source/modules/vfs_full_audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log selected file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2000
   6  * Copyright (C) Alexander Bokovoy, 2002
   7  * Copyright (C) John H Terpstra, 2003
   8  * Copyright (C) Stefan (metze) Metzmacher, 2003
   9  * Copyright (C) Volker Lendecke, 2004
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 2 of the License, or
  14  * (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24  */
  25
  26 /*
  27  * This module implements parseable logging for all Samba VFS operations.
  28  *
  29  * You use it as follows:
  30  *
  31  * [tmp]
  32  * path = /tmp
  33  * vfs objects = full_audit
  34  * full_audit:prefix = %u|%I
  35  * full_audit:success = open opendir
  36  * full_audit:failure = all
  37  *
  38  * This leads to syslog entries of the form:
  39  * smbd_audit: nobody|192.168.234.1|opendir|ok|.
  40  * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
  41  *
  42  * where "nobody" is the connected username and "192.168.234.1" is the
  43  * client's IP address.
  44  *
  45  * Options:
  46  *
  47  * prefix: A macro expansion template prepended to the syslog entry.
  48  *
  49  * success: A list of VFS operations for which a successful completion should
  50  * be logged. Defaults to no logging at all. The special operation "all" logs
  51  * - you guessed it - everything.
  52  *
  53  * failure: A list of VFS operations for which failure to complete should be
  54  * logged. Defaults to logging everything.
  55  */
  56
  57
  58 #include "includes.h"
  59
  60 extern struct current_user current_user;
  61
  62 static int vfs_full_audit_debug_level = DBGC_VFS;
  63
  64 #undef DBGC_CLASS
  65 #define DBGC_CLASS vfs_full_audit_debug_level
  66
  67 /* Function prototypes */
  68
  69 static int smb_full_audit_connect(vfs_handle_struct *handle, connection_struct *conn,
  70                          const char *svc, const char *user);
  71 static void smb_full_audit_disconnect(vfs_handle_struct *handle,
  72                              connection_struct *conn);
  73 static SMB_BIG_UINT smb_full_audit_disk_free(vfs_handle_struct *handle,
  74                                     connection_struct *conn, const char *path,
  75                                     BOOL small_query, SMB_BIG_UINT *bsize,
  76                                     SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize);
  77 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
  78                            struct connection_struct *conn,
  79                            enum SMB_QUOTA_TYPE qtype, unid_t id,
  80                            SMB_DISK_QUOTA *qt);
  81 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
  82                            struct connection_struct *conn,
  83                            enum SMB_QUOTA_TYPE qtype, unid_t id,
  84                            SMB_DISK_QUOTA *qt);
  85 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
  86                                 struct files_struct *fsp,
  87                                 SHADOW_COPY_DATA *shadow_copy_data, BOOL labels);
  88
  89 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle, connection_struct *conn,
  90                           const char *fname);
  91 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
  92                                     connection_struct *conn, DIR *dirp);
  93 static void smb_full_audit_seekdir(vfs_handle_struct *handle, connection_struct *conn,
  94                         DIR *dirp, long offset);
  95 static long smb_full_audit_telldir(vfs_handle_struct *handle, connection_struct *conn,
  96                         DIR *dirp);
  97 static void smb_full_audit_rewinddir(vfs_handle_struct *handle, connection_struct *conn,
  98                         DIR *dirp);
  99 static int smb_full_audit_mkdir(vfs_handle_struct *handle, connection_struct *conn,
 100                        const char *path, mode_t mode);
 101 static int smb_full_audit_rmdir(vfs_handle_struct *handle, connection_struct *conn,
 102                        const char *path);
 103 static int smb_full_audit_closedir(vfs_handle_struct *handle, connection_struct *conn,
 104                           DIR *dirp);
 105 static int smb_full_audit_open(vfs_handle_struct *handle, connection_struct *conn,
 106                       const char *fname, int flags, mode_t mode);
 107 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd);
 108 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
 109                           int fd, void *data, size_t n);
 110 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
 111                            int fd, void *data, size_t n, SMB_OFF_T offset);
 112 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
 113                            int fd, const void *data, size_t n);
 114 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
 115                             int fd, const void *data, size_t n,
 116                             SMB_OFF_T offset);
 117 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
 118                              int filedes, SMB_OFF_T offset, int whence);
 119 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
 120                               files_struct *fsp, int fromfd,
 121                               const DATA_BLOB *hdr, SMB_OFF_T offset,
 122                               size_t n);
 123 static int smb_full_audit_rename(vfs_handle_struct *handle, connection_struct *conn,
 124                         const char *oldname, const char *newname);
 125 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp, int fd);
 126 static int smb_full_audit_stat(vfs_handle_struct *handle, connection_struct *conn,
 127                       const char *fname, SMB_STRUCT_STAT *sbuf);
 128 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd,
 129                        SMB_STRUCT_STAT *sbuf);
 130 static int smb_full_audit_lstat(vfs_handle_struct *handle, connection_struct *conn,
 131                        const char *path, SMB_STRUCT_STAT *sbuf);
 132 static int smb_full_audit_unlink(vfs_handle_struct *handle, connection_struct *conn,
 133                         const char *path);
 134 static int smb_full_audit_chmod(vfs_handle_struct *handle, connection_struct *conn,
 135                        const char *path, mode_t mode);
 136 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd,
 137                         mode_t mode);
 138 static int smb_full_audit_chown(vfs_handle_struct *handle, connection_struct *conn,
 139                        const char *path, uid_t uid, gid_t gid);
 140 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp, int fd,
 141                         uid_t uid, gid_t gid);
 142 static int smb_full_audit_chdir(vfs_handle_struct *handle, connection_struct *conn,
 143                        const char *path);
 144 static char *smb_full_audit_getwd(vfs_handle_struct *handle, connection_struct *conn,
 145                          char *path);
 146 static int smb_full_audit_utime(vfs_handle_struct *handle, connection_struct *conn,
 147                        const char *path, struct utimbuf *times);
 148 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
 149                            int fd, SMB_OFF_T len);
 150 static BOOL smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp, int fd,
 151                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type);
 152 static int smb_full_audit_symlink(vfs_handle_struct *handle, connection_struct *conn,
 153                          const char *oldpath, const char *newpath);
 154 static int smb_full_audit_readlink(vfs_handle_struct *handle, connection_struct *conn,
 155                           const char *path, char *buf, size_t bufsiz);
 156 static int smb_full_audit_link(vfs_handle_struct *handle, connection_struct *conn,
 157                       const char *oldpath, const char *newpath);
 158 static int smb_full_audit_mknod(vfs_handle_struct *handle, connection_struct *conn,
 159                        const char *pathname, mode_t mode, SMB_DEV_T dev);
 160 static char *smb_full_audit_realpath(vfs_handle_struct *handle, connection_struct *conn,
 161                             const char *path, char *resolved_path);
 162 static size_t smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 163                                 int fd, uint32 security_info,
 164                                 SEC_DESC **ppdesc);
 165 static size_t smb_full_audit_get_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 166                                const char *name, uint32 security_info,
 167                                SEC_DESC **ppdesc);
 168 static BOOL smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 169                               int fd, uint32 security_info_sent,
 170                               SEC_DESC *psd);
 171 static BOOL smb_full_audit_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 172                              const char *name, uint32 security_info_sent,
 173                              SEC_DESC *psd);
 174 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn,
 175                            const char *path, mode_t mode);
 176 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
 177                             int fd, mode_t mode);
 178 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
 179                                    connection_struct *conn,
 180                                    SMB_ACL_T theacl, int entry_id,
 181                                    SMB_ACL_ENTRY_T *entry_p);
 182 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
 183                                       connection_struct *conn,
 184                                       SMB_ACL_ENTRY_T entry_d,
 185                                       SMB_ACL_TAG_T *tag_type_p);
 186 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
 187                                      connection_struct *conn,
 188                                      SMB_ACL_ENTRY_T entry_d,
 189                                      SMB_ACL_PERMSET_T *permset_p);
 190 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
 191                                           connection_struct *conn,
 192                                           SMB_ACL_ENTRY_T entry_d);
 193 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
 194                                         connection_struct *conn,
 195                                         const char *path_p,
 196                                         SMB_ACL_TYPE_T type);
 197 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
 198                                       files_struct *fsp,
 199                                       int fd);
 200 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
 201                                      connection_struct *conn,
 202                                      SMB_ACL_PERMSET_T permset);
 203 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
 204                                   connection_struct *conn,
 205                                   SMB_ACL_PERMSET_T permset,
 206                                   SMB_ACL_PERM_T perm);
 207 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
 208                                     connection_struct *conn, SMB_ACL_T theacl,
 209                                     ssize_t *plen);
 210 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
 211                                     connection_struct *conn,
 212                                     int count);
 213 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
 214                                       connection_struct *conn, SMB_ACL_T *pacl,
 215                                       SMB_ACL_ENTRY_T *pentry);
 216 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
 217                                       connection_struct *conn,
 218                                       SMB_ACL_ENTRY_T entry,
 219                                       SMB_ACL_TAG_T tagtype);
 220 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
 221                                        connection_struct *conn,
 222                                        SMB_ACL_ENTRY_T entry,
 223                                        void *qual);
 224 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
 225                                      connection_struct *conn,
 226                                      SMB_ACL_ENTRY_T entry,
 227                                      SMB_ACL_PERMSET_T permset);
 228 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
 229                                connection_struct *conn,
 230                                SMB_ACL_T theacl );
 231 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
 232                                   connection_struct *conn,
 233                                   const char *name, SMB_ACL_TYPE_T acltype,
 234                                   SMB_ACL_T theacl);
 235 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
 236                                 int fd, SMB_ACL_T theacl);
 237 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
 238                                          connection_struct *conn,
 239                                          const char *path);
 240 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
 241                                   connection_struct *conn,
 242                                   SMB_ACL_PERMSET_T permset,
 243                                   SMB_ACL_PERM_T perm);
 244 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
 245                                    connection_struct *conn,
 246                                    char *text);
 247 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
 248                                   connection_struct *conn,
 249                                   SMB_ACL_T posix_acl);
 250 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
 251                                         connection_struct *conn,
 252                                         void *qualifier,
 253                                         SMB_ACL_TAG_T tagtype);
 254 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
 255                               struct connection_struct *conn, const char *path,
 256                               const char *name, void *value, size_t size);
 257 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
 258                                struct connection_struct *conn,
 259                                const char *path, const char *name,
 260                                void *value, size_t size);
 261 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
 262                                struct files_struct *fsp, int fd,
 263                                const char *name, void *value, size_t size);
 264 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
 265                                struct connection_struct *conn,
 266                                const char *path, char *list, size_t size);
 267 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
 268                                 struct connection_struct *conn,
 269                                 const char *path, char *list, size_t size);
 270 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
 271                                 struct files_struct *fsp, int fd, char *list,
 272                                 size_t size);
 273 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
 274                              struct connection_struct *conn, const char *path,
 275                              const char *name);
 276 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
 277                               struct connection_struct *conn, const char *path,
 278                               const char *name);
 279 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
 280                               struct files_struct *fsp, int fd,
 281                               const char *name);
 282 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
 283                           struct connection_struct *conn, const char *path,
 284                           const char *name, const void *value, size_t size,
 285                           int flags);
 286 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
 287                            struct connection_struct *conn, const char *path,
 288                            const char *name, const void *value, size_t size,
 289                            int flags);
 290 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
 291                            struct files_struct *fsp, int fd, const char *name,
 292                            const void *value, size_t size, int flags);
 293
 294 /* VFS operations */
 295
 296 static vfs_op_tuple audit_op_tuples[] = {
 297
 298         /* Disk operations */
 299
 300         {SMB_VFS_OP(smb_full_audit_connect),    SMB_VFS_OP_CONNECT,
 301          SMB_VFS_LAYER_LOGGER},
 302         {SMB_VFS_OP(smb_full_audit_disconnect), SMB_VFS_OP_DISCONNECT,
 303          SMB_VFS_LAYER_LOGGER},
 304         {SMB_VFS_OP(smb_full_audit_disk_free),  SMB_VFS_OP_DISK_FREE,
 305          SMB_VFS_LAYER_LOGGER},
 306         {SMB_VFS_OP(smb_full_audit_get_quota),  SMB_VFS_OP_GET_QUOTA,
 307          SMB_VFS_LAYER_LOGGER},
 308         {SMB_VFS_OP(smb_full_audit_set_quota),  SMB_VFS_OP_SET_QUOTA,
 309          SMB_VFS_LAYER_LOGGER},
 310         {SMB_VFS_OP(smb_full_audit_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,
 311          SMB_VFS_LAYER_LOGGER},
 312
 313         /* Directory operations */
 314
 315         {SMB_VFS_OP(smb_full_audit_opendir),    SMB_VFS_OP_OPENDIR,
 316          SMB_VFS_LAYER_LOGGER},
 317         {SMB_VFS_OP(smb_full_audit_readdir),    SMB_VFS_OP_READDIR,
 318          SMB_VFS_LAYER_LOGGER},
 319         {SMB_VFS_OP(smb_full_audit_seekdir),    SMB_VFS_OP_SEEKDIR,
 320          SMB_VFS_LAYER_LOGGER},
 321         {SMB_VFS_OP(smb_full_audit_telldir),    SMB_VFS_OP_TELLDIR,
 322          SMB_VFS_LAYER_LOGGER},
 323         {SMB_VFS_OP(smb_full_audit_rewinddir),  SMB_VFS_OP_REWINDDIR,
 324          SMB_VFS_LAYER_LOGGER},
 325         {SMB_VFS_OP(smb_full_audit_mkdir),      SMB_VFS_OP_MKDIR,
 326          SMB_VFS_LAYER_LOGGER},
 327         {SMB_VFS_OP(smb_full_audit_rmdir),      SMB_VFS_OP_RMDIR,
 328          SMB_VFS_LAYER_LOGGER},
 329         {SMB_VFS_OP(smb_full_audit_closedir),   SMB_VFS_OP_CLOSEDIR,
 330          SMB_VFS_LAYER_LOGGER},
 331
 332         /* File operations */
 333
 334         {SMB_VFS_OP(smb_full_audit_open),       SMB_VFS_OP_OPEN,
 335          SMB_VFS_LAYER_LOGGER},
 336         {SMB_VFS_OP(smb_full_audit_close),      SMB_VFS_OP_CLOSE,
 337          SMB_VFS_LAYER_LOGGER},
 338         {SMB_VFS_OP(smb_full_audit_read),       SMB_VFS_OP_READ,
 339          SMB_VFS_LAYER_LOGGER},
 340         {SMB_VFS_OP(smb_full_audit_pread),      SMB_VFS_OP_PREAD,
 341          SMB_VFS_LAYER_LOGGER},
 342         {SMB_VFS_OP(smb_full_audit_write),      SMB_VFS_OP_WRITE,
 343          SMB_VFS_LAYER_LOGGER},
 344         {SMB_VFS_OP(smb_full_audit_pwrite),     SMB_VFS_OP_PWRITE,
 345          SMB_VFS_LAYER_LOGGER},
 346         {SMB_VFS_OP(smb_full_audit_lseek),      SMB_VFS_OP_LSEEK,
 347          SMB_VFS_LAYER_LOGGER},
 348         {SMB_VFS_OP(smb_full_audit_sendfile),   SMB_VFS_OP_SENDFILE,
 349          SMB_VFS_LAYER_LOGGER},
 350         {SMB_VFS_OP(smb_full_audit_rename),     SMB_VFS_OP_RENAME,
 351          SMB_VFS_LAYER_LOGGER},
 352         {SMB_VFS_OP(smb_full_audit_fsync),      SMB_VFS_OP_FSYNC,
 353          SMB_VFS_LAYER_LOGGER},
 354         {SMB_VFS_OP(smb_full_audit_stat),       SMB_VFS_OP_STAT,
 355          SMB_VFS_LAYER_LOGGER},
 356         {SMB_VFS_OP(smb_full_audit_fstat),      SMB_VFS_OP_FSTAT,
 357          SMB_VFS_LAYER_LOGGER},
 358         {SMB_VFS_OP(smb_full_audit_lstat),      SMB_VFS_OP_LSTAT,
 359          SMB_VFS_LAYER_LOGGER},
 360         {SMB_VFS_OP(smb_full_audit_unlink),     SMB_VFS_OP_UNLINK,
 361          SMB_VFS_LAYER_LOGGER},
 362         {SMB_VFS_OP(smb_full_audit_chmod),      SMB_VFS_OP_CHMOD,
 363          SMB_VFS_LAYER_LOGGER},
 364         {SMB_VFS_OP(smb_full_audit_fchmod),     SMB_VFS_OP_FCHMOD,
 365          SMB_VFS_LAYER_LOGGER},
 366         {SMB_VFS_OP(smb_full_audit_chown),      SMB_VFS_OP_CHOWN,
 367          SMB_VFS_LAYER_LOGGER},
 368         {SMB_VFS_OP(smb_full_audit_fchown),     SMB_VFS_OP_FCHOWN,
 369          SMB_VFS_LAYER_LOGGER},
 370         {SMB_VFS_OP(smb_full_audit_chdir),      SMB_VFS_OP_CHDIR,
 371          SMB_VFS_LAYER_LOGGER},
 372         {SMB_VFS_OP(smb_full_audit_getwd),      SMB_VFS_OP_GETWD,
 373          SMB_VFS_LAYER_LOGGER},
 374         {SMB_VFS_OP(smb_full_audit_utime),      SMB_VFS_OP_UTIME,
 375          SMB_VFS_LAYER_LOGGER},
 376         {SMB_VFS_OP(smb_full_audit_ftruncate),  SMB_VFS_OP_FTRUNCATE,
 377          SMB_VFS_LAYER_LOGGER},
 378         {SMB_VFS_OP(smb_full_audit_lock),       SMB_VFS_OP_LOCK,
 379          SMB_VFS_LAYER_LOGGER},
 380         {SMB_VFS_OP(smb_full_audit_symlink),    SMB_VFS_OP_SYMLINK,
 381          SMB_VFS_LAYER_LOGGER},
 382         {SMB_VFS_OP(smb_full_audit_readlink),   SMB_VFS_OP_READLINK,
 383          SMB_VFS_LAYER_LOGGER},
 384         {SMB_VFS_OP(smb_full_audit_link),       SMB_VFS_OP_LINK,
 385          SMB_VFS_LAYER_LOGGER},
 386         {SMB_VFS_OP(smb_full_audit_mknod),      SMB_VFS_OP_MKNOD,
 387          SMB_VFS_LAYER_LOGGER},
 388         {SMB_VFS_OP(smb_full_audit_realpath),   SMB_VFS_OP_REALPATH,
 389          SMB_VFS_LAYER_LOGGER},
 390
 391         /* NT ACL operations. */
 392
 393         {SMB_VFS_OP(smb_full_audit_fget_nt_acl),        SMB_VFS_OP_FGET_NT_ACL,
 394          SMB_VFS_LAYER_LOGGER},
 395         {SMB_VFS_OP(smb_full_audit_get_nt_acl), SMB_VFS_OP_GET_NT_ACL,
 396          SMB_VFS_LAYER_LOGGER},
 397         {SMB_VFS_OP(smb_full_audit_fset_nt_acl),        SMB_VFS_OP_FSET_NT_ACL,
 398          SMB_VFS_LAYER_LOGGER},
 399         {SMB_VFS_OP(smb_full_audit_set_nt_acl), SMB_VFS_OP_SET_NT_ACL,
 400          SMB_VFS_LAYER_LOGGER},
 401
 402         /* POSIX ACL operations. */
 403
 404         {SMB_VFS_OP(smb_full_audit_chmod_acl),  SMB_VFS_OP_CHMOD_ACL,
 405          SMB_VFS_LAYER_LOGGER},
 406         {SMB_VFS_OP(smb_full_audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL,
 407          SMB_VFS_LAYER_LOGGER},
 408         {SMB_VFS_OP(smb_full_audit_sys_acl_get_entry),  SMB_VFS_OP_SYS_ACL_GET_ENTRY,
 409          SMB_VFS_LAYER_LOGGER},
 410         {SMB_VFS_OP(smb_full_audit_sys_acl_get_tag_type),       SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,
 411          SMB_VFS_LAYER_LOGGER},
 412         {SMB_VFS_OP(smb_full_audit_sys_acl_get_permset),        SMB_VFS_OP_SYS_ACL_GET_PERMSET,
 413          SMB_VFS_LAYER_LOGGER},
 414         {SMB_VFS_OP(smb_full_audit_sys_acl_get_qualifier),      SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,
 415          SMB_VFS_LAYER_LOGGER},
 416         {SMB_VFS_OP(smb_full_audit_sys_acl_get_file),   SMB_VFS_OP_SYS_ACL_GET_FILE,
 417          SMB_VFS_LAYER_LOGGER},
 418         {SMB_VFS_OP(smb_full_audit_sys_acl_get_fd),     SMB_VFS_OP_SYS_ACL_GET_FD,
 419          SMB_VFS_LAYER_LOGGER},
 420         {SMB_VFS_OP(smb_full_audit_sys_acl_clear_perms),        SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,
 421          SMB_VFS_LAYER_LOGGER},
 422         {SMB_VFS_OP(smb_full_audit_sys_acl_add_perm),   SMB_VFS_OP_SYS_ACL_ADD_PERM,
 423          SMB_VFS_LAYER_LOGGER},
 424         {SMB_VFS_OP(smb_full_audit_sys_acl_to_text),    SMB_VFS_OP_SYS_ACL_TO_TEXT,
 425          SMB_VFS_LAYER_LOGGER},
 426         {SMB_VFS_OP(smb_full_audit_sys_acl_init),       SMB_VFS_OP_SYS_ACL_INIT,
 427          SMB_VFS_LAYER_LOGGER},
 428         {SMB_VFS_OP(smb_full_audit_sys_acl_create_entry),       SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,
 429          SMB_VFS_LAYER_LOGGER},
 430         {SMB_VFS_OP(smb_full_audit_sys_acl_set_tag_type),       SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,
 431          SMB_VFS_LAYER_LOGGER},
 432         {SMB_VFS_OP(smb_full_audit_sys_acl_set_qualifier),      SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,
 433          SMB_VFS_LAYER_LOGGER},
 434         {SMB_VFS_OP(smb_full_audit_sys_acl_set_permset),        SMB_VFS_OP_SYS_ACL_SET_PERMSET,
 435          SMB_VFS_LAYER_LOGGER},
 436         {SMB_VFS_OP(smb_full_audit_sys_acl_valid),      SMB_VFS_OP_SYS_ACL_VALID,
 437          SMB_VFS_LAYER_LOGGER},
 438         {SMB_VFS_OP(smb_full_audit_sys_acl_set_file),   SMB_VFS_OP_SYS_ACL_SET_FILE,
 439          SMB_VFS_LAYER_LOGGER},
 440         {SMB_VFS_OP(smb_full_audit_sys_acl_set_fd),     SMB_VFS_OP_SYS_ACL_SET_FD,
 441          SMB_VFS_LAYER_LOGGER},
 442         {SMB_VFS_OP(smb_full_audit_sys_acl_delete_def_file),    SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
 443          SMB_VFS_LAYER_LOGGER},
 444         {SMB_VFS_OP(smb_full_audit_sys_acl_get_perm),   SMB_VFS_OP_SYS_ACL_GET_PERM,
 445          SMB_VFS_LAYER_LOGGER},
 446         {SMB_VFS_OP(smb_full_audit_sys_acl_free_text),  SMB_VFS_OP_SYS_ACL_FREE_TEXT,
 447          SMB_VFS_LAYER_LOGGER},
 448         {SMB_VFS_OP(smb_full_audit_sys_acl_free_acl),   SMB_VFS_OP_SYS_ACL_FREE_ACL,
 449          SMB_VFS_LAYER_LOGGER},
 450         {SMB_VFS_OP(smb_full_audit_sys_acl_free_qualifier),     SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,
 451          SMB_VFS_LAYER_LOGGER},
 452
 453         /* EA operations. */
 454
 455         {SMB_VFS_OP(smb_full_audit_getxattr),   SMB_VFS_OP_GETXATTR,
 456          SMB_VFS_LAYER_LOGGER},
 457         {SMB_VFS_OP(smb_full_audit_lgetxattr),  SMB_VFS_OP_LGETXATTR,
 458          SMB_VFS_LAYER_LOGGER},
 459         {SMB_VFS_OP(smb_full_audit_fgetxattr),  SMB_VFS_OP_FGETXATTR,
 460          SMB_VFS_LAYER_LOGGER},
 461         {SMB_VFS_OP(smb_full_audit_listxattr),  SMB_VFS_OP_LISTXATTR,
 462          SMB_VFS_LAYER_LOGGER},
 463         {SMB_VFS_OP(smb_full_audit_llistxattr), SMB_VFS_OP_LLISTXATTR,
 464          SMB_VFS_LAYER_LOGGER},
 465         {SMB_VFS_OP(smb_full_audit_flistxattr), SMB_VFS_OP_FLISTXATTR,
 466          SMB_VFS_LAYER_LOGGER},
 467         {SMB_VFS_OP(smb_full_audit_removexattr),        SMB_VFS_OP_REMOVEXATTR,
 468          SMB_VFS_LAYER_LOGGER},
 469         {SMB_VFS_OP(smb_full_audit_lremovexattr),       SMB_VFS_OP_LREMOVEXATTR,
 470          SMB_VFS_LAYER_LOGGER},
 471         {SMB_VFS_OP(smb_full_audit_fremovexattr),       SMB_VFS_OP_FREMOVEXATTR,
 472          SMB_VFS_LAYER_LOGGER},
 473         {SMB_VFS_OP(smb_full_audit_setxattr),   SMB_VFS_OP_SETXATTR,
 474          SMB_VFS_LAYER_LOGGER},
 475         {SMB_VFS_OP(smb_full_audit_lsetxattr),  SMB_VFS_OP_LSETXATTR,
 476          SMB_VFS_LAYER_LOGGER},
 477         {SMB_VFS_OP(smb_full_audit_fsetxattr),  SMB_VFS_OP_FSETXATTR,
 478          SMB_VFS_LAYER_LOGGER},
 479
 480         /* Finish VFS operations definition */
 481
 482         {SMB_VFS_OP(NULL),              SMB_VFS_OP_NOOP,
 483          SMB_VFS_LAYER_NOOP}
 484 };
 485
 486 /* The following array *must* be in the same order as defined in vfs.h */
 487
 488 static struct {
 489         vfs_op_type type;
 490         const char *name;
 491 } vfs_op_names[] = {
 492         { SMB_VFS_OP_CONNECT,   "connect" },
 493         { SMB_VFS_OP_DISCONNECT,        "disconnect" },
 494         { SMB_VFS_OP_DISK_FREE, "disk_free" },
 495         { SMB_VFS_OP_GET_QUOTA, "get_quota" },
 496         { SMB_VFS_OP_SET_QUOTA, "set_quota" },
 497         { SMB_VFS_OP_GET_SHADOW_COPY_DATA,      "get_shadow_copy_data" },
 498         { SMB_VFS_OP_OPENDIR,   "opendir" },
 499         { SMB_VFS_OP_READDIR,   "readdir" },
 500         { SMB_VFS_OP_SEEKDIR,   "seekdir" },
 501         { SMB_VFS_OP_TELLDIR,   "telldir" },
 502         { SMB_VFS_OP_REWINDDIR, "rewinddir" },
 503         { SMB_VFS_OP_MKDIR,     "mkdir" },
 504         { SMB_VFS_OP_RMDIR,     "rmdir" },
 505         { SMB_VFS_OP_CLOSEDIR,  "closedir" },
 506         { SMB_VFS_OP_OPEN,      "open" },
 507         { SMB_VFS_OP_CLOSE,     "close" },
 508         { SMB_VFS_OP_READ,      "read" },
 509         { SMB_VFS_OP_PREAD,     "pread" },
 510         { SMB_VFS_OP_WRITE,     "write" },
 511         { SMB_VFS_OP_PWRITE,    "pwrite" },
 512         { SMB_VFS_OP_LSEEK,     "lseek" },
 513         { SMB_VFS_OP_SENDFILE,  "sendfile" },
 514         { SMB_VFS_OP_RENAME,    "rename" },
 515         { SMB_VFS_OP_FSYNC,     "fsync" },
 516         { SMB_VFS_OP_STAT,      "stat" },
 517         { SMB_VFS_OP_FSTAT,     "fstat" },
 518         { SMB_VFS_OP_LSTAT,     "lstat" },
 519         { SMB_VFS_OP_UNLINK,    "unlink" },
 520         { SMB_VFS_OP_CHMOD,     "chmod" },
 521         { SMB_VFS_OP_FCHMOD,    "fchmod" },
 522         { SMB_VFS_OP_CHOWN,     "chown" },
 523         { SMB_VFS_OP_FCHOWN,    "fchown" },
 524         { SMB_VFS_OP_CHDIR,     "chdir" },
 525         { SMB_VFS_OP_GETWD,     "getwd" },
 526         { SMB_VFS_OP_UTIME,     "utime" },
 527         { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
 528         { SMB_VFS_OP_LOCK,      "lock" },
 529         { SMB_VFS_OP_SYMLINK,   "symlink" },
 530         { SMB_VFS_OP_READLINK,  "readlink" },
 531         { SMB_VFS_OP_LINK,      "link" },
 532         { SMB_VFS_OP_MKNOD,     "mknod" },
 533         { SMB_VFS_OP_REALPATH,  "realpath" },
 534         { SMB_VFS_OP_FGET_NT_ACL,       "fget_nt_acl" },
 535         { SMB_VFS_OP_GET_NT_ACL,        "get_nt_acl" },
 536         { SMB_VFS_OP_FSET_NT_ACL,       "fset_nt_acl" },
 537         { SMB_VFS_OP_SET_NT_ACL,        "set_nt_acl" },
 538         { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
 539         { SMB_VFS_OP_FCHMOD_ACL,        "fchmod_acl" },
 540         { SMB_VFS_OP_SYS_ACL_GET_ENTRY, "sys_acl_get_entry" },
 541         { SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,      "sys_acl_get_tag_type" },
 542         { SMB_VFS_OP_SYS_ACL_GET_PERMSET,       "sys_acl_get_permset" },
 543         { SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,     "sys_acl_get_qualifier" },
 544         { SMB_VFS_OP_SYS_ACL_GET_FILE,  "sys_acl_get_file" },
 545         { SMB_VFS_OP_SYS_ACL_GET_FD,    "sys_acl_get_fd" },
 546         { SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,       "sys_acl_clear_perms" },
 547         { SMB_VFS_OP_SYS_ACL_ADD_PERM,  "sys_acl_add_perm" },
 548         { SMB_VFS_OP_SYS_ACL_TO_TEXT,   "sys_acl_to_text" },
 549         { SMB_VFS_OP_SYS_ACL_INIT,      "sys_acl_init" },
 550         { SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,      "sys_acl_create_entry" },
 551         { SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,      "sys_acl_set_tag_type" },
 552         { SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,     "sys_acl_set_qualifier" },
 553         { SMB_VFS_OP_SYS_ACL_SET_PERMSET,       "sys_acl_set_permset" },
 554         { SMB_VFS_OP_SYS_ACL_VALID,     "sys_acl_valid" },
 555         { SMB_VFS_OP_SYS_ACL_SET_FILE,  "sys_acl_set_file" },
 556         { SMB_VFS_OP_SYS_ACL_SET_FD,    "sys_acl_set_fd" },
 557         { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,   "sys_acl_delete_def_file" },
 558         { SMB_VFS_OP_SYS_ACL_GET_PERM,  "sys_acl_get_perm" },
 559         { SMB_VFS_OP_SYS_ACL_FREE_TEXT, "sys_acl_free_text" },
 560         { SMB_VFS_OP_SYS_ACL_FREE_ACL,  "sys_acl_free_acl" },
 561         { SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,    "sys_acl_free_qualifier" },
 562         { SMB_VFS_OP_GETXATTR,  "getxattr" },
 563         { SMB_VFS_OP_LGETXATTR, "lgetxattr" },
 564         { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
 565         { SMB_VFS_OP_LISTXATTR, "listxattr" },
 566         { SMB_VFS_OP_LLISTXATTR,        "llistxattr" },
 567         { SMB_VFS_OP_FLISTXATTR,        "flistxattr" },
 568         { SMB_VFS_OP_REMOVEXATTR,       "removexattr" },
 569         { SMB_VFS_OP_LREMOVEXATTR,      "lremovexattr" },
 570         { SMB_VFS_OP_FREMOVEXATTR,      "fremovexattr" },
 571         { SMB_VFS_OP_SETXATTR,  "setxattr" },
 572         { SMB_VFS_OP_LSETXATTR, "lsetxattr" },
 573         { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
 574         { SMB_VFS_OP_LAST, NULL }
 575 };
 576
 577 static int audit_syslog_facility(vfs_handle_struct *handle)
 578 {
 579         /* fix me: let this be configurable by:
 580          *      lp_param_enum(SNUM(handle->conn),
 581          *                    (handle->param?handle->param:"full_audit"),
 582          *                    "syslog facility",
 583          *                    audit_enum_facility,LOG_USER);
 584          */
 585         return LOG_USER;
 586 }
 587
 588 static int audit_syslog_priority(vfs_handle_struct *handle)
 589 {
 590         /* fix me: let this be configurable by:
 591          *      lp_param_enum(SNUM(handle->conn),
 592          *                    (handle->param?handle->param:"full_audit"),
 593          *                    "syslog priority",
 594          *                    audit_enum_priority,LOG_NOTICE);
 595          */
 596         return LOG_NOTICE;
 597 }
 598
 599 static char *audit_prefix(connection_struct *conn)
 600 {
 601         static pstring prefix;
 602
 603         pstrcpy(prefix, lp_parm_const_string(SNUM(conn), "full_audit",
 604                                              "prefix", "%u|%I"));
 605         standard_sub_snum(SNUM(conn), prefix, sizeof(prefix)-1);
 606         return prefix;
 607 }
 608
 609 static struct bitmap *success_ops = NULL;
 610
 611 static BOOL log_success(vfs_op_type op)
 612 {
 613         if (success_ops == NULL)
 614                 return True;
 615
 616         return bitmap_query(success_ops, op);
 617 }
 618
 619 static struct bitmap *failure_ops = NULL;
 620
 621 static BOOL log_failure(vfs_op_type op)
 622 {
 623         if (failure_ops == NULL)
 624                 return True;
 625
 626         return bitmap_query(failure_ops, op);
 627 }
 628
 629 static void init_bitmap(struct bitmap **bm, const char **ops)
 630 {
 631         BOOL log_all = False;
 632
 633         if (*bm != NULL)
 634                 return;
 635
 636         *bm = bitmap_allocate(SMB_VFS_OP_LAST);
 637
 638         if (*bm == NULL) {
 639                 DEBUG(0, ("Could not alloc bitmap -- "
 640                           "defaulting to logging everything\n"));
 641                 return;
 642         }
 643
 644         while (*ops != NULL) {
 645                 int i;
 646                 BOOL found = False;
 647
 648                 if (strequal(*ops, "all")) {
 649                         log_all = True;
 650                         break;
 651                 }
 652
 653                 for (i=0; i<SMB_VFS_OP_LAST; i++) {
 654                         if (vfs_op_names[i].name == NULL) {
 655                                 smb_panic("vfs_full_audit.c: name table not "
 656                                           "in sync with vfs.h\n");
 657                         }
 658
 659                         if (strequal(*ops, vfs_op_names[i].name)) {
 660                                 bitmap_set(*bm, i);
 661                                 found = True;
 662                         }
 663                 }
 664                 if (!found) {
 665                         DEBUG(0, ("Could not find opname %s, logging all\n",
 666                                   *ops));
 667                         log_all = True;
 668                         break;
 669                 }
 670                 ops += 1;
 671         }
 672
 673         if (log_all) {
 674                 /* The query functions default to True */
 675                 bitmap_free(*bm);
 676                 *bm = NULL;
 677         }
 678 }
 679
 680 static const char *audit_opname(vfs_op_type op)
 681 {
 682         if (op >= SMB_VFS_OP_LAST)
 683                 return "INVALID VFS OP";
 684         return vfs_op_names[op].name;
 685 }
 686
 687 static void do_log(vfs_op_type op, BOOL success, vfs_handle_struct *handle,
 688                    const char *format, ...)
 689 {
 690         fstring err_msg;
 691         pstring op_msg;
 692         va_list ap;
 693
 694         if (success && (!log_success(op)))
 695                 return;
 696
 697         if (!success && (!log_failure(op)))
 698                 return;
 699
 700         if (success)
 701                 fstrcpy(err_msg, "ok");
 702         else
 703                 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
 704
 705         va_start(ap, format);
 706         vsnprintf(op_msg, sizeof(op_msg), format, ap);
 707         va_end(ap);
 708
 709         syslog(audit_syslog_priority(handle), "%s|%s|%s|%s\n",
 710                audit_prefix(handle->conn), audit_opname(op), err_msg, op_msg);
 711
 712         return;
 713 }
 714
 715 /* Implementation of vfs_ops.  Pass everything on to the default
 716    operation but log event first. */
 717
 718 static int smb_full_audit_connect(vfs_handle_struct *handle, connection_struct *conn,
 719                          const char *svc, const char *user)
 720 {
 721         int result;
 722         const char *none[] = { NULL };
 723         const char *all [] = { "all" };
 724
 725         openlog("smbd_audit", 0, audit_syslog_facility(handle));
 726
 727         init_bitmap(&success_ops,
 728                     lp_parm_string_list(SNUM(conn), "full_audit", "success",
 729                                         none));
 730         init_bitmap(&failure_ops,
 731                     lp_parm_string_list(SNUM(conn), "full_audit", "failure",
 732                                         all));
 733
 734         result = SMB_VFS_NEXT_CONNECT(handle, conn, svc, user);
 735
 736         do_log(SMB_VFS_OP_CONNECT, True, handle,
 737                "%s", svc);
 738
 739         return result;
 740 }
 741
 742 static void smb_full_audit_disconnect(vfs_handle_struct *handle,
 743                              connection_struct *conn)
 744 {
 745         SMB_VFS_NEXT_DISCONNECT(handle, conn);
 746
 747         do_log(SMB_VFS_OP_DISCONNECT, True, handle,
 748                "%s", lp_servicename(SNUM(conn)));
 749
 750         bitmap_free(success_ops);
 751         success_ops = NULL;
 752
 753         bitmap_free(failure_ops);
 754         failure_ops = NULL;
 755
 756         return;
 757 }
 758
 759 static SMB_BIG_UINT smb_full_audit_disk_free(vfs_handle_struct *handle,
 760                                     connection_struct *conn, const char *path,
 761                                     BOOL small_query, SMB_BIG_UINT *bsize,
 762                                     SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize)
 763 {
 764         SMB_BIG_UINT result;
 765
 766         result = SMB_VFS_NEXT_DISK_FREE(handle, conn, path, small_query, bsize,
 767                                         dfree, dsize);
 768
 769         /* Don't have a reasonable notion of failure here */
 770
 771         do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
 772
 773         return result;
 774 }
 775
 776 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
 777                            struct connection_struct *conn,
 778                            enum SMB_QUOTA_TYPE qtype, unid_t id,
 779                            SMB_DISK_QUOTA *qt)
 780 {
 781         int result;
 782
 783         result = SMB_VFS_NEXT_GET_QUOTA(handle, conn, qtype, id, qt);
 784
 785         do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
 786
 787         return result;
 788 }
 789
 790
 791 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
 792                            struct connection_struct *conn,
 793                            enum SMB_QUOTA_TYPE qtype, unid_t id,
 794                            SMB_DISK_QUOTA *qt)
 795 {
 796         int result;
 797
 798         result = SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, qt);
 799
 800         do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
 801
 802         return result;
 803 }
 804
 805 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 806                                 struct files_struct *fsp,
 807                                 SHADOW_COPY_DATA *shadow_copy_data, BOOL labels)
 808 {
 809         int result;
 810
 811         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
 812
 813         do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
 814
 815         return result;
 816 }
 817
 818 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle, connection_struct *conn,
 819                           const char *fname)
 820 {
 821         DIR *result;
 822
 823         result = SMB_VFS_NEXT_OPENDIR(handle, conn, fname);
 824
 825         do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
 826
 827         return result;
 828 }
 829
 830 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
 831                                     connection_struct *conn, DIR *dirp)
 832 {
 833         SMB_STRUCT_DIRENT *result;
 834
 835         result = SMB_VFS_NEXT_READDIR(handle, conn, dirp);
 836
 837         /* This operation has no reasonable error condition
 838          * (End of dir is also failure), so always succeed.
 839          */
 840         do_log(SMB_VFS_OP_READDIR, True, handle, "");
 841
 842         return result;
 843 }
 844
 845 static void smb_full_audit_seekdir(vfs_handle_struct *handle, connection_struct *conn,
 846                         DIR *dirp, long offset)
 847 {
 848         SMB_VFS_NEXT_SEEKDIR(handle, conn, dirp, offset);
 849
 850         do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
 851         return;
 852 }
 853
 854 static long smb_full_audit_telldir(vfs_handle_struct *handle, connection_struct *conn,
 855                         DIR *dirp)
 856 {
 857         long result;
 858
 859         result = SMB_VFS_NEXT_TELLDIR(handle, conn, dirp);
 860
 861         do_log(SMB_VFS_OP_OPENDIR, True, handle, "");
 862
 863         return result;
 864 }
 865
 866 static void smb_full_audit_rewinddir(vfs_handle_struct *handle, connection_struct *conn,
 867                         DIR *dirp)
 868 {
 869         SMB_VFS_NEXT_REWINDDIR(handle, conn, dirp);
 870
 871         do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
 872         return;
 873 }
 874
 875 static int smb_full_audit_mkdir(vfs_handle_struct *handle, connection_struct *conn,
 876                        const char *path, mode_t mode)
 877 {
 878         int result;
 879
 880         result = SMB_VFS_NEXT_MKDIR(handle, conn, path, mode);
 881
 882         do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
 883
 884         return result;
 885 }
 886
 887 static int smb_full_audit_rmdir(vfs_handle_struct *handle, connection_struct *conn,
 888                        const char *path)
 889 {
 890         int result;
 891
 892         result = SMB_VFS_NEXT_RMDIR(handle, conn, path);
 893
 894         do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
 895
 896         return result;
 897 }
 898
 899 static int smb_full_audit_closedir(vfs_handle_struct *handle, connection_struct *conn,
 900                           DIR *dirp)
 901 {
 902         int result;
 903
 904         result = SMB_VFS_NEXT_CLOSEDIR(handle, conn, dirp);
 905
 906         do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
 907
 908         return result;
 909 }
 910
 911 static int smb_full_audit_open(vfs_handle_struct *handle, connection_struct *conn,
 912                       const char *fname, int flags, mode_t mode)
 913 {
 914         int result;
 915
 916         result = SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
 917
 918         do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
 919                ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
 920                fname);
 921
 922         return result;
 923 }
 924
 925 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
 926 {
 927         int result;
 928
 929         result = SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
 930
 931         do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s", fsp->fsp_name);
 932
 933         return result;
 934 }
 935
 936 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
 937                           int fd, void *data, size_t n)
 938 {
 939         ssize_t result;
 940
 941         result = SMB_VFS_NEXT_READ(handle, fsp, fd, data, n);
 942
 943         do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s", fsp->fsp_name);
 944
 945         return result;
 946 }
 947
 948 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
 949                            int fd, void *data, size_t n, SMB_OFF_T offset)
 950 {
 951         ssize_t result;
 952
 953         result = SMB_VFS_NEXT_PREAD(handle, fsp, fd, data, n, offset);
 954
 955         do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s", fsp->fsp_name);
 956
 957         return result;
 958 }
 959
 960 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
 961                            int fd, const void *data, size_t n)
 962 {
 963         ssize_t result;
 964
 965         result = SMB_VFS_NEXT_WRITE(handle, fsp, fd, data, n);
 966
 967         do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s", fsp->fsp_name);
 968
 969         return result;
 970 }
 971
 972 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
 973                             int fd, const void *data, size_t n,
 974                             SMB_OFF_T offset)
 975 {
 976         ssize_t result;
 977
 978         result = SMB_VFS_NEXT_PWRITE(handle, fsp, fd, data, n, offset);
 979
 980         do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s", fsp->fsp_name);
 981
 982         return result;
 983 }
 984
 985 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
 986                              int filedes, SMB_OFF_T offset, int whence)
 987 {
 988         ssize_t result;
 989
 990         result = SMB_VFS_NEXT_LSEEK(handle, fsp, filedes, offset, whence);
 991
 992         do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
 993                "%s", fsp->fsp_name);
 994
 995         return result;
 996 }
 997
 998 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
 999                               files_struct *fsp, int fromfd,
1000                               const DATA_BLOB *hdr, SMB_OFF_T offset,
1001                               size_t n)
1002 {
1003         ssize_t result;
1004
1005         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fsp, fromfd, hdr,
1006                                        offset, n);
1007
1008         do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1009                "%s", fsp->fsp_name);
1010
1011         return result;
1012 }
1013
1014 static int smb_full_audit_rename(vfs_handle_struct *handle, connection_struct *conn,
1015                         const char *oldname, const char *newname)
1016 {
1017         int result;
1018
1019         result = SMB_VFS_NEXT_RENAME(handle, conn, oldname, newname);
1020
1021         do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s", oldname, newname);
1022
1023         return result;
1024 }
1025
1026 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp, int fd)
1027 {
1028         int result;
1029
1030         result = SMB_VFS_NEXT_FSYNC(handle, fsp, fd);
1031
1032         do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s", fsp->fsp_name);
1033
1034         return result;
1035 }
1036
1037 static int smb_full_audit_stat(vfs_handle_struct *handle, connection_struct *conn,
1038                       const char *fname, SMB_STRUCT_STAT *sbuf)
1039 {
1040         int result;
1041
1042         result = SMB_VFS_NEXT_STAT(handle, conn, fname, sbuf);
1043
1044         do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s", fname);
1045
1046         return result;
1047 }
1048
1049 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd,
1050                        SMB_STRUCT_STAT *sbuf)
1051 {
1052         int result;
1053
1054         result = SMB_VFS_NEXT_FSTAT(handle, fsp, fd, sbuf);
1055
1056         do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s", fsp->fsp_name);
1057
1058         return result;
1059 }
1060
1061 static int smb_full_audit_lstat(vfs_handle_struct *handle, connection_struct *conn,
1062                        const char *path, SMB_STRUCT_STAT *sbuf)
1063 {
1064         int result;
1065
1066         result = SMB_VFS_NEXT_LSTAT(handle, conn, path, sbuf);
1067
1068         do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s", path);
1069
1070         return result;
1071 }
1072
1073 static int smb_full_audit_unlink(vfs_handle_struct *handle, connection_struct *conn,
1074                         const char *path)
1075 {
1076         int result;
1077
1078         result = SMB_VFS_NEXT_UNLINK(handle, conn, path);
1079
1080         do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s", path);
1081
1082         return result;
1083 }
1084
1085 static int smb_full_audit_chmod(vfs_handle_struct *handle, connection_struct *conn,
1086                        const char *path, mode_t mode)
1087 {
1088         int result;
1089
1090         result = SMB_VFS_NEXT_CHMOD(handle, conn, path, mode);
1091
1092         do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1093
1094         return result;
1095 }
1096
1097 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd,
1098                         mode_t mode)
1099 {
1100         int result;
1101
1102         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode);
1103
1104         do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1105                "%s|%o", fsp->fsp_name, mode);
1106
1107         return result;
1108 }
1109
1110 static int smb_full_audit_chown(vfs_handle_struct *handle, connection_struct *conn,
1111                        const char *path, uid_t uid, gid_t gid)
1112 {
1113         int result;
1114
1115         result = SMB_VFS_NEXT_CHOWN(handle, conn, path, uid, gid);
1116
1117         do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1118                path, (long int)uid, (long int)gid);
1119
1120         return result;
1121 }
1122
1123 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp, int fd,
1124                         uid_t uid, gid_t gid)
1125 {
1126         int result;
1127
1128         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, fd, uid, gid);
1129
1130         do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1131                fsp->fsp_name, (long int)uid, (long int)gid);
1132
1133         return result;
1134 }
1135
1136 static int smb_full_audit_chdir(vfs_handle_struct *handle, connection_struct *conn,
1137                        const char *path)
1138 {
1139         int result;
1140
1141         result = SMB_VFS_NEXT_CHDIR(handle, conn, path);
1142
1143         do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1144
1145         return result;
1146 }
1147
1148 static char *smb_full_audit_getwd(vfs_handle_struct *handle, connection_struct *conn,
1149                          char *path)
1150 {
1151         char *result;
1152
1153         result = SMB_VFS_NEXT_GETWD(handle, conn, path);
1154
1155         do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s", path);
1156
1157         return result;
1158 }
1159
1160 static int smb_full_audit_utime(vfs_handle_struct *handle, connection_struct *conn,
1161                        const char *path, struct utimbuf *times)
1162 {
1163         int result;
1164
1165         result = SMB_VFS_NEXT_UTIME(handle, conn, path, times);
1166
1167         do_log(SMB_VFS_OP_UTIME, (result >= 0), handle, "%s", path);
1168
1169         return result;
1170 }
1171
1172 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1173                            int fd, SMB_OFF_T len)
1174 {
1175         int result;
1176
1177         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, fd, len);
1178
1179         do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1180                "%s", fsp->fsp_name);
1181
1182         return result;
1183 }
1184
1185 static BOOL smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp, int fd,
1186                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1187 {
1188         BOOL result;
1189
1190         result = SMB_VFS_NEXT_LOCK(handle, fsp, fd, op, offset, count, type);
1191
1192         do_log(SMB_VFS_OP_LOCK, (result >= 0), handle, "%s", fsp->fsp_name);
1193
1194         return result;
1195 }
1196
1197 static int smb_full_audit_symlink(vfs_handle_struct *handle, connection_struct *conn,
1198                          const char *oldpath, const char *newpath)
1199 {
1200         int result;
1201
1202         result = SMB_VFS_NEXT_SYMLINK(handle, conn, oldpath, newpath);
1203
1204         do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1205                "%s|%s", oldpath, newpath);
1206
1207         return result;
1208 }
1209
1210 static int smb_full_audit_readlink(vfs_handle_struct *handle, connection_struct *conn,
1211                           const char *path, char *buf, size_t bufsiz)
1212 {
1213         int result;
1214
1215         result = SMB_VFS_NEXT_READLINK(handle, conn, path, buf, bufsiz);
1216
1217         do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1218
1219         return result;
1220 }
1221
1222 static int smb_full_audit_link(vfs_handle_struct *handle, connection_struct *conn,
1223                       const char *oldpath, const char *newpath)
1224 {
1225         int result;
1226
1227         result = SMB_VFS_NEXT_LINK(handle, conn, oldpath, newpath);
1228
1229         do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1230                "%s|%s", oldpath, newpath);
1231
1232         return result;
1233 }
1234
1235 static int smb_full_audit_mknod(vfs_handle_struct *handle, connection_struct *conn,
1236                        const char *pathname, mode_t mode, SMB_DEV_T dev)
1237 {
1238         int result;
1239
1240         result = SMB_VFS_NEXT_MKNOD(handle, conn, pathname, mode, dev);
1241
1242         do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1243
1244         return result;
1245 }
1246
1247 static char *smb_full_audit_realpath(vfs_handle_struct *handle, connection_struct *conn,
1248                             const char *path, char *resolved_path)
1249 {
1250         char *result;
1251
1252         result = SMB_VFS_NEXT_REALPATH(handle, conn, path, resolved_path);
1253
1254         do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1255
1256         return result;
1257 }
1258
1259 static size_t smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1260                                 int fd, uint32 security_info,
1261                                 SEC_DESC **ppdesc)
1262 {
1263         size_t result;
1264
1265         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, fd, security_info,
1266                                           ppdesc);
1267
1268         do_log(SMB_VFS_OP_FGET_NT_ACL, (result > 0), handle,
1269                "%s", fsp->fsp_name);
1270
1271         return result;
1272 }
1273
1274 static size_t smb_full_audit_get_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1275                                const char *name, uint32 security_info,
1276                                SEC_DESC **ppdesc)
1277 {
1278         size_t result;
1279
1280         result = SMB_VFS_NEXT_GET_NT_ACL(handle, fsp, name, security_info,
1281                                          ppdesc);
1282
1283         do_log(SMB_VFS_OP_GET_NT_ACL, (result > 0), handle,
1284                "%s", fsp->fsp_name);
1285
1286         return result;
1287 }
1288
1289 static BOOL smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1290                               int fd, uint32 security_info_sent,
1291                               SEC_DESC *psd)
1292 {
1293         BOOL result;
1294
1295         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, fd, security_info_sent,
1296                                           psd);
1297
1298         do_log(SMB_VFS_OP_FSET_NT_ACL, result, handle, "%s", fsp->fsp_name);
1299
1300         return result;
1301 }
1302
1303 static BOOL smb_full_audit_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1304                              const char *name, uint32 security_info_sent,
1305                              SEC_DESC *psd)
1306 {
1307         BOOL result;
1308
1309         result = SMB_VFS_NEXT_SET_NT_ACL(handle, fsp, name, security_info_sent,
1310                                          psd);
1311
1312         do_log(SMB_VFS_OP_SET_NT_ACL, result, handle, "%s", fsp->fsp_name);
1313
1314         return result;
1315 }
1316
1317 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn,
1318                            const char *path, mode_t mode)
1319 {
1320         int result;
1321
1322         result = SMB_VFS_NEXT_CHMOD_ACL(handle, conn, path, mode);
1323
1324         do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1325                "%s|%o", path, mode);
1326
1327         return result;
1328 }
1329
1330 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1331                             int fd, mode_t mode)
1332 {
1333         int result;
1334
1335         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode);
1336
1337         do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1338                "%s|%o", fsp->fsp_name, mode);
1339
1340         return result;
1341 }
1342
1343 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1344                                    connection_struct *conn,
1345                                    SMB_ACL_T theacl, int entry_id,
1346                                    SMB_ACL_ENTRY_T *entry_p)
1347 {
1348         int result;
1349
1350         result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, conn, theacl, entry_id,
1351                                                 entry_p);
1352
1353         do_log(SMB_VFS_OP_SYS_ACL_GET_ENTRY, (result >= 0), handle,
1354                "");
1355
1356         return result;
1357 }
1358
1359 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1360                                       connection_struct *conn,
1361                                       SMB_ACL_ENTRY_T entry_d,
1362                                       SMB_ACL_TAG_T *tag_type_p)
1363 {
1364         int result;
1365
1366         result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, conn, entry_d,
1367                                                    tag_type_p);
1368
1369         do_log(SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, (result >= 0), handle,
1370                "");
1371
1372         return result;
1373 }
1374
1375 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1376                                      connection_struct *conn,
1377                                      SMB_ACL_ENTRY_T entry_d,
1378                                      SMB_ACL_PERMSET_T *permset_p)
1379 {
1380         int result;
1381
1382         result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, conn, entry_d,
1383                                                   permset_p);
1384
1385         do_log(SMB_VFS_OP_SYS_ACL_GET_PERMSET, (result >= 0), handle,
1386                "");
1387
1388         return result;
1389 }
1390
1391 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1392                                           connection_struct *conn,
1393                                           SMB_ACL_ENTRY_T entry_d)
1394 {
1395         void *result;
1396
1397         result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, conn, entry_d);
1398
1399         do_log(SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, (result != NULL), handle,
1400                "");
1401
1402         return result;
1403 }
1404
1405 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1406                                         connection_struct *conn,
1407                                         const char *path_p,
1408                                         SMB_ACL_TYPE_T type)
1409 {
1410         SMB_ACL_T result;
1411
1412         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, conn, path_p, type);
1413
1414         do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1415                "%s", path_p);
1416
1417         return result;
1418 }
1419
1420 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1421                                       files_struct *fsp, int fd)
1422 {
1423         SMB_ACL_T result;
1424
1425         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, fd);
1426
1427         do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1428                "%s", fsp->fsp_name);
1429
1430         return result;
1431 }
1432
1433 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1434                                      connection_struct *conn,
1435                                      SMB_ACL_PERMSET_T permset)
1436 {
1437         int result;
1438
1439         result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, conn, permset);
1440
1441         do_log(SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, (result >= 0), handle,
1442                "");
1443
1444         return result;
1445 }
1446
1447 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1448                                   connection_struct *conn,
1449                                   SMB_ACL_PERMSET_T permset,
1450                                   SMB_ACL_PERM_T perm)
1451 {
1452         int result;
1453
1454         result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, conn, permset, perm);
1455
1456         do_log(SMB_VFS_OP_SYS_ACL_ADD_PERM, (result >= 0), handle,
1457                "");
1458
1459         return result;
1460 }
1461
1462 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
1463                                     connection_struct *conn, SMB_ACL_T theacl,
1464                                     ssize_t *plen)
1465 {
1466         char * result;
1467
1468         result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, conn, theacl, plen);
1469
1470         do_log(SMB_VFS_OP_SYS_ACL_TO_TEXT, (result != NULL), handle,
1471                "");
1472
1473         return result;
1474 }
1475
1476 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
1477                                     connection_struct *conn,
1478                                     int count)
1479 {
1480         SMB_ACL_T result;
1481
1482         result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, conn, count);
1483
1484         do_log(SMB_VFS_OP_SYS_ACL_INIT, (result != NULL), handle,
1485                "");
1486
1487         return result;
1488 }
1489
1490 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1491                                       connection_struct *conn, SMB_ACL_T *pacl,
1492                                       SMB_ACL_ENTRY_T *pentry)
1493 {
1494         int result;
1495
1496         result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, conn, pacl, pentry);
1497
1498         do_log(SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, (result >= 0), handle,
1499                "");
1500
1501         return result;
1502 }
1503
1504 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1505                                       connection_struct *conn,
1506                                       SMB_ACL_ENTRY_T entry,
1507                                       SMB_ACL_TAG_T tagtype)
1508 {
1509         int result;
1510
1511         result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, conn, entry,
1512                                                    tagtype);
1513
1514         do_log(SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, (result >= 0), handle,
1515                "");
1516
1517         return result;
1518 }
1519
1520 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1521                                        connection_struct *conn,
1522                                        SMB_ACL_ENTRY_T entry,
1523                                        void *qual)
1524 {
1525         int result;
1526
1527         result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, conn, entry, qual);
1528
1529         do_log(SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, (result >= 0), handle,
1530                "");
1531
1532         return result;
1533 }
1534
1535 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1536                                      connection_struct *conn,
1537                                      SMB_ACL_ENTRY_T entry,
1538                                      SMB_ACL_PERMSET_T permset)
1539 {
1540         int result;
1541
1542         result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, conn, entry, permset);
1543
1544         do_log(SMB_VFS_OP_SYS_ACL_SET_PERMSET, (result >= 0), handle,
1545                "");
1546
1547         return result;
1548 }
1549
1550 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
1551                                connection_struct *conn,
1552                                SMB_ACL_T theacl )
1553 {
1554         int result;
1555
1556         result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, conn, theacl);
1557
1558         do_log(SMB_VFS_OP_SYS_ACL_VALID, (result >= 0), handle,
1559                "");
1560
1561         return result;
1562 }
1563
1564 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
1565                                   connection_struct *conn,
1566                                   const char *name, SMB_ACL_TYPE_T acltype,
1567                                   SMB_ACL_T theacl)
1568 {
1569         int result;
1570
1571         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, conn, name, acltype,
1572                                                theacl);
1573
1574         do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
1575                "%s", name);
1576
1577         return result;
1578 }
1579
1580 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
1581                                 int fd, SMB_ACL_T theacl)
1582 {
1583         int result;
1584
1585         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, fd, theacl);
1586
1587         do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
1588                "%s", fsp->fsp_name);
1589
1590         return result;
1591 }
1592
1593 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1594                                          connection_struct *conn,
1595                                          const char *path)
1596 {
1597         int result;
1598
1599         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, conn, path);
1600
1601         do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
1602                "%s", path);
1603
1604         return result;
1605 }
1606
1607 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
1608                                   connection_struct *conn,
1609                                   SMB_ACL_PERMSET_T permset,
1610                                   SMB_ACL_PERM_T perm)
1611 {
1612         int result;
1613
1614         result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, conn, permset, perm);
1615
1616         do_log(SMB_VFS_OP_SYS_ACL_GET_PERM, (result >= 0), handle,
1617                "");
1618
1619         return result;
1620 }
1621
1622 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
1623                                    connection_struct *conn,
1624                                    char *text)
1625 {
1626         int result;
1627
1628         result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, conn, text);
1629
1630         do_log(SMB_VFS_OP_SYS_ACL_FREE_TEXT, (result >= 0), handle,
1631                "");
1632
1633         return result;
1634 }
1635
1636 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
1637                                   connection_struct *conn,
1638                                   SMB_ACL_T posix_acl)
1639 {
1640         int result;
1641
1642         result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, conn, posix_acl);
1643
1644         do_log(SMB_VFS_OP_SYS_ACL_FREE_ACL, (result >= 0), handle,
1645                "");
1646
1647         return result;
1648 }
1649
1650 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
1651                                         connection_struct *conn,
1652                                         void *qualifier,
1653                                         SMB_ACL_TAG_T tagtype)
1654 {
1655         int result;
1656
1657         result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, conn, qualifier,
1658                                                      tagtype);
1659
1660         do_log(SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, (result >= 0), handle,
1661                "");
1662
1663         return result;
1664 }
1665
1666 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
1667                               struct connection_struct *conn, const char *path,
1668                               const char *name, void *value, size_t size)
1669 {
1670         ssize_t result;
1671
1672         result = SMB_VFS_NEXT_GETXATTR(handle, conn, path, name, value, size);
1673
1674         do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
1675                "%s|%s", path, name);
1676
1677         return result;
1678 }
1679
1680 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
1681                                struct connection_struct *conn,
1682                                const char *path, const char *name,
1683                                void *value, size_t size)
1684 {
1685         ssize_t result;
1686
1687         result = SMB_VFS_NEXT_LGETXATTR(handle, conn, path, name, value, size);
1688
1689         do_log(SMB_VFS_OP_LGETXATTR, (result >= 0), handle,
1690                "%s|%s", path, name);
1691
1692         return result;
1693 }
1694
1695 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
1696                                struct files_struct *fsp, int fd,
1697                                const char *name, void *value, size_t size)
1698 {
1699         ssize_t result;
1700
1701         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, fd, name, value, size);
1702
1703         do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
1704                "%s|%s", fsp->fsp_name, name);
1705
1706         return result;
1707 }
1708
1709 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
1710                                struct connection_struct *conn,
1711                                const char *path, char *list, size_t size)
1712 {
1713         ssize_t result;
1714
1715         result = SMB_VFS_NEXT_LISTXATTR(handle, conn, path, list, size);
1716
1717         do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
1718
1719         return result;
1720 }
1721
1722 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
1723                                 struct connection_struct *conn,
1724                                 const char *path, char *list, size_t size)
1725 {
1726         ssize_t result;
1727
1728         result = SMB_VFS_NEXT_LLISTXATTR(handle, conn, path, list, size);
1729
1730         do_log(SMB_VFS_OP_LLISTXATTR, (result >= 0), handle, "%s", path);
1731
1732         return result;
1733 }
1734
1735 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
1736                                 struct files_struct *fsp, int fd, char *list,
1737                                 size_t size)
1738 {
1739         ssize_t result;
1740
1741         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, fd, list, size);
1742
1743         do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
1744                "%s", fsp->fsp_name);
1745
1746         return result;
1747 }
1748
1749 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
1750                              struct connection_struct *conn, const char *path,
1751                              const char *name)
1752 {
1753         int result;
1754
1755         result = SMB_VFS_NEXT_REMOVEXATTR(handle, conn, path, name);
1756
1757         do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
1758                "%s|%s", path, name);
1759
1760         return result;
1761 }
1762
1763 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
1764                               struct connection_struct *conn, const char *path,
1765                               const char *name)
1766 {
1767         int result;
1768
1769         result = SMB_VFS_NEXT_LREMOVEXATTR(handle, conn, path, name);
1770
1771         do_log(SMB_VFS_OP_LREMOVEXATTR, (result >= 0), handle,
1772                "%s|%s", path, name);
1773
1774         return result;
1775 }
1776
1777 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
1778                               struct files_struct *fsp, int fd,
1779                               const char *name)
1780 {
1781         int result;
1782
1783         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, fd, name);
1784
1785         do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
1786                "%s|%s", fsp->fsp_name, name);
1787
1788         return result;
1789 }
1790
1791 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
1792                           struct connection_struct *conn, const char *path,
1793                           const char *name, const void *value, size_t size,
1794                           int flags)
1795 {
1796         int result;
1797
1798         result = SMB_VFS_NEXT_SETXATTR(handle, conn, path, name, value, size,
1799                                        flags);
1800
1801         do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
1802                "%s|%s", path, name);
1803
1804         return result;
1805 }
1806
1807 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
1808                            struct connection_struct *conn, const char *path,
1809                            const char *name, const void *value, size_t size,
1810                            int flags)
1811 {
1812         int result;
1813
1814         result = SMB_VFS_NEXT_LSETXATTR(handle, conn, path, name, value, size,
1815                                         flags);
1816
1817         do_log(SMB_VFS_OP_LSETXATTR, (result >= 0), handle,
1818                "%s|%s", path, name);
1819
1820         return result;
1821 }
1822
1823 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
1824                            struct files_struct *fsp, int fd, const char *name,
1825                            const void *value, size_t size, int flags)
1826 {
1827         int result;
1828
1829         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, fd, name, value, size,
1830                                         flags);
1831
1832         do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
1833                "%s|%s", fsp->fsp_name, name);
1834
1835         return result;
1836 }
1837
1838 NTSTATUS vfs_full_audit_init(void)
1839 {
1840         NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
1841                                         "full_audit", audit_op_tuples);
1842
1843         if (!NT_STATUS_IS_OK(ret))
1844                 return ret;
1845
1846         vfs_full_audit_debug_level = debug_add_class("full_audit");
1847         if (vfs_full_audit_debug_level == -1) {
1848                 vfs_full_audit_debug_level = DBGC_VFS;
1849                 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
1850                           "class!\n"));
1851         } else {
1852                 DEBUG(10, ("vfs_full_audit: Debug class number of "
1853                            "'full_audit': %d\n", vfs_full_audit_debug_level));
1854         }
1855
1856         return ret;
1857 }
1858