vfs_extd_audit: implement SMB_VFS_OPENAT()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/modules/vfs_extd_audit.c b/source3/modules/vfs_extd_audit.c
index b8cb5d54e6c32e15954a05f9bfeb76cc89d29326..d38a09a2b54ab057f6e5ad2bc78ab602bd29e0cd 100644 (file)
--- a/source3/modules/vfs_extd_audit.c
+++ b/source3/modules/vfs_extd_audit.c
@@ -236,6 +236,37 @@ static int audit_open(vfs_handle_struct *handle,
        return result;
 }
 
+static int audit_openat(vfs_handle_struct *handle,
+                       const struct files_struct *dirfsp,
+                       const struct smb_filename *smb_fname,
+                       files_struct *fsp,
+                       int flags,
+                       mode_t mode)
+{
+       int ret;
+
+       ret = SMB_VFS_NEXT_OPENAT(handle, dirfsp, smb_fname, fsp, flags, mode);
+
+       if (lp_syslog() > 0) {
+               syslog(audit_syslog_priority(handle),
+                      "openat %s/%s (fd %d) %s%s%s\n",
+                      smb_fname_str_dbg(fsp->fsp_name),
+                      smb_fname->base_name,
+                      ret,
+                      ((flags & O_WRONLY) || (flags & O_RDWR)) ?
+                      "for writing " : "",
+                      (ret < 0) ? "failed: " : "",
+                      (ret < 0) ? strerror(errno) : "");
+       }
+       DEBUG(2, ("vfs_extd_audit: open %s/%s %s %s\n",
+              smb_fname_str_dbg(fsp->fsp_name),
+              smb_fname_str_dbg(smb_fname),
+              (ret < 0) ? "failed: " : "",
+              (ret < 0) ? strerror(errno) : ""));
+
+       return ret;
+}
+
 static int audit_close(vfs_handle_struct *handle, files_struct *fsp)
 {
        int result;
@@ -359,6 +390,7 @@ static struct vfs_fn_pointers vfs_extd_audit_fns = {
        .disconnect_fn = audit_disconnect,
        .mkdirat_fn = audit_mkdirat,
        .open_fn = audit_open,
+       .openat_fn = audit_openat,
        .close_fn = audit_close,
        .renameat_fn = audit_renameat,
        .unlinkat_fn = audit_unlinkat,