2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
40 #ifndef SYSLOG_FACILITY
41 #define SYSLOG_FACILITY LOG_USER
44 #ifndef SYSLOG_PRIORITY
45 #define SYSLOG_PRIORITY LOG_NOTICE
48 /* Function prototypes */
50 int audit_connect(struct connection_struct
*conn
, char *svc
, char *user
);
51 void audit_disconnect(struct connection_struct
*conn
);
52 DIR *audit_opendir(struct connection_struct
*conn
, char *fname
);
53 int audit_mkdir(struct connection_struct
*conn
, char *path
, mode_t mode
);
54 int audit_rmdir(struct connection_struct
*conn
, char *path
);
55 int audit_open(struct connection_struct
*conn
, char *fname
, int flags
, mode_t mode
);
56 int audit_close(struct files_struct
*fsp
, int fd
);
57 int audit_rename(struct connection_struct
*conn
, char *old
, char *new);
58 int audit_unlink(struct connection_struct
*conn
, char *path
);
59 int audit_chmod(struct connection_struct
*conn
, char *path
, mode_t mode
);
63 extern struct vfs_ops default_vfs_ops
; /* For passthrough operation */
65 struct vfs_ops audit_ops
= {
73 /* Directory operations */
101 NULL
, /* fget_nt_acl */
102 NULL
, /* get_nt_acl */
103 NULL
, /* fset_nt_acl */
104 NULL
/* set_nt_acl */
107 /* VFS initialisation function. Return initialised vfs_ops structure
110 struct vfs_ops
*vfs_init(void)
112 openlog("smbd_audit", LOG_PID
, SYSLOG_FACILITY
);
113 syslog(SYSLOG_PRIORITY
, "VFS_INIT: &audit_ops: 0x%8.8x\n",
118 /* Implementation of vfs_ops. Pass everything on to the default
119 operation but log event first. */
121 int audit_connect(struct connection_struct
*conn
, char *svc
, char *user
)
123 syslog(SYSLOG_PRIORITY
, "connect to service %s by user %s\n",
126 return default_vfs_ops
.connect(conn
, svc
, user
);
129 void audit_disconnect(struct connection_struct
*conn
)
131 syslog(SYSLOG_PRIORITY
, "disconnected\n");
132 default_vfs_ops
.disconnect(conn
);
135 DIR *audit_opendir(struct connection_struct
*conn
, char *fname
)
137 DIR *result
= default_vfs_ops
.opendir(conn
, fname
);
139 syslog(SYSLOG_PRIORITY
, "opendir %s %s%s\n",
141 (result
== NULL
) ? "failed: " : "",
142 (result
== NULL
) ? strerror(errno
) : "");
147 int audit_mkdir(struct connection_struct
*conn
, char *path
, mode_t mode
)
149 int result
= default_vfs_ops
.mkdir(conn
, path
, mode
);
151 syslog(SYSLOG_PRIORITY
, "mkdir %s %s%s\n",
153 (result
< 0) ? "failed: " : "",
154 (result
< 0) ? strerror(errno
) : "");
159 int audit_rmdir(struct connection_struct
*conn
, char *path
)
161 int result
= default_vfs_ops
.rmdir(conn
, path
);
163 syslog(SYSLOG_PRIORITY
, "rmdir %s %s%s\n",
165 (result
< 0) ? "failed: " : "",
166 (result
< 0) ? strerror(errno
) : "");
171 int audit_open(struct connection_struct
*conn
, char *fname
, int flags
, mode_t mode
)
173 int result
= default_vfs_ops
.open(conn
, fname
, flags
, mode
);
175 syslog(SYSLOG_PRIORITY
, "open %s (fd %d) %s%s%s\n",
177 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
178 (result
< 0) ? "failed: " : "",
179 (result
< 0) ? strerror(errno
) : "");
184 int audit_close(struct files_struct
*fsp
, int fd
)
186 int result
= default_vfs_ops
.close(fsp
, fd
);
188 syslog(SYSLOG_PRIORITY
, "close fd %d %s%s\n",
190 (result
< 0) ? "failed: " : "",
191 (result
< 0) ? strerror(errno
) : "");
196 int audit_rename(struct connection_struct
*conn
, char *old
, char *new)
198 int result
= default_vfs_ops
.rename(conn
, old
, new);
200 syslog(SYSLOG_PRIORITY
, "rename %s -> %s %s%s\n",
202 (result
< 0) ? "failed: " : "",
203 (result
< 0) ? strerror(errno
) : "");
208 int audit_unlink(struct connection_struct
*conn
, char *path
)
210 int result
= default_vfs_ops
.unlink(conn
, path
);
212 syslog(SYSLOG_PRIORITY
, "unlink %s %s%s\n",
214 (result
< 0) ? "failed: " : "",
215 (result
< 0) ? strerror(errno
) : "");
220 int audit_chmod(struct connection_struct
*conn
, char *path
, mode_t mode
)
222 int result
= default_vfs_ops
.chmod(conn
, path
, mode
);
224 syslog(SYSLOG_PRIORITY
, "chmod %s mode 0x%x %s%s\n",
226 (result
< 0) ? "failed: " : "",
227 (result
< 0) ? strerror(errno
) : "");