2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
39 #ifndef SYSLOG_FACILITY
40 #define SYSLOG_FACILITY LOG_USER
43 #ifndef SYSLOG_PRIORITY
44 #define SYSLOG_PRIORITY LOG_NOTICE
47 /* Function prototypes */
49 int audit_connect(struct vfs_connection_struct
*conn
, char *svc
, char *user
);
50 void audit_disconnect(void);
51 DIR *audit_opendir(char *fname
);
52 int audit_mkdir(char *path
, mode_t mode
);
53 int audit_rmdir(char *path
);
54 int audit_open(char *fname
, int flags
, mode_t mode
);
55 int audit_close(int fd
);
56 int audit_rename(char *old
, char *new);
57 int audit_unlink(char *path
);
58 int audit_chmod(char *path
, mode_t mode
);
62 extern struct vfs_ops default_vfs_ops
; /* For passthrough operation */
64 struct vfs_ops audit_ops
= {
72 /* Directory operations */
99 /* VFS initialisation function. Return initialised vfs_ops structure
102 struct vfs_ops
*vfs_init(void)
104 openlog("smbd_audit", LOG_PID
, SYSLOG_FACILITY
);
108 /* Implementation of vfs_ops. Pass everything on to the default
109 operation but log event first. */
111 int audit_connect(struct vfs_connection_struct
*conn
, char *svc
, char *user
)
113 syslog(SYSLOG_PRIORITY
, "connect to service %s by user %s\n",
116 return default_vfs_ops
.connect(conn
, svc
, user
);
119 void audit_disconnect(void)
121 syslog(SYSLOG_PRIORITY
, "disconnected\n");
122 default_vfs_ops
.disconnect();
125 DIR *audit_opendir(char *fname
)
127 DIR *result
= default_vfs_ops
.opendir(fname
);
129 syslog(SYSLOG_PRIORITY
, "opendir %s %s%s\n",
131 (result
== NULL
) ? "failed: " : "",
132 (result
== NULL
) ? strerror(errno
) : "");
137 int audit_mkdir(char *path
, mode_t mode
)
139 int result
= default_vfs_ops
.mkdir(path
, mode
);
141 syslog(SYSLOG_PRIORITY
, "mkdir %s %s%s\n",
143 (result
< 0) ? "failed: " : "",
144 (result
< 0) ? strerror(errno
) : "");
149 int audit_rmdir(char *path
)
151 int result
= default_vfs_ops
.rmdir(path
);
153 syslog(SYSLOG_PRIORITY
, "rmdir %s %s%s\n",
155 (result
< 0) ? "failed: " : "",
156 (result
< 0) ? strerror(errno
) : "");
161 int audit_open(char *fname
, int flags
, mode_t mode
)
163 int result
= default_vfs_ops
.open(fname
, flags
, mode
);
165 syslog(SYSLOG_PRIORITY
, "open %s (fd %d) %s%s%s\n",
167 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
168 (result
< 0) ? "failed: " : "",
169 (result
< 0) ? strerror(errno
) : "");
174 int audit_close(int fd
)
176 int result
= default_vfs_ops
.close(fd
);
178 syslog(SYSLOG_PRIORITY
, "close fd %d %s%s\n",
180 (result
< 0) ? "failed: " : "",
181 (result
< 0) ? strerror(errno
) : "");
186 int audit_rename(char *old
, char *new)
188 int result
= default_vfs_ops
.rename(old
, new);
190 syslog(SYSLOG_PRIORITY
, "rename %s -> %s %s%s\n",
192 (result
< 0) ? "failed: " : "",
193 (result
< 0) ? strerror(errno
) : "");
198 int audit_unlink(char *path
)
200 int result
= default_vfs_ops
.unlink(path
);
202 syslog(SYSLOG_PRIORITY
, "unlink %s %s%s\n",
204 (result
< 0) ? "failed: " : "",
205 (result
< 0) ? strerror(errno
) : "");