?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix a typo
[Samba/gebeck_regimport.git] / source3 / modules / vfs_full_audit.c
blob48198e7fa5b3627af3316123d6cf1c125b596723
1 /*
2 * Auditing VFS module for samba. Log selected file operations to syslog
3 * facility.
4 *
5 * Copyright (C) Tim Potter, 1999-2000
6 * Copyright (C) Alexander Bokovoy, 2002
7 * Copyright (C) John H Terpstra, 2003
8 * Copyright (C) Stefan (metze) Metzmacher, 2003
9 * Copyright (C) Volker Lendecke, 2004
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /*
26 * This module implements parseable logging for all Samba VFS operations.
27 *
28 * You use it as follows:
29 *
30 * [tmp]
31 * path = /tmp
32 * vfs objects = full_audit
33 * full_audit:prefix = %u|%I
34 * full_audit:success = open opendir
35 * full_audit:failure = all
36 *
37 * vfs op can be "all" which means log all operations.
38 * vfs op can be "none" which means no logging.
39 *
40 * This leads to syslog entries of the form:
41 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43 *
44 * where "nobody" is the connected username and "192.168.234.1" is the
45 * client's IP address.
46 *
47 * Options:
48 *
49 * prefix: A macro expansion template prepended to the syslog entry.
50 *
51 * success: A list of VFS operations for which a successful completion should
52 * be logged. Defaults to no logging at all. The special operation "all" logs
53 * - you guessed it - everything.
54 *
55 * failure: A list of VFS operations for which failure to complete should be
56 * logged. Defaults to logging everything.
57 */
58
59
60 #include "includes.h"
61 #include "system/filesys.h"
62 #include "system/syslog.h"
63 #include "smbd/smbd.h"
64 #include "../librpc/gen_ndr/ndr_netlogon.h"
65 #include "auth.h"
66 #include "ntioctl.h"
67 #include "lib/param/loadparm.h"
68 #include "lib/util/bitmap.h"
69 #include "lib/util/tevent_unix.h"
70
71 static int vfs_full_audit_debug_level = DBGC_VFS;
72
73 struct vfs_full_audit_private_data {
74 struct bitmap *success_ops;
75 struct bitmap *failure_ops;
76 };
77
78 #undef DBGC_CLASS
79 #define DBGC_CLASS vfs_full_audit_debug_level
80
81 typedef enum _vfs_op_type {
82 SMB_VFS_OP_NOOP = -1,
83
84 /* Disk operations */
85
86 SMB_VFS_OP_CONNECT = 0,
87 SMB_VFS_OP_DISCONNECT,
88 SMB_VFS_OP_DISK_FREE,
89 SMB_VFS_OP_GET_QUOTA,
90 SMB_VFS_OP_SET_QUOTA,
91 SMB_VFS_OP_GET_SHADOW_COPY_DATA,
92 SMB_VFS_OP_STATVFS,
93 SMB_VFS_OP_FS_CAPABILITIES,
94
95 /* Directory operations */
96
97 SMB_VFS_OP_OPENDIR,
98 SMB_VFS_OP_FDOPENDIR,
99 SMB_VFS_OP_READDIR,
100 SMB_VFS_OP_SEEKDIR,
101 SMB_VFS_OP_TELLDIR,
102 SMB_VFS_OP_REWINDDIR,
103 SMB_VFS_OP_MKDIR,
104 SMB_VFS_OP_RMDIR,
105 SMB_VFS_OP_CLOSEDIR,
106 SMB_VFS_OP_INIT_SEARCH_OP,
107
108 /* File operations */
109
110 SMB_VFS_OP_OPEN,
111 SMB_VFS_OP_CREATE_FILE,
112 SMB_VFS_OP_CLOSE,
113 SMB_VFS_OP_READ,
114 SMB_VFS_OP_PREAD,
115 SMB_VFS_OP_PREAD_SEND,
116 SMB_VFS_OP_PREAD_RECV,
117 SMB_VFS_OP_WRITE,
118 SMB_VFS_OP_PWRITE,
119 SMB_VFS_OP_PWRITE_SEND,
120 SMB_VFS_OP_PWRITE_RECV,
121 SMB_VFS_OP_LSEEK,
122 SMB_VFS_OP_SENDFILE,
123 SMB_VFS_OP_RECVFILE,
124 SMB_VFS_OP_RENAME,
125 SMB_VFS_OP_FSYNC,
126 SMB_VFS_OP_FSYNC_SEND,
127 SMB_VFS_OP_FSYNC_RECV,
128 SMB_VFS_OP_STAT,
129 SMB_VFS_OP_FSTAT,
130 SMB_VFS_OP_LSTAT,
131 SMB_VFS_OP_GET_ALLOC_SIZE,
132 SMB_VFS_OP_UNLINK,
133 SMB_VFS_OP_CHMOD,
134 SMB_VFS_OP_FCHMOD,
135 SMB_VFS_OP_CHOWN,
136 SMB_VFS_OP_FCHOWN,
137 SMB_VFS_OP_LCHOWN,
138 SMB_VFS_OP_CHDIR,
139 SMB_VFS_OP_GETWD,
140 SMB_VFS_OP_NTIMES,
141 SMB_VFS_OP_FTRUNCATE,
142 SMB_VFS_OP_FALLOCATE,
143 SMB_VFS_OP_LOCK,
144 SMB_VFS_OP_KERNEL_FLOCK,
145 SMB_VFS_OP_LINUX_SETLEASE,
146 SMB_VFS_OP_GETLOCK,
147 SMB_VFS_OP_SYMLINK,
148 SMB_VFS_OP_READLINK,
149 SMB_VFS_OP_LINK,
150 SMB_VFS_OP_MKNOD,
151 SMB_VFS_OP_REALPATH,
152 SMB_VFS_OP_NOTIFY_WATCH,
153 SMB_VFS_OP_CHFLAGS,
154 SMB_VFS_OP_FILE_ID_CREATE,
155 SMB_VFS_OP_STREAMINFO,
156 SMB_VFS_OP_GET_REAL_FILENAME,
157 SMB_VFS_OP_CONNECTPATH,
158 SMB_VFS_OP_BRL_LOCK_WINDOWS,
159 SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
160 SMB_VFS_OP_BRL_CANCEL_WINDOWS,
161 SMB_VFS_OP_STRICT_LOCK,
162 SMB_VFS_OP_STRICT_UNLOCK,
163 SMB_VFS_OP_TRANSLATE_NAME,
164
165 /* NT ACL operations. */
166
167 SMB_VFS_OP_FGET_NT_ACL,
168 SMB_VFS_OP_GET_NT_ACL,
169 SMB_VFS_OP_FSET_NT_ACL,
170
171 /* POSIX ACL operations. */
172
173 SMB_VFS_OP_CHMOD_ACL,
174 SMB_VFS_OP_FCHMOD_ACL,
175
176 SMB_VFS_OP_SYS_ACL_GET_FILE,
177 SMB_VFS_OP_SYS_ACL_GET_FD,
178 SMB_VFS_OP_SYS_ACL_SET_FILE,
179 SMB_VFS_OP_SYS_ACL_SET_FD,
180 SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
181
182 /* EA operations. */
183 SMB_VFS_OP_GETXATTR,
184 SMB_VFS_OP_FGETXATTR,
185 SMB_VFS_OP_LISTXATTR,
186 SMB_VFS_OP_FLISTXATTR,
187 SMB_VFS_OP_REMOVEXATTR,
188 SMB_VFS_OP_FREMOVEXATTR,
189 SMB_VFS_OP_SETXATTR,
190 SMB_VFS_OP_FSETXATTR,
191
192 /* aio operations */
193 SMB_VFS_OP_AIO_FORCE,
194
195 /* offline operations */
196 SMB_VFS_OP_IS_OFFLINE,
197 SMB_VFS_OP_SET_OFFLINE,
198
199 /* This should always be last enum value */
200
201 SMB_VFS_OP_LAST
202 } vfs_op_type;
203
204 /* The following array *must* be in the same order as defined in vfs.h */
205
206 static struct {
207 vfs_op_type type;
208 const char *name;
209 } vfs_op_names[] = {
210 { SMB_VFS_OP_CONNECT, "connect" },
211 { SMB_VFS_OP_DISCONNECT, "disconnect" },
212 { SMB_VFS_OP_DISK_FREE, "disk_free" },
213 { SMB_VFS_OP_GET_QUOTA, "get_quota" },
214 { SMB_VFS_OP_SET_QUOTA, "set_quota" },
215 { SMB_VFS_OP_GET_SHADOW_COPY_DATA, "get_shadow_copy_data" },
216 { SMB_VFS_OP_STATVFS, "statvfs" },
217 { SMB_VFS_OP_FS_CAPABILITIES, "fs_capabilities" },
218 { SMB_VFS_OP_OPENDIR, "opendir" },
219 { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
220 { SMB_VFS_OP_READDIR, "readdir" },
221 { SMB_VFS_OP_SEEKDIR, "seekdir" },
222 { SMB_VFS_OP_TELLDIR, "telldir" },
223 { SMB_VFS_OP_REWINDDIR, "rewinddir" },
224 { SMB_VFS_OP_MKDIR, "mkdir" },
225 { SMB_VFS_OP_RMDIR, "rmdir" },
226 { SMB_VFS_OP_CLOSEDIR, "closedir" },
227 { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
228 { SMB_VFS_OP_OPEN, "open" },
229 { SMB_VFS_OP_CREATE_FILE, "create_file" },
230 { SMB_VFS_OP_CLOSE, "close" },
231 { SMB_VFS_OP_READ, "read" },
232 { SMB_VFS_OP_PREAD, "pread" },
233 { SMB_VFS_OP_PREAD_SEND, "pread_send" },
234 { SMB_VFS_OP_PREAD_RECV, "pread_recv" },
235 { SMB_VFS_OP_WRITE, "write" },
236 { SMB_VFS_OP_PWRITE, "pwrite" },
237 { SMB_VFS_OP_LSEEK, "lseek" },
238 { SMB_VFS_OP_SENDFILE, "sendfile" },
239 { SMB_VFS_OP_RECVFILE, "recvfile" },
240 { SMB_VFS_OP_RENAME, "rename" },
241 { SMB_VFS_OP_FSYNC, "fsync" },
242 { SMB_VFS_OP_FSYNC_SEND, "fsync_send" },
243 { SMB_VFS_OP_FSYNC_RECV, "fsync_recv" },
244 { SMB_VFS_OP_STAT, "stat" },
245 { SMB_VFS_OP_FSTAT, "fstat" },
246 { SMB_VFS_OP_LSTAT, "lstat" },
247 { SMB_VFS_OP_GET_ALLOC_SIZE, "get_alloc_size" },
248 { SMB_VFS_OP_UNLINK, "unlink" },
249 { SMB_VFS_OP_CHMOD, "chmod" },
250 { SMB_VFS_OP_FCHMOD, "fchmod" },
251 { SMB_VFS_OP_CHOWN, "chown" },
252 { SMB_VFS_OP_FCHOWN, "fchown" },
253 { SMB_VFS_OP_LCHOWN, "lchown" },
254 { SMB_VFS_OP_CHDIR, "chdir" },
255 { SMB_VFS_OP_GETWD, "getwd" },
256 { SMB_VFS_OP_NTIMES, "ntimes" },
257 { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
258 { SMB_VFS_OP_FALLOCATE,"fallocate" },
259 { SMB_VFS_OP_LOCK, "lock" },
260 { SMB_VFS_OP_KERNEL_FLOCK, "kernel_flock" },
261 { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
262 { SMB_VFS_OP_GETLOCK, "getlock" },
263 { SMB_VFS_OP_SYMLINK, "symlink" },
264 { SMB_VFS_OP_READLINK, "readlink" },
265 { SMB_VFS_OP_LINK, "link" },
266 { SMB_VFS_OP_MKNOD, "mknod" },
267 { SMB_VFS_OP_REALPATH, "realpath" },
268 { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
269 { SMB_VFS_OP_CHFLAGS, "chflags" },
270 { SMB_VFS_OP_FILE_ID_CREATE, "file_id_create" },
271 { SMB_VFS_OP_STREAMINFO, "streaminfo" },
272 { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
273 { SMB_VFS_OP_CONNECTPATH, "connectpath" },
274 { SMB_VFS_OP_BRL_LOCK_WINDOWS, "brl_lock_windows" },
275 { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
276 { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
277 { SMB_VFS_OP_STRICT_LOCK, "strict_lock" },
278 { SMB_VFS_OP_STRICT_UNLOCK, "strict_unlock" },
279 { SMB_VFS_OP_TRANSLATE_NAME, "translate_name" },
280 { SMB_VFS_OP_FGET_NT_ACL, "fget_nt_acl" },
281 { SMB_VFS_OP_GET_NT_ACL, "get_nt_acl" },
282 { SMB_VFS_OP_FSET_NT_ACL, "fset_nt_acl" },
283 { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
284 { SMB_VFS_OP_FCHMOD_ACL, "fchmod_acl" },
285 { SMB_VFS_OP_SYS_ACL_GET_FILE, "sys_acl_get_file" },
286 { SMB_VFS_OP_SYS_ACL_GET_FD, "sys_acl_get_fd" },
287 { SMB_VFS_OP_SYS_ACL_SET_FILE, "sys_acl_set_file" },
288 { SMB_VFS_OP_SYS_ACL_SET_FD, "sys_acl_set_fd" },
289 { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, "sys_acl_delete_def_file" },
290 { SMB_VFS_OP_GETXATTR, "getxattr" },
291 { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
292 { SMB_VFS_OP_LISTXATTR, "listxattr" },
293 { SMB_VFS_OP_FLISTXATTR, "flistxattr" },
294 { SMB_VFS_OP_REMOVEXATTR, "removexattr" },
295 { SMB_VFS_OP_FREMOVEXATTR, "fremovexattr" },
296 { SMB_VFS_OP_SETXATTR, "setxattr" },
297 { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
298 { SMB_VFS_OP_AIO_FORCE, "aio_force" },
299 { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
300 { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
301 { SMB_VFS_OP_LAST, NULL }
302 };
303
304 static int audit_syslog_facility(vfs_handle_struct *handle)
305 {
306 static const struct enum_list enum_log_facilities[] = {
307 { LOG_USER, "USER" },
308 { LOG_LOCAL0, "LOCAL0" },
309 { LOG_LOCAL1, "LOCAL1" },
310 { LOG_LOCAL2, "LOCAL2" },
311 { LOG_LOCAL3, "LOCAL3" },
312 { LOG_LOCAL4, "LOCAL4" },
313 { LOG_LOCAL5, "LOCAL5" },
314 { LOG_LOCAL6, "LOCAL6" },
315 { LOG_LOCAL7, "LOCAL7" },
316 { -1, NULL}
317 };
318
319 int facility;
320
321 facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
322
323 return facility;
324 }
325
326 static int audit_syslog_priority(vfs_handle_struct *handle)
327 {
328 static const struct enum_list enum_log_priorities[] = {
329 { LOG_EMERG, "EMERG" },
330 { LOG_ALERT, "ALERT" },
331 { LOG_CRIT, "CRIT" },
332 { LOG_ERR, "ERR" },
333 { LOG_WARNING, "WARNING" },
334 { LOG_NOTICE, "NOTICE" },
335 { LOG_INFO, "INFO" },
336 { LOG_DEBUG, "DEBUG" },
337 { -1, NULL}
338 };
339
340 int priority;
341
342 priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
343 enum_log_priorities, LOG_NOTICE);
344 if (priority == -1) {
345 priority = LOG_WARNING;
346 }
347
348 return priority;
349 }
350
351 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
352 {
353 char *prefix = NULL;
354 char *result;
355
356 prefix = talloc_strdup(ctx,
357 lp_parm_const_string(SNUM(conn), "full_audit",
358 "prefix", "%u|%I"));
359 if (!prefix) {
360 return NULL;
361 }
362 result = talloc_sub_advanced(ctx,
363 lp_servicename(talloc_tos(), SNUM(conn)),
364 conn->session_info->unix_info->unix_name,
365 conn->connectpath,
366 conn->session_info->unix_token->gid,
367 conn->session_info->unix_info->sanitized_username,
368 conn->session_info->info->domain_name,
369 prefix);
370 TALLOC_FREE(prefix);
371 return result;
372 }
373
374 static bool log_success(vfs_handle_struct *handle, vfs_op_type op)
375 {
376 struct vfs_full_audit_private_data *pd = NULL;
377
378 SMB_VFS_HANDLE_GET_DATA(handle, pd,
379 struct vfs_full_audit_private_data,
380 return True);
381
382 if (pd->success_ops == NULL) {
383 return True;
384 }
385
386 return bitmap_query(pd->success_ops, op);
387 }
388
389 static bool log_failure(vfs_handle_struct *handle, vfs_op_type op)
390 {
391 struct vfs_full_audit_private_data *pd = NULL;
392
393 SMB_VFS_HANDLE_GET_DATA(handle, pd,
394 struct vfs_full_audit_private_data,
395 return True);
396
397 if (pd->failure_ops == NULL)
398 return True;
399
400 return bitmap_query(pd->failure_ops, op);
401 }
402
403 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
404 {
405 struct bitmap *bm;
406
407 if (ops == NULL) {
408 return NULL;
409 }
410
411 bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
412 if (bm == NULL) {
413 DEBUG(0, ("Could not alloc bitmap -- "
414 "defaulting to logging everything\n"));
415 return NULL;
416 }
417
418 for (; *ops != NULL; ops += 1) {
419 int i;
420 bool neg = false;
421 const char *op;
422
423 if (strequal(*ops, "all")) {
424 for (i=0; i<SMB_VFS_OP_LAST; i++) {
425 bitmap_set(bm, i);
426 }
427 continue;
428 }
429
430 if (strequal(*ops, "none")) {
431 break;
432 }
433
434 op = ops[0];
435 if (op[0] == '!') {
436 neg = true;
437 op += 1;
438 }
439
440 for (i=0; i<SMB_VFS_OP_LAST; i++) {
441 if (vfs_op_names[i].name == NULL) {
442 smb_panic("vfs_full_audit.c: name table not "
443 "in sync with vfs.h\n");
444 }
445 if (strequal(op, vfs_op_names[i].name)) {
446 if (neg) {
447 bitmap_clear(bm, i);
448 } else {
449 bitmap_set(bm, i);
450 }
451 break;
452 }
453 }
454 if (i == SMB_VFS_OP_LAST) {
455 DEBUG(0, ("Could not find opname %s, logging all\n",
456 *ops));
457 TALLOC_FREE(bm);
458 return NULL;
459 }
460 }
461 return bm;
462 }
463
464 static const char *audit_opname(vfs_op_type op)
465 {
466 if (op >= SMB_VFS_OP_LAST)
467 return "INVALID VFS OP";
468 return vfs_op_names[op].name;
469 }
470
471 static TALLOC_CTX *tmp_do_log_ctx;
472 /*
473 * Get us a temporary talloc context usable just for DEBUG arguments
474 */
475 static TALLOC_CTX *do_log_ctx(void)
476 {
477 if (tmp_do_log_ctx == NULL) {
478 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
479 }
480 return tmp_do_log_ctx;
481 }
482
483 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
484 const char *format, ...)
485 {
486 fstring err_msg;
487 char *audit_pre = NULL;
488 va_list ap;
489 char *op_msg = NULL;
490 int priority;
491
492 if (success && (!log_success(handle, op)))
493 goto out;
494
495 if (!success && (!log_failure(handle, op)))
496 goto out;
497
498 if (success)
499 fstrcpy(err_msg, "ok");
500 else
501 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
502
503 va_start(ap, format);
504 op_msg = talloc_vasprintf(talloc_tos(), format, ap);
505 va_end(ap);
506
507 if (!op_msg) {
508 goto out;
509 }
510
511 /*
512 * Specify the facility to interoperate with other syslog callers
513 * (smbd for example).
514 */
515 priority = audit_syslog_priority(handle) |
516 audit_syslog_facility(handle);
517
518 audit_pre = audit_prefix(talloc_tos(), handle->conn);
519 syslog(priority, "%s|%s|%s|%s\n",
520 audit_pre ? audit_pre : "",
521 audit_opname(op), err_msg, op_msg);
522
523 out:
524 TALLOC_FREE(audit_pre);
525 TALLOC_FREE(op_msg);
526 TALLOC_FREE(tmp_do_log_ctx);
527 }
528
529 /**
530 * Return a string using the do_log_ctx()
531 */
532 static const char *smb_fname_str_do_log(const struct smb_filename *smb_fname)
533 {
534 char *fname = NULL;
535 NTSTATUS status;
536
537 if (smb_fname == NULL) {
538 return "";
539 }
540 status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
541 if (!NT_STATUS_IS_OK(status)) {
542 return "";
543 }
544 return fname;
545 }
546
547 /**
548 * Return an fsp debug string using the do_log_ctx()
549 */
550 static const char *fsp_str_do_log(const struct files_struct *fsp)
551 {
552 return smb_fname_str_do_log(fsp->fsp_name);
553 }
554
555 /* Implementation of vfs_ops. Pass everything on to the default
556 operation but log event first. */
557
558 static int smb_full_audit_connect(vfs_handle_struct *handle,
559 const char *svc, const char *user)
560 {
561 int result;
562 struct vfs_full_audit_private_data *pd = NULL;
563
564 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
565 if (result < 0) {
566 return result;
567 }
568
569 pd = talloc_zero(handle, struct vfs_full_audit_private_data);
570 if (!pd) {
571 SMB_VFS_NEXT_DISCONNECT(handle);
572 return -1;
573 }
574
575 #ifdef WITH_SYSLOG
576 openlog("smbd_audit", 0, audit_syslog_facility(handle));
577 #endif
578
579 pd->success_ops = init_bitmap(
580 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
581 "success", NULL));
582 pd->failure_ops = init_bitmap(
583 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
584 "failure", NULL));
585
586 /* Store the private data. */
587 SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
588 struct vfs_full_audit_private_data, return -1);
589
590 do_log(SMB_VFS_OP_CONNECT, True, handle,
591 "%s", svc);
592
593 return 0;
594 }
595
596 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
597 {
598 SMB_VFS_NEXT_DISCONNECT(handle);
599
600 do_log(SMB_VFS_OP_DISCONNECT, True, handle,
601 "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
602
603 /* The bitmaps will be disconnected when the private
604 data is deleted. */
605 }
606
607 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
608 const char *path,
609 bool small_query, uint64_t *bsize,
610 uint64_t *dfree, uint64_t *dsize)
611 {
612 uint64_t result;
613
614 result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
615 dfree, dsize);
616
617 /* Don't have a reasonable notion of failure here */
618
619 do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
620
621 return result;
622 }
623
624 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
625 enum SMB_QUOTA_TYPE qtype, unid_t id,
626 SMB_DISK_QUOTA *qt)
627 {
628 int result;
629
630 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
631
632 do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
633
634 return result;
635 }
636
637
638 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
639 enum SMB_QUOTA_TYPE qtype, unid_t id,
640 SMB_DISK_QUOTA *qt)
641 {
642 int result;
643
644 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
645
646 do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
647
648 return result;
649 }
650
651 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
652 struct files_struct *fsp,
653 struct shadow_copy_data *shadow_copy_data,
654 bool labels)
655 {
656 int result;
657
658 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
659
660 do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
661
662 return result;
663 }
664
665 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
666 const char *path,
667 struct vfs_statvfs_struct *statbuf)
668 {
669 int result;
670
671 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
672
673 do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
674
675 return result;
676 }
677
678 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
679 {
680 int result;
681
682 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
683
684 do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
685
686 return result;
687 }
688
689 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
690 const char *fname, const char *mask, uint32 attr)
691 {
692 DIR *result;
693
694 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
695
696 do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
697
698 return result;
699 }
700
701 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
702 files_struct *fsp, const char *mask, uint32 attr)
703 {
704 DIR *result;
705
706 result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
707
708 do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
709 fsp_str_do_log(fsp));
710
711 return result;
712 }
713
714 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
715 DIR *dirp, SMB_STRUCT_STAT *sbuf)
716 {
717 struct dirent *result;
718
719 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
720
721 /* This operation has no reasonable error condition
722 * (End of dir is also failure), so always succeed.
723 */
724 do_log(SMB_VFS_OP_READDIR, True, handle, "");
725
726 return result;
727 }
728
729 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
730 DIR *dirp, long offset)
731 {
732 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
733
734 do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
735 }
736
737 static long smb_full_audit_telldir(vfs_handle_struct *handle,
738 DIR *dirp)
739 {
740 long result;
741
742 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
743
744 do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
745
746 return result;
747 }
748
749 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
750 DIR *dirp)
751 {
752 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
753
754 do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
755 }
756
757 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
758 const char *path, mode_t mode)
759 {
760 int result;
761
762 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
763
764 do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
765
766 return result;
767 }
768
769 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
770 const char *path)
771 {
772 int result;
773
774 result = SMB_VFS_NEXT_RMDIR(handle, path);
775
776 do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
777
778 return result;
779 }
780
781 static int smb_full_audit_closedir(vfs_handle_struct *handle,
782 DIR *dirp)
783 {
784 int result;
785
786 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
787
788 do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
789
790 return result;
791 }
792
793 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
794 DIR *dirp)
795 {
796 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
797
798 do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
799 }
800
801 static int smb_full_audit_open(vfs_handle_struct *handle,
802 struct smb_filename *smb_fname,
803 files_struct *fsp, int flags, mode_t mode)
804 {
805 int result;
806
807 result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
808
809 do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
810 ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
811 smb_fname_str_do_log(smb_fname));
812
813 return result;
814 }
815
816 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
817 struct smb_request *req,
818 uint16_t root_dir_fid,
819 struct smb_filename *smb_fname,
820 uint32_t access_mask,
821 uint32_t share_access,
822 uint32_t create_disposition,
823 uint32_t create_options,
824 uint32_t file_attributes,
825 uint32_t oplock_request,
826 uint64_t allocation_size,
827 uint32_t private_flags,
828 struct security_descriptor *sd,
829 struct ea_list *ea_list,
830 files_struct **result_fsp,
831 int *pinfo)
832 {
833 NTSTATUS result;
834 const char* str_create_disposition;
835
836 switch (create_disposition) {
837 case FILE_SUPERSEDE:
838 str_create_disposition = "supersede";
839 break;
840 case FILE_OVERWRITE_IF:
841 str_create_disposition = "overwrite_if";
842 break;
843 case FILE_OPEN:
844 str_create_disposition = "open";
845 break;
846 case FILE_OVERWRITE:
847 str_create_disposition = "overwrite";
848 break;
849 case FILE_CREATE:
850 str_create_disposition = "create";
851 break;
852 case FILE_OPEN_IF:
853 str_create_disposition = "open_if";
854 break;
855 default:
856 str_create_disposition = "unknown";
857 }
858
859 result = SMB_VFS_NEXT_CREATE_FILE(
860 handle, /* handle */
861 req, /* req */
862 root_dir_fid, /* root_dir_fid */
863 smb_fname, /* fname */
864 access_mask, /* access_mask */
865 share_access, /* share_access */
866 create_disposition, /* create_disposition*/
867 create_options, /* create_options */
868 file_attributes, /* file_attributes */
869 oplock_request, /* oplock_request */
870 allocation_size, /* allocation_size */
871 private_flags,
872 sd, /* sd */
873 ea_list, /* ea_list */
874 result_fsp, /* result */
875 pinfo); /* pinfo */
876
877 do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
878 "0x%x|%s|%s|%s", access_mask,
879 create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
880 str_create_disposition, smb_fname_str_do_log(smb_fname));
881
882 return result;
883 }
884
885 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
886 {
887 int result;
888
889 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
890
891 do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
892 fsp_str_do_log(fsp));
893
894 return result;
895 }
896
897 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
898 void *data, size_t n)
899 {
900 ssize_t result;
901
902 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
903
904 do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s",
905 fsp_str_do_log(fsp));
906
907 return result;
908 }
909
910 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
911 void *data, size_t n, off_t offset)
912 {
913 ssize_t result;
914
915 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
916
917 do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
918 fsp_str_do_log(fsp));
919
920 return result;
921 }
922
923 struct smb_full_audit_pread_state {
924 vfs_handle_struct *handle;
925 files_struct *fsp;
926 ssize_t ret;
927 int err;
928 };
929
930 static void smb_full_audit_pread_done(struct tevent_req *subreq);
931
932 static struct tevent_req *smb_full_audit_pread_send(
933 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
934 struct tevent_context *ev, struct files_struct *fsp,
935 void *data, size_t n, off_t offset)
936 {
937 struct tevent_req *req, *subreq;
938 struct smb_full_audit_pread_state *state;
939
940 req = tevent_req_create(mem_ctx, &state,
941 struct smb_full_audit_pread_state);
942 if (req == NULL) {
943 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
944 fsp_str_do_log(fsp));
945 return NULL;
946 }
947 state->handle = handle;
948 state->fsp = fsp;
949
950 subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
951 n, offset);
952 if (tevent_req_nomem(subreq, req)) {
953 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
954 fsp_str_do_log(fsp));
955 return tevent_req_post(req, ev);
956 }
957 tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
958
959 do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
960 return req;
961 }
962
963 static void smb_full_audit_pread_done(struct tevent_req *subreq)
964 {
965 struct tevent_req *req = tevent_req_callback_data(
966 subreq, struct tevent_req);
967 struct smb_full_audit_pread_state *state = tevent_req_data(
968 req, struct smb_full_audit_pread_state);
969
970 state->ret = SMB_VFS_PREAD_RECV(subreq, &state->err);
971 TALLOC_FREE(subreq);
972 tevent_req_done(req);
973 }
974
975 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req, int *err)
976 {
977 struct smb_full_audit_pread_state *state = tevent_req_data(
978 req, struct smb_full_audit_pread_state);
979
980 if (tevent_req_is_unix_error(req, err)) {
981 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
982 fsp_str_do_log(state->fsp));
983 return -1;
984 }
985
986 do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
987 fsp_str_do_log(state->fsp));
988
989 *err = state->err;
990 return state->ret;
991 }
992
993 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
994 const void *data, size_t n)
995 {
996 ssize_t result;
997
998 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
999
1000 do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s",
1001 fsp_str_do_log(fsp));
1002
1003 return result;
1004 }
1005
1006 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1007 const void *data, size_t n,
1008 off_t offset)
1009 {
1010 ssize_t result;
1011
1012 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1013
1014 do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1015 fsp_str_do_log(fsp));
1016
1017 return result;
1018 }
1019
1020 struct smb_full_audit_pwrite_state {
1021 vfs_handle_struct *handle;
1022 files_struct *fsp;
1023 ssize_t ret;
1024 int err;
1025 };
1026
1027 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1028
1029 static struct tevent_req *smb_full_audit_pwrite_send(
1030 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1031 struct tevent_context *ev, struct files_struct *fsp,
1032 const void *data, size_t n, off_t offset)
1033 {
1034 struct tevent_req *req, *subreq;
1035 struct smb_full_audit_pwrite_state *state;
1036
1037 req = tevent_req_create(mem_ctx, &state,
1038 struct smb_full_audit_pwrite_state);
1039 if (req == NULL) {
1040 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1041 fsp_str_do_log(fsp));
1042 return NULL;
1043 }
1044 state->handle = handle;
1045 state->fsp = fsp;
1046
1047 subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1048 n, offset);
1049 if (tevent_req_nomem(subreq, req)) {
1050 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1051 fsp_str_do_log(fsp));
1052 return tevent_req_post(req, ev);
1053 }
1054 tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1055
1056 do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1057 fsp_str_do_log(fsp));
1058 return req;
1059 }
1060
1061 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1062 {
1063 struct tevent_req *req = tevent_req_callback_data(
1064 subreq, struct tevent_req);
1065 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1066 req, struct smb_full_audit_pwrite_state);
1067
1068 state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->err);
1069 TALLOC_FREE(subreq);
1070 tevent_req_done(req);
1071 }
1072
1073 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req, int *err)
1074 {
1075 struct smb_full_audit_pwrite_state *state = tevent_req_data(
1076 req, struct smb_full_audit_pwrite_state);
1077
1078 if (tevent_req_is_unix_error(req, err)) {
1079 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1080 fsp_str_do_log(state->fsp));
1081 return -1;
1082 }
1083
1084 do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1085 fsp_str_do_log(state->fsp));
1086
1087 *err = state->err;
1088 return state->ret;
1089 }
1090
1091 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1092 off_t offset, int whence)
1093 {
1094 ssize_t result;
1095
1096 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1097
1098 do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1099 "%s", fsp_str_do_log(fsp));
1100
1101 return result;
1102 }
1103
1104 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1105 files_struct *fromfsp,
1106 const DATA_BLOB *hdr, off_t offset,
1107 size_t n)
1108 {
1109 ssize_t result;
1110
1111 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1112
1113 do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1114 "%s", fsp_str_do_log(fromfsp));
1115
1116 return result;
1117 }
1118
1119 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1120 files_struct *tofsp,
1121 off_t offset,
1122 size_t n)
1123 {
1124 ssize_t result;
1125
1126 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1127
1128 do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1129 "%s", fsp_str_do_log(tofsp));
1130
1131 return result;
1132 }
1133
1134 static int smb_full_audit_rename(vfs_handle_struct *handle,
1135 const struct smb_filename *smb_fname_src,
1136 const struct smb_filename *smb_fname_dst)
1137 {
1138 int result;
1139
1140 result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1141
1142 do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1143 smb_fname_str_do_log(smb_fname_src),
1144 smb_fname_str_do_log(smb_fname_dst));
1145
1146 return result;
1147 }
1148
1149 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1150 {
1151 int result;
1152
1153 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1154
1155 do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s",
1156 fsp_str_do_log(fsp));
1157
1158 return result;
1159 }
1160
1161 struct smb_full_audit_fsync_state {
1162 vfs_handle_struct *handle;
1163 files_struct *fsp;
1164 int ret;
1165 int err;
1166 };
1167
1168 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1169
1170 static struct tevent_req *smb_full_audit_fsync_send(
1171 struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1172 struct tevent_context *ev, struct files_struct *fsp)
1173 {
1174 struct tevent_req *req, *subreq;
1175 struct smb_full_audit_fsync_state *state;
1176
1177 req = tevent_req_create(mem_ctx, &state,
1178 struct smb_full_audit_fsync_state);
1179 if (req == NULL) {
1180 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1181 fsp_str_do_log(fsp));
1182 return NULL;
1183 }
1184 state->handle = handle;
1185 state->fsp = fsp;
1186
1187 subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1188 if (tevent_req_nomem(subreq, req)) {
1189 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1190 fsp_str_do_log(fsp));
1191 return tevent_req_post(req, ev);
1192 }
1193 tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1194
1195 do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1196 return req;
1197 }
1198
1199 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1200 {
1201 struct tevent_req *req = tevent_req_callback_data(
1202 subreq, struct tevent_req);
1203 struct smb_full_audit_fsync_state *state = tevent_req_data(
1204 req, struct smb_full_audit_fsync_state);
1205
1206 state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->err);
1207 TALLOC_FREE(subreq);
1208 tevent_req_done(req);
1209 }
1210
1211 static int smb_full_audit_fsync_recv(struct tevent_req *req, int *err)
1212 {
1213 struct smb_full_audit_fsync_state *state = tevent_req_data(
1214 req, struct smb_full_audit_fsync_state);
1215
1216 if (tevent_req_is_unix_error(req, err)) {
1217 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1218 fsp_str_do_log(state->fsp));
1219 return -1;
1220 }
1221
1222 do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1223 fsp_str_do_log(state->fsp));
1224
1225 *err = state->err;
1226 return state->ret;
1227 }
1228
1229 static int smb_full_audit_stat(vfs_handle_struct *handle,
1230 struct smb_filename *smb_fname)
1231 {
1232 int result;
1233
1234 result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1235
1236 do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1237 smb_fname_str_do_log(smb_fname));
1238
1239 return result;
1240 }
1241
1242 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1243 SMB_STRUCT_STAT *sbuf)
1244 {
1245 int result;
1246
1247 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1248
1249 do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1250 fsp_str_do_log(fsp));
1251
1252 return result;
1253 }
1254
1255 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1256 struct smb_filename *smb_fname)
1257 {
1258 int result;
1259
1260 result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1261
1262 do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1263 smb_fname_str_do_log(smb_fname));
1264
1265 return result;
1266 }
1267
1268 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1269 files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1270 {
1271 uint64_t result;
1272
1273 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1274
1275 do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1276 "%llu", result);
1277
1278 return result;
1279 }
1280
1281 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1282 const struct smb_filename *smb_fname)
1283 {
1284 int result;
1285
1286 result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1287
1288 do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1289 smb_fname_str_do_log(smb_fname));
1290
1291 return result;
1292 }
1293
1294 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1295 const char *path, mode_t mode)
1296 {
1297 int result;
1298
1299 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1300
1301 do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1302
1303 return result;
1304 }
1305
1306 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1307 mode_t mode)
1308 {
1309 int result;
1310
1311 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1312
1313 do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1314 "%s|%o", fsp_str_do_log(fsp), mode);
1315
1316 return result;
1317 }
1318
1319 static int smb_full_audit_chown(vfs_handle_struct *handle,
1320 const char *path, uid_t uid, gid_t gid)
1321 {
1322 int result;
1323
1324 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1325
1326 do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1327 path, (long int)uid, (long int)gid);
1328
1329 return result;
1330 }
1331
1332 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1333 uid_t uid, gid_t gid)
1334 {
1335 int result;
1336
1337 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1338
1339 do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1340 fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1341
1342 return result;
1343 }
1344
1345 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1346 const char *path, uid_t uid, gid_t gid)
1347 {
1348 int result;
1349
1350 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1351
1352 do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1353 path, (long int)uid, (long int)gid);
1354
1355 return result;
1356 }
1357
1358 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1359 const char *path)
1360 {
1361 int result;
1362
1363 result = SMB_VFS_NEXT_CHDIR(handle, path);
1364
1365 do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1366
1367 return result;
1368 }
1369
1370 static char *smb_full_audit_getwd(vfs_handle_struct *handle)
1371 {
1372 char *result;
1373
1374 result = SMB_VFS_NEXT_GETWD(handle);
1375
1376 do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1377 result == NULL? "" : result);
1378
1379 return result;
1380 }
1381
1382 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1383 const struct smb_filename *smb_fname,
1384 struct smb_file_time *ft)
1385 {
1386 int result;
1387
1388 result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1389
1390 do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s",
1391 smb_fname_str_do_log(smb_fname));
1392
1393 return result;
1394 }
1395
1396 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1397 off_t len)
1398 {
1399 int result;
1400
1401 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1402
1403 do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1404 "%s", fsp_str_do_log(fsp));
1405
1406 return result;
1407 }
1408
1409 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1410 enum vfs_fallocate_mode mode,
1411 off_t offset,
1412 off_t len)
1413 {
1414 int result;
1415
1416 result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1417
1418 do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1419 "%s", fsp_str_do_log(fsp));
1420
1421 return result;
1422 }
1423
1424 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1425 int op, off_t offset, off_t count, int type)
1426 {
1427 bool result;
1428
1429 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1430
1431 do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1432
1433 return result;
1434 }
1435
1436 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1437 struct files_struct *fsp,
1438 uint32 share_mode, uint32 access_mask)
1439 {
1440 int result;
1441
1442 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1443
1444 do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1445 fsp_str_do_log(fsp));
1446
1447 return result;
1448 }
1449
1450 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1451 int leasetype)
1452 {
1453 int result;
1454
1455 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1456
1457 do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1458 fsp_str_do_log(fsp));
1459
1460 return result;
1461 }
1462
1463 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1464 off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1465 {
1466 bool result;
1467
1468 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1469
1470 do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1471
1472 return result;
1473 }
1474
1475 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1476 const char *oldpath, const char *newpath)
1477 {
1478 int result;
1479
1480 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1481
1482 do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1483 "%s|%s", oldpath, newpath);
1484
1485 return result;
1486 }
1487
1488 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1489 const char *path, char *buf, size_t bufsiz)
1490 {
1491 int result;
1492
1493 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1494
1495 do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1496
1497 return result;
1498 }
1499
1500 static int smb_full_audit_link(vfs_handle_struct *handle,
1501 const char *oldpath, const char *newpath)
1502 {
1503 int result;
1504
1505 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1506
1507 do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1508 "%s|%s", oldpath, newpath);
1509
1510 return result;
1511 }
1512
1513 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1514 const char *pathname, mode_t mode, SMB_DEV_T dev)
1515 {
1516 int result;
1517
1518 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1519
1520 do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1521
1522 return result;
1523 }
1524
1525 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1526 const char *path)
1527 {
1528 char *result;
1529
1530 result = SMB_VFS_NEXT_REALPATH(handle, path);
1531
1532 do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1533
1534 return result;
1535 }
1536
1537 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1538 struct sys_notify_context *ctx,
1539 const char *path,
1540 uint32_t *filter,
1541 uint32_t *subdir_filter,
1542 void (*callback)(struct sys_notify_context *ctx,
1543 void *private_data,
1544 struct notify_event *ev),
1545 void *private_data, void *handle_p)
1546 {
1547 NTSTATUS result;
1548
1549 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, path,
1550 filter, subdir_filter, callback,
1551 private_data, handle_p);
1552
1553 do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1554
1555 return result;
1556 }
1557
1558 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1559 const char *path, unsigned int flags)
1560 {
1561 int result;
1562
1563 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1564
1565 do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1566
1567 return result;
1568 }
1569
1570 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1571 const SMB_STRUCT_STAT *sbuf)
1572 {
1573 struct file_id id_zero;
1574 struct file_id result;
1575
1576 ZERO_STRUCT(id_zero);
1577
1578 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1579
1580 do_log(SMB_VFS_OP_FILE_ID_CREATE,
1581 !file_id_equal(&id_zero, &result),
1582 handle, "%s", file_id_string_tos(&result));
1583
1584 return result;
1585 }
1586
1587 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1588 struct files_struct *fsp,
1589 const char *fname,
1590 TALLOC_CTX *mem_ctx,
1591 unsigned int *pnum_streams,
1592 struct stream_struct **pstreams)
1593 {
1594 NTSTATUS result;
1595
1596 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1597 pnum_streams, pstreams);
1598
1599 do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1600 "%s", fname);
1601
1602 return result;
1603 }
1604
1605 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1606 const char *path,
1607 const char *name,
1608 TALLOC_CTX *mem_ctx,
1609 char **found_name)
1610 {
1611 int result;
1612
1613 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1614 found_name);
1615
1616 do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1617 "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1618
1619 return result;
1620 }
1621
1622 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1623 const char *fname)
1624 {
1625 const char *result;
1626
1627 result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1628
1629 do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1630 "%s", fname);
1631
1632 return result;
1633 }
1634
1635 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1636 struct byte_range_lock *br_lck,
1637 struct lock_struct *plock,
1638 bool blocking_lock,
1639 struct blocking_lock_record *blr)
1640 {
1641 NTSTATUS result;
1642
1643 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1644 blocking_lock, blr);
1645
1646 do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1647 "%s:%llu-%llu. type=%d. blocking=%d", fsp_str_do_log(br_lck->fsp),
1648 plock->start, plock->size, plock->lock_type, blocking_lock );
1649
1650 return result;
1651 }
1652
1653 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1654 struct messaging_context *msg_ctx,
1655 struct byte_range_lock *br_lck,
1656 const struct lock_struct *plock)
1657 {
1658 bool result;
1659
1660 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1661 plock);
1662
1663 do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1664 "%s:%llu-%llu:%d", fsp_str_do_log(br_lck->fsp), plock->start,
1665 plock->size, plock->lock_type);
1666
1667 return result;
1668 }
1669
1670 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1671 struct byte_range_lock *br_lck,
1672 struct lock_struct *plock,
1673 struct blocking_lock_record *blr)
1674 {
1675 bool result;
1676
1677 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock, blr);
1678
1679 do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1680 "%s:%llu-%llu:%d", fsp_str_do_log(br_lck->fsp), plock->start,
1681 plock->size);
1682
1683 return result;
1684 }
1685
1686 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
1687 struct files_struct *fsp,
1688 struct lock_struct *plock)
1689 {
1690 bool result;
1691
1692 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1693
1694 do_log(SMB_VFS_OP_STRICT_LOCK, result, handle,
1695 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1696 plock->size);
1697
1698 return result;
1699 }
1700
1701 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
1702 struct files_struct *fsp,
1703 struct lock_struct *plock)
1704 {
1705 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1706
1707 do_log(SMB_VFS_OP_STRICT_UNLOCK, true, handle,
1708 "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1709 plock->size);
1710 }
1711
1712 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1713 const char *name,
1714 enum vfs_translate_direction direction,
1715 TALLOC_CTX *mem_ctx,
1716 char **mapped_name)
1717 {
1718 NTSTATUS result;
1719
1720 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1721 mapped_name);
1722
1723 do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1724
1725 return result;
1726 }
1727
1728 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1729 uint32 security_info,
1730 struct security_descriptor **ppdesc)
1731 {
1732 NTSTATUS result;
1733
1734 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1735
1736 do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1737 "%s", fsp_str_do_log(fsp));
1738
1739 return result;
1740 }
1741
1742 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1743 const char *name,
1744 uint32 security_info,
1745 struct security_descriptor **ppdesc)
1746 {
1747 NTSTATUS result;
1748
1749 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1750
1751 do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1752 "%s", name);
1753
1754 return result;
1755 }
1756
1757 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1758 uint32 security_info_sent,
1759 const struct security_descriptor *psd)
1760 {
1761 NTSTATUS result;
1762
1763 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1764
1765 do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle, "%s",
1766 fsp_str_do_log(fsp));
1767
1768 return result;
1769 }
1770
1771 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1772 const char *path, mode_t mode)
1773 {
1774 int result;
1775
1776 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1777
1778 do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1779 "%s|%o", path, mode);
1780
1781 return result;
1782 }
1783
1784 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1785 mode_t mode)
1786 {
1787 int result;
1788
1789 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1790
1791 do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1792 "%s|%o", fsp_str_do_log(fsp), mode);
1793
1794 return result;
1795 }
1796
1797 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1798 const char *path_p,
1799 SMB_ACL_TYPE_T type)
1800 {
1801 SMB_ACL_T result;
1802
1803 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1804
1805 do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1806 "%s", path_p);
1807
1808 return result;
1809 }
1810
1811 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1812 files_struct *fsp)
1813 {
1814 SMB_ACL_T result;
1815
1816 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1817
1818 do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1819 "%s", fsp_str_do_log(fsp));
1820
1821 return result;
1822 }
1823
1824 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
1825
1826 const char *name, SMB_ACL_TYPE_T acltype,
1827 SMB_ACL_T theacl)
1828 {
1829 int result;
1830
1831 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1832 theacl);
1833
1834 do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
1835 "%s", name);
1836
1837 return result;
1838 }
1839
1840 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
1841 SMB_ACL_T theacl)
1842 {
1843 int result;
1844
1845 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1846
1847 do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
1848 "%s", fsp_str_do_log(fsp));
1849
1850 return result;
1851 }
1852
1853 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1854
1855 const char *path)
1856 {
1857 int result;
1858
1859 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
1860
1861 do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
1862 "%s", path);
1863
1864 return result;
1865 }
1866
1867 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
1868 const char *path,
1869 const char *name, void *value, size_t size)
1870 {
1871 ssize_t result;
1872
1873 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
1874
1875 do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
1876 "%s|%s", path, name);
1877
1878 return result;
1879 }
1880
1881 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
1882 struct files_struct *fsp,
1883 const char *name, void *value, size_t size)
1884 {
1885 ssize_t result;
1886
1887 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
1888
1889 do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
1890 "%s|%s", fsp_str_do_log(fsp), name);
1891
1892 return result;
1893 }
1894
1895 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
1896 const char *path, char *list, size_t size)
1897 {
1898 ssize_t result;
1899
1900 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
1901
1902 do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
1903
1904 return result;
1905 }
1906
1907 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
1908 struct files_struct *fsp, char *list,
1909 size_t size)
1910 {
1911 ssize_t result;
1912
1913 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
1914
1915 do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
1916 "%s", fsp_str_do_log(fsp));
1917
1918 return result;
1919 }
1920
1921 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
1922 const char *path,
1923 const char *name)
1924 {
1925 int result;
1926
1927 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
1928
1929 do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
1930 "%s|%s", path, name);
1931
1932 return result;
1933 }
1934
1935 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
1936 struct files_struct *fsp,
1937 const char *name)
1938 {
1939 int result;
1940
1941 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
1942
1943 do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
1944 "%s|%s", fsp_str_do_log(fsp), name);
1945
1946 return result;
1947 }
1948
1949 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
1950 const char *path,
1951 const char *name, const void *value, size_t size,
1952 int flags)
1953 {
1954 int result;
1955
1956 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
1957 flags);
1958
1959 do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
1960 "%s|%s", path, name);
1961
1962 return result;
1963 }
1964
1965 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
1966 struct files_struct *fsp, const char *name,
1967 const void *value, size_t size, int flags)
1968 {
1969 int result;
1970
1971 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
1972
1973 do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
1974 "%s|%s", fsp_str_do_log(fsp), name);
1975
1976 return result;
1977 }
1978
1979 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
1980 struct files_struct *fsp)
1981 {
1982 bool result;
1983
1984 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
1985 do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
1986 "%s", fsp_str_do_log(fsp));
1987
1988 return result;
1989 }
1990
1991 static bool smb_full_audit_is_offline(struct vfs_handle_struct *handle,
1992 const struct smb_filename *fname,
1993 SMB_STRUCT_STAT *sbuf)
1994 {
1995 bool result;
1996
1997 result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
1998 do_log(SMB_VFS_OP_IS_OFFLINE, result, handle, "%s",
1999 smb_fname_str_do_log(fname));
2000 return result;
2001 }
2002
2003 static int smb_full_audit_set_offline(struct vfs_handle_struct *handle,
2004 const struct smb_filename *fname)
2005 {
2006 int result;
2007
2008 result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2009 do_log(SMB_VFS_OP_SET_OFFLINE, result >= 0, handle, "%s",
2010 smb_fname_str_do_log(fname));
2011 return result;
2012 }
2013
2014 static struct vfs_fn_pointers vfs_full_audit_fns = {
2015
2016 /* Disk operations */
2017
2018 .connect_fn = smb_full_audit_connect,
2019 .disconnect_fn = smb_full_audit_disconnect,
2020 .disk_free_fn = smb_full_audit_disk_free,
2021 .get_quota_fn = smb_full_audit_get_quota,
2022 .set_quota_fn = smb_full_audit_set_quota,
2023 .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2024 .statvfs_fn = smb_full_audit_statvfs,
2025 .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2026 .opendir_fn = smb_full_audit_opendir,
2027 .fdopendir_fn = smb_full_audit_fdopendir,
2028 .readdir_fn = smb_full_audit_readdir,
2029 .seekdir_fn = smb_full_audit_seekdir,
2030 .telldir_fn = smb_full_audit_telldir,
2031 .rewind_dir_fn = smb_full_audit_rewinddir,
2032 .mkdir_fn = smb_full_audit_mkdir,
2033 .rmdir_fn = smb_full_audit_rmdir,
2034 .closedir_fn = smb_full_audit_closedir,
2035 .init_search_op_fn = smb_full_audit_init_search_op,
2036 .open_fn = smb_full_audit_open,
2037 .create_file_fn = smb_full_audit_create_file,
2038 .close_fn = smb_full_audit_close,
2039 .read_fn = smb_full_audit_read,
2040 .pread_fn = smb_full_audit_pread,
2041 .pread_send_fn = smb_full_audit_pread_send,
2042 .pread_recv_fn = smb_full_audit_pread_recv,
2043 .write_fn = smb_full_audit_write,
2044 .pwrite_fn = smb_full_audit_pwrite,
2045 .pwrite_send_fn = smb_full_audit_pwrite_send,
2046 .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2047 .lseek_fn = smb_full_audit_lseek,
2048 .sendfile_fn = smb_full_audit_sendfile,
2049 .recvfile_fn = smb_full_audit_recvfile,
2050 .rename_fn = smb_full_audit_rename,
2051 .fsync_fn = smb_full_audit_fsync,
2052 .fsync_send_fn = smb_full_audit_fsync_send,
2053 .fsync_recv_fn = smb_full_audit_fsync_recv,
2054 .stat_fn = smb_full_audit_stat,
2055 .fstat_fn = smb_full_audit_fstat,
2056 .lstat_fn = smb_full_audit_lstat,
2057 .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2058 .unlink_fn = smb_full_audit_unlink,
2059 .chmod_fn = smb_full_audit_chmod,
2060 .fchmod_fn = smb_full_audit_fchmod,
2061 .chown_fn = smb_full_audit_chown,
2062 .fchown_fn = smb_full_audit_fchown,
2063 .lchown_fn = smb_full_audit_lchown,
2064 .chdir_fn = smb_full_audit_chdir,
2065 .getwd_fn = smb_full_audit_getwd,
2066 .ntimes_fn = smb_full_audit_ntimes,
2067 .ftruncate_fn = smb_full_audit_ftruncate,
2068 .fallocate_fn = smb_full_audit_fallocate,
2069 .lock_fn = smb_full_audit_lock,
2070 .kernel_flock_fn = smb_full_audit_kernel_flock,
2071 .linux_setlease_fn = smb_full_audit_linux_setlease,
2072 .getlock_fn = smb_full_audit_getlock,
2073 .symlink_fn = smb_full_audit_symlink,
2074 .readlink_fn = smb_full_audit_readlink,
2075 .link_fn = smb_full_audit_link,
2076 .mknod_fn = smb_full_audit_mknod,
2077 .realpath_fn = smb_full_audit_realpath,
2078 .notify_watch_fn = smb_full_audit_notify_watch,
2079 .chflags_fn = smb_full_audit_chflags,
2080 .file_id_create_fn = smb_full_audit_file_id_create,
2081 .streaminfo_fn = smb_full_audit_streaminfo,
2082 .get_real_filename_fn = smb_full_audit_get_real_filename,
2083 .connectpath_fn = smb_full_audit_connectpath,
2084 .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2085 .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2086 .brl_cancel_windows_fn = smb_full_audit_brl_cancel_windows,
2087 .strict_lock_fn = smb_full_audit_strict_lock,
2088 .strict_unlock_fn = smb_full_audit_strict_unlock,
2089 .translate_name_fn = smb_full_audit_translate_name,
2090 .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2091 .get_nt_acl_fn = smb_full_audit_get_nt_acl,
2092 .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2093 .chmod_acl_fn = smb_full_audit_chmod_acl,
2094 .fchmod_acl_fn = smb_full_audit_fchmod_acl,
2095 .sys_acl_get_file_fn = smb_full_audit_sys_acl_get_file,
2096 .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2097 .sys_acl_set_file_fn = smb_full_audit_sys_acl_set_file,
2098 .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2099 .sys_acl_delete_def_file_fn = smb_full_audit_sys_acl_delete_def_file,
2100 .getxattr_fn = smb_full_audit_getxattr,
2101 .fgetxattr_fn = smb_full_audit_fgetxattr,
2102 .listxattr_fn = smb_full_audit_listxattr,
2103 .flistxattr_fn = smb_full_audit_flistxattr,
2104 .removexattr_fn = smb_full_audit_removexattr,
2105 .fremovexattr_fn = smb_full_audit_fremovexattr,
2106 .setxattr_fn = smb_full_audit_setxattr,
2107 .fsetxattr_fn = smb_full_audit_fsetxattr,
2108 .aio_force_fn = smb_full_audit_aio_force,
2109 .is_offline_fn = smb_full_audit_is_offline,
2110 .set_offline_fn = smb_full_audit_set_offline,
2111 };
2112
2113 NTSTATUS vfs_full_audit_init(void)
2114 {
2115 NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2116 "full_audit", &vfs_full_audit_fns);
2117
2118 if (!NT_STATUS_IS_OK(ret))
2119 return ret;
2120
2121 vfs_full_audit_debug_level = debug_add_class("full_audit");
2122 if (vfs_full_audit_debug_level == -1) {
2123 vfs_full_audit_debug_level = DBGC_VFS;
2124 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2125 "class!\n"));
2126 } else {
2127 DEBUG(10, ("vfs_full_audit: Debug class number of "
2128 "'full_audit': %d\n", vfs_full_audit_debug_level));
2129 }
2130
2131 return ret;
2132 }
reg import