2000-02-03 07:40:56 +03:00
/*
2000-05-17 06:48:04 +04:00
* Auditing VFS module for samba . Log selected file operations to syslog
2000-02-03 07:40:56 +03:00
* facility .
*
2003-05-12 03:34:18 +04:00
* Copyright ( C ) Tim Potter 1999 - 2000
* Copyright ( C ) Alexander Bokovoy 2002
* Copyright ( C ) Stefan ( metze ) Metzmacher 2002
2000-02-03 07:40:56 +03:00
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
* the Free Software Foundation ; either version 3 of the License , or
2000-02-03 07:40:56 +03:00
* ( at your option ) any later version .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
*
* You should have received a copy of the GNU General Public License
2007-07-10 09:23:25 +04:00
* along with this program ; if not , see < http : //www.gnu.org/licenses/>.
2000-02-03 07:40:56 +03:00
*/
2003-05-12 03:34:18 +04:00
# include "includes.h"
# undef DBGC_CLASS
# define DBGC_CLASS DBGC_VFS
2000-02-03 07:40:56 +03:00
2002-03-19 05:51:48 +03:00
/* Function prototypes */
2006-07-11 22:01:26 +04:00
static int audit_connect ( vfs_handle_struct * handle , const char * svc , const char * user ) ;
static void audit_disconnect ( vfs_handle_struct * handle ) ;
static SMB_STRUCT_DIR * audit_opendir ( vfs_handle_struct * handle , const char * fname , const char * mask , uint32 attr ) ;
static int audit_mkdir ( vfs_handle_struct * handle , const char * path , mode_t mode ) ;
static int audit_rmdir ( vfs_handle_struct * handle , const char * path ) ;
static int audit_open ( vfs_handle_struct * handle , const char * fname , files_struct * fsp , int flags , mode_t mode ) ;
2003-05-12 03:34:18 +04:00
static int audit_close ( vfs_handle_struct * handle , files_struct * fsp , int fd ) ;
2006-07-11 22:01:26 +04:00
static int audit_rename ( vfs_handle_struct * handle , const char * oldname , const char * newname ) ;
static int audit_unlink ( vfs_handle_struct * handle , const char * path ) ;
static int audit_chmod ( vfs_handle_struct * handle , const char * path , mode_t mode ) ;
static int audit_chmod_acl ( vfs_handle_struct * handle , const char * name , mode_t mode ) ;
2008-01-07 15:44:37 +03:00
static int audit_fchmod ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode ) ;
2008-01-08 03:14:24 +03:00
static int audit_fchmod_acl ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode ) ;
2002-03-19 05:51:48 +03:00
/* VFS operations */
2003-05-12 03:34:18 +04:00
static vfs_op_tuple audit_op_tuples [ ] = {
2002-03-19 05:51:48 +03:00
/* Disk operations */
2003-05-14 14:59:01 +04:00
{ SMB_VFS_OP ( audit_connect ) , SMB_VFS_OP_CONNECT , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_disconnect ) , SMB_VFS_OP_DISCONNECT , SMB_VFS_LAYER_LOGGER } ,
2002-03-19 05:51:48 +03:00
/* Directory operations */
2003-05-14 14:59:01 +04:00
{ SMB_VFS_OP ( audit_opendir ) , SMB_VFS_OP_OPENDIR , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_mkdir ) , SMB_VFS_OP_MKDIR , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_rmdir ) , SMB_VFS_OP_RMDIR , SMB_VFS_LAYER_LOGGER } ,
2002-03-19 05:51:48 +03:00
/* File operations */
2003-05-14 14:59:01 +04:00
{ SMB_VFS_OP ( audit_open ) , SMB_VFS_OP_OPEN , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_close ) , SMB_VFS_OP_CLOSE , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_rename ) , SMB_VFS_OP_RENAME , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_unlink ) , SMB_VFS_OP_UNLINK , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_chmod ) , SMB_VFS_OP_CHMOD , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_fchmod ) , SMB_VFS_OP_FCHMOD , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_chmod_acl ) , SMB_VFS_OP_CHMOD_ACL , SMB_VFS_LAYER_LOGGER } ,
{ SMB_VFS_OP ( audit_fchmod_acl ) , SMB_VFS_OP_FCHMOD_ACL , SMB_VFS_LAYER_LOGGER } ,
2002-07-30 13:59:53 +04:00
/* Finish VFS operations definition */
2003-05-14 14:59:01 +04:00
{ SMB_VFS_OP ( NULL ) , SMB_VFS_OP_NOOP , SMB_VFS_LAYER_NOOP }
2002-03-19 05:51:48 +03:00
} ;
2003-05-12 03:34:18 +04:00
static int audit_syslog_facility ( vfs_handle_struct * handle )
2002-03-19 05:51:48 +03:00
{
2005-09-29 19:57:21 +04:00
static const struct enum_list enum_log_facilities [ ] = {
{ LOG_USER , " USER " } ,
{ LOG_LOCAL0 , " LOCAL0 " } ,
{ LOG_LOCAL1 , " LOCAL1 " } ,
{ LOG_LOCAL2 , " LOCAL2 " } ,
{ LOG_LOCAL3 , " LOCAL3 " } ,
{ LOG_LOCAL4 , " LOCAL4 " } ,
{ LOG_LOCAL5 , " LOCAL5 " } ,
{ LOG_LOCAL6 , " LOCAL6 " } ,
{ LOG_LOCAL7 , " LOCAL7 " }
} ;
int facility ;
facility = lp_parm_enum ( SNUM ( handle - > conn ) , " audit " , " facility " , enum_log_facilities , LOG_USER ) ;
return facility ;
2003-05-12 03:34:18 +04:00
}
2002-03-19 05:51:48 +03:00
2003-05-12 03:34:18 +04:00
static int audit_syslog_priority ( vfs_handle_struct * handle )
{
2005-09-29 19:57:21 +04:00
static const struct enum_list enum_log_priorities [ ] = {
{ LOG_EMERG , " EMERG " } ,
{ LOG_ALERT , " ALERT " } ,
{ LOG_CRIT , " CRIT " } ,
{ LOG_ERR , " ERR " } ,
{ LOG_WARNING , " WARNING " } ,
{ LOG_NOTICE , " NOTICE " } ,
{ LOG_INFO , " INFO " } ,
{ LOG_DEBUG , " DEBUG " }
} ;
int priority ;
priority = lp_parm_enum ( SNUM ( handle - > conn ) , " audit " , " priority " , enum_log_priorities , LOG_NOTICE ) ;
return priority ;
2002-07-30 13:59:53 +04:00
}
2000-02-03 07:40:56 +03:00
/* Implementation of vfs_ops. Pass everything on to the default
operation but log event first . */
2006-07-11 22:01:26 +04:00
static int audit_connect ( vfs_handle_struct * handle , const char * svc , const char * user )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
openlog ( " smbd_audit " , LOG_PID , audit_syslog_facility ( handle ) ) ;
syslog ( audit_syslog_priority ( handle ) , " connect to service %s by user %s \n " ,
2000-05-17 06:48:04 +04:00
svc , user ) ;
2000-02-03 07:40:56 +03:00
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_CONNECT ( handle , svc , user ) ;
2003-05-12 03:34:18 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static void audit_disconnect ( vfs_handle_struct * handle )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " disconnected \n " ) ;
2006-07-11 22:01:26 +04:00
SMB_VFS_NEXT_DISCONNECT ( handle ) ;
2003-05-12 03:34:18 +04:00
return ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static SMB_STRUCT_DIR * audit_opendir ( vfs_handle_struct * handle , const char * fname , const char * mask , uint32 attr )
2000-02-03 07:40:56 +03:00
{
2005-08-22 22:03:08 +04:00
SMB_STRUCT_DIR * result ;
2003-05-12 03:34:18 +04:00
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_OPENDIR ( handle , fname , mask , attr ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " opendir %s %s%s \n " ,
2000-05-17 06:48:04 +04:00
fname ,
( result = = NULL ) ? " failed: " : " " ,
( result = = NULL ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static int audit_mkdir ( vfs_handle_struct * handle , const char * path , mode_t mode )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_MKDIR ( handle , path , mode ) ;
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " mkdir %s %s%s \n " ,
2000-05-17 06:48:04 +04:00
path ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static int audit_rmdir ( vfs_handle_struct * handle , const char * path )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_RMDIR ( handle , path ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " rmdir %s %s%s \n " ,
2000-05-17 06:48:04 +04:00
path ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static int audit_open ( vfs_handle_struct * handle , const char * fname , files_struct * fsp , int flags , mode_t mode )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_OPEN ( handle , fname , fsp , flags , mode ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " open %s (fd %d) %s%s%s \n " ,
2000-05-17 06:48:04 +04:00
fname , result ,
( ( flags & O_WRONLY ) | | ( flags & O_RDWR ) ) ? " for writing " : " " ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2003-05-12 03:34:18 +04:00
static int audit_close ( vfs_handle_struct * handle , files_struct * fsp , int fd )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2003-05-14 14:59:01 +04:00
result = SMB_VFS_NEXT_CLOSE ( handle , fsp , fd ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " close fd %d %s%s \n " ,
2000-05-17 06:48:04 +04:00
fd ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static int audit_rename ( vfs_handle_struct * handle , const char * oldname , const char * newname )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_RENAME ( handle , oldname , newname ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " rename %s -> %s %s%s \n " ,
2005-06-25 00:25:18 +04:00
oldname , newname ,
2000-05-17 06:48:04 +04:00
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2006-07-11 22:01:26 +04:00
static int audit_unlink ( vfs_handle_struct * handle , const char * path )
2000-02-03 07:40:56 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_UNLINK ( handle , path ) ;
2000-02-03 07:40:56 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " unlink %s %s%s \n " ,
2000-05-17 06:48:04 +04:00
path ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2000-02-03 07:40:56 +03:00
2000-05-17 06:48:04 +04:00
return result ;
2000-02-03 07:40:56 +03:00
}
2000-11-06 23:01:03 +03:00
2006-07-11 22:01:26 +04:00
static int audit_chmod ( vfs_handle_struct * handle , const char * path , mode_t mode )
2000-11-06 23:01:03 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_CHMOD ( handle , path , mode ) ;
2000-11-06 23:01:03 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " chmod %s mode 0x%x %s%s \n " ,
2000-11-06 23:01:03 +03:00
path , mode ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
return result ;
}
2006-07-11 22:01:26 +04:00
static int audit_chmod_acl ( vfs_handle_struct * handle , const char * path , mode_t mode )
2001-10-18 04:21:48 +04:00
{
2003-02-21 19:15:44 +03:00
int result ;
2006-07-11 22:01:26 +04:00
result = SMB_VFS_NEXT_CHMOD_ACL ( handle , path , mode ) ;
2003-02-21 19:15:44 +03:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " chmod_acl %s mode 0x%x %s%s \n " ,
2002-03-19 05:51:48 +03:00
path , mode ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
return result ;
}
2001-10-18 04:21:48 +04:00
2008-01-07 15:44:37 +03:00
static int audit_fchmod ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode )
2002-03-19 05:51:48 +03:00
{
2003-05-12 03:34:18 +04:00
int result ;
2002-03-19 05:51:48 +03:00
2008-01-07 15:44:37 +03:00
result = SMB_VFS_NEXT_FCHMOD ( handle , fsp , mode ) ;
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " fchmod %s mode 0x%x %s%s \n " ,
2002-03-19 05:51:48 +03:00
fsp - > fsp_name , mode ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2001-10-24 04:45:41 +04:00
2002-03-19 05:51:48 +03:00
return result ;
}
2001-10-24 04:45:41 +04:00
2008-01-08 03:14:24 +03:00
static int audit_fchmod_acl ( vfs_handle_struct * handle , files_struct * fsp , mode_t mode )
2002-03-19 05:51:48 +03:00
{
2003-02-21 19:15:44 +03:00
int result ;
2008-01-08 03:14:24 +03:00
result = SMB_VFS_NEXT_FCHMOD_ACL ( handle , fsp , mode ) ;
2001-10-24 04:45:41 +04:00
2003-05-12 03:34:18 +04:00
syslog ( audit_syslog_priority ( handle ) , " fchmod_acl %s mode 0x%x %s%s \n " ,
2002-03-19 05:51:48 +03:00
fsp - > fsp_name , mode ,
( result < 0 ) ? " failed: " : " " ,
( result < 0 ) ? strerror ( errno ) : " " ) ;
2001-10-18 04:21:48 +04:00
2002-03-19 05:51:48 +03:00
return result ;
2001-10-18 04:21:48 +04:00
}
2003-04-16 18:45:11 +04:00
2006-12-19 23:16:52 +03:00
NTSTATUS vfs_audit_init ( void ) ;
2003-04-28 21:48:48 +04:00
NTSTATUS vfs_audit_init ( void )
2003-04-16 18:45:11 +04:00
{
2003-05-12 03:34:18 +04:00
return smb_register_vfs ( SMB_VFS_INTERFACE_VERSION , " audit " , audit_op_tuples ) ;
2003-04-16 18:45:11 +04:00
}