source4/modules/vfs_audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log selected file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2000
   6  * Copyright (C) Alexander Bokovoy, 2002
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23 #include "config.h"
  24 #include <stdio.h>
  25 #include <sys/stat.h>
  26 #ifdef HAVE_UTIME_H
  27 #include <utime.h>
  28 #endif
  29 #ifdef HAVE_DIRENT_H
  30 #include <dirent.h>
  31 #endif
  32 #include <syslog.h>
  33 #ifdef HAVE_FCNTL_H
  34 #include <fcntl.h>
  35 #endif
  36 #include <errno.h>
  37 #include <string.h>
  38 #include <includes.h>
  39 #include <vfs.h>
  40
  41 #ifndef SYSLOG_FACILITY
  42 #define SYSLOG_FACILITY   LOG_USER
  43 #endif
  44
  45 #ifndef SYSLOG_PRIORITY
  46 #define SYSLOG_PRIORITY   LOG_NOTICE
  47 #endif
  48
  49 /* Function prototypes */
  50
  51 static int audit_connect(struct tcon_context *conn, const char *svc, const char *user);
  52 static void audit_disconnect(struct tcon_context *conn);
  53 static DIR *audit_opendir(struct tcon_context *conn, const char *fname);
  54 static int audit_mkdir(struct tcon_context *conn, const char *path, mode_t mode);
  55 static int audit_rmdir(struct tcon_context *conn, const char *path);
  56 static int audit_open(struct tcon_context *conn, const char *fname, int flags, mode_t mode);
  57 static int audit_close(struct files_struct *fsp, int fd);
  58 static int audit_rename(struct tcon_context *conn, const char *old, const char *new);
  59 static int audit_unlink(struct tcon_context *conn, const char *path);
  60 static int audit_chmod(struct tcon_context *conn, const char *path, mode_t mode);
  61 static int audit_chmod_acl(struct tcon_context *conn, const char *name, mode_t mode);
  62 static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode);
  63 static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode);
  64
  65 /* VFS operations */
  66
  67 static struct vfs_ops default_vfs_ops;   /* For passthrough operation */
  68 static struct smb_vfs_handle_struct *audit_handle;
  69
  70 static vfs_op_tuple audit_ops[] = {
  71
  72         /* Disk operations */
  73
  74         {audit_connect,         SMB_VFS_OP_CONNECT,     SMB_VFS_LAYER_LOGGER},
  75         {audit_disconnect,      SMB_VFS_OP_DISCONNECT,  SMB_VFS_LAYER_LOGGER},
  76
  77         /* Directory operations */
  78
  79         {audit_opendir,         SMB_VFS_OP_OPENDIR,     SMB_VFS_LAYER_LOGGER},
  80         {audit_mkdir,           SMB_VFS_OP_MKDIR,       SMB_VFS_LAYER_LOGGER},
  81         {audit_rmdir,           SMB_VFS_OP_RMDIR,       SMB_VFS_LAYER_LOGGER},
  82
  83         /* File operations */
  84
  85         {audit_open,            SMB_VFS_OP_OPEN,        SMB_VFS_LAYER_LOGGER},
  86         {audit_close,           SMB_VFS_OP_CLOSE,       SMB_VFS_LAYER_LOGGER},
  87         {audit_rename,          SMB_VFS_OP_RENAME,      SMB_VFS_LAYER_LOGGER},
  88         {audit_unlink,          SMB_VFS_OP_UNLINK,      SMB_VFS_LAYER_LOGGER},
  89         {audit_chmod,           SMB_VFS_OP_CHMOD,       SMB_VFS_LAYER_LOGGER},
  90         {audit_fchmod,          SMB_VFS_OP_FCHMOD,      SMB_VFS_LAYER_LOGGER},
  91         {audit_chmod_acl,       SMB_VFS_OP_CHMOD_ACL,   SMB_VFS_LAYER_LOGGER},
  92         {audit_fchmod_acl,      SMB_VFS_OP_FCHMOD_ACL,  SMB_VFS_LAYER_LOGGER},
  93
  94         /* Finish VFS operations definition */
  95
  96         {NULL,                  SMB_VFS_OP_NOOP,        SMB_VFS_LAYER_NOOP}
  97 };
  98
  99 /* VFS initialisation function.  Return vfs_op_tuple array back to SAMBA. */
 100
 101 vfs_op_tuple *vfs_init(int *vfs_version, struct vfs_ops *def_vfs_ops,
 102                         struct smb_vfs_handle_struct *vfs_handle)
 103 {
 104         *vfs_version = SMB_VFS_INTERFACE_VERSION;
 105         memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops));
 106
 107         audit_handle = vfs_handle;
 108
 109         openlog("smbd_audit", LOG_PID, SYSLOG_FACILITY);
 110         syslog(SYSLOG_PRIORITY, "VFS_INIT: vfs_ops loaded\n");
 111         return audit_ops;
 112 }
 113
 114 /* VFS finalization function. */
 115 void vfs_done(struct tcon_context *conn)
 116 {
 117         syslog(SYSLOG_PRIORITY, "VFS_DONE: vfs module unloaded\n");
 118 }
 119
 120 /* Implementation of vfs_ops.  Pass everything on to the default
 121    operation but log event first. */
 122
 123 static int audit_connect(struct tcon_context *conn, const char *svc, const char *user)
 124 {
 125         syslog(SYSLOG_PRIORITY, "connect to service %s by user %s\n",
 126                svc, user);
 127
 128         return default_vfs_ops.connect(conn, svc, user);
 129 }
 130
 131 static void audit_disconnect(struct tcon_context *conn)
 132 {
 133         syslog(SYSLOG_PRIORITY, "disconnected\n");
 134         default_vfs_ops.disconnect(conn);
 135 }
 136
 137 static DIR *audit_opendir(struct tcon_context *conn, const char *fname)
 138 {
 139         DIR *result = default_vfs_ops.opendir(conn, fname);
 140
 141         syslog(SYSLOG_PRIORITY, "opendir %s %s%s\n",
 142                fname,
 143                (result == NULL) ? "failed: " : "",
 144                (result == NULL) ? strerror(errno) : "");
 145
 146         return result;
 147 }
 148
 149 static int audit_mkdir(struct tcon_context *conn, const char *path, mode_t mode)
 150 {
 151         int result = default_vfs_ops.mkdir(conn, path, mode);
 152
 153         syslog(SYSLOG_PRIORITY, "mkdir %s %s%s\n",
 154                path,
 155                (result < 0) ? "failed: " : "",
 156                (result < 0) ? strerror(errno) : "");
 157
 158         return result;
 159 }
 160
 161 static int audit_rmdir(struct tcon_context *conn, const char *path)
 162 {
 163         int result = default_vfs_ops.rmdir(conn, path);
 164
 165         syslog(SYSLOG_PRIORITY, "rmdir %s %s%s\n",
 166                path,
 167                (result < 0) ? "failed: " : "",
 168                (result < 0) ? strerror(errno) : "");
 169
 170         return result;
 171 }
 172
 173 static int audit_open(struct tcon_context *conn, const char *fname, int flags, mode_t mode)
 174 {
 175         int result = default_vfs_ops.open(conn, fname, flags, mode);
 176
 177         syslog(SYSLOG_PRIORITY, "open %s (fd %d) %s%s%s\n",
 178                fname, result,
 179                ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "",
 180                (result < 0) ? "failed: " : "",
 181                (result < 0) ? strerror(errno) : "");
 182
 183         return result;
 184 }
 185
 186 static int audit_close(struct files_struct *fsp, int fd)
 187 {
 188         int result = default_vfs_ops.close(fsp, fd);
 189
 190         syslog(SYSLOG_PRIORITY, "close fd %d %s%s\n",
 191                fd,
 192                (result < 0) ? "failed: " : "",
 193                (result < 0) ? strerror(errno) : "");
 194
 195         return result;
 196 }
 197
 198 static int audit_rename(struct tcon_context *conn, const char *old, const char *new)
 199 {
 200         int result = default_vfs_ops.rename(conn, old, new);
 201
 202         syslog(SYSLOG_PRIORITY, "rename %s -> %s %s%s\n",
 203                old, new,
 204                (result < 0) ? "failed: " : "",
 205                (result < 0) ? strerror(errno) : "");
 206
 207         return result;
 208 }
 209
 210 static int audit_unlink(struct tcon_context *conn, const char *path)
 211 {
 212         int result = default_vfs_ops.unlink(conn, path);
 213
 214         syslog(SYSLOG_PRIORITY, "unlink %s %s%s\n",
 215                path,
 216                (result < 0) ? "failed: " : "",
 217                (result < 0) ? strerror(errno) : "");
 218
 219         return result;
 220 }
 221
 222 static int audit_chmod(struct tcon_context *conn, const char *path, mode_t mode)
 223 {
 224         int result = default_vfs_ops.chmod(conn, path, mode);
 225
 226         syslog(SYSLOG_PRIORITY, "chmod %s mode 0x%x %s%s\n",
 227                path, mode,
 228                (result < 0) ? "failed: " : "",
 229                (result < 0) ? strerror(errno) : "");
 230
 231         return result;
 232 }
 233
 234 static int audit_chmod_acl(struct tcon_context *conn, const char *path, mode_t mode)
 235 {
 236         int result;
 237
 238         if ( !default_vfs_ops.chmod_acl )
 239                 return 0;
 240
 241         result = default_vfs_ops.chmod_acl(conn, path, mode);
 242
 243         syslog(SYSLOG_PRIORITY, "chmod_acl %s mode 0x%x %s%s\n",
 244                path, mode,
 245                (result < 0) ? "failed: " : "",
 246                (result < 0) ? strerror(errno) : "");
 247
 248         return result;
 249 }
 250
 251 static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode)
 252 {
 253         int result = default_vfs_ops.fchmod(fsp, fd, mode);
 254
 255         syslog(SYSLOG_PRIORITY, "fchmod %s mode 0x%x %s%s\n",
 256                fsp->fsp_name, mode,
 257                (result < 0) ? "failed: " : "",
 258                (result < 0) ? strerror(errno) : "");
 259
 260         return result;
 261 }
 262
 263 static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode)
 264 {
 265         int result;
 266
 267         if ( !default_vfs_ops.fchmod_acl )
 268                 return 0;
 269
 270         result = default_vfs_ops.fchmod_acl(fsp, fd, mode);
 271
 272         syslog(SYSLOG_PRIORITY, "fchmod_acl %s mode 0x%x %s%s\n",
 273                fsp->fsp_name, mode,
 274                (result < 0) ? "failed: " : "",
 275                (result < 0) ? strerror(errno) : "");
 276
 277         return result;
 278 }