144
2145 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2146 {
2147 int result;
2148
2149 result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2150 do_log(SMB_VFS_OP_AIO_RETURN, (result >= 0), handle,
2151 "%s", fsp_str_do_log(fsp));
2152
2153 return result;
2154 }
2155
2156 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2157 {
2158 int result;
2159
2160 result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2161 do_log(SMB_VFS_OP_AIO_CANCEL, (result >= 0), handle,
2162 "%s", fsp_str_do_log(fsp));
2163
2164 return result;
2165 }
2166
2167 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2168 {
2169 int result;
2170
2171 result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2172 do_log(SMB_VFS_OP_AIO_ERROR, (result >= 0), handle,
2173 "%s", fsp_str_do_log(fsp));
2174
2175 return result;
2176 }
2177
2178 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb)
2179 {
2180 int result;
2181
2182 result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2183 do_log(SMB_VFS_OP_AIO_FSYNC, (result >= 0), handle,
2184 "%s", fsp_str_do_log(fsp));
2185
2186 return result;
2187 }
2188
2189 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts)
2190 {
2191 int result;
2192
2193 result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2194 do_log(SMB_VFS_OP_AIO_SUSPEND, (result >= 0), handle,
2195 "%s", fsp_str_do_log(fsp));
2196
2197 return result;
2198 }
2199
2200 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2201 struct files_struct *fsp)
2202 {
2203 bool result;
2204
2205 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2206 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2207 "%s", fsp_str_do_log(fsp));
2208
2209 return result;
2210 }
2211
2212 static bool smb_full_audit_is_offline(struct vfs_handle_struct *handle,
2213 const struct smb_filename *fname,
2214 SMB_STRUCT_STAT *sbuf)
2215 {
2216 bool result;
2217
2218 result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
2219 do_log(SMB_VFS_OP_IS_OFFLINE, result, handle, "%s",
2220 smb_fname_str_do_log(fname));
2221 return result;
2222 }
2223
2224 static int smb_full_audit_set_offline(struct vfs_handle_struct *handle,
2225 const struct smb_filename *fname)
2226 {
2227 int result;
2228
2229 result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2230 do_log(SMB_VFS_OP_SET_OFFLINE, result >= 0, handle, "%s",
2231 smb_fname_str_do_log(fname));
2232 return result;
2233 }
2234
2235 static struct vfs_fn_pointers vfs_full_audit_fns = {
2236
2237 /* Disk operations */
2238
2239 .connect_fn = smb_full_audit_connect,
2240 .disconnect = smb_full_audit_disconnect,
2241 .disk_free = smb_full_audit_disk_free,
2242 .get_quota = smb_full_audit_get_quota,
2243 .set_quota = smb_full_audit_set_quota,
2244 .get_shadow_copy_data = smb_full_audit_get_shadow_copy_data,
2245 .statvfs = smb_full_audit_statvfs,
2246 .fs_capabilities = smb_full_audit_fs_capabilities,
2247 .opendir = smb_full_audit_opendir,
2248 .fdopendir = smb_full_audit_fdopendir,
2249 .readdir = smb_full_audit_readdir,
2250 .seekdir = smb_full_audit_seekdir,
2251 .telldir = smb_full_audit_telldir,
2252 .rewind_dir = smb_full_audit_rewinddir,
2253 .mkdir = smb_full_audit_mkdir,
2254 .rmdir = smb_full_audit_rmdir,
2255 .closedir = smb_full_audit_closedir,
2256 .init_search_op = smb_full_audit_init_search_op,
2257 .open_fn = smb_full_audit_open,
2258 .create_file = smb_full_audit_create_file,
2259 .close_fn = smb_full_audit_close,
2260 .vfs_read = smb_full_audit_read,
2261 .pread = smb_full_audit_pread,
2262 .write = smb_full_audit_write,
2263 .pwrite = smb_full_audit_pwrite,
2264 .lseek = smb_full_audit_lseek,
2265 .sendfile = smb_full_audit_sendfile,
2266 .recvfile = smb_full_audit_recvfile,
2267 .rename = smb_full_audit_rename,
2268 .fsync = smb_full_audit_fsync,
2269 .stat = smb_full_audit_stat,
2270 .fstat = smb_full_audit_fstat,
2271 .lstat = smb_full_audit_lstat,
2272 .get_alloc_size = smb_full_audit_get_alloc_size,
2273 .unlink = smb_full_audit_unlink,
2274 .chmod = smb_full_audit_chmod,
2275 .fchmod = smb_full_audit_fchmod,
2276 .chown = smb_full_audit_chown,
2277 .fchown = smb_full_audit_fchown,
2278 .lchown = smb_full_audit_lchown,
2279 .chdir = smb_full_audit_chdir,
2280 .getwd = smb_full_audit_getwd,
2281 .ntimes = smb_full_audit_ntimes,
2282 .ftruncate = smb_full_audit_ftruncate,
2283 .fallocate = smb_full_audit_fallocate,
2284 .lock = smb_full_audit_lock,
2285 .kernel_flock = smb_full_audit_kernel_flock,
2286 .linux_setlease = smb_full_audit_linux_setlease,
2287 .getlock = smb_full_audit_getlock,
2288 .symlink = smb_full_audit_symlink,
2289 .vfs_readlink = smb_full_audit_readlink,
2290 .link = smb_full_audit_link,
2291 .mknod = smb_full_audit_mknod,
2292 .realpath = smb_full_audit_realpath,
2293 .notify_watch = smb_full_audit_notify_watch,
2294 .chflags = smb_full_audit_chflags,
2295 .file_id_create = smb_full_audit_file_id_create,
2296 .streaminfo = smb_full_audit_streaminfo,
2297 .get_real_filename = smb_full_audit_get_real_filename,
2298 .connectpath = smb_full_audit_connectpath,
2299 .brl_lock_windows = smb_full_audit_brl_lock_windows,
2300 .brl_unlock_windows = smb_full_audit_brl_unlock_windows,
2301 .brl_cancel_windows = smb_full_audit_brl_cancel_windows,
2302 .strict_lock = smb_full_audit_strict_lock,
2303 .strict_unlock = smb_full_audit_strict_unlock,
2304 .translate_name = smb_full_audit_translate_name,
2305 .fget_nt_acl = smb_full_audit_fget_nt_acl,
2306 .get_nt_acl = smb_full_audit_get_nt_acl,
2307 .fset_nt_acl = smb_full_audit_fset_nt_acl,
2308 .chmod_acl = smb_full_audit_chmod_acl,
2309 .fchmod_acl = smb_full_audit_fchmod_acl,
2310 .sys_acl_get_entry = smb_full_audit_sys_acl_get_entry,
2311 .sys_acl_get_tag_type = smb_full_audit_sys_acl_get_tag_type,
2312 .sys_acl_get_permset = smb_full_audit_sys_acl_get_permset,
2313 .sys_acl_get_qualifier = smb_full_audit_sys_acl_get_qualifier,
2314 .sys_acl_get_file = smb_full_audit_sys_acl_get_file,
2315 .sys_acl_get_fd = smb_full_audit_sys_acl_get_fd,
2316 .sys_acl_clear_perms = smb_full_audit_sys_acl_clear_perms,
2317 .sys_acl_add_perm = smb_full_audit_sys_acl_add_perm,
2318 .sys_acl_to_text = smb_full_audit_sys_acl_to_text,
2319 .sys_acl_init = smb_full_audit_sys_acl_init,
2320 .sys_acl_create_entry = smb_full_audit_sys_acl_create_entry,
2321 .sys_acl_set_tag_type = smb_full_audit_sys_acl_set_tag_type,
2322 .sys_acl_set_qualifier = smb_full_audit_sys_acl_set_qualifier,
2323 .sys_acl_set_permset = smb_full_audit_sys_acl_set_permset,
2324 .sys_acl_valid = smb_full_audit_sys_acl_valid,
2325 .sys_acl_set_file = smb_full_audit_sys_acl_set_file,
2326 .sys_acl_set_fd = smb_full_audit_sys_acl_set_fd,
2327 .sys_acl_delete_def_file = smb_full_audit_sys_acl_delete_def_file,
2328 .sys_acl_get_perm = smb_full_audit_sys_acl_get_perm,
2329 .sys_acl_free_text = smb_full_audit_sys_acl_free_text,
2330 .sys_acl_free_acl = smb_full_audit_sys_acl_free_acl,
2331 .sys_acl_free_qualifier = smb_full_audit_sys_acl_free_qualifier,
2332 .getxattr = smb_full_audit_getxattr,
2333 .lgetxattr = smb_full_audit_lgetxattr,
2334 .fgetxattr = smb_full_audit_fgetxattr,
2335 .listxattr = smb_full_audit_listxattr,
2336 .llistxattr = smb_full_audit_llistxattr,
2337 .flistxattr = smb_full_audit_flistxattr,
2338 .removexattr = smb_full_audit_removexattr,
2339 .lremovexattr = smb_full_audit_lremovexattr,
2340 .fremovexattr = smb_full_audit_fremovexattr,
2341 .setxattr = smb_full_audit_setxattr,
2342 .lsetxattr = smb_full_audit_lsetxattr,
2343 .fsetxattr = smb_full_audit_fsetxattr,
2344 .aio_read = smb_full_audit_aio_read,
2345 .aio_write = smb_full_audit_aio_write,
2346 .aio_return_fn = smb_full_audit_aio_return,
2347 .aio_cancel = smb_full_audit_aio_cancel,
2348 .aio_error_fn = smb_full_audit_aio_error,
2349 .aio_fsync = smb_full_audit_aio_fsync,
2350 .aio_suspend = smb_full_audit_aio_suspend,
2351 .aio_force = smb_full_audit_aio_force,
2352 .is_offline = smb_full_audit_is_offline,
2353 .set_offline = smb_full_audit_set_offline,
2354 };
2355
2356 NTSTATUS vfs_full_audit_init(void)
2357 {
2358 NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2359 "full_audit", &vfs_full_audit_fns);
2360
2361 if (!NT_STATUS_IS_OK(ret))
2362 return ret;
2363
2364 vfs_full_audit_debug_level = debug_add_class("full_audit");
2365 if (vfs_full_audit_debug_level == -1) {
2366 vfs_full_audit_debug_level = DBGC_VFS;
2367 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2368 "class!\n"));
2369 } else {
2370 DEBUG(10, ("vfs_full_audit: Debug class number of "
2371 "'full_audit': %d\n", vfs_full_audit_debug_level));
2372 }
2373
2374 return ret;
2375 }
Samba GIT mirror