2 * Auditing VFS module for samba. Log selected file operations to syslog
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 static int vfs_extd_audit_debug_level
= DBGC_VFS
;
30 #define DBGC_CLASS vfs_extd_audit_debug_level
32 /* Function prototypes */
34 static int audit_connect(vfs_handle_struct
*handle
, const char *svc
, const char *user
);
35 static void audit_disconnect(vfs_handle_struct
*handle
);
36 static SMB_STRUCT_DIR
*audit_opendir(vfs_handle_struct
*handle
, const char *fname
, const char *mask
, uint32 attr
);
37 static int audit_mkdir(vfs_handle_struct
*handle
, const char *path
, mode_t mode
);
38 static int audit_rmdir(vfs_handle_struct
*handle
, const char *path
);
39 static int audit_open(vfs_handle_struct
*handle
, struct smb_filename
*smb_fname
, files_struct
*fsp
, int flags
, mode_t mode
);
40 static int audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
);
41 static int audit_rename(vfs_handle_struct
*handle
,
42 const struct smb_filename
*smb_fname_src
,
43 const struct smb_filename
*smb_fname_dst
);
44 static int audit_unlink(vfs_handle_struct
*handle
, const char *path
);
45 static int audit_chmod(vfs_handle_struct
*handle
, const char *path
, mode_t mode
);
46 static int audit_chmod_acl(vfs_handle_struct
*handle
, const char *name
, mode_t mode
);
47 static int audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
);
48 static int audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
);
52 static vfs_op_tuple audit_op_tuples
[] = {
56 {SMB_VFS_OP(audit_connect
), SMB_VFS_OP_CONNECT
, SMB_VFS_LAYER_LOGGER
},
57 {SMB_VFS_OP(audit_disconnect
), SMB_VFS_OP_DISCONNECT
, SMB_VFS_LAYER_LOGGER
},
59 /* Directory operations */
61 {SMB_VFS_OP(audit_opendir
), SMB_VFS_OP_OPENDIR
, SMB_VFS_LAYER_LOGGER
},
62 {SMB_VFS_OP(audit_mkdir
), SMB_VFS_OP_MKDIR
, SMB_VFS_LAYER_LOGGER
},
63 {SMB_VFS_OP(audit_rmdir
), SMB_VFS_OP_RMDIR
, SMB_VFS_LAYER_LOGGER
},
67 {SMB_VFS_OP(audit_open
), SMB_VFS_OP_OPEN
, SMB_VFS_LAYER_LOGGER
},
68 {SMB_VFS_OP(audit_close
), SMB_VFS_OP_CLOSE
, SMB_VFS_LAYER_LOGGER
},
69 {SMB_VFS_OP(audit_rename
), SMB_VFS_OP_RENAME
, SMB_VFS_LAYER_LOGGER
},
70 {SMB_VFS_OP(audit_unlink
), SMB_VFS_OP_UNLINK
, SMB_VFS_LAYER_LOGGER
},
71 {SMB_VFS_OP(audit_chmod
), SMB_VFS_OP_CHMOD
, SMB_VFS_LAYER_LOGGER
},
72 {SMB_VFS_OP(audit_fchmod
), SMB_VFS_OP_FCHMOD
, SMB_VFS_LAYER_LOGGER
},
73 {SMB_VFS_OP(audit_chmod_acl
), SMB_VFS_OP_CHMOD_ACL
, SMB_VFS_LAYER_LOGGER
},
74 {SMB_VFS_OP(audit_fchmod_acl
), SMB_VFS_OP_FCHMOD_ACL
, SMB_VFS_LAYER_LOGGER
},
76 /* Finish VFS operations definition */
78 {SMB_VFS_OP(NULL
), SMB_VFS_OP_NOOP
, SMB_VFS_LAYER_NOOP
}
82 static int audit_syslog_facility(vfs_handle_struct
*handle
)
84 static const struct enum_list enum_log_facilities
[] = {
86 { LOG_LOCAL0
, "LOCAL0" },
87 { LOG_LOCAL1
, "LOCAL1" },
88 { LOG_LOCAL2
, "LOCAL2" },
89 { LOG_LOCAL3
, "LOCAL3" },
90 { LOG_LOCAL4
, "LOCAL4" },
91 { LOG_LOCAL5
, "LOCAL5" },
92 { LOG_LOCAL6
, "LOCAL6" },
93 { LOG_LOCAL7
, "LOCAL7" }
98 facility
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "facility", enum_log_facilities
, LOG_USER
);
104 static int audit_syslog_priority(vfs_handle_struct
*handle
)
106 static const struct enum_list enum_log_priorities
[] = {
107 { LOG_EMERG
, "EMERG" },
108 { LOG_ALERT
, "ALERT" },
109 { LOG_CRIT
, "CRIT" },
111 { LOG_WARNING
, "WARNING" },
112 { LOG_NOTICE
, "NOTICE" },
113 { LOG_INFO
, "INFO" },
114 { LOG_DEBUG
, "DEBUG" }
119 priority
= lp_parm_enum(SNUM(handle
->conn
), "extd_audit", "priority",
120 enum_log_priorities
, LOG_NOTICE
);
121 if (priority
== -1) {
122 priority
= LOG_WARNING
;
128 /* Implementation of vfs_ops. Pass everything on to the default
129 operation but log event first. */
131 static int audit_connect(vfs_handle_struct
*handle
, const char *svc
, const char *user
)
135 openlog("smbd_audit", LOG_PID
, audit_syslog_facility(handle
));
137 if (lp_syslog() > 0) {
138 syslog(audit_syslog_priority(handle
),
139 "connect to service %s by user %s\n",
142 DEBUG(10, ("Connected to service %s as user %s\n",
145 result
= SMB_VFS_NEXT_CONNECT(handle
, svc
, user
);
150 static void audit_disconnect(vfs_handle_struct
*handle
)
152 if (lp_syslog() > 0) {
153 syslog(audit_syslog_priority(handle
), "disconnected\n");
155 DEBUG(10, ("Disconnected from VFS module extd_audit\n"));
156 SMB_VFS_NEXT_DISCONNECT(handle
);
161 static SMB_STRUCT_DIR
*audit_opendir(vfs_handle_struct
*handle
, const char *fname
, const char *mask
, uint32 attr
)
163 SMB_STRUCT_DIR
*result
;
165 result
= SMB_VFS_NEXT_OPENDIR(handle
, fname
, mask
, attr
);
167 if (lp_syslog() > 0) {
168 syslog(audit_syslog_priority(handle
), "opendir %s %s%s\n",
170 (result
== NULL
) ? "failed: " : "",
171 (result
== NULL
) ? strerror(errno
) : "");
173 DEBUG(1, ("vfs_extd_audit: opendir %s %s %s\n",
175 (result
== NULL
) ? "failed: " : "",
176 (result
== NULL
) ? strerror(errno
) : ""));
181 static int audit_mkdir(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
185 result
= SMB_VFS_NEXT_MKDIR(handle
, path
, mode
);
187 if (lp_syslog() > 0) {
188 syslog(audit_syslog_priority(handle
), "mkdir %s %s%s\n",
190 (result
< 0) ? "failed: " : "",
191 (result
< 0) ? strerror(errno
) : "");
193 DEBUG(0, ("vfs_extd_audit: mkdir %s %s %s\n",
195 (result
< 0) ? "failed: " : "",
196 (result
< 0) ? strerror(errno
) : ""));
201 static int audit_rmdir(vfs_handle_struct
*handle
, const char *path
)
205 result
= SMB_VFS_NEXT_RMDIR(handle
, path
);
207 if (lp_syslog() > 0) {
208 syslog(audit_syslog_priority(handle
), "rmdir %s %s%s\n",
210 (result
< 0) ? "failed: " : "",
211 (result
< 0) ? strerror(errno
) : "");
213 DEBUG(0, ("vfs_extd_audit: rmdir %s %s %s\n",
215 (result
< 0) ? "failed: " : "",
216 (result
< 0) ? strerror(errno
) : ""));
221 static int audit_open(vfs_handle_struct
*handle
,
222 struct smb_filename
*smb_fname
, files_struct
*fsp
,
223 int flags
, mode_t mode
)
227 result
= SMB_VFS_NEXT_OPEN(handle
, smb_fname
, fsp
, flags
, mode
);
229 if (lp_syslog() > 0) {
230 syslog(audit_syslog_priority(handle
), "open %s (fd %d) %s%s%s\n",
231 smb_fname_str_dbg(smb_fname
), result
,
232 ((flags
& O_WRONLY
) || (flags
& O_RDWR
)) ? "for writing " : "",
233 (result
< 0) ? "failed: " : "",
234 (result
< 0) ? strerror(errno
) : "");
236 DEBUG(2, ("vfs_extd_audit: open %s %s %s\n",
237 smb_fname_str_dbg(smb_fname
),
238 (result
< 0) ? "failed: " : "",
239 (result
< 0) ? strerror(errno
) : ""));
244 static int audit_close(vfs_handle_struct
*handle
, files_struct
*fsp
)
248 result
= SMB_VFS_NEXT_CLOSE(handle
, fsp
);
250 if (lp_syslog() > 0) {
251 syslog(audit_syslog_priority(handle
), "close fd %d %s%s\n",
253 (result
< 0) ? "failed: " : "",
254 (result
< 0) ? strerror(errno
) : "");
256 DEBUG(2, ("vfs_extd_audit: close fd %d %s %s\n",
258 (result
< 0) ? "failed: " : "",
259 (result
< 0) ? strerror(errno
) : ""));
264 static int audit_rename(vfs_handle_struct
*handle
,
265 const struct smb_filename
*smb_fname_src
,
266 const struct smb_filename
*smb_fname_dst
)
270 result
= SMB_VFS_NEXT_RENAME(handle
, smb_fname_src
, smb_fname_dst
);
272 if (lp_syslog() > 0) {
273 syslog(audit_syslog_priority(handle
), "rename %s -> %s %s%s\n",
274 smb_fname_str_dbg(smb_fname_src
),
275 smb_fname_str_dbg(smb_fname_dst
),
276 (result
< 0) ? "failed: " : "",
277 (result
< 0) ? strerror(errno
) : "");
279 DEBUG(1, ("vfs_extd_audit: rename old: %s newname: %s %s %s\n",
280 smb_fname_str_dbg(smb_fname_src
),
281 smb_fname_str_dbg(smb_fname_dst
),
282 (result
< 0) ? "failed: " : "",
283 (result
< 0) ? strerror(errno
) : ""));
288 static int audit_unlink(vfs_handle_struct
*handle
, const char *path
)
292 result
= SMB_VFS_NEXT_UNLINK(handle
, path
);
294 if (lp_syslog() > 0) {
295 syslog(audit_syslog_priority(handle
), "unlink %s %s%s\n",
297 (result
< 0) ? "failed: " : "",
298 (result
< 0) ? strerror(errno
) : "");
300 DEBUG(0, ("vfs_extd_audit: unlink %s %s %s\n",
302 (result
< 0) ? "failed: " : "",
303 (result
< 0) ? strerror(errno
) : ""));
308 static int audit_chmod(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
312 result
= SMB_VFS_NEXT_CHMOD(handle
, path
, mode
);
314 if (lp_syslog() > 0) {
315 syslog(audit_syslog_priority(handle
), "chmod %s mode 0x%x %s%s\n",
317 (result
< 0) ? "failed: " : "",
318 (result
< 0) ? strerror(errno
) : "");
320 DEBUG(1, ("vfs_extd_audit: chmod %s mode 0x%x %s %s\n",
321 path
, (unsigned int)mode
,
322 (result
< 0) ? "failed: " : "",
323 (result
< 0) ? strerror(errno
) : ""));
328 static int audit_chmod_acl(vfs_handle_struct
*handle
, const char *path
, mode_t mode
)
332 result
= SMB_VFS_NEXT_CHMOD_ACL(handle
, path
, mode
);
334 if (lp_syslog() > 0) {
335 syslog(audit_syslog_priority(handle
), "chmod_acl %s mode 0x%x %s%s\n",
337 (result
< 0) ? "failed: " : "",
338 (result
< 0) ? strerror(errno
) : "");
340 DEBUG(1, ("vfs_extd_audit: chmod_acl %s mode 0x%x %s %s\n",
341 path
, (unsigned int)mode
,
342 (result
< 0) ? "failed: " : "",
343 (result
< 0) ? strerror(errno
) : ""));
348 static int audit_fchmod(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
352 result
= SMB_VFS_NEXT_FCHMOD(handle
, fsp
, mode
);
354 if (lp_syslog() > 0) {
355 syslog(audit_syslog_priority(handle
), "fchmod %s mode 0x%x %s%s\n",
357 (result
< 0) ? "failed: " : "",
358 (result
< 0) ? strerror(errno
) : "");
360 DEBUG(1, ("vfs_extd_audit: fchmod %s mode 0x%x %s %s",
361 fsp
->fsp_name
, (unsigned int)mode
,
362 (result
< 0) ? "failed: " : "",
363 (result
< 0) ? strerror(errno
) : ""));
368 static int audit_fchmod_acl(vfs_handle_struct
*handle
, files_struct
*fsp
, mode_t mode
)
372 result
= SMB_VFS_NEXT_FCHMOD_ACL(handle
, fsp
, mode
);
374 if (lp_syslog() > 0) {
375 syslog(audit_syslog_priority(handle
), "fchmod_acl %s mode 0x%x %s%s\n",
377 (result
< 0) ? "failed: " : "",
378 (result
< 0) ? strerror(errno
) : "");
380 DEBUG(1, ("vfs_extd_audit: fchmod_acl %s mode 0x%x %s %s",
381 fsp
->fsp_name
, (unsigned int)mode
,
382 (result
< 0) ? "failed: " : "",
383 (result
< 0) ? strerror(errno
) : ""));
388 NTSTATUS
vfs_extd_audit_init(void);
389 NTSTATUS
vfs_extd_audit_init(void)
391 NTSTATUS ret
= smb_register_vfs(SMB_VFS_INTERFACE_VERSION
, "extd_audit", audit_op_tuples
);
393 if (!NT_STATUS_IS_OK(ret
))
396 vfs_extd_audit_debug_level
= debug_add_class("extd_audit");
397 if (vfs_extd_audit_debug_level
== -1) {
398 vfs_extd_audit_debug_level
= DBGC_VFS
;
399 DEBUG(0, ("vfs_extd_audit: Couldn't register custom debugging class!\n"));
401 DEBUG(10, ("vfs_extd_audit: Debug class number of 'extd_audit': %d\n", vfs_extd_audit_debug_level
));