2003-02-07 07:53:15 +03:00
/*
* Auditing VFS module for samba . Log selected file operations to syslog
* facility .
*
* Copyright ( C ) Tim Potter , 1999 - 2000
* Copyright ( C ) Alexander Bokovoy , 2002
2003-02-07 08:01:06 +03:00
* Copyright ( C ) John H Terpstra , 2003
2003-05-12 03:34:18 +04:00
* Copyright ( C ) Stefan ( metze ) Metzmacher , 2003
2003-02-07 07:53:15 +03:00
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
* the Free Software Foundation ; either version 3 of the License , or
2003-02-07 07:53:15 +03:00
* ( at your option ) any later version .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
*
* You should have received a copy of the GNU General Public License
2007-07-10 09:23:25 +04:00
* along with this program ; if not , see < http : //www.gnu.org/licenses/>.
2003-02-07 07:53:15 +03:00
*/
2003-05-12 03:34:18 +04:00
# include "includes.h"
2011-02-26 01:20:06 +03:00
# include "system/filesys.h"
2011-02-25 18:19:10 +03:00
# include "system/syslog.h"
2011-03-23 00:34:22 +03:00
# include "smbd/smbd.h"
2011-06-29 09:33:54 +04:00
# include "lib/param/loadparm.h"
2003-05-12 03:34:18 +04:00
static int vfs_extd_audit_debug_level = DBGC_VFS ;
# undef DBGC_CLASS
# define DBGC_CLASS vfs_extd_audit_debug_level
2003-02-07 07:53:15 +03:00
2003-05-12 03:34:18 +04:00
static int audit_syslog_facility ( vfs_handle_struct * handle )
2003-02-07 07:53:15 +03:00
{
2005-09-29 19:57:21 +04:00
static const struct enum_list enum_log_facilities [ ] = {
{ LOG_USER , " USER " } ,
{ LOG_LOCAL0 , " LOCAL0 " } ,
{ LOG_LOCAL1 , " LOCAL1 " } ,
{ LOG_LOCAL2 , " LOCAL2 " } ,
{ LOG_LOCAL3 , " LOCAL3 " } ,
{ LOG_LOCAL4 , " LOCAL4 " } ,
{ LOG_LOCAL5 , " LOCAL5 " } ,
{ LOG_LOCAL6 , " LOCAL6 " } ,
2011-05-24 19:19:52 +04:00
{ LOG_LOCAL7 , " LOCAL7 " } ,
{ - 1 , NULL }
2005-09-29 19:57:21 +04:00
} ;
int facility ;
facility = lp_parm_enum ( SNUM ( handle - > conn ) , " extd_audit " , " facility " , enum_log_facilities , LOG_USER ) ;
return facility ;
2003-05-12 03:34:18 +04:00
}
2003-02-07 07:53:15 +03:00
2003-05-12 03:34:18 +04:00
static int audit_syslog_priority ( vfs_handle_struct * handle )
{
2005-09-29 19:57:21 +04:00
static const struct enum_list enum_log_priorities [ ] = {
{ LOG_EMERG , " EMERG " } ,
{ LOG_ALERT , " ALERT " } ,
{ LOG_CRIT , " CRIT " } ,
{ LOG_ERR , " ERR " } ,
{ LOG_WARNING , " WARNING " } ,
{ LOG_NOTICE , " NOTICE " } ,
{ LOG_INFO , " INFO " } ,
2011-05-24 19:19:52 +04:00
{ LOG_DEBUG , " DEBUG " } ,
{ - 1 , NULL }
2005-09-29 19:57:21 +04:00
} ;
int priority ;
Fix Coverity warnings
ID 449, 448, 447, 446, 445, 444, 443, 442, 441, 440, 439, 438, 437
(This used to be commit 0d50b4ee9068d04d1d9eb7786e08775d7ba16bc8)
2008-03-23 17:51:52 +03:00
priority = lp_parm_enum ( SNUM ( handle - > conn ) , " extd_audit " , " priority " ,
enum_log_priorities , LOG_NOTICE ) ;
if ( priority = = - 1 ) {
priority = LOG_WARNING ;
}
2005-09-29 19:57:21 +04:00
return priority ;
2003-02-07 07:53:15 +03:00
}
/* Implementation of vfs_ops. Pass everything on to the default
operation but log event first . */
2006-07-11 22:01:26 +04:00
static int audit_connect ( vfs_handle_struct * handle , const char * svc , const char * user )
2003-02-07 07:53:15 +03:00
{
2009-12-01 02:53:04 +03:00
int result = SMB_VFS_NEXT_CONNECT ( handle , svc , user ) ;
if ( result < 0 ) {
return result ;
}
2003-05-12 03:34:18 +04:00
openlog ( " smbd_audit " , LOG_PID , audit_syslog_facility ( handle ) ) ;
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) ,
" connect to service %s by user %s \n " ,
svc , user ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 10 , ( " Connected to service %s as user %s \n " ,
svc , user ) ) ;
2003-02-07 07:53:15 +03:00
2009-12-01 02:53:04 +03:00
return 0 ;
2003-02-07 07:53:15 +03:00
}
2006-07-11 22:01:26 +04:00
static void audit_disconnect ( vfs_handle_struct * handle )
2003-02-07 07:53:15 +03:00
{
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " disconnected \n " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 10 , ( " Disconnected from VFS module extd_audit \n " ) ) ;
2006-07-11 22:01:26 +04:00
SMB_VFS_NEXT_DISCONNECT ( handle ) ;
2003-02-07 07:53:15 +03:00
2003-05-12 03:34:18 +04:00
return ;
2003-02-07 07:53:15 +03:00
}
2016-02-27 01:53:12 +03:00
static DIR * audit_opendir ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname ,
const char * mask ,
uint32_t attr )
2003-02-07 07:53:15 +03:00
{
2012-03-28 06:22:03 +04:00
DIR * result ;
2003-05-12 03:34:18 +04:00
2016-02-27 01:53:12 +03:00
result = SMB_VFS_NEXT_OPENDIR ( handle , smb_fname , mask , attr ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " opendir %s %s%s \n " ,
2016-02-27 01:53:12 +03:00
smb_fname - > base_name ,
2009-01-21 20:31:30 +03:00
( result = = NULL ) ? " failed: " : " " ,
( result = = NULL ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: opendir %s %s %s \n " ,
2016-02-27 01:53:12 +03:00
smb_fname - > base_name ,
2004-04-29 16:11:59 +04:00
( result = = NULL ) ? " failed: " : " " ,
( result = = NULL ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2016-02-24 00:14:03 +03:00
static int audit_mkdir ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname ,
mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2016-02-24 00:14:03 +03:00
result = SMB_VFS_NEXT_MKDIR ( handle , smb_fname , mode ) ;
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " mkdir %s %s%s \n " ,
2016-02-24 00:14:03 +03:00
smb_fname - > base_name ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 0 , ( " vfs_extd_audit: mkdir %s %s %s \n " ,
2016-02-24 00:14:03 +03:00
smb_fname - > base_name ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2016-02-25 01:02:45 +03:00
static int audit_rmdir ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2016-02-25 01:02:45 +03:00
result = SMB_VFS_NEXT_RMDIR ( handle , smb_fname ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " rmdir %s %s%s \n " ,
2016-02-25 01:02:45 +03:00
smb_fname - > base_name ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 0 , ( " vfs_extd_audit: rmdir %s %s %s \n " ,
2016-02-25 01:02:45 +03:00
smb_fname - > base_name ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2009-06-16 23:01:13 +04:00
static int audit_open ( vfs_handle_struct * handle ,
struct smb_filename * smb_fname , files_struct * fsp ,
int flags , mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2009-06-16 23:01:13 +04:00
result = SMB_VFS_NEXT_OPEN ( handle , smb_fname , fsp , flags , mode ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " open %s (fd %d) %s%s%s \n " ,
2009-07-01 10:08:02 +04:00
smb_fname - > base_name , result ,
2009-01-21 20:31:30 +03:00
( ( flags & O_WRONLY ) | | ( flags & O_RDWR ) ) ? " for writing " : " " ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 2 , ( " vfs_extd_audit: open %s %s %s \n " ,
2009-06-16 23:01:13 +04:00
smb_fname_str_dbg ( smb_fname ) ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2008-01-11 16:19:28 +03:00
static int audit_close ( vfs_handle_struct * handle , files_struct * fsp )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2008-01-11 16:19:28 +03:00
result = SMB_VFS_NEXT_CLOSE ( handle , fsp ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " close fd %d %s%s \n " ,
fsp - > fh - > fd ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 2 , ( " vfs_extd_audit: close fd %d %s %s \n " ,
2008-01-11 16:19:28 +03:00
fsp - > fh - > fd ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2009-07-01 04:04:38 +04:00
static int audit_rename ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname_src ,
const struct smb_filename * smb_fname_dst )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2009-07-01 04:04:38 +04:00
result = SMB_VFS_NEXT_RENAME ( handle , smb_fname_src , smb_fname_dst ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " rename %s -> %s %s%s \n " ,
2009-07-01 10:08:02 +04:00
smb_fname_src - > base_name ,
smb_fname_dst - > base_name ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2005-06-25 00:25:18 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: rename old: %s newname: %s %s %s \n " ,
2009-07-01 04:04:38 +04:00
smb_fname_str_dbg ( smb_fname_src ) ,
smb_fname_str_dbg ( smb_fname_dst ) ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
return result ;
2003-02-07 07:53:15 +03:00
}
2009-07-02 20:27:44 +04:00
static int audit_unlink ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2009-07-02 20:27:44 +04:00
result = SMB_VFS_NEXT_UNLINK ( handle , smb_fname ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " unlink %s %s%s \n " ,
2009-07-02 20:27:44 +04:00
smb_fname - > base_name ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 0 , ( " vfs_extd_audit: unlink %s %s %s \n " ,
2009-07-02 20:27:44 +04:00
smb_fname_str_dbg ( smb_fname ) ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2016-03-02 03:20:25 +03:00
static int audit_chmod ( vfs_handle_struct * handle ,
const struct smb_filename * smb_fname ,
mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2003-02-07 07:53:15 +03:00
2016-03-02 03:20:25 +03:00
result = SMB_VFS_NEXT_CHMOD ( handle , smb_fname , mode ) ;
2003-05-12 03:34:18 +04:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " chmod %s mode 0x%x %s%s \n " ,
2016-03-02 03:20:25 +03:00
smb_fname - > base_name , mode ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: chmod %s mode 0x%x %s %s \n " ,
2016-03-02 03:20:25 +03:00
smb_fname - > base_name , ( unsigned int ) mode ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2006-07-11 22:01:26 +04:00
static int audit_chmod_acl ( vfs_handle_struct * handle , const char * path , mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_CHMOD_ACL ( handle , path , mode ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " chmod_acl %s mode 0x%x %s%s \n " ,
path , mode ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: chmod_acl %s mode 0x%x %s %s \n " ,
2009-02-24 03:22:43 +03:00
path , ( unsigned int ) mode ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2008-01-07 15:44:37 +03:00
static int audit_fchmod ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2008-01-07 15:44:37 +03:00
result = SMB_VFS_NEXT_FCHMOD ( handle , fsp , mode ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " fchmod %s mode 0x%x %s%s \n " ,
2009-07-11 05:11:32 +04:00
fsp - > fsp_name - > base_name , mode ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: fchmod %s mode 0x%x %s %s " ,
2009-07-11 05:11:32 +04:00
fsp_str_dbg ( fsp ) , ( unsigned int ) mode ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2008-01-08 03:14:24 +03:00
static int audit_fchmod_acl ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode )
2003-02-07 07:53:15 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2009-01-21 20:31:30 +03:00
2008-01-08 03:14:24 +03:00
result = SMB_VFS_NEXT_FCHMOD_ACL ( handle , fsp , mode ) ;
2003-02-07 07:53:15 +03:00
2009-01-21 20:31:30 +03:00
if ( lp_syslog ( ) > 0 ) {
syslog ( audit_syslog_priority ( handle ) , " fchmod_acl %s mode 0x%x %s%s \n " ,
2009-07-11 05:11:32 +04:00
fsp - > fsp_name - > base_name , mode ,
2009-01-21 20:31:30 +03:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
}
2004-04-29 16:11:59 +04:00
DEBUG ( 1 , ( " vfs_extd_audit: fchmod_acl %s mode 0x%x %s %s " ,
2009-07-11 05:11:32 +04:00
fsp_str_dbg ( fsp ) , ( unsigned int ) mode ,
2004-04-29 16:11:59 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ) ;
2003-02-07 07:53:15 +03:00
return result ;
}
2003-04-16 18:45:11 +04:00
2009-07-24 04:28:58 +04:00
static struct vfs_fn_pointers vfs_extd_audit_fns = {
. connect_fn = audit_connect ,
2011-12-04 08:45:04 +04:00
. disconnect_fn = audit_disconnect ,
. opendir_fn = audit_opendir ,
. mkdir_fn = audit_mkdir ,
. rmdir_fn = audit_rmdir ,
2011-04-21 00:55:25 +04:00
. open_fn = audit_open ,
2009-07-24 04:28:58 +04:00
. close_fn = audit_close ,
2011-12-04 08:45:04 +04:00
. rename_fn = audit_rename ,
. unlink_fn = audit_unlink ,
. chmod_fn = audit_chmod ,
. fchmod_fn = audit_fchmod ,
. chmod_acl_fn = audit_chmod_acl ,
. fchmod_acl_fn = audit_fchmod_acl ,
2009-07-01 09:44:39 +04:00
} ;
2015-08-13 19:16:20 +03:00
static_decl_vfs ;
2003-04-28 21:48:48 +04:00
NTSTATUS vfs_extd_audit_init ( void )
2003-04-16 18:45:11 +04:00
{
2009-07-24 04:28:58 +04:00
NTSTATUS ret = smb_register_vfs ( SMB_VFS_INTERFACE_VERSION ,
" extd_audit " , & vfs_extd_audit_fns ) ;
2003-05-12 03:34:18 +04:00
2003-06-22 14:09:52 +04:00
if ( ! NT_STATUS_IS_OK ( ret ) )
2003-05-12 03:34:18 +04:00
return ret ;
vfs_extd_audit_debug_level = debug_add_class ( " extd_audit " ) ;
if ( vfs_extd_audit_debug_level = = - 1 ) {
vfs_extd_audit_debug_level = DBGC_VFS ;
DEBUG ( 0 , ( " vfs_extd_audit: Couldn't register custom debugging class! \n " ) ) ;
} else {
DEBUG ( 10 , ( " vfs_extd_audit: Debug class number of 'extd_audit': %d \n " , vfs_extd_audit_debug_level ) ) ;
}
return ret ;
2003-04-16 18:45:11 +04:00
}