source3/modules/vfs_full_audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log selected file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2000
   6  * Copyright (C) Alexander Bokovoy, 2002
   7  * Copyright (C) John H Terpstra, 2003
   8  * Copyright (C) Stefan (metze) Metzmacher, 2003
   9  * Copyright (C) Volker Lendecke, 2004
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 3 of the License, or
  14  * (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /*
  26  * This module implements parseable logging for all Samba VFS operations.
  27  *
  28  * You use it as follows:
  29  *
  30  * [tmp]
  31  * path = /tmp
  32  * vfs objects = full_audit
  33  * full_audit:prefix = %u|%I
  34  * full_audit:success = open opendir
  35  * full_audit:failure = all
  36  *
  37  * vfs op can be "all" which means log all operations.
  38  * vfs op can be "none" which means no logging.
  39  *
  40  * This leads to syslog entries of the form:
  41  * smbd_audit: nobody|192.168.234.1|opendir|ok|.
  42  * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
  43  *
  44  * where "nobody" is the connected username and "192.168.234.1" is the
  45  * client's IP address.
  46  *
  47  * Options:
  48  *
  49  * prefix: A macro expansion template prepended to the syslog entry.
  50  *
  51  * success: A list of VFS operations for which a successful completion should
  52  * be logged. Defaults to no logging at all. The special operation "all" logs
  53  * - you guessed it - everything.
  54  *
  55  * failure: A list of VFS operations for which failure to complete should be
  56  * logged. Defaults to logging everything.
  57  */
  58
  59
  60 #include "includes.h"
  61
  62 static int vfs_full_audit_debug_level = DBGC_VFS;
  63
  64 struct vfs_full_audit_private_data {
  65         struct bitmap *success_ops;
  66         struct bitmap *failure_ops;
  67 };
  68
  69 #undef DBGC_CLASS
  70 #define DBGC_CLASS vfs_full_audit_debug_level
  71
  72 /* Function prototypes */
  73
  74 static int smb_full_audit_connect(vfs_handle_struct *handle,
  75                          const char *svc, const char *user);
  76 static void smb_full_audit_disconnect(vfs_handle_struct *handle);
  77 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
  78                                     const char *path,
  79                                     bool small_query, uint64_t *bsize,
  80                                     uint64_t *dfree, uint64_t *dsize);
  81 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
  82                            enum SMB_QUOTA_TYPE qtype, unid_t id,
  83                            SMB_DISK_QUOTA *qt);
  84 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
  85                            enum SMB_QUOTA_TYPE qtype, unid_t id,
  86                            SMB_DISK_QUOTA *qt);
  87 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
  88                                 struct files_struct *fsp,
  89                                 SHADOW_COPY_DATA *shadow_copy_data, bool labels);
  90 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
  91                                 const char *path,
  92                                 struct vfs_statvfs_struct *statbuf);
  93
  94 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
  95                           const char *fname, const char *mask, uint32 attr);
  96 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
  97                                     SMB_STRUCT_DIR *dirp,
  98                                     SMB_STRUCT_STAT *sbuf);
  99 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
 100                         SMB_STRUCT_DIR *dirp, long offset);
 101 static long smb_full_audit_telldir(vfs_handle_struct *handle,
 102                         SMB_STRUCT_DIR *dirp);
 103 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
 104                         SMB_STRUCT_DIR *dirp);
 105 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
 106                        const char *path, mode_t mode);
 107 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
 108                        const char *path);
 109 static int smb_full_audit_closedir(vfs_handle_struct *handle,
 110                           SMB_STRUCT_DIR *dirp);
 111 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
 112                         SMB_STRUCT_DIR *dirp);
 113 static int smb_full_audit_open(vfs_handle_struct *handle,
 114                       const char *fname, files_struct *fsp, int flags, mode_t mode);
 115 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
 116                                       struct smb_request *req,
 117                                       uint16_t root_dir_fid,
 118                                       const char *fname,
 119                                       uint32_t create_file_flags,
 120                                       uint32_t access_mask,
 121                                       uint32_t share_access,
 122                                       uint32_t create_disposition,
 123                                       uint32_t create_options,
 124                                       uint32_t file_attributes,
 125                                       uint32_t oplock_request,
 126                                       uint64_t allocation_size,
 127                                       struct security_descriptor *sd,
 128                                       struct ea_list *ea_list,
 129                                       files_struct **result,
 130                                       int *pinfo,
 131                                       SMB_STRUCT_STAT *psbuf);
 132 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp);
 133 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
 134                           void *data, size_t n);
 135 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
 136                            void *data, size_t n, SMB_OFF_T offset);
 137 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
 138                            const void *data, size_t n);
 139 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
 140                             const void *data, size_t n,
 141                             SMB_OFF_T offset);
 142 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
 143                              SMB_OFF_T offset, int whence);
 144 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
 145                               files_struct *fromfsp,
 146                               const DATA_BLOB *hdr, SMB_OFF_T offset,
 147                               size_t n);
 148 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 149                               files_struct *tofsp,
 150                               SMB_OFF_T offset,
 151                               size_t n);
 152 static int smb_full_audit_rename(vfs_handle_struct *handle,
 153                         const char *oldname, const char *newname);
 154 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp);
 155 static int smb_full_audit_stat(vfs_handle_struct *handle,
 156                       const char *fname, SMB_STRUCT_STAT *sbuf);
 157 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
 158                        SMB_STRUCT_STAT *sbuf);
 159 static int smb_full_audit_lstat(vfs_handle_struct *handle,
 160                        const char *path, SMB_STRUCT_STAT *sbuf);
 161 static int smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
 162                        files_struct *fsp, const SMB_STRUCT_STAT *sbuf);
 163 static int smb_full_audit_unlink(vfs_handle_struct *handle,
 164                         const char *path);
 165 static int smb_full_audit_chmod(vfs_handle_struct *handle,
 166                        const char *path, mode_t mode);
 167 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
 168                         mode_t mode);
 169 static int smb_full_audit_chown(vfs_handle_struct *handle,
 170                        const char *path, uid_t uid, gid_t gid);
 171 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
 172                         uid_t uid, gid_t gid);
 173 static int smb_full_audit_lchown(vfs_handle_struct *handle,
 174                        const char *path, uid_t uid, gid_t gid);
 175 static int smb_full_audit_chdir(vfs_handle_struct *handle,
 176                        const char *path);
 177 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
 178                          char *path);
 179 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
 180                        const char *path, struct smb_file_time *ft);
 181 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
 182                            SMB_OFF_T len);
 183 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
 184                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type);
 185 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
 186                                        struct files_struct *fsp,
 187                                        uint32 share_mode);
 188 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
 189                                         int leasetype);
 190 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
 191                        SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid);
 192 static int smb_full_audit_symlink(vfs_handle_struct *handle,
 193                          const char *oldpath, const char *newpath);
 194 static int smb_full_audit_readlink(vfs_handle_struct *handle,
 195                           const char *path, char *buf, size_t bufsiz);
 196 static int smb_full_audit_link(vfs_handle_struct *handle,
 197                       const char *oldpath, const char *newpath);
 198 static int smb_full_audit_mknod(vfs_handle_struct *handle,
 199                        const char *pathname, mode_t mode, SMB_DEV_T dev);
 200 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
 201                             const char *path, char *resolved_path);
 202 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
 203                         struct sys_notify_context *ctx,
 204                         struct notify_entry *e,
 205                         void (*callback)(struct sys_notify_context *ctx,
 206                                         void *private_data,
 207                                         struct notify_event *ev),
 208                         void *private_data, void *handle_p);
 209 static int smb_full_audit_chflags(vfs_handle_struct *handle,
 210                             const char *path, unsigned int flags);
 211 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
 212                                                     SMB_DEV_T dev, SMB_INO_T inode);
 213 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
 214                                           struct files_struct *fsp,
 215                                           const char *fname,
 216                                           TALLOC_CTX *mem_ctx,
 217                                           unsigned int *pnum_streams,
 218                                           struct stream_struct **pstreams);
 219 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
 220                                             const char *path,
 221                                             const char *name,
 222                                             TALLOC_CTX *mem_ctx,
 223                                             char **found_name);
 224 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 225                                 uint32 security_info,
 226                                 SEC_DESC **ppdesc);
 227 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
 228                                const char *name, uint32 security_info,
 229                                SEC_DESC **ppdesc);
 230 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 231                               uint32 security_info_sent,
 232                               const SEC_DESC *psd);
 233 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
 234                            const char *path, mode_t mode);
 235 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
 236                                      mode_t mode);
 237 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
 238                                    SMB_ACL_T theacl, int entry_id,
 239                                    SMB_ACL_ENTRY_T *entry_p);
 240 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
 241                                       SMB_ACL_ENTRY_T entry_d,
 242                                       SMB_ACL_TAG_T *tag_type_p);
 243 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
 244                                      SMB_ACL_ENTRY_T entry_d,
 245                                      SMB_ACL_PERMSET_T *permset_p);
 246 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
 247                                           SMB_ACL_ENTRY_T entry_d);
 248 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
 249                                         const char *path_p,
 250                                         SMB_ACL_TYPE_T type);
 251 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
 252                                       files_struct *fsp);
 253 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
 254                                      SMB_ACL_PERMSET_T permset);
 255 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
 256                                   SMB_ACL_PERMSET_T permset,
 257                                   SMB_ACL_PERM_T perm);
 258 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
 259                                     SMB_ACL_T theacl,
 260                                     ssize_t *plen);
 261 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
 262                                     int count);
 263 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
 264                                       SMB_ACL_T *pacl,
 265                                       SMB_ACL_ENTRY_T *pentry);
 266 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
 267                                       SMB_ACL_ENTRY_T entry,
 268                                       SMB_ACL_TAG_T tagtype);
 269 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
 270                                        SMB_ACL_ENTRY_T entry,
 271                                        void *qual);
 272 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
 273                                      SMB_ACL_ENTRY_T entry,
 274                                      SMB_ACL_PERMSET_T permset);
 275 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
 276                                SMB_ACL_T theacl );
 277 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
 278                                   const char *name, SMB_ACL_TYPE_T acltype,
 279                                   SMB_ACL_T theacl);
 280 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
 281                                 SMB_ACL_T theacl);
 282 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
 283                                          const char *path);
 284 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
 285                                   SMB_ACL_PERMSET_T permset,
 286                                   SMB_ACL_PERM_T perm);
 287 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
 288                                    char *text);
 289 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
 290                                   SMB_ACL_T posix_acl);
 291 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
 292                                         void *qualifier,
 293                                         SMB_ACL_TAG_T tagtype);
 294 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
 295                               const char *path,
 296                               const char *name, void *value, size_t size);
 297 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
 298                                const char *path, const char *name,
 299                                void *value, size_t size);
 300 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
 301                                struct files_struct *fsp,
 302                                const char *name, void *value, size_t size);
 303 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
 304                                const char *path, char *list, size_t size);
 305 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
 306                                 const char *path, char *list, size_t size);
 307 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
 308                                 struct files_struct *fsp, char *list,
 309                                 size_t size);
 310 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
 311                              const char *path,
 312                              const char *name);
 313 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
 314                               const char *path,
 315                               const char *name);
 316 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
 317                               struct files_struct *fsp,
 318                               const char *name);
 319 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
 320                           const char *path,
 321                           const char *name, const void *value, size_t size,
 322                           int flags);
 323 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
 324                            const char *path,
 325                            const char *name, const void *value, size_t size,
 326                            int flags);
 327 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
 328                            struct files_struct *fsp, const char *name,
 329                            const void *value, size_t size, int flags);
 330
 331 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
 332 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
 333 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
 334 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
 335 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
 336 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb);
 337 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts);
 338
 339 /* VFS operations */
 340
 341 static vfs_op_tuple audit_op_tuples[] = {
 342
 343         /* Disk operations */
 344
 345         {SMB_VFS_OP(smb_full_audit_connect),    SMB_VFS_OP_CONNECT,
 346          SMB_VFS_LAYER_LOGGER},
 347         {SMB_VFS_OP(smb_full_audit_disconnect), SMB_VFS_OP_DISCONNECT,
 348          SMB_VFS_LAYER_LOGGER},
 349         {SMB_VFS_OP(smb_full_audit_disk_free),  SMB_VFS_OP_DISK_FREE,
 350          SMB_VFS_LAYER_LOGGER},
 351         {SMB_VFS_OP(smb_full_audit_get_quota),  SMB_VFS_OP_GET_QUOTA,
 352          SMB_VFS_LAYER_LOGGER},
 353         {SMB_VFS_OP(smb_full_audit_set_quota),  SMB_VFS_OP_SET_QUOTA,
 354          SMB_VFS_LAYER_LOGGER},
 355         {SMB_VFS_OP(smb_full_audit_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,
 356          SMB_VFS_LAYER_LOGGER},
 357         {SMB_VFS_OP(smb_full_audit_statvfs),    SMB_VFS_OP_STATVFS,
 358          SMB_VFS_LAYER_LOGGER},
 359
 360         /* Directory operations */
 361
 362         {SMB_VFS_OP(smb_full_audit_opendir),    SMB_VFS_OP_OPENDIR,
 363          SMB_VFS_LAYER_LOGGER},
 364         {SMB_VFS_OP(smb_full_audit_readdir),    SMB_VFS_OP_READDIR,
 365          SMB_VFS_LAYER_LOGGER},
 366         {SMB_VFS_OP(smb_full_audit_seekdir),    SMB_VFS_OP_SEEKDIR,
 367          SMB_VFS_LAYER_LOGGER},
 368         {SMB_VFS_OP(smb_full_audit_telldir),    SMB_VFS_OP_TELLDIR,
 369          SMB_VFS_LAYER_LOGGER},
 370         {SMB_VFS_OP(smb_full_audit_rewinddir),  SMB_VFS_OP_REWINDDIR,
 371          SMB_VFS_LAYER_LOGGER},
 372         {SMB_VFS_OP(smb_full_audit_mkdir),      SMB_VFS_OP_MKDIR,
 373          SMB_VFS_LAYER_LOGGER},
 374         {SMB_VFS_OP(smb_full_audit_rmdir),      SMB_VFS_OP_RMDIR,
 375          SMB_VFS_LAYER_LOGGER},
 376         {SMB_VFS_OP(smb_full_audit_closedir),   SMB_VFS_OP_CLOSEDIR,
 377          SMB_VFS_LAYER_LOGGER},
 378         {SMB_VFS_OP(smb_full_audit_init_search_op), SMB_VFS_OP_INIT_SEARCH_OP,
 379          SMB_VFS_LAYER_LOGGER},
 380
 381         /* File operations */
 382
 383         {SMB_VFS_OP(smb_full_audit_open),       SMB_VFS_OP_OPEN,
 384          SMB_VFS_LAYER_LOGGER},
 385         {SMB_VFS_OP(smb_full_audit_create_file),SMB_VFS_OP_CREATE_FILE,
 386          SMB_VFS_LAYER_LOGGER},
 387         {SMB_VFS_OP(smb_full_audit_close),      SMB_VFS_OP_CLOSE,
 388          SMB_VFS_LAYER_LOGGER},
 389         {SMB_VFS_OP(smb_full_audit_read),       SMB_VFS_OP_READ,
 390          SMB_VFS_LAYER_LOGGER},
 391         {SMB_VFS_OP(smb_full_audit_pread),      SMB_VFS_OP_PREAD,
 392          SMB_VFS_LAYER_LOGGER},
 393         {SMB_VFS_OP(smb_full_audit_write),      SMB_VFS_OP_WRITE,
 394          SMB_VFS_LAYER_LOGGER},
 395         {SMB_VFS_OP(smb_full_audit_pwrite),     SMB_VFS_OP_PWRITE,
 396          SMB_VFS_LAYER_LOGGER},
 397         {SMB_VFS_OP(smb_full_audit_lseek),      SMB_VFS_OP_LSEEK,
 398          SMB_VFS_LAYER_LOGGER},
 399         {SMB_VFS_OP(smb_full_audit_sendfile),   SMB_VFS_OP_SENDFILE,
 400          SMB_VFS_LAYER_LOGGER},
 401         {SMB_VFS_OP(smb_full_audit_recvfile),   SMB_VFS_OP_RECVFILE,
 402          SMB_VFS_LAYER_LOGGER},
 403         {SMB_VFS_OP(smb_full_audit_rename),     SMB_VFS_OP_RENAME,
 404          SMB_VFS_LAYER_LOGGER},
 405         {SMB_VFS_OP(smb_full_audit_fsync),      SMB_VFS_OP_FSYNC,
 406          SMB_VFS_LAYER_LOGGER},
 407         {SMB_VFS_OP(smb_full_audit_stat),       SMB_VFS_OP_STAT,
 408          SMB_VFS_LAYER_LOGGER},
 409         {SMB_VFS_OP(smb_full_audit_fstat),      SMB_VFS_OP_FSTAT,
 410          SMB_VFS_LAYER_LOGGER},
 411         {SMB_VFS_OP(smb_full_audit_lstat),      SMB_VFS_OP_LSTAT,
 412          SMB_VFS_LAYER_LOGGER},
 413         {SMB_VFS_OP(smb_full_audit_get_alloc_size),     SMB_VFS_OP_GET_ALLOC_SIZE,
 414          SMB_VFS_LAYER_LOGGER},
 415         {SMB_VFS_OP(smb_full_audit_unlink),     SMB_VFS_OP_UNLINK,
 416          SMB_VFS_LAYER_LOGGER},
 417         {SMB_VFS_OP(smb_full_audit_chmod),      SMB_VFS_OP_CHMOD,
 418          SMB_VFS_LAYER_LOGGER},
 419         {SMB_VFS_OP(smb_full_audit_fchmod),     SMB_VFS_OP_FCHMOD,
 420          SMB_VFS_LAYER_LOGGER},
 421         {SMB_VFS_OP(smb_full_audit_chown),      SMB_VFS_OP_CHOWN,
 422          SMB_VFS_LAYER_LOGGER},
 423         {SMB_VFS_OP(smb_full_audit_fchown),     SMB_VFS_OP_FCHOWN,
 424          SMB_VFS_LAYER_LOGGER},
 425         {SMB_VFS_OP(smb_full_audit_lchown),     SMB_VFS_OP_LCHOWN,
 426          SMB_VFS_LAYER_LOGGER},
 427         {SMB_VFS_OP(smb_full_audit_chdir),      SMB_VFS_OP_CHDIR,
 428          SMB_VFS_LAYER_LOGGER},
 429         {SMB_VFS_OP(smb_full_audit_getwd),      SMB_VFS_OP_GETWD,
 430          SMB_VFS_LAYER_LOGGER},
 431         {SMB_VFS_OP(smb_full_audit_ntimes),     SMB_VFS_OP_NTIMES,
 432          SMB_VFS_LAYER_LOGGER},
 433         {SMB_VFS_OP(smb_full_audit_ftruncate),  SMB_VFS_OP_FTRUNCATE,
 434          SMB_VFS_LAYER_LOGGER},
 435         {SMB_VFS_OP(smb_full_audit_lock),       SMB_VFS_OP_LOCK,
 436          SMB_VFS_LAYER_LOGGER},
 437         {SMB_VFS_OP(smb_full_audit_kernel_flock),       SMB_VFS_OP_KERNEL_FLOCK,
 438          SMB_VFS_LAYER_LOGGER},
 439         {SMB_VFS_OP(smb_full_audit_linux_setlease),       SMB_VFS_OP_LINUX_SETLEASE,
 440          SMB_VFS_LAYER_LOGGER},
 441         {SMB_VFS_OP(smb_full_audit_getlock),    SMB_VFS_OP_GETLOCK,
 442          SMB_VFS_LAYER_LOGGER},
 443         {SMB_VFS_OP(smb_full_audit_symlink),    SMB_VFS_OP_SYMLINK,
 444          SMB_VFS_LAYER_LOGGER},
 445         {SMB_VFS_OP(smb_full_audit_readlink),   SMB_VFS_OP_READLINK,
 446          SMB_VFS_LAYER_LOGGER},
 447         {SMB_VFS_OP(smb_full_audit_link),       SMB_VFS_OP_LINK,
 448          SMB_VFS_LAYER_LOGGER},
 449         {SMB_VFS_OP(smb_full_audit_mknod),      SMB_VFS_OP_MKNOD,
 450          SMB_VFS_LAYER_LOGGER},
 451         {SMB_VFS_OP(smb_full_audit_realpath),   SMB_VFS_OP_REALPATH,
 452          SMB_VFS_LAYER_LOGGER},
 453         {SMB_VFS_OP(smb_full_audit_notify_watch),SMB_VFS_OP_NOTIFY_WATCH,
 454          SMB_VFS_LAYER_LOGGER},
 455         {SMB_VFS_OP(smb_full_audit_chflags),    SMB_VFS_OP_CHFLAGS,
 456          SMB_VFS_LAYER_LOGGER},
 457         {SMB_VFS_OP(smb_full_audit_file_id_create),     SMB_VFS_OP_FILE_ID_CREATE,
 458          SMB_VFS_LAYER_LOGGER},
 459         {SMB_VFS_OP(smb_full_audit_streaminfo), SMB_VFS_OP_STREAMINFO,
 460          SMB_VFS_LAYER_LOGGER},
 461         {SMB_VFS_OP(smb_full_audit_get_real_filename), SMB_VFS_OP_GET_REAL_FILENAME,
 462          SMB_VFS_LAYER_LOGGER},
 463
 464         /* NT ACL operations. */
 465
 466         {SMB_VFS_OP(smb_full_audit_fget_nt_acl),        SMB_VFS_OP_FGET_NT_ACL,
 467          SMB_VFS_LAYER_LOGGER},
 468         {SMB_VFS_OP(smb_full_audit_get_nt_acl), SMB_VFS_OP_GET_NT_ACL,
 469          SMB_VFS_LAYER_LOGGER},
 470         {SMB_VFS_OP(smb_full_audit_fset_nt_acl),        SMB_VFS_OP_FSET_NT_ACL,
 471          SMB_VFS_LAYER_LOGGER},
 472
 473         /* POSIX ACL operations. */
 474
 475         {SMB_VFS_OP(smb_full_audit_chmod_acl),  SMB_VFS_OP_CHMOD_ACL,
 476          SMB_VFS_LAYER_LOGGER},
 477         {SMB_VFS_OP(smb_full_audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL,
 478          SMB_VFS_LAYER_LOGGER},
 479         {SMB_VFS_OP(smb_full_audit_sys_acl_get_entry),  SMB_VFS_OP_SYS_ACL_GET_ENTRY,
 480          SMB_VFS_LAYER_LOGGER},
 481         {SMB_VFS_OP(smb_full_audit_sys_acl_get_tag_type),       SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,
 482          SMB_VFS_LAYER_LOGGER},
 483         {SMB_VFS_OP(smb_full_audit_sys_acl_get_permset),        SMB_VFS_OP_SYS_ACL_GET_PERMSET,
 484          SMB_VFS_LAYER_LOGGER},
 485         {SMB_VFS_OP(smb_full_audit_sys_acl_get_qualifier),      SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,
 486          SMB_VFS_LAYER_LOGGER},
 487         {SMB_VFS_OP(smb_full_audit_sys_acl_get_file),   SMB_VFS_OP_SYS_ACL_GET_FILE,
 488          SMB_VFS_LAYER_LOGGER},
 489 {SMB_VFS_OP(smb_full_audit_sys_acl_get_fd),     SMB_VFS_OP_SYS_ACL_GET_FD,
 490          SMB_VFS_LAYER_LOGGER},
 491         {SMB_VFS_OP(smb_full_audit_sys_acl_clear_perms),        SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,
 492          SMB_VFS_LAYER_LOGGER},
 493         {SMB_VFS_OP(smb_full_audit_sys_acl_add_perm),   SMB_VFS_OP_SYS_ACL_ADD_PERM,
 494          SMB_VFS_LAYER_LOGGER},
 495         {SMB_VFS_OP(smb_full_audit_sys_acl_to_text),    SMB_VFS_OP_SYS_ACL_TO_TEXT,
 496          SMB_VFS_LAYER_LOGGER},
 497         {SMB_VFS_OP(smb_full_audit_sys_acl_init),       SMB_VFS_OP_SYS_ACL_INIT,
 498          SMB_VFS_LAYER_LOGGER},
 499         {SMB_VFS_OP(smb_full_audit_sys_acl_create_entry),       SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,
 500          SMB_VFS_LAYER_LOGGER},
 501         {SMB_VFS_OP(smb_full_audit_sys_acl_set_tag_type),       SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,
 502          SMB_VFS_LAYER_LOGGER},
 503         {SMB_VFS_OP(smb_full_audit_sys_acl_set_qualifier),      SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,
 504          SMB_VFS_LAYER_LOGGER},
 505         {SMB_VFS_OP(smb_full_audit_sys_acl_set_permset),        SMB_VFS_OP_SYS_ACL_SET_PERMSET,
 506          SMB_VFS_LAYER_LOGGER},
 507         {SMB_VFS_OP(smb_full_audit_sys_acl_valid),      SMB_VFS_OP_SYS_ACL_VALID,
 508          SMB_VFS_LAYER_LOGGER},
 509         {SMB_VFS_OP(smb_full_audit_sys_acl_set_file),   SMB_VFS_OP_SYS_ACL_SET_FILE,
 510          SMB_VFS_LAYER_LOGGER},
 511         {SMB_VFS_OP(smb_full_audit_sys_acl_set_fd),     SMB_VFS_OP_SYS_ACL_SET_FD,
 512          SMB_VFS_LAYER_LOGGER},
 513         {SMB_VFS_OP(smb_full_audit_sys_acl_delete_def_file),    SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
 514          SMB_VFS_LAYER_LOGGER},
 515         {SMB_VFS_OP(smb_full_audit_sys_acl_get_perm),   SMB_VFS_OP_SYS_ACL_GET_PERM,
 516          SMB_VFS_LAYER_LOGGER},
 517         {SMB_VFS_OP(smb_full_audit_sys_acl_free_text),  SMB_VFS_OP_SYS_ACL_FREE_TEXT,
 518          SMB_VFS_LAYER_LOGGER},
 519         {SMB_VFS_OP(smb_full_audit_sys_acl_free_acl),   SMB_VFS_OP_SYS_ACL_FREE_ACL,
 520          SMB_VFS_LAYER_LOGGER},
 521         {SMB_VFS_OP(smb_full_audit_sys_acl_free_qualifier),     SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,
 522          SMB_VFS_LAYER_LOGGER},
 523
 524         /* EA operations. */
 525
 526         {SMB_VFS_OP(smb_full_audit_getxattr),   SMB_VFS_OP_GETXATTR,
 527          SMB_VFS_LAYER_LOGGER},
 528         {SMB_VFS_OP(smb_full_audit_lgetxattr),  SMB_VFS_OP_LGETXATTR,
 529          SMB_VFS_LAYER_LOGGER},
 530         {SMB_VFS_OP(smb_full_audit_fgetxattr),  SMB_VFS_OP_FGETXATTR,
 531          SMB_VFS_LAYER_LOGGER},
 532         {SMB_VFS_OP(smb_full_audit_listxattr),  SMB_VFS_OP_LISTXATTR,
 533          SMB_VFS_LAYER_LOGGER},
 534         {SMB_VFS_OP(smb_full_audit_llistxattr), SMB_VFS_OP_LLISTXATTR,
 535          SMB_VFS_LAYER_LOGGER},
 536         {SMB_VFS_OP(smb_full_audit_flistxattr), SMB_VFS_OP_FLISTXATTR,
 537          SMB_VFS_LAYER_LOGGER},
 538         {SMB_VFS_OP(smb_full_audit_removexattr),        SMB_VFS_OP_REMOVEXATTR,
 539          SMB_VFS_LAYER_LOGGER},
 540         {SMB_VFS_OP(smb_full_audit_lremovexattr),       SMB_VFS_OP_LREMOVEXATTR,
 541          SMB_VFS_LAYER_LOGGER},
 542         {SMB_VFS_OP(smb_full_audit_fremovexattr),       SMB_VFS_OP_FREMOVEXATTR,
 543          SMB_VFS_LAYER_LOGGER},
 544         {SMB_VFS_OP(smb_full_audit_setxattr),   SMB_VFS_OP_SETXATTR,
 545          SMB_VFS_LAYER_LOGGER},
 546         {SMB_VFS_OP(smb_full_audit_lsetxattr),  SMB_VFS_OP_LSETXATTR,
 547          SMB_VFS_LAYER_LOGGER},
 548         {SMB_VFS_OP(smb_full_audit_fsetxattr),  SMB_VFS_OP_FSETXATTR,
 549          SMB_VFS_LAYER_LOGGER},
 550
 551         {SMB_VFS_OP(smb_full_audit_aio_read),   SMB_VFS_OP_AIO_READ,
 552          SMB_VFS_LAYER_LOGGER},
 553         {SMB_VFS_OP(smb_full_audit_aio_write),  SMB_VFS_OP_AIO_WRITE,
 554          SMB_VFS_LAYER_LOGGER},
 555         {SMB_VFS_OP(smb_full_audit_aio_return), SMB_VFS_OP_AIO_RETURN,
 556          SMB_VFS_LAYER_LOGGER},
 557         {SMB_VFS_OP(smb_full_audit_aio_cancel), SMB_VFS_OP_AIO_CANCEL,
 558          SMB_VFS_LAYER_LOGGER},
 559         {SMB_VFS_OP(smb_full_audit_aio_error),  SMB_VFS_OP_AIO_ERROR,
 560          SMB_VFS_LAYER_LOGGER},
 561         {SMB_VFS_OP(smb_full_audit_aio_fsync),  SMB_VFS_OP_AIO_FSYNC,
 562          SMB_VFS_LAYER_LOGGER},
 563         {SMB_VFS_OP(smb_full_audit_aio_suspend),SMB_VFS_OP_AIO_SUSPEND,
 564          SMB_VFS_LAYER_LOGGER},
 565
 566         /* Finish VFS operations definition */
 567
 568         {SMB_VFS_OP(NULL),              SMB_VFS_OP_NOOP,
 569          SMB_VFS_LAYER_NOOP}
 570 };
 571
 572 /* The following array *must* be in the same order as defined in vfs.h */
 573
 574 static struct {
 575         vfs_op_type type;
 576         const char *name;
 577 } vfs_op_names[] = {
 578         { SMB_VFS_OP_CONNECT,   "connect" },
 579         { SMB_VFS_OP_DISCONNECT,        "disconnect" },
 580         { SMB_VFS_OP_DISK_FREE, "disk_free" },
 581         { SMB_VFS_OP_GET_QUOTA, "get_quota" },
 582         { SMB_VFS_OP_SET_QUOTA, "set_quota" },
 583         { SMB_VFS_OP_GET_SHADOW_COPY_DATA,      "get_shadow_copy_data" },
 584         { SMB_VFS_OP_STATVFS,   "statvfs" },
 585         { SMB_VFS_OP_FS_CAPABILITIES,   "fs_capabilities" },
 586         { SMB_VFS_OP_OPENDIR,   "opendir" },
 587         { SMB_VFS_OP_READDIR,   "readdir" },
 588         { SMB_VFS_OP_SEEKDIR,   "seekdir" },
 589         { SMB_VFS_OP_TELLDIR,   "telldir" },
 590         { SMB_VFS_OP_REWINDDIR, "rewinddir" },
 591         { SMB_VFS_OP_MKDIR,     "mkdir" },
 592         { SMB_VFS_OP_RMDIR,     "rmdir" },
 593         { SMB_VFS_OP_CLOSEDIR,  "closedir" },
 594         { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
 595         { SMB_VFS_OP_OPEN,      "open" },
 596         { SMB_VFS_OP_CREATE_FILE, "create_file" },
 597         { SMB_VFS_OP_CLOSE,     "close" },
 598         { SMB_VFS_OP_READ,      "read" },
 599         { SMB_VFS_OP_PREAD,     "pread" },
 600         { SMB_VFS_OP_WRITE,     "write" },
 601         { SMB_VFS_OP_PWRITE,    "pwrite" },
 602         { SMB_VFS_OP_LSEEK,     "lseek" },
 603         { SMB_VFS_OP_SENDFILE,  "sendfile" },
 604         { SMB_VFS_OP_RECVFILE,  "recvfile" },
 605         { SMB_VFS_OP_RENAME,    "rename" },
 606         { SMB_VFS_OP_FSYNC,     "fsync" },
 607         { SMB_VFS_OP_STAT,      "stat" },
 608         { SMB_VFS_OP_FSTAT,     "fstat" },
 609         { SMB_VFS_OP_LSTAT,     "lstat" },
 610         { SMB_VFS_OP_GET_ALLOC_SIZE,    "get_alloc_size" },
 611         { SMB_VFS_OP_UNLINK,    "unlink" },
 612         { SMB_VFS_OP_CHMOD,     "chmod" },
 613         { SMB_VFS_OP_FCHMOD,    "fchmod" },
 614         { SMB_VFS_OP_CHOWN,     "chown" },
 615         { SMB_VFS_OP_FCHOWN,    "fchown" },
 616         { SMB_VFS_OP_LCHOWN,    "lchown" },
 617         { SMB_VFS_OP_CHDIR,     "chdir" },
 618         { SMB_VFS_OP_GETWD,     "getwd" },
 619         { SMB_VFS_OP_NTIMES,    "ntimes" },
 620         { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
 621         { SMB_VFS_OP_LOCK,      "lock" },
 622         { SMB_VFS_OP_KERNEL_FLOCK,      "kernel_flock" },
 623         { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
 624         { SMB_VFS_OP_GETLOCK,   "getlock" },
 625         { SMB_VFS_OP_SYMLINK,   "symlink" },
 626         { SMB_VFS_OP_READLINK,  "readlink" },
 627         { SMB_VFS_OP_LINK,      "link" },
 628         { SMB_VFS_OP_MKNOD,     "mknod" },
 629         { SMB_VFS_OP_REALPATH,  "realpath" },
 630         { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
 631         { SMB_VFS_OP_CHFLAGS,   "chflags" },
 632         { SMB_VFS_OP_FILE_ID_CREATE,    "file_id_create" },
 633         { SMB_VFS_OP_STREAMINFO,        "streaminfo" },
 634         { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
 635         { SMB_VFS_OP_FGET_NT_ACL,       "fget_nt_acl" },
 636         { SMB_VFS_OP_GET_NT_ACL,        "get_nt_acl" },
 637         { SMB_VFS_OP_FSET_NT_ACL,       "fset_nt_acl" },
 638         { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
 639         { SMB_VFS_OP_FCHMOD_ACL,        "fchmod_acl" },
 640         { SMB_VFS_OP_SYS_ACL_GET_ENTRY, "sys_acl_get_entry" },
 641         { SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,      "sys_acl_get_tag_type" },
 642         { SMB_VFS_OP_SYS_ACL_GET_PERMSET,       "sys_acl_get_permset" },
 643         { SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,     "sys_acl_get_qualifier" },
 644         { SMB_VFS_OP_SYS_ACL_GET_FILE,  "sys_acl_get_file" },
 645         { SMB_VFS_OP_SYS_ACL_GET_FD,    "sys_acl_get_fd" },
 646         { SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,       "sys_acl_clear_perms" },
 647         { SMB_VFS_OP_SYS_ACL_ADD_PERM,  "sys_acl_add_perm" },
 648         { SMB_VFS_OP_SYS_ACL_TO_TEXT,   "sys_acl_to_text" },
 649         { SMB_VFS_OP_SYS_ACL_INIT,      "sys_acl_init" },
 650         { SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,      "sys_acl_create_entry" },
 651         { SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,      "sys_acl_set_tag_type" },
 652         { SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,     "sys_acl_set_qualifier" },
 653         { SMB_VFS_OP_SYS_ACL_SET_PERMSET,       "sys_acl_set_permset" },
 654         { SMB_VFS_OP_SYS_ACL_VALID,     "sys_acl_valid" },
 655         { SMB_VFS_OP_SYS_ACL_SET_FILE,  "sys_acl_set_file" },
 656         { SMB_VFS_OP_SYS_ACL_SET_FD,    "sys_acl_set_fd" },
 657         { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,   "sys_acl_delete_def_file" },
 658         { SMB_VFS_OP_SYS_ACL_GET_PERM,  "sys_acl_get_perm" },
 659         { SMB_VFS_OP_SYS_ACL_FREE_TEXT, "sys_acl_free_text" },
 660         { SMB_VFS_OP_SYS_ACL_FREE_ACL,  "sys_acl_free_acl" },
 661         { SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,    "sys_acl_free_qualifier" },
 662         { SMB_VFS_OP_GETXATTR,  "getxattr" },
 663         { SMB_VFS_OP_LGETXATTR, "lgetxattr" },
 664         { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
 665         { SMB_VFS_OP_LISTXATTR, "listxattr" },
 666         { SMB_VFS_OP_LLISTXATTR,        "llistxattr" },
 667         { SMB_VFS_OP_FLISTXATTR,        "flistxattr" },
 668         { SMB_VFS_OP_REMOVEXATTR,       "removexattr" },
 669         { SMB_VFS_OP_LREMOVEXATTR,      "lremovexattr" },
 670         { SMB_VFS_OP_FREMOVEXATTR,      "fremovexattr" },
 671         { SMB_VFS_OP_SETXATTR,  "setxattr" },
 672         { SMB_VFS_OP_LSETXATTR, "lsetxattr" },
 673         { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
 674         { SMB_VFS_OP_AIO_READ,  "aio_read" },
 675         { SMB_VFS_OP_AIO_WRITE, "aio_write" },
 676         { SMB_VFS_OP_AIO_RETURN,"aio_return" },
 677         { SMB_VFS_OP_AIO_CANCEL,"aio_cancel" },
 678         { SMB_VFS_OP_AIO_ERROR, "aio_error" },
 679         { SMB_VFS_OP_AIO_FSYNC, "aio_fsync" },
 680         { SMB_VFS_OP_AIO_SUSPEND,"aio_suspend" },
 681         { SMB_VFS_OP_AIO_FORCE, "aio_force" },
 682         { SMB_VFS_OP_IS_OFFLINE, "aio_is_offline" },
 683         { SMB_VFS_OP_SET_OFFLINE, "aio_set_offline" },
 684         { SMB_VFS_OP_LAST, NULL }
 685 };
 686
 687 static int audit_syslog_facility(vfs_handle_struct *handle)
 688 {
 689         static const struct enum_list enum_log_facilities[] = {
 690                 { LOG_USER, "USER" },
 691                 { LOG_LOCAL0, "LOCAL0" },
 692                 { LOG_LOCAL1, "LOCAL1" },
 693                 { LOG_LOCAL2, "LOCAL2" },
 694                 { LOG_LOCAL3, "LOCAL3" },
 695                 { LOG_LOCAL4, "LOCAL4" },
 696                 { LOG_LOCAL5, "LOCAL5" },
 697                 { LOG_LOCAL6, "LOCAL6" },
 698                 { LOG_LOCAL7, "LOCAL7" }
 699         };
 700
 701         int facility;
 702
 703         facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
 704
 705         return facility;
 706 }
 707
 708 static int audit_syslog_priority(vfs_handle_struct *handle)
 709 {
 710         static const struct enum_list enum_log_priorities[] = {
 711                 { LOG_EMERG, "EMERG" },
 712                 { LOG_ALERT, "ALERT" },
 713                 { LOG_CRIT, "CRIT" },
 714                 { LOG_ERR, "ERR" },
 715                 { LOG_WARNING, "WARNING" },
 716                 { LOG_NOTICE, "NOTICE" },
 717                 { LOG_INFO, "INFO" },
 718                 { LOG_DEBUG, "DEBUG" }
 719         };
 720
 721         int priority;
 722
 723         priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
 724                                 enum_log_priorities, LOG_NOTICE);
 725         if (priority == -1) {
 726                 priority = LOG_WARNING;
 727         }
 728
 729         return priority;
 730 }
 731
 732 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
 733 {
 734         char *prefix = NULL;
 735         char *result;
 736
 737         prefix = talloc_strdup(ctx,
 738                         lp_parm_const_string(SNUM(conn), "full_audit",
 739                                              "prefix", "%u|%I"));
 740         if (!prefix) {
 741                 return NULL;
 742         }
 743         result = talloc_sub_advanced(ctx,
 744                         lp_servicename(SNUM(conn)),
 745                         conn->server_info->unix_name,
 746                         conn->connectpath,
 747                         conn->server_info->utok.gid,
 748                         conn->server_info->sanitized_username,
 749                         pdb_get_domain(conn->server_info->sam_account),
 750                         prefix);
 751         TALLOC_FREE(prefix);
 752         return result;
 753 }
 754
 755 static bool log_success(vfs_handle_struct *handle, vfs_op_type op)
 756 {
 757         struct vfs_full_audit_private_data *pd = NULL;
 758
 759         SMB_VFS_HANDLE_GET_DATA(handle, pd,
 760                 struct vfs_full_audit_private_data,
 761                 return True);
 762
 763         if (pd->success_ops == NULL) {
 764                 return True;
 765         }
 766
 767         return bitmap_query(pd->success_ops, op);
 768 }
 769
 770 static bool log_failure(vfs_handle_struct *handle, vfs_op_type op)
 771 {
 772         struct vfs_full_audit_private_data *pd = NULL;
 773
 774         SMB_VFS_HANDLE_GET_DATA(handle, pd,
 775                 struct vfs_full_audit_private_data,
 776                 return True);
 777
 778         if (pd->failure_ops == NULL)
 779                 return True;
 780
 781         return bitmap_query(pd->failure_ops, op);
 782 }
 783
 784 static void init_bitmap(struct bitmap **bm, const char **ops)
 785 {
 786         bool log_all = False;
 787
 788         if (*bm != NULL)
 789                 return;
 790
 791         *bm = bitmap_allocate(SMB_VFS_OP_LAST);
 792
 793         if (*bm == NULL) {
 794                 DEBUG(0, ("Could not alloc bitmap -- "
 795                           "defaulting to logging everything\n"));
 796                 return;
 797         }
 798
 799         while (*ops != NULL) {
 800                 int i;
 801                 bool found = False;
 802
 803                 if (strequal(*ops, "all")) {
 804                         log_all = True;
 805                         break;
 806                 }
 807
 808                 if (strequal(*ops, "none")) {
 809                         break;
 810                 }
 811
 812                 for (i=0; i<SMB_VFS_OP_LAST; i++) {
 813                         if (vfs_op_names[i].name == NULL) {
 814                                 smb_panic("vfs_full_audit.c: name table not "
 815                                           "in sync with vfs.h\n");
 816                         }
 817
 818                         if (strequal(*ops, vfs_op_names[i].name)) {
 819                                 bitmap_set(*bm, i);
 820                                 found = True;
 821                         }
 822                 }
 823                 if (!found) {
 824                         DEBUG(0, ("Could not find opname %s, logging all\n",
 825                                   *ops));
 826                         log_all = True;
 827                         break;
 828                 }
 829                 ops += 1;
 830         }
 831
 832         if (log_all) {
 833                 /* The query functions default to True */
 834                 bitmap_free(*bm);
 835                 *bm = NULL;
 836         }
 837 }
 838
 839 static const char *audit_opname(vfs_op_type op)
 840 {
 841         if (op >= SMB_VFS_OP_LAST)
 842                 return "INVALID VFS OP";
 843         return vfs_op_names[op].name;
 844 }
 845
 846 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
 847                    const char *format, ...)
 848 {
 849         fstring err_msg;
 850         char *audit_pre = NULL;
 851         va_list ap;
 852         char *op_msg = NULL;
 853
 854         if (success && (!log_success(handle, op)))
 855                 return;
 856
 857         if (!success && (!log_failure(handle, op)))
 858                 return;
 859
 860         if (success)
 861                 fstrcpy(err_msg, "ok");
 862         else
 863                 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
 864
 865         va_start(ap, format);
 866         op_msg = talloc_vasprintf(talloc_tos(), format, ap);
 867         va_end(ap);
 868
 869         if (!op_msg) {
 870                 return;
 871         }
 872
 873         audit_pre = audit_prefix(talloc_tos(), handle->conn);
 874         syslog(audit_syslog_priority(handle), "%s|%s|%s|%s\n",
 875                 audit_pre ? audit_pre : "",
 876                 audit_opname(op), err_msg, op_msg);
 877
 878         TALLOC_FREE(audit_pre);
 879         TALLOC_FREE(op_msg);
 880
 881         return;
 882 }
 883
 884 /* Free function for the private data. */
 885
 886 static void free_private_data(void **p_data)
 887 {
 888         struct vfs_full_audit_private_data *pd = *(struct vfs_full_audit_private_data **)p_data;
 889
 890         if (pd->success_ops) {
 891                 bitmap_free(pd->success_ops);
 892         }
 893         if (pd->failure_ops) {
 894                 bitmap_free(pd->failure_ops);
 895         }
 896         SAFE_FREE(pd);
 897         *p_data = NULL;
 898 }
 899
 900 /* Implementation of vfs_ops.  Pass everything on to the default
 901    operation but log event first. */
 902
 903 static int smb_full_audit_connect(vfs_handle_struct *handle,
 904                          const char *svc, const char *user)
 905 {
 906         int result;
 907         struct vfs_full_audit_private_data *pd = NULL;
 908         const char *none[] = { NULL };
 909         const char *all [] = { "all" };
 910
 911         if (!handle) {
 912                 return -1;
 913         }
 914
 915         pd = SMB_MALLOC_P(struct vfs_full_audit_private_data);
 916         if (!pd) {
 917                 return -1;
 918         }
 919         ZERO_STRUCTP(pd);
 920
 921         openlog("smbd_audit", 0, audit_syslog_facility(handle));
 922
 923         init_bitmap(&pd->success_ops,
 924                     lp_parm_string_list(SNUM(handle->conn), "full_audit", "success",
 925                                         none));
 926         init_bitmap(&pd->failure_ops,
 927                     lp_parm_string_list(SNUM(handle->conn), "full_audit", "failure",
 928                                         all));
 929
 930         /* Store the private data. */
 931         SMB_VFS_HANDLE_SET_DATA(handle, pd, free_private_data,
 932                                 struct vfs_full_audit_private_data, return -1);
 933
 934         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 935
 936         do_log(SMB_VFS_OP_CONNECT, True, handle,
 937                "%s", svc);
 938
 939         return result;
 940 }
 941
 942 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
 943 {
 944         SMB_VFS_NEXT_DISCONNECT(handle);
 945
 946         do_log(SMB_VFS_OP_DISCONNECT, True, handle,
 947                "%s", lp_servicename(SNUM(handle->conn)));
 948
 949         /* The bitmaps will be disconnected when the private
 950            data is deleted. */
 951
 952         return;
 953 }
 954
 955 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
 956                                     const char *path,
 957                                     bool small_query, uint64_t *bsize,
 958                                     uint64_t *dfree, uint64_t *dsize)
 959 {
 960         uint64_t result;
 961
 962         result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
 963                                         dfree, dsize);
 964
 965         /* Don't have a reasonable notion of failure here */
 966
 967         do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
 968
 969         return result;
 970 }
 971
 972 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
 973                            enum SMB_QUOTA_TYPE qtype, unid_t id,
 974                            SMB_DISK_QUOTA *qt)
 975 {
 976         int result;
 977
 978         result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
 979
 980         do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
 981
 982         return result;
 983 }
 984
 985
 986 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
 987                            enum SMB_QUOTA_TYPE qtype, unid_t id,
 988                            SMB_DISK_QUOTA *qt)
 989 {
 990         int result;
 991
 992         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 993
 994         do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
 995
 996         return result;
 997 }
 998
 999 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
1000                                 struct files_struct *fsp,
1001                                 SHADOW_COPY_DATA *shadow_copy_data, bool labels)
1002 {
1003         int result;
1004
1005         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
1006
1007         do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
1008
1009         return result;
1010 }
1011
1012 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
1013                                 const char *path,
1014                                 struct vfs_statvfs_struct *statbuf)
1015 {
1016         int result;
1017
1018         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
1019
1020         do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
1021
1022         return result;
1023 }
1024
1025 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
1026                           const char *fname, const char *mask, uint32 attr)
1027 {
1028         SMB_STRUCT_DIR *result;
1029
1030         result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
1031
1032         do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
1033
1034         return result;
1035 }
1036
1037 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
1038                                     SMB_STRUCT_DIR *dirp, SMB_STRUCT_STAT *sbuf)
1039 {
1040         SMB_STRUCT_DIRENT *result;
1041
1042         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
1043
1044         /* This operation has no reasonable error condition
1045          * (End of dir is also failure), so always succeed.
1046          */
1047         do_log(SMB_VFS_OP_READDIR, True, handle, "");
1048
1049         return result;
1050 }
1051
1052 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
1053                         SMB_STRUCT_DIR *dirp, long offset)
1054 {
1055         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
1056
1057         do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
1058         return;
1059 }
1060
1061 static long smb_full_audit_telldir(vfs_handle_struct *handle,
1062                         SMB_STRUCT_DIR *dirp)
1063 {
1064         long result;
1065
1066         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
1067
1068         do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
1069
1070         return result;
1071 }
1072
1073 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
1074                         SMB_STRUCT_DIR *dirp)
1075 {
1076         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
1077
1078         do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
1079         return;
1080 }
1081
1082 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
1083                        const char *path, mode_t mode)
1084 {
1085         int result;
1086
1087         result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
1088
1089         do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
1090
1091         return result;
1092 }
1093
1094 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
1095                        const char *path)
1096 {
1097         int result;
1098
1099         result = SMB_VFS_NEXT_RMDIR(handle, path);
1100
1101         do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
1102
1103         return result;
1104 }
1105
1106 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1107                           SMB_STRUCT_DIR *dirp)
1108 {
1109         int result;
1110
1111         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1112
1113         do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1114
1115         return result;
1116 }
1117
1118 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
1119                         SMB_STRUCT_DIR *dirp)
1120 {
1121         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
1122
1123         do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
1124         return;
1125 }
1126
1127 static int smb_full_audit_open(vfs_handle_struct *handle,
1128                       const char *fname, files_struct *fsp, int flags, mode_t mode)
1129 {
1130         int result;
1131
1132         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
1133
1134         do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
1135                ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1136                fname);
1137
1138         return result;
1139 }
1140
1141 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1142                                       struct smb_request *req,
1143                                       uint16_t root_dir_fid,
1144                                       const char *fname,
1145                                       uint32_t create_file_flags,
1146                                       uint32_t access_mask,
1147                                       uint32_t share_access,
1148                                       uint32_t create_disposition,
1149                                       uint32_t create_options,
1150                                       uint32_t file_attributes,
1151                                       uint32_t oplock_request,
1152                                       uint64_t allocation_size,
1153                                       struct security_descriptor *sd,
1154                                       struct ea_list *ea_list,
1155                                       files_struct **result_fsp,
1156                                       int *pinfo,
1157                                       SMB_STRUCT_STAT *psbuf)
1158 {
1159         NTSTATUS result;
1160
1161         result = SMB_VFS_NEXT_CREATE_FILE(
1162                 handle,                                 /* handle */
1163                 req,                                    /* req */
1164                 root_dir_fid,                           /* root_dir_fid */
1165                 fname,                                  /* fname */
1166                 create_file_flags,                      /* create_file_flags */
1167                 access_mask,                            /* access_mask */
1168                 share_access,                           /* share_access */
1169                 create_disposition,                     /* create_disposition*/
1170                 create_options,                         /* create_options */
1171                 file_attributes,                        /* file_attributes */
1172                 oplock_request,                         /* oplock_request */
1173                 allocation_size,                        /* allocation_size */
1174                 sd,                                     /* sd */
1175                 ea_list,                                /* ea_list */
1176                 result_fsp,                             /* result */
1177                 pinfo,                                  /* pinfo */
1178                 psbuf);                                 /* psbuf */
1179
1180         do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle, "0x%x|%s",
1181                access_mask, fname);
1182
1183         return result;
1184 }
1185
1186 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1187 {
1188         int result;
1189
1190         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1191
1192         do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s", fsp->fsp_name);
1193
1194         return result;
1195 }
1196
1197 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
1198                           void *data, size_t n)
1199 {
1200         ssize_t result;
1201
1202         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
1203
1204         do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s", fsp->fsp_name);
1205
1206         return result;
1207 }
1208
1209 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1210                            void *data, size_t n, SMB_OFF_T offset)
1211 {
1212         ssize_t result;
1213
1214         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1215
1216         do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s", fsp->fsp_name);
1217
1218         return result;
1219 }
1220
1221 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
1222                            const void *data, size_t n)
1223 {
1224         ssize_t result;
1225
1226         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
1227
1228         do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1229
1230         return result;
1231 }
1232
1233 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1234                             const void *data, size_t n,
1235                             SMB_OFF_T offset)
1236 {
1237         ssize_t result;
1238
1239         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1240
1241         do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1242
1243         return result;
1244 }
1245
1246 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1247                              SMB_OFF_T offset, int whence)
1248 {
1249         ssize_t result;
1250
1251         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1252
1253         do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1254                "%s", fsp->fsp_name);
1255
1256         return result;
1257 }
1258
1259 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1260                               files_struct *fromfsp,
1261                               const DATA_BLOB *hdr, SMB_OFF_T offset,
1262                               size_t n)
1263 {
1264         ssize_t result;
1265
1266         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1267
1268         do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1269                "%s", fromfsp->fsp_name);
1270
1271         return result;
1272 }
1273
1274 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1275                       files_struct *tofsp,
1276                               SMB_OFF_T offset,
1277                               size_t n)
1278 {
1279         ssize_t result;
1280
1281         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1282
1283         do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1284                "%s", tofsp->fsp_name);
1285
1286         return result;
1287 }
1288
1289 static int smb_full_audit_rename(vfs_handle_struct *handle,
1290                         const char *oldname, const char *newname)
1291 {
1292         int result;
1293
1294         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
1295
1296         do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s", oldname, newname);
1297
1298         return result;
1299 }
1300
1301 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1302 {
1303         int result;
1304
1305         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1306
1307         do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s", fsp->fsp_name);
1308
1309         return result;
1310 }
1311
1312 static int smb_full_audit_stat(vfs_handle_struct *handle,
1313                       const char *fname, SMB_STRUCT_STAT *sbuf)
1314 {
1315         int result;
1316
1317         result = SMB_VFS_NEXT_STAT(handle, fname, sbuf);
1318
1319         do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s", fname);
1320
1321         return result;
1322 }
1323
1324 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1325                        SMB_STRUCT_STAT *sbuf)
1326 {
1327         int result;
1328
1329         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1330
1331         do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s", fsp->fsp_name);
1332
1333         return result;
1334 }
1335
1336 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1337                        const char *path, SMB_STRUCT_STAT *sbuf)
1338 {
1339         int result;
1340
1341         result = SMB_VFS_NEXT_LSTAT(handle, path, sbuf);
1342
1343         do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s", path);
1344
1345         return result;
1346 }
1347
1348 static int smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1349                        files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1350 {
1351         int result;
1352
1353         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1354
1355         do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result >= 0), handle, "%d", result);
1356
1357         return result;
1358 }
1359
1360 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1361                         const char *path)
1362 {
1363         int result;
1364
1365         result = SMB_VFS_NEXT_UNLINK(handle, path);
1366
1367         do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s", path);
1368
1369         return result;
1370 }
1371
1372 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1373                        const char *path, mode_t mode)
1374 {
1375         int result;
1376
1377         result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1378
1379         do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1380
1381         return result;
1382 }
1383
1384 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1385                         mode_t mode)
1386 {
1387         int result;
1388
1389         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1390
1391         do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1392                "%s|%o", fsp->fsp_name, mode);
1393
1394         return result;
1395 }
1396
1397 static int smb_full_audit_chown(vfs_handle_struct *handle,
1398                        const char *path, uid_t uid, gid_t gid)
1399 {
1400         int result;
1401
1402         result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1403
1404         do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1405                path, (long int)uid, (long int)gid);
1406
1407         return result;
1408 }
1409
1410 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1411                         uid_t uid, gid_t gid)
1412 {
1413         int result;
1414
1415         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1416
1417         do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1418                fsp->fsp_name, (long int)uid, (long int)gid);
1419
1420         return result;
1421 }
1422
1423 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1424                        const char *path, uid_t uid, gid_t gid)
1425 {
1426         int result;
1427
1428         result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1429
1430         do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1431                path, (long int)uid, (long int)gid);
1432
1433         return result;
1434 }
1435
1436 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1437                        const char *path)
1438 {
1439         int result;
1440
1441         result = SMB_VFS_NEXT_CHDIR(handle, path);
1442
1443         do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1444
1445         return result;
1446 }
1447
1448 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
1449                          char *path)
1450 {
1451         char *result;
1452
1453         result = SMB_VFS_NEXT_GETWD(handle, path);
1454
1455         do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s", path);
1456
1457         return result;
1458 }
1459
1460 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1461                        const char *path, struct smb_file_time *ft)
1462 {
1463         int result;
1464
1465         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1466
1467         do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s", path);
1468
1469         return result;
1470 }
1471
1472 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1473                            SMB_OFF_T len)
1474 {
1475         int result;
1476
1477         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1478
1479         do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1480                "%s", fsp->fsp_name);
1481
1482         return result;
1483 }
1484
1485 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1486                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1487 {
1488         bool result;
1489
1490         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1491
1492         do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp->fsp_name);
1493
1494         return result;
1495 }
1496
1497 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1498                                        struct files_struct *fsp,
1499                                        uint32 share_mode)
1500 {
1501         int result;
1502
1503         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode);
1504
1505         do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1506                fsp->fsp_name);
1507
1508         return result;
1509 }
1510
1511 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1512                                  int leasetype)
1513 {
1514         int result;
1515
1516         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1517
1518         do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1519                fsp->fsp_name);
1520
1521         return result;
1522 }
1523
1524 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1525                        SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid)
1526 {
1527         bool result;
1528
1529         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1530
1531         do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp->fsp_name);
1532
1533         return result;
1534 }
1535
1536 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1537                          const char *oldpath, const char *newpath)
1538 {
1539         int result;
1540
1541         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1542
1543         do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1544                "%s|%s", oldpath, newpath);
1545
1546         return result;
1547 }
1548
1549 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1550                           const char *path, char *buf, size_t bufsiz)
1551 {
1552         int result;
1553
1554         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1555
1556         do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1557
1558         return result;
1559 }
1560
1561 static int smb_full_audit_link(vfs_handle_struct *handle,
1562                       const char *oldpath, const char *newpath)
1563 {
1564         int result;
1565
1566         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1567
1568         do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1569                "%s|%s", oldpath, newpath);
1570
1571         return result;
1572 }
1573
1574 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1575                        const char *pathname, mode_t mode, SMB_DEV_T dev)
1576 {
1577         int result;
1578
1579         result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1580
1581         do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1582
1583         return result;
1584 }
1585
1586 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1587                             const char *path, char *resolved_path)
1588 {
1589         char *result;
1590
1591         result = SMB_VFS_NEXT_REALPATH(handle, path, resolved_path);
1592
1593         do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1594
1595         return result;
1596 }
1597
1598 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1599                         struct sys_notify_context *ctx,
1600                         struct notify_entry *e,
1601                         void (*callback)(struct sys_notify_context *ctx,
1602                                         void *private_data,
1603                                         struct notify_event *ev),
1604                         void *private_data, void *handle_p)
1605 {
1606         NTSTATUS result;
1607
1608         result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback, private_data, handle_p);
1609
1610         do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1611
1612         return result;
1613 }
1614
1615 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1616                             const char *path, unsigned int flags)
1617 {
1618         int result;
1619
1620         result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1621
1622         do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1623
1624         return result;
1625 }
1626
1627 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1628                                                     SMB_DEV_T dev, SMB_INO_T inode)
1629 {
1630         struct file_id id_zero;
1631         struct file_id result;
1632
1633         ZERO_STRUCT(id_zero);
1634
1635         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, dev, inode);
1636
1637         do_log(SMB_VFS_OP_FILE_ID_CREATE,
1638                !file_id_equal(&id_zero, &result),
1639                handle, "%s", file_id_string_tos(&result));
1640
1641         return result;
1642 }
1643
1644 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1645                                           struct files_struct *fsp,
1646                                           const char *fname,
1647                                           TALLOC_CTX *mem_ctx,
1648                                           unsigned int *pnum_streams,
1649                                           struct stream_struct **pstreams)
1650 {
1651         NTSTATUS result;
1652
1653         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1654                                          pnum_streams, pstreams);
1655
1656         do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1657                "%s", fname);
1658
1659         return result;
1660 }
1661
1662 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1663                                             const char *path,
1664                                             const char *name,
1665                                             TALLOC_CTX *mem_ctx,
1666                                             char **found_name)
1667 {
1668         int result;
1669
1670         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1671                                                 found_name);
1672
1673         do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1674                "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1675
1676         return result;
1677 }
1678
1679 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1680                                 uint32 security_info,
1681                                 SEC_DESC **ppdesc)
1682 {
1683         NTSTATUS result;
1684
1685         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1686
1687         do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1688                "%s", fsp->fsp_name);
1689
1690         return result;
1691 }
1692
1693 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1694                                           const char *name,
1695                                           uint32 security_info,
1696                                           SEC_DESC **ppdesc)
1697 {
1698         NTSTATUS result;
1699
1700         result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1701
1702         do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1703                "%s", name);
1704
1705         return result;
1706 }
1707
1708 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1709                               uint32 security_info_sent,
1710                               const SEC_DESC *psd)
1711 {
1712         NTSTATUS result;
1713
1714         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1715
1716         do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle, "%s", fsp->fsp_name);
1717
1718         return result;
1719 }
1720
1721 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1722                            const char *path, mode_t mode)
1723 {
1724         int result;
1725
1726         result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1727
1728         do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1729                "%s|%o", path, mode);
1730
1731         return result;
1732 }
1733
1734 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1735                                      mode_t mode)
1736 {
1737         int result;
1738
1739         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1740
1741         do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1742                "%s|%o", fsp->fsp_name, mode);
1743
1744         return result;
1745 }
1746
1747 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1748
1749                                    SMB_ACL_T theacl, int entry_id,
1750                                    SMB_ACL_ENTRY_T *entry_p)
1751 {
1752         int result;
1753
1754         result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1755                                                 entry_p);
1756
1757         do_log(SMB_VFS_OP_SYS_ACL_GET_ENTRY, (result >= 0), handle,
1758                "");
1759
1760         return result;
1761 }
1762
1763 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1764
1765                                       SMB_ACL_ENTRY_T entry_d,
1766                                       SMB_ACL_TAG_T *tag_type_p)
1767 {
1768         int result;
1769
1770         result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1771                                                    tag_type_p);
1772
1773         do_log(SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, (result >= 0), handle,
1774                "");
1775
1776         return result;
1777 }
1778
1779 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1780
1781                                      SMB_ACL_ENTRY_T entry_d,
1782                                      SMB_ACL_PERMSET_T *permset_p)
1783 {
1784         int result;
1785
1786         result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1787                                                   permset_p);
1788
1789         do_log(SMB_VFS_OP_SYS_ACL_GET_PERMSET, (result >= 0), handle,
1790                "");
1791
1792         return result;
1793 }
1794
1795 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1796
1797                                           SMB_ACL_ENTRY_T entry_d)
1798 {
1799         void *result;
1800
1801         result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1802
1803         do_log(SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, (result != NULL), handle,
1804                "");
1805
1806         return result;
1807 }
1808
1809 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1810                                         const char *path_p,
1811                                         SMB_ACL_TYPE_T type)
1812 {
1813         SMB_ACL_T result;
1814
1815         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1816
1817         do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1818                "%s", path_p);
1819
1820         return result;
1821 }
1822
1823 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1824                                       files_struct *fsp)
1825 {
1826         SMB_ACL_T result;
1827
1828         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1829
1830         do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1831                "%s", fsp->fsp_name);
1832
1833         return result;
1834 }
1835
1836 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1837
1838                                      SMB_ACL_PERMSET_T permset)
1839 {
1840         int result;
1841
1842         result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1843
1844         do_log(SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, (result >= 0), handle,
1845                "");
1846
1847         return result;
1848 }
1849
1850 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1851
1852                                   SMB_ACL_PERMSET_T permset,
1853                                   SMB_ACL_PERM_T perm)
1854 {
1855         int result;
1856
1857         result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1858
1859         do_log(SMB_VFS_OP_SYS_ACL_ADD_PERM, (result >= 0), handle,
1860                "");
1861
1862         return result;
1863 }
1864
1865 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
1866                                     SMB_ACL_T theacl,
1867                                     ssize_t *plen)
1868 {
1869         char * result;
1870
1871         result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
1872
1873         do_log(SMB_VFS_OP_SYS_ACL_TO_TEXT, (result != NULL), handle,
1874                "");
1875
1876         return result;
1877 }
1878
1879 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
1880
1881                                     int count)
1882 {
1883         SMB_ACL_T result;
1884
1885         result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
1886
1887         do_log(SMB_VFS_OP_SYS_ACL_INIT, (result != NULL), handle,
1888                "");
1889
1890         return result;
1891 }
1892
1893 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1894                                       SMB_ACL_T *pacl,
1895                                       SMB_ACL_ENTRY_T *pentry)
1896 {
1897         int result;
1898
1899         result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
1900
1901         do_log(SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, (result >= 0), handle,
1902                "");
1903
1904         return result;
1905 }
1906
1907 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1908
1909                                       SMB_ACL_ENTRY_T entry,
1910                                       SMB_ACL_TAG_T tagtype)
1911 {
1912         int result;
1913
1914         result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
1915                                                    tagtype);
1916
1917         do_log(SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, (result >= 0), handle,
1918                "");
1919
1920         return result;
1921 }
1922
1923 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1924
1925                                        SMB_ACL_ENTRY_T entry,
1926                                        void *qual)
1927 {
1928         int result;
1929
1930         result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
1931
1932         do_log(SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, (result >= 0), handle,
1933                "");
1934
1935         return result;
1936 }
1937
1938 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1939
1940                                      SMB_ACL_ENTRY_T entry,
1941                                      SMB_ACL_PERMSET_T permset)
1942 {
1943         int result;
1944
1945         result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
1946
1947         do_log(SMB_VFS_OP_SYS_ACL_SET_PERMSET, (result >= 0), handle,
1948                "");
1949
1950         return result;
1951 }
1952
1953 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
1954
1955                                SMB_ACL_T theacl )
1956 {
1957         int result;
1958
1959         result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
1960
1961         do_log(SMB_VFS_OP_SYS_ACL_VALID, (result >= 0), handle,
1962                "");
1963
1964         return result;
1965 }
1966
1967 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
1968
1969                                   const char *name, SMB_ACL_TYPE_T acltype,
1970                                   SMB_ACL_T theacl)
1971 {
1972         int result;
1973
1974         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1975                                                theacl);
1976
1977         do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
1978                "%s", name);
1979
1980         return result;
1981 }
1982
1983 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
1984                                 SMB_ACL_T theacl)
1985 {
1986         int result;
1987
1988         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1989
1990         do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
1991                "%s", fsp->fsp_name);
1992
1993         return result;
1994 }
1995
1996 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1997
1998                                          const char *path)
1999 {
2000         int result;
2001
2002         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2003
2004         do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2005                "%s", path);
2006
2007         return result;
2008 }
2009
2010 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
2011
2012                                   SMB_ACL_PERMSET_T permset,
2013                                   SMB_ACL_PERM_T perm)
2014 {
2015         int result;
2016
2017         result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
2018
2019         do_log(SMB_VFS_OP_SYS_ACL_GET_PERM, (result >= 0), handle,
2020                "");
2021
2022         return result;
2023 }
2024
2025 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
2026
2027                                    char *text)
2028 {
2029         int result;
2030
2031         result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
2032
2033         do_log(SMB_VFS_OP_SYS_ACL_FREE_TEXT, (result >= 0), handle,
2034                "");
2035
2036         return result;
2037 }
2038
2039 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
2040
2041                                   SMB_ACL_T posix_acl)
2042 {
2043         int result;
2044
2045         result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
2046
2047         do_log(SMB_VFS_OP_SYS_ACL_FREE_ACL, (result >= 0), handle,
2048                "");
2049
2050         return result;
2051 }
2052
2053 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
2054                                         void *qualifier,
2055                                         SMB_ACL_TAG_T tagtype)
2056 {
2057         int result;
2058
2059         result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
2060                                                      tagtype);
2061
2062         do_log(SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, (result >= 0), handle,
2063                "");
2064
2065         return result;
2066 }
2067
2068 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2069                               const char *path,
2070                               const char *name, void *value, size_t size)
2071 {
2072         ssize_t result;
2073
2074         result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2075
2076         do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2077                "%s|%s", path, name);
2078
2079         return result;
2080 }
2081
2082 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
2083                                const char *path, const char *name,
2084                                void *value, size_t size)
2085 {
2086         ssize_t result;
2087
2088         result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
2089
2090         do_log(SMB_VFS_OP_LGETXATTR, (result >= 0), handle,
2091                "%s|%s", path, name);
2092
2093         return result;
2094 }
2095
2096 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2097                                struct files_struct *fsp,
2098                                const char *name, void *value, size_t size)
2099 {
2100         ssize_t result;
2101
2102         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2103
2104         do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2105                "%s|%s", fsp->fsp_name, name);
2106
2107         return result;
2108 }
2109
2110 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2111                                const char *path, char *list, size_t size)
2112 {
2113         ssize_t result;
2114
2115         result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2116
2117         do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
2118
2119         return result;
2120 }
2121
2122 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
2123                                 const char *path, char *list, size_t size)
2124 {
2125         ssize_t result;
2126
2127         result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2128
2129         do_log(SMB_VFS_OP_LLISTXATTR, (result >= 0), handle, "%s", path);
2130
2131         return result;
2132 }
2133
2134 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2135                                 struct files_struct *fsp, char *list,
2136                                 size_t size)
2137 {
2138         ssize_t result;
2139
2140         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2141
2142         do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2143                "%s", fsp->fsp_name);
2144
2145         return result;
2146 }
2147
2148 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2149                              const char *path,
2150                              const char *name)
2151 {
2152         int result;
2153
2154         result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2155
2156         do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2157                "%s|%s", path, name);
2158
2159         return result;
2160 }
2161
2162 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
2163                               const char *path,
2164                               const char *name)
2165 {
2166         int result;
2167
2168         result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2169
2170         do_log(SMB_VFS_OP_LREMOVEXATTR, (result >= 0), handle,
2171                "%s|%s", path, name);
2172
2173         return result;
2174 }
2175
2176 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2177                               struct files_struct *fsp,
2178                               const char *name)
2179 {
2180         int result;
2181
2182         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2183
2184         do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2185                "%s|%s", fsp->fsp_name, name);
2186
2187         return result;
2188 }
2189
2190 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2191                           const char *path,
2192                           const char *name, const void *value, size_t size,
2193                           int flags)
2194 {
2195         int result;
2196
2197         result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2198                                        flags);
2199
2200         do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2201                "%s|%s", path, name);
2202
2203         return result;
2204 }
2205
2206 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
2207                            const char *path,
2208                            const char *name, const void *value, size_t size,
2209                            int flags)
2210 {
2211         int result;
2212
2213         result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2214                                         flags);
2215
2216         do_log(SMB_VFS_OP_LSETXATTR, (result >= 0), handle,
2217                "%s|%s", path, name);
2218
2219         return result;
2220 }
2221
2222 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2223                            struct files_struct *fsp, const char *name,
2224                            const void *value, size_t size, int flags)
2225 {
2226         int result;
2227
2228         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2229
2230         do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2231                "%s|%s", fsp->fsp_name, name);
2232
2233         return result;
2234 }
2235
2236 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2237 {
2238         int result;
2239
2240         result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2241         do_log(SMB_VFS_OP_AIO_READ, (result >= 0), handle,
2242                 "%s", fsp->fsp_name);
2243
2244         return result;
2245 }
2246
2247 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2248 {
2249         int result;
2250
2251         result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2252         do_log(SMB_VFS_OP_AIO_WRITE, (result >= 0), handle,
2253                 "%s", fsp->fsp_name);
2254
2255         return result;
2256 }
2257
2258 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2259 {
2260         int result;
2261
2262         result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2263         do_log(SMB_VFS_OP_AIO_RETURN, (result >= 0), handle,
2264                 "%s", fsp->fsp_name);
2265
2266         return result;
2267 }
2268
2269 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2270 {
2271         int result;
2272
2273         result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2274         do_log(SMB_VFS_OP_AIO_CANCEL, (result >= 0), handle,
2275                 "%s", fsp->fsp_name);
2276
2277         return result;
2278 }
2279
2280 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2281 {
2282         int result;
2283
2284         result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2285         do_log(SMB_VFS_OP_AIO_ERROR, (result >= 0), handle,
2286                 "%s", fsp->fsp_name);
2287
2288         return result;
2289 }
2290
2291 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb)
2292 {
2293         int result;
2294
2295         result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2296         do_log(SMB_VFS_OP_AIO_FSYNC, (result >= 0), handle,
2297                 "%s", fsp->fsp_name);
2298
2299         return result;
2300 }
2301
2302 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts)
2303 {
2304         int result;
2305
2306         result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2307         do_log(SMB_VFS_OP_AIO_SUSPEND, (result >= 0), handle,
2308                 "%s", fsp->fsp_name);
2309
2310         return result;
2311 }
2312
2313
2314 NTSTATUS vfs_full_audit_init(void);
2315 NTSTATUS vfs_full_audit_init(void)
2316 {
2317         NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2318                                         "full_audit", audit_op_tuples);
2319
2320         if (!NT_STATUS_IS_OK(ret))
2321                 return ret;
2322
2323         vfs_full_audit_debug_level = debug_add_class("full_audit");
2324         if (vfs_full_audit_debug_level == -1) {
2325                 vfs_full_audit_debug_level = DBGC_VFS;
2326                 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2327                           "class!\n"));
2328         } else {
2329                 DEBUG(10, ("vfs_full_audit: Debug class number of "
2330                            "'full_audit': %d\n", vfs_full_audit_debug_level));
2331         }
2332
2333         return ret;
2334 }