s3: Added SMB_VFS_INIT_SEARCH_OP to initialize data at the beginning of SMB search...
[ira/wip.git] / source3 / modules / vfs_full_audit.c
1 /* 
2  * Auditing VFS module for samba.  Log selected file operations to syslog
3  * facility.
4  *
5  * Copyright (C) Tim Potter, 1999-2000
6  * Copyright (C) Alexander Bokovoy, 2002
7  * Copyright (C) John H Terpstra, 2003
8  * Copyright (C) Stefan (metze) Metzmacher, 2003
9  * Copyright (C) Volker Lendecke, 2004
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 3 of the License, or
14  * (at your option) any later version.
15  *  
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  * GNU General Public License for more details.
20  *  
21  * You should have received a copy of the GNU General Public License
22  * along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 /*
26  * This module implements parseable logging for all Samba VFS operations.
27  *
28  * You use it as follows:
29  *
30  * [tmp]
31  * path = /tmp
32  * vfs objects = full_audit
33  * full_audit:prefix = %u|%I
34  * full_audit:success = open opendir
35  * full_audit:failure = all
36  *
37  * vfs op can be "all" which means log all operations.
38  * vfs op can be "none" which means no logging.
39  *
40  * This leads to syslog entries of the form:
41  * smbd_audit: nobody|192.168.234.1|opendir|ok|.
42  * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
43  *
44  * where "nobody" is the connected username and "192.168.234.1" is the
45  * client's IP address. 
46  *
47  * Options:
48  *
49  * prefix: A macro expansion template prepended to the syslog entry.
50  *
51  * success: A list of VFS operations for which a successful completion should
52  * be logged. Defaults to no logging at all. The special operation "all" logs
53  * - you guessed it - everything.
54  *
55  * failure: A list of VFS operations for which failure to complete should be
56  * logged. Defaults to logging everything.
57  */
58
59
60 #include "includes.h"
61
62 static int vfs_full_audit_debug_level = DBGC_VFS;
63
64 struct vfs_full_audit_private_data {
65         struct bitmap *success_ops;
66         struct bitmap *failure_ops;
67 };
68
69 #undef DBGC_CLASS
70 #define DBGC_CLASS vfs_full_audit_debug_level
71
72 /* Function prototypes */
73
74 static int smb_full_audit_connect(vfs_handle_struct *handle,
75                          const char *svc, const char *user);
76 static void smb_full_audit_disconnect(vfs_handle_struct *handle);
77 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
78                                     const char *path,
79                                     bool small_query, uint64_t *bsize, 
80                                     uint64_t *dfree, uint64_t *dsize);
81 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
82                            enum SMB_QUOTA_TYPE qtype, unid_t id,
83                            SMB_DISK_QUOTA *qt);
84 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
85                            enum SMB_QUOTA_TYPE qtype, unid_t id,
86                            SMB_DISK_QUOTA *qt);
87 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
88                                 struct files_struct *fsp,
89                                 SHADOW_COPY_DATA *shadow_copy_data, bool labels);
90 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
91                                 const char *path,
92                                 struct vfs_statvfs_struct *statbuf);
93
94 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
95                           const char *fname, const char *mask, uint32 attr);
96 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
97                                     SMB_STRUCT_DIR *dirp,
98                                     SMB_STRUCT_STAT *sbuf);
99 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
100                         SMB_STRUCT_DIR *dirp, long offset);
101 static long smb_full_audit_telldir(vfs_handle_struct *handle,
102                         SMB_STRUCT_DIR *dirp);
103 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
104                         SMB_STRUCT_DIR *dirp);
105 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
106                        const char *path, mode_t mode);
107 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
108                        const char *path);
109 static int smb_full_audit_closedir(vfs_handle_struct *handle,
110                           SMB_STRUCT_DIR *dirp);
111 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
112                         SMB_STRUCT_DIR *dirp);
113 static int smb_full_audit_open(vfs_handle_struct *handle,
114                       const char *fname, files_struct *fsp, int flags, mode_t mode);
115 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
116                                       struct smb_request *req,
117                                       uint16_t root_dir_fid,
118                                       const char *fname,
119                                       uint32_t create_file_flags,
120                                       uint32_t access_mask,
121                                       uint32_t share_access,
122                                       uint32_t create_disposition,
123                                       uint32_t create_options,
124                                       uint32_t file_attributes,
125                                       uint32_t oplock_request,
126                                       uint64_t allocation_size,
127                                       struct security_descriptor *sd,
128                                       struct ea_list *ea_list,
129                                       files_struct **result,
130                                       int *pinfo,
131                                       SMB_STRUCT_STAT *psbuf);
132 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp);
133 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
134                           void *data, size_t n);
135 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
136                            void *data, size_t n, SMB_OFF_T offset);
137 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
138                            const void *data, size_t n);
139 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
140                             const void *data, size_t n,
141                             SMB_OFF_T offset);
142 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
143                              SMB_OFF_T offset, int whence);
144 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
145                               files_struct *fromfsp,
146                               const DATA_BLOB *hdr, SMB_OFF_T offset,
147                               size_t n);
148 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
149                               files_struct *tofsp,
150                               SMB_OFF_T offset,
151                               size_t n);
152 static int smb_full_audit_rename(vfs_handle_struct *handle,
153                         const char *oldname, const char *newname);
154 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp);
155 static int smb_full_audit_stat(vfs_handle_struct *handle,
156                       const char *fname, SMB_STRUCT_STAT *sbuf);
157 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
158                        SMB_STRUCT_STAT *sbuf);
159 static int smb_full_audit_lstat(vfs_handle_struct *handle,
160                        const char *path, SMB_STRUCT_STAT *sbuf);
161 static int smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
162                        files_struct *fsp, const SMB_STRUCT_STAT *sbuf);
163 static int smb_full_audit_unlink(vfs_handle_struct *handle,
164                         const char *path);
165 static int smb_full_audit_chmod(vfs_handle_struct *handle,
166                        const char *path, mode_t mode);
167 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
168                         mode_t mode);
169 static int smb_full_audit_chown(vfs_handle_struct *handle,
170                        const char *path, uid_t uid, gid_t gid);
171 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
172                         uid_t uid, gid_t gid);
173 static int smb_full_audit_lchown(vfs_handle_struct *handle,
174                        const char *path, uid_t uid, gid_t gid);
175 static int smb_full_audit_chdir(vfs_handle_struct *handle,
176                        const char *path);
177 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
178                          char *path);
179 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
180                        const char *path, struct smb_file_time *ft);
181 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
182                            SMB_OFF_T len);
183 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
184                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type);
185 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
186                                        struct files_struct *fsp,
187                                        uint32 share_mode);
188 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
189                                         int leasetype);
190 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
191                        SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid);
192 static int smb_full_audit_symlink(vfs_handle_struct *handle,
193                          const char *oldpath, const char *newpath);
194 static int smb_full_audit_readlink(vfs_handle_struct *handle,
195                           const char *path, char *buf, size_t bufsiz);
196 static int smb_full_audit_link(vfs_handle_struct *handle,
197                       const char *oldpath, const char *newpath);
198 static int smb_full_audit_mknod(vfs_handle_struct *handle,
199                        const char *pathname, mode_t mode, SMB_DEV_T dev);
200 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
201                             const char *path, char *resolved_path);
202 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
203                         struct sys_notify_context *ctx,
204                         struct notify_entry *e,
205                         void (*callback)(struct sys_notify_context *ctx,
206                                         void *private_data,
207                                         struct notify_event *ev),
208                         void *private_data, void *handle_p);
209 static int smb_full_audit_chflags(vfs_handle_struct *handle,
210                             const char *path, unsigned int flags);
211 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
212                                                     SMB_DEV_T dev, SMB_INO_T inode);
213 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
214                                           struct files_struct *fsp,
215                                           const char *fname,
216                                           TALLOC_CTX *mem_ctx,
217                                           unsigned int *pnum_streams,
218                                           struct stream_struct **pstreams);
219 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
220                                             const char *path,
221                                             const char *name,
222                                             TALLOC_CTX *mem_ctx,
223                                             char **found_name);
224 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
225                                 uint32 security_info,
226                                 SEC_DESC **ppdesc);
227 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
228                                const char *name, uint32 security_info,
229                                SEC_DESC **ppdesc);
230 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
231                               uint32 security_info_sent,
232                               const SEC_DESC *psd);
233 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
234                            const char *path, mode_t mode);
235 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
236                                      mode_t mode);
237 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
238                                    SMB_ACL_T theacl, int entry_id,
239                                    SMB_ACL_ENTRY_T *entry_p);
240 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
241                                       SMB_ACL_ENTRY_T entry_d,
242                                       SMB_ACL_TAG_T *tag_type_p);
243 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
244                                      SMB_ACL_ENTRY_T entry_d,
245                                      SMB_ACL_PERMSET_T *permset_p);
246 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
247                                           SMB_ACL_ENTRY_T entry_d);
248 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
249                                         const char *path_p,
250                                         SMB_ACL_TYPE_T type);
251 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
252                                       files_struct *fsp);
253 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
254                                      SMB_ACL_PERMSET_T permset);
255 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
256                                   SMB_ACL_PERMSET_T permset,
257                                   SMB_ACL_PERM_T perm);
258 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
259                                     SMB_ACL_T theacl,
260                                     ssize_t *plen);
261 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
262                                     int count);
263 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
264                                       SMB_ACL_T *pacl,
265                                       SMB_ACL_ENTRY_T *pentry);
266 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
267                                       SMB_ACL_ENTRY_T entry,
268                                       SMB_ACL_TAG_T tagtype);
269 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
270                                        SMB_ACL_ENTRY_T entry,
271                                        void *qual);
272 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
273                                      SMB_ACL_ENTRY_T entry,
274                                      SMB_ACL_PERMSET_T permset);
275 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
276                                SMB_ACL_T theacl );
277 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
278                                   const char *name, SMB_ACL_TYPE_T acltype,
279                                   SMB_ACL_T theacl);
280 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
281                                 SMB_ACL_T theacl);
282 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
283                                          const char *path);
284 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
285                                   SMB_ACL_PERMSET_T permset,
286                                   SMB_ACL_PERM_T perm);
287 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
288                                    char *text);
289 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
290                                   SMB_ACL_T posix_acl);
291 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
292                                         void *qualifier,
293                                         SMB_ACL_TAG_T tagtype);
294 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
295                               const char *path,
296                               const char *name, void *value, size_t size);
297 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
298                                const char *path, const char *name,
299                                void *value, size_t size);
300 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
301                                struct files_struct *fsp,
302                                const char *name, void *value, size_t size);
303 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
304                                const char *path, char *list, size_t size);
305 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
306                                 const char *path, char *list, size_t size);
307 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
308                                 struct files_struct *fsp, char *list,
309                                 size_t size);
310 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
311                              const char *path,
312                              const char *name);
313 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
314                               const char *path,
315                               const char *name);
316 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
317                               struct files_struct *fsp,
318                               const char *name);
319 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
320                           const char *path,
321                           const char *name, const void *value, size_t size,
322                           int flags);
323 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
324                            const char *path,
325                            const char *name, const void *value, size_t size,
326                            int flags);
327 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
328                            struct files_struct *fsp, const char *name,
329                            const void *value, size_t size, int flags);
330
331 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
332 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
333 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
334 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
335 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb);
336 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb);
337 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts);
338
339 /* VFS operations */
340
341 static vfs_op_tuple audit_op_tuples[] = {
342     
343         /* Disk operations */
344
345         {SMB_VFS_OP(smb_full_audit_connect),    SMB_VFS_OP_CONNECT,
346          SMB_VFS_LAYER_LOGGER},
347         {SMB_VFS_OP(smb_full_audit_disconnect), SMB_VFS_OP_DISCONNECT,
348          SMB_VFS_LAYER_LOGGER},
349         {SMB_VFS_OP(smb_full_audit_disk_free),  SMB_VFS_OP_DISK_FREE,
350          SMB_VFS_LAYER_LOGGER},
351         {SMB_VFS_OP(smb_full_audit_get_quota),  SMB_VFS_OP_GET_QUOTA,
352          SMB_VFS_LAYER_LOGGER},
353         {SMB_VFS_OP(smb_full_audit_set_quota),  SMB_VFS_OP_SET_QUOTA,
354          SMB_VFS_LAYER_LOGGER},
355         {SMB_VFS_OP(smb_full_audit_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,
356          SMB_VFS_LAYER_LOGGER},
357         {SMB_VFS_OP(smb_full_audit_statvfs),    SMB_VFS_OP_STATVFS,
358          SMB_VFS_LAYER_LOGGER},
359
360         /* Directory operations */
361
362         {SMB_VFS_OP(smb_full_audit_opendir),    SMB_VFS_OP_OPENDIR,
363          SMB_VFS_LAYER_LOGGER},
364         {SMB_VFS_OP(smb_full_audit_readdir),    SMB_VFS_OP_READDIR,
365          SMB_VFS_LAYER_LOGGER},
366         {SMB_VFS_OP(smb_full_audit_seekdir),    SMB_VFS_OP_SEEKDIR,
367          SMB_VFS_LAYER_LOGGER},
368         {SMB_VFS_OP(smb_full_audit_telldir),    SMB_VFS_OP_TELLDIR,
369          SMB_VFS_LAYER_LOGGER},
370         {SMB_VFS_OP(smb_full_audit_rewinddir),  SMB_VFS_OP_REWINDDIR,
371          SMB_VFS_LAYER_LOGGER},
372         {SMB_VFS_OP(smb_full_audit_mkdir),      SMB_VFS_OP_MKDIR,
373          SMB_VFS_LAYER_LOGGER},
374         {SMB_VFS_OP(smb_full_audit_rmdir),      SMB_VFS_OP_RMDIR,
375          SMB_VFS_LAYER_LOGGER},
376         {SMB_VFS_OP(smb_full_audit_closedir),   SMB_VFS_OP_CLOSEDIR,
377          SMB_VFS_LAYER_LOGGER},
378         {SMB_VFS_OP(smb_full_audit_init_search_op), SMB_VFS_OP_INIT_SEARCH_OP,
379          SMB_VFS_LAYER_LOGGER},
380
381         /* File operations */
382
383         {SMB_VFS_OP(smb_full_audit_open),       SMB_VFS_OP_OPEN,
384          SMB_VFS_LAYER_LOGGER},
385         {SMB_VFS_OP(smb_full_audit_create_file),SMB_VFS_OP_CREATE_FILE,
386          SMB_VFS_LAYER_LOGGER},
387         {SMB_VFS_OP(smb_full_audit_close),      SMB_VFS_OP_CLOSE,
388          SMB_VFS_LAYER_LOGGER},
389         {SMB_VFS_OP(smb_full_audit_read),       SMB_VFS_OP_READ,
390          SMB_VFS_LAYER_LOGGER},
391         {SMB_VFS_OP(smb_full_audit_pread),      SMB_VFS_OP_PREAD,
392          SMB_VFS_LAYER_LOGGER},
393         {SMB_VFS_OP(smb_full_audit_write),      SMB_VFS_OP_WRITE,
394          SMB_VFS_LAYER_LOGGER},
395         {SMB_VFS_OP(smb_full_audit_pwrite),     SMB_VFS_OP_PWRITE,
396          SMB_VFS_LAYER_LOGGER},
397         {SMB_VFS_OP(smb_full_audit_lseek),      SMB_VFS_OP_LSEEK,
398          SMB_VFS_LAYER_LOGGER},
399         {SMB_VFS_OP(smb_full_audit_sendfile),   SMB_VFS_OP_SENDFILE,
400          SMB_VFS_LAYER_LOGGER},
401         {SMB_VFS_OP(smb_full_audit_recvfile),   SMB_VFS_OP_RECVFILE,
402          SMB_VFS_LAYER_LOGGER},
403         {SMB_VFS_OP(smb_full_audit_rename),     SMB_VFS_OP_RENAME,
404          SMB_VFS_LAYER_LOGGER},
405         {SMB_VFS_OP(smb_full_audit_fsync),      SMB_VFS_OP_FSYNC,
406          SMB_VFS_LAYER_LOGGER},
407         {SMB_VFS_OP(smb_full_audit_stat),       SMB_VFS_OP_STAT,
408          SMB_VFS_LAYER_LOGGER},
409         {SMB_VFS_OP(smb_full_audit_fstat),      SMB_VFS_OP_FSTAT,
410          SMB_VFS_LAYER_LOGGER},
411         {SMB_VFS_OP(smb_full_audit_lstat),      SMB_VFS_OP_LSTAT,
412          SMB_VFS_LAYER_LOGGER},
413         {SMB_VFS_OP(smb_full_audit_get_alloc_size),     SMB_VFS_OP_GET_ALLOC_SIZE,
414          SMB_VFS_LAYER_LOGGER},
415         {SMB_VFS_OP(smb_full_audit_unlink),     SMB_VFS_OP_UNLINK,
416          SMB_VFS_LAYER_LOGGER},
417         {SMB_VFS_OP(smb_full_audit_chmod),      SMB_VFS_OP_CHMOD,
418          SMB_VFS_LAYER_LOGGER},
419         {SMB_VFS_OP(smb_full_audit_fchmod),     SMB_VFS_OP_FCHMOD,
420          SMB_VFS_LAYER_LOGGER},
421         {SMB_VFS_OP(smb_full_audit_chown),      SMB_VFS_OP_CHOWN,
422          SMB_VFS_LAYER_LOGGER},
423         {SMB_VFS_OP(smb_full_audit_fchown),     SMB_VFS_OP_FCHOWN,
424          SMB_VFS_LAYER_LOGGER},
425         {SMB_VFS_OP(smb_full_audit_lchown),     SMB_VFS_OP_LCHOWN,
426          SMB_VFS_LAYER_LOGGER},
427         {SMB_VFS_OP(smb_full_audit_chdir),      SMB_VFS_OP_CHDIR,
428          SMB_VFS_LAYER_LOGGER},
429         {SMB_VFS_OP(smb_full_audit_getwd),      SMB_VFS_OP_GETWD,
430          SMB_VFS_LAYER_LOGGER},
431         {SMB_VFS_OP(smb_full_audit_ntimes),     SMB_VFS_OP_NTIMES,
432          SMB_VFS_LAYER_LOGGER},
433         {SMB_VFS_OP(smb_full_audit_ftruncate),  SMB_VFS_OP_FTRUNCATE,
434          SMB_VFS_LAYER_LOGGER},
435         {SMB_VFS_OP(smb_full_audit_lock),       SMB_VFS_OP_LOCK,
436          SMB_VFS_LAYER_LOGGER},
437         {SMB_VFS_OP(smb_full_audit_kernel_flock),       SMB_VFS_OP_KERNEL_FLOCK,
438          SMB_VFS_LAYER_LOGGER},
439         {SMB_VFS_OP(smb_full_audit_linux_setlease),       SMB_VFS_OP_LINUX_SETLEASE,
440          SMB_VFS_LAYER_LOGGER},
441         {SMB_VFS_OP(smb_full_audit_getlock),    SMB_VFS_OP_GETLOCK,
442          SMB_VFS_LAYER_LOGGER},
443         {SMB_VFS_OP(smb_full_audit_symlink),    SMB_VFS_OP_SYMLINK,
444          SMB_VFS_LAYER_LOGGER},
445         {SMB_VFS_OP(smb_full_audit_readlink),   SMB_VFS_OP_READLINK,
446          SMB_VFS_LAYER_LOGGER},
447         {SMB_VFS_OP(smb_full_audit_link),       SMB_VFS_OP_LINK,
448          SMB_VFS_LAYER_LOGGER},
449         {SMB_VFS_OP(smb_full_audit_mknod),      SMB_VFS_OP_MKNOD,
450          SMB_VFS_LAYER_LOGGER},
451         {SMB_VFS_OP(smb_full_audit_realpath),   SMB_VFS_OP_REALPATH,
452          SMB_VFS_LAYER_LOGGER},
453         {SMB_VFS_OP(smb_full_audit_notify_watch),SMB_VFS_OP_NOTIFY_WATCH,
454          SMB_VFS_LAYER_LOGGER},
455         {SMB_VFS_OP(smb_full_audit_chflags),    SMB_VFS_OP_CHFLAGS,
456          SMB_VFS_LAYER_LOGGER},
457         {SMB_VFS_OP(smb_full_audit_file_id_create),     SMB_VFS_OP_FILE_ID_CREATE,
458          SMB_VFS_LAYER_LOGGER},
459         {SMB_VFS_OP(smb_full_audit_streaminfo), SMB_VFS_OP_STREAMINFO,
460          SMB_VFS_LAYER_LOGGER},
461         {SMB_VFS_OP(smb_full_audit_get_real_filename), SMB_VFS_OP_GET_REAL_FILENAME,
462          SMB_VFS_LAYER_LOGGER},
463
464         /* NT ACL operations. */
465
466         {SMB_VFS_OP(smb_full_audit_fget_nt_acl),        SMB_VFS_OP_FGET_NT_ACL,
467          SMB_VFS_LAYER_LOGGER},
468         {SMB_VFS_OP(smb_full_audit_get_nt_acl), SMB_VFS_OP_GET_NT_ACL,
469          SMB_VFS_LAYER_LOGGER},
470         {SMB_VFS_OP(smb_full_audit_fset_nt_acl),        SMB_VFS_OP_FSET_NT_ACL,
471          SMB_VFS_LAYER_LOGGER},
472
473         /* POSIX ACL operations. */
474
475         {SMB_VFS_OP(smb_full_audit_chmod_acl),  SMB_VFS_OP_CHMOD_ACL,
476          SMB_VFS_LAYER_LOGGER},
477         {SMB_VFS_OP(smb_full_audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL,
478          SMB_VFS_LAYER_LOGGER},
479         {SMB_VFS_OP(smb_full_audit_sys_acl_get_entry),  SMB_VFS_OP_SYS_ACL_GET_ENTRY,
480          SMB_VFS_LAYER_LOGGER},
481         {SMB_VFS_OP(smb_full_audit_sys_acl_get_tag_type),       SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,
482          SMB_VFS_LAYER_LOGGER},
483         {SMB_VFS_OP(smb_full_audit_sys_acl_get_permset),        SMB_VFS_OP_SYS_ACL_GET_PERMSET,
484          SMB_VFS_LAYER_LOGGER},
485         {SMB_VFS_OP(smb_full_audit_sys_acl_get_qualifier),      SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,
486          SMB_VFS_LAYER_LOGGER},
487         {SMB_VFS_OP(smb_full_audit_sys_acl_get_file),   SMB_VFS_OP_SYS_ACL_GET_FILE,
488          SMB_VFS_LAYER_LOGGER},
489 {SMB_VFS_OP(smb_full_audit_sys_acl_get_fd),     SMB_VFS_OP_SYS_ACL_GET_FD,
490          SMB_VFS_LAYER_LOGGER},
491         {SMB_VFS_OP(smb_full_audit_sys_acl_clear_perms),        SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,
492          SMB_VFS_LAYER_LOGGER},
493         {SMB_VFS_OP(smb_full_audit_sys_acl_add_perm),   SMB_VFS_OP_SYS_ACL_ADD_PERM,
494          SMB_VFS_LAYER_LOGGER},
495         {SMB_VFS_OP(smb_full_audit_sys_acl_to_text),    SMB_VFS_OP_SYS_ACL_TO_TEXT,
496          SMB_VFS_LAYER_LOGGER},
497         {SMB_VFS_OP(smb_full_audit_sys_acl_init),       SMB_VFS_OP_SYS_ACL_INIT,
498          SMB_VFS_LAYER_LOGGER},
499         {SMB_VFS_OP(smb_full_audit_sys_acl_create_entry),       SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,
500          SMB_VFS_LAYER_LOGGER},
501         {SMB_VFS_OP(smb_full_audit_sys_acl_set_tag_type),       SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,
502          SMB_VFS_LAYER_LOGGER},
503         {SMB_VFS_OP(smb_full_audit_sys_acl_set_qualifier),      SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,
504          SMB_VFS_LAYER_LOGGER},
505         {SMB_VFS_OP(smb_full_audit_sys_acl_set_permset),        SMB_VFS_OP_SYS_ACL_SET_PERMSET,
506          SMB_VFS_LAYER_LOGGER},
507         {SMB_VFS_OP(smb_full_audit_sys_acl_valid),      SMB_VFS_OP_SYS_ACL_VALID,
508          SMB_VFS_LAYER_LOGGER},
509         {SMB_VFS_OP(smb_full_audit_sys_acl_set_file),   SMB_VFS_OP_SYS_ACL_SET_FILE,
510          SMB_VFS_LAYER_LOGGER},
511         {SMB_VFS_OP(smb_full_audit_sys_acl_set_fd),     SMB_VFS_OP_SYS_ACL_SET_FD,
512          SMB_VFS_LAYER_LOGGER},
513         {SMB_VFS_OP(smb_full_audit_sys_acl_delete_def_file),    SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
514          SMB_VFS_LAYER_LOGGER},
515         {SMB_VFS_OP(smb_full_audit_sys_acl_get_perm),   SMB_VFS_OP_SYS_ACL_GET_PERM,
516          SMB_VFS_LAYER_LOGGER},
517         {SMB_VFS_OP(smb_full_audit_sys_acl_free_text),  SMB_VFS_OP_SYS_ACL_FREE_TEXT,
518          SMB_VFS_LAYER_LOGGER},
519         {SMB_VFS_OP(smb_full_audit_sys_acl_free_acl),   SMB_VFS_OP_SYS_ACL_FREE_ACL,
520          SMB_VFS_LAYER_LOGGER},
521         {SMB_VFS_OP(smb_full_audit_sys_acl_free_qualifier),     SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,
522          SMB_VFS_LAYER_LOGGER},
523         
524         /* EA operations. */
525
526         {SMB_VFS_OP(smb_full_audit_getxattr),   SMB_VFS_OP_GETXATTR,
527          SMB_VFS_LAYER_LOGGER},
528         {SMB_VFS_OP(smb_full_audit_lgetxattr),  SMB_VFS_OP_LGETXATTR,
529          SMB_VFS_LAYER_LOGGER},
530         {SMB_VFS_OP(smb_full_audit_fgetxattr),  SMB_VFS_OP_FGETXATTR,
531          SMB_VFS_LAYER_LOGGER},
532         {SMB_VFS_OP(smb_full_audit_listxattr),  SMB_VFS_OP_LISTXATTR,
533          SMB_VFS_LAYER_LOGGER},
534         {SMB_VFS_OP(smb_full_audit_llistxattr), SMB_VFS_OP_LLISTXATTR,
535          SMB_VFS_LAYER_LOGGER},
536         {SMB_VFS_OP(smb_full_audit_flistxattr), SMB_VFS_OP_FLISTXATTR,
537          SMB_VFS_LAYER_LOGGER},
538         {SMB_VFS_OP(smb_full_audit_removexattr),        SMB_VFS_OP_REMOVEXATTR,
539          SMB_VFS_LAYER_LOGGER},
540         {SMB_VFS_OP(smb_full_audit_lremovexattr),       SMB_VFS_OP_LREMOVEXATTR,
541          SMB_VFS_LAYER_LOGGER},
542         {SMB_VFS_OP(smb_full_audit_fremovexattr),       SMB_VFS_OP_FREMOVEXATTR,
543          SMB_VFS_LAYER_LOGGER},
544         {SMB_VFS_OP(smb_full_audit_setxattr),   SMB_VFS_OP_SETXATTR,
545          SMB_VFS_LAYER_LOGGER},
546         {SMB_VFS_OP(smb_full_audit_lsetxattr),  SMB_VFS_OP_LSETXATTR,
547          SMB_VFS_LAYER_LOGGER},
548         {SMB_VFS_OP(smb_full_audit_fsetxattr),  SMB_VFS_OP_FSETXATTR,
549          SMB_VFS_LAYER_LOGGER},
550         
551         {SMB_VFS_OP(smb_full_audit_aio_read),   SMB_VFS_OP_AIO_READ,
552          SMB_VFS_LAYER_LOGGER},
553         {SMB_VFS_OP(smb_full_audit_aio_write),  SMB_VFS_OP_AIO_WRITE,
554          SMB_VFS_LAYER_LOGGER},
555         {SMB_VFS_OP(smb_full_audit_aio_return), SMB_VFS_OP_AIO_RETURN,
556          SMB_VFS_LAYER_LOGGER},
557         {SMB_VFS_OP(smb_full_audit_aio_cancel), SMB_VFS_OP_AIO_CANCEL,
558          SMB_VFS_LAYER_LOGGER},
559         {SMB_VFS_OP(smb_full_audit_aio_error),  SMB_VFS_OP_AIO_ERROR,
560          SMB_VFS_LAYER_LOGGER},
561         {SMB_VFS_OP(smb_full_audit_aio_fsync),  SMB_VFS_OP_AIO_FSYNC,
562          SMB_VFS_LAYER_LOGGER},
563         {SMB_VFS_OP(smb_full_audit_aio_suspend),SMB_VFS_OP_AIO_SUSPEND,
564          SMB_VFS_LAYER_LOGGER},
565
566         /* Finish VFS operations definition */
567         
568         {SMB_VFS_OP(NULL),              SMB_VFS_OP_NOOP,
569          SMB_VFS_LAYER_NOOP}
570 };
571
572 /* The following array *must* be in the same order as defined in vfs.h */
573
574 static struct {
575         vfs_op_type type;
576         const char *name;
577 } vfs_op_names[] = {
578         { SMB_VFS_OP_CONNECT,   "connect" },
579         { SMB_VFS_OP_DISCONNECT,        "disconnect" },
580         { SMB_VFS_OP_DISK_FREE, "disk_free" },
581         { SMB_VFS_OP_GET_QUOTA, "get_quota" },
582         { SMB_VFS_OP_SET_QUOTA, "set_quota" },
583         { SMB_VFS_OP_GET_SHADOW_COPY_DATA,      "get_shadow_copy_data" },
584         { SMB_VFS_OP_STATVFS,   "statvfs" },
585         { SMB_VFS_OP_FS_CAPABILITIES,   "fs_capabilities" },
586         { SMB_VFS_OP_OPENDIR,   "opendir" },
587         { SMB_VFS_OP_READDIR,   "readdir" },
588         { SMB_VFS_OP_SEEKDIR,   "seekdir" },
589         { SMB_VFS_OP_TELLDIR,   "telldir" },
590         { SMB_VFS_OP_REWINDDIR, "rewinddir" },
591         { SMB_VFS_OP_MKDIR,     "mkdir" },
592         { SMB_VFS_OP_RMDIR,     "rmdir" },
593         { SMB_VFS_OP_CLOSEDIR,  "closedir" },
594         { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
595         { SMB_VFS_OP_OPEN,      "open" },
596         { SMB_VFS_OP_CREATE_FILE, "create_file" },
597         { SMB_VFS_OP_CLOSE,     "close" },
598         { SMB_VFS_OP_READ,      "read" },
599         { SMB_VFS_OP_PREAD,     "pread" },
600         { SMB_VFS_OP_WRITE,     "write" },
601         { SMB_VFS_OP_PWRITE,    "pwrite" },
602         { SMB_VFS_OP_LSEEK,     "lseek" },
603         { SMB_VFS_OP_SENDFILE,  "sendfile" },
604         { SMB_VFS_OP_RECVFILE,  "recvfile" },
605         { SMB_VFS_OP_RENAME,    "rename" },
606         { SMB_VFS_OP_FSYNC,     "fsync" },
607         { SMB_VFS_OP_STAT,      "stat" },
608         { SMB_VFS_OP_FSTAT,     "fstat" },
609         { SMB_VFS_OP_LSTAT,     "lstat" },
610         { SMB_VFS_OP_GET_ALLOC_SIZE,    "get_alloc_size" },
611         { SMB_VFS_OP_UNLINK,    "unlink" },
612         { SMB_VFS_OP_CHMOD,     "chmod" },
613         { SMB_VFS_OP_FCHMOD,    "fchmod" },
614         { SMB_VFS_OP_CHOWN,     "chown" },
615         { SMB_VFS_OP_FCHOWN,    "fchown" },
616         { SMB_VFS_OP_LCHOWN,    "lchown" },
617         { SMB_VFS_OP_CHDIR,     "chdir" },
618         { SMB_VFS_OP_GETWD,     "getwd" },
619         { SMB_VFS_OP_NTIMES,    "ntimes" },
620         { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
621         { SMB_VFS_OP_LOCK,      "lock" },
622         { SMB_VFS_OP_KERNEL_FLOCK,      "kernel_flock" },
623         { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
624         { SMB_VFS_OP_GETLOCK,   "getlock" },
625         { SMB_VFS_OP_SYMLINK,   "symlink" },
626         { SMB_VFS_OP_READLINK,  "readlink" },
627         { SMB_VFS_OP_LINK,      "link" },
628         { SMB_VFS_OP_MKNOD,     "mknod" },
629         { SMB_VFS_OP_REALPATH,  "realpath" },
630         { SMB_VFS_OP_NOTIFY_WATCH, "notify_watch" },
631         { SMB_VFS_OP_CHFLAGS,   "chflags" },
632         { SMB_VFS_OP_FILE_ID_CREATE,    "file_id_create" },
633         { SMB_VFS_OP_STREAMINFO,        "streaminfo" },
634         { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
635         { SMB_VFS_OP_FGET_NT_ACL,       "fget_nt_acl" },
636         { SMB_VFS_OP_GET_NT_ACL,        "get_nt_acl" },
637         { SMB_VFS_OP_FSET_NT_ACL,       "fset_nt_acl" },
638         { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
639         { SMB_VFS_OP_FCHMOD_ACL,        "fchmod_acl" },
640         { SMB_VFS_OP_SYS_ACL_GET_ENTRY, "sys_acl_get_entry" },
641         { SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE,      "sys_acl_get_tag_type" },
642         { SMB_VFS_OP_SYS_ACL_GET_PERMSET,       "sys_acl_get_permset" },
643         { SMB_VFS_OP_SYS_ACL_GET_QUALIFIER,     "sys_acl_get_qualifier" },
644         { SMB_VFS_OP_SYS_ACL_GET_FILE,  "sys_acl_get_file" },
645         { SMB_VFS_OP_SYS_ACL_GET_FD,    "sys_acl_get_fd" },
646         { SMB_VFS_OP_SYS_ACL_CLEAR_PERMS,       "sys_acl_clear_perms" },
647         { SMB_VFS_OP_SYS_ACL_ADD_PERM,  "sys_acl_add_perm" },
648         { SMB_VFS_OP_SYS_ACL_TO_TEXT,   "sys_acl_to_text" },
649         { SMB_VFS_OP_SYS_ACL_INIT,      "sys_acl_init" },
650         { SMB_VFS_OP_SYS_ACL_CREATE_ENTRY,      "sys_acl_create_entry" },
651         { SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE,      "sys_acl_set_tag_type" },
652         { SMB_VFS_OP_SYS_ACL_SET_QUALIFIER,     "sys_acl_set_qualifier" },
653         { SMB_VFS_OP_SYS_ACL_SET_PERMSET,       "sys_acl_set_permset" },
654         { SMB_VFS_OP_SYS_ACL_VALID,     "sys_acl_valid" },
655         { SMB_VFS_OP_SYS_ACL_SET_FILE,  "sys_acl_set_file" },
656         { SMB_VFS_OP_SYS_ACL_SET_FD,    "sys_acl_set_fd" },
657         { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,   "sys_acl_delete_def_file" },
658         { SMB_VFS_OP_SYS_ACL_GET_PERM,  "sys_acl_get_perm" },
659         { SMB_VFS_OP_SYS_ACL_FREE_TEXT, "sys_acl_free_text" },
660         { SMB_VFS_OP_SYS_ACL_FREE_ACL,  "sys_acl_free_acl" },
661         { SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER,    "sys_acl_free_qualifier" },
662         { SMB_VFS_OP_GETXATTR,  "getxattr" },
663         { SMB_VFS_OP_LGETXATTR, "lgetxattr" },
664         { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
665         { SMB_VFS_OP_LISTXATTR, "listxattr" },
666         { SMB_VFS_OP_LLISTXATTR,        "llistxattr" },
667         { SMB_VFS_OP_FLISTXATTR,        "flistxattr" },
668         { SMB_VFS_OP_REMOVEXATTR,       "removexattr" },
669         { SMB_VFS_OP_LREMOVEXATTR,      "lremovexattr" },
670         { SMB_VFS_OP_FREMOVEXATTR,      "fremovexattr" },
671         { SMB_VFS_OP_SETXATTR,  "setxattr" },
672         { SMB_VFS_OP_LSETXATTR, "lsetxattr" },
673         { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
674         { SMB_VFS_OP_AIO_READ,  "aio_read" },
675         { SMB_VFS_OP_AIO_WRITE, "aio_write" },
676         { SMB_VFS_OP_AIO_RETURN,"aio_return" },
677         { SMB_VFS_OP_AIO_CANCEL,"aio_cancel" },
678         { SMB_VFS_OP_AIO_ERROR, "aio_error" },
679         { SMB_VFS_OP_AIO_FSYNC, "aio_fsync" },
680         { SMB_VFS_OP_AIO_SUSPEND,"aio_suspend" },
681         { SMB_VFS_OP_AIO_FORCE, "aio_force" },
682         { SMB_VFS_OP_IS_OFFLINE, "aio_is_offline" },
683         { SMB_VFS_OP_SET_OFFLINE, "aio_set_offline" },
684         { SMB_VFS_OP_LAST, NULL }
685 };      
686
687 static int audit_syslog_facility(vfs_handle_struct *handle)
688 {
689         static const struct enum_list enum_log_facilities[] = {
690                 { LOG_USER, "USER" },
691                 { LOG_LOCAL0, "LOCAL0" },
692                 { LOG_LOCAL1, "LOCAL1" },
693                 { LOG_LOCAL2, "LOCAL2" },
694                 { LOG_LOCAL3, "LOCAL3" },
695                 { LOG_LOCAL4, "LOCAL4" },
696                 { LOG_LOCAL5, "LOCAL5" },
697                 { LOG_LOCAL6, "LOCAL6" },
698                 { LOG_LOCAL7, "LOCAL7" }
699         };
700
701         int facility;
702
703         facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
704
705         return facility;
706 }
707
708 static int audit_syslog_priority(vfs_handle_struct *handle)
709 {
710         static const struct enum_list enum_log_priorities[] = {
711                 { LOG_EMERG, "EMERG" },
712                 { LOG_ALERT, "ALERT" },
713                 { LOG_CRIT, "CRIT" },
714                 { LOG_ERR, "ERR" },
715                 { LOG_WARNING, "WARNING" },
716                 { LOG_NOTICE, "NOTICE" },
717                 { LOG_INFO, "INFO" },
718                 { LOG_DEBUG, "DEBUG" }
719         };
720
721         int priority;
722
723         priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
724                                 enum_log_priorities, LOG_NOTICE);
725         if (priority == -1) {
726                 priority = LOG_WARNING;
727         }
728
729         return priority;
730 }
731
732 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
733 {
734         char *prefix = NULL;
735         char *result;
736
737         prefix = talloc_strdup(ctx,
738                         lp_parm_const_string(SNUM(conn), "full_audit",
739                                              "prefix", "%u|%I"));
740         if (!prefix) {
741                 return NULL;
742         }
743         result = talloc_sub_advanced(ctx,
744                         lp_servicename(SNUM(conn)),
745                         conn->server_info->unix_name,
746                         conn->connectpath,
747                         conn->server_info->utok.gid,
748                         conn->server_info->sanitized_username,
749                         pdb_get_domain(conn->server_info->sam_account),
750                         prefix);
751         TALLOC_FREE(prefix);
752         return result;
753 }
754
755 static bool log_success(vfs_handle_struct *handle, vfs_op_type op)
756 {
757         struct vfs_full_audit_private_data *pd = NULL;
758
759         SMB_VFS_HANDLE_GET_DATA(handle, pd,
760                 struct vfs_full_audit_private_data,
761                 return True);
762
763         if (pd->success_ops == NULL) {
764                 return True;
765         }
766
767         return bitmap_query(pd->success_ops, op);
768 }
769
770 static bool log_failure(vfs_handle_struct *handle, vfs_op_type op)
771 {
772         struct vfs_full_audit_private_data *pd = NULL;
773
774         SMB_VFS_HANDLE_GET_DATA(handle, pd,
775                 struct vfs_full_audit_private_data,
776                 return True);
777
778         if (pd->failure_ops == NULL)
779                 return True;
780
781         return bitmap_query(pd->failure_ops, op);
782 }
783
784 static void init_bitmap(struct bitmap **bm, const char **ops)
785 {
786         bool log_all = False;
787
788         if (*bm != NULL)
789                 return;
790
791         *bm = bitmap_allocate(SMB_VFS_OP_LAST);
792
793         if (*bm == NULL) {
794                 DEBUG(0, ("Could not alloc bitmap -- "
795                           "defaulting to logging everything\n"));
796                 return;
797         }
798
799         while (*ops != NULL) {
800                 int i;
801                 bool found = False;
802
803                 if (strequal(*ops, "all")) {
804                         log_all = True;
805                         break;
806                 }
807
808                 if (strequal(*ops, "none")) {
809                         break;
810                 }
811
812                 for (i=0; i<SMB_VFS_OP_LAST; i++) {
813                         if (vfs_op_names[i].name == NULL) {
814                                 smb_panic("vfs_full_audit.c: name table not "
815                                           "in sync with vfs.h\n");
816                         }
817
818                         if (strequal(*ops, vfs_op_names[i].name)) {
819                                 bitmap_set(*bm, i);
820                                 found = True;
821                         }
822                 }
823                 if (!found) {
824                         DEBUG(0, ("Could not find opname %s, logging all\n",
825                                   *ops));
826                         log_all = True;
827                         break;
828                 }
829                 ops += 1;
830         }
831
832         if (log_all) {
833                 /* The query functions default to True */
834                 bitmap_free(*bm);
835                 *bm = NULL;
836         }
837 }
838
839 static const char *audit_opname(vfs_op_type op)
840 {
841         if (op >= SMB_VFS_OP_LAST)
842                 return "INVALID VFS OP";
843         return vfs_op_names[op].name;
844 }
845
846 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
847                    const char *format, ...)
848 {
849         fstring err_msg;
850         char *audit_pre = NULL;
851         va_list ap;
852         char *op_msg = NULL;
853
854         if (success && (!log_success(handle, op)))
855                 return;
856
857         if (!success && (!log_failure(handle, op)))
858                 return;
859
860         if (success)
861                 fstrcpy(err_msg, "ok");
862         else
863                 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
864
865         va_start(ap, format);
866         op_msg = talloc_vasprintf(talloc_tos(), format, ap);
867         va_end(ap);
868
869         if (!op_msg) {
870                 return;
871         }
872
873         audit_pre = audit_prefix(talloc_tos(), handle->conn);
874         syslog(audit_syslog_priority(handle), "%s|%s|%s|%s\n",
875                 audit_pre ? audit_pre : "",
876                 audit_opname(op), err_msg, op_msg);
877
878         TALLOC_FREE(audit_pre);
879         TALLOC_FREE(op_msg);
880
881         return;
882 }
883
884 /* Free function for the private data. */
885
886 static void free_private_data(void **p_data)
887 {
888         struct vfs_full_audit_private_data *pd = *(struct vfs_full_audit_private_data **)p_data;
889
890         if (pd->success_ops) {
891                 bitmap_free(pd->success_ops);
892         }
893         if (pd->failure_ops) {
894                 bitmap_free(pd->failure_ops);
895         }
896         SAFE_FREE(pd);
897         *p_data = NULL;
898 }
899
900 /* Implementation of vfs_ops.  Pass everything on to the default
901    operation but log event first. */
902
903 static int smb_full_audit_connect(vfs_handle_struct *handle,
904                          const char *svc, const char *user)
905 {
906         int result;
907         struct vfs_full_audit_private_data *pd = NULL;
908         const char *none[] = { NULL };
909         const char *all [] = { "all" };
910
911         if (!handle) {
912                 return -1;
913         }
914
915         pd = SMB_MALLOC_P(struct vfs_full_audit_private_data);
916         if (!pd) {
917                 return -1;
918         }
919         ZERO_STRUCTP(pd);
920
921         openlog("smbd_audit", 0, audit_syslog_facility(handle));
922
923         init_bitmap(&pd->success_ops,
924                     lp_parm_string_list(SNUM(handle->conn), "full_audit", "success",
925                                         none));
926         init_bitmap(&pd->failure_ops,
927                     lp_parm_string_list(SNUM(handle->conn), "full_audit", "failure",
928                                         all));
929
930         /* Store the private data. */
931         SMB_VFS_HANDLE_SET_DATA(handle, pd, free_private_data,
932                                 struct vfs_full_audit_private_data, return -1);
933
934         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
935
936         do_log(SMB_VFS_OP_CONNECT, True, handle,
937                "%s", svc);
938
939         return result;
940 }
941
942 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
943 {
944         SMB_VFS_NEXT_DISCONNECT(handle);
945
946         do_log(SMB_VFS_OP_DISCONNECT, True, handle,
947                "%s", lp_servicename(SNUM(handle->conn)));
948
949         /* The bitmaps will be disconnected when the private
950            data is deleted. */
951
952         return;
953 }
954
955 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
956                                     const char *path,
957                                     bool small_query, uint64_t *bsize, 
958                                     uint64_t *dfree, uint64_t *dsize)
959 {
960         uint64_t result;
961
962         result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
963                                         dfree, dsize);
964
965         /* Don't have a reasonable notion of failure here */
966
967         do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", path);
968
969         return result;
970 }
971
972 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
973                            enum SMB_QUOTA_TYPE qtype, unid_t id,
974                            SMB_DISK_QUOTA *qt)
975 {
976         int result;
977
978         result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
979
980         do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "");
981
982         return result;
983 }
984
985         
986 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
987                            enum SMB_QUOTA_TYPE qtype, unid_t id,
988                            SMB_DISK_QUOTA *qt)
989 {
990         int result;
991
992         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
993
994         do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
995
996         return result;
997 }
998
999 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
1000                                 struct files_struct *fsp,
1001                                 SHADOW_COPY_DATA *shadow_copy_data, bool labels)
1002 {
1003         int result;
1004
1005         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
1006
1007         do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
1008
1009         return result;
1010 }
1011
1012 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
1013                                 const char *path,
1014                                 struct vfs_statvfs_struct *statbuf)
1015 {
1016         int result;
1017
1018         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
1019
1020         do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
1021
1022         return result;
1023 }
1024
1025 static SMB_STRUCT_DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
1026                           const char *fname, const char *mask, uint32 attr)
1027 {
1028         SMB_STRUCT_DIR *result;
1029
1030         result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
1031
1032         do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s", fname);
1033
1034         return result;
1035 }
1036
1037 static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
1038                                     SMB_STRUCT_DIR *dirp, SMB_STRUCT_STAT *sbuf)
1039 {
1040         SMB_STRUCT_DIRENT *result;
1041
1042         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
1043
1044         /* This operation has no reasonable error condition
1045          * (End of dir is also failure), so always succeed.
1046          */
1047         do_log(SMB_VFS_OP_READDIR, True, handle, "");
1048
1049         return result;
1050 }
1051
1052 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
1053                         SMB_STRUCT_DIR *dirp, long offset)
1054 {
1055         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
1056
1057         do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
1058         return;
1059 }
1060
1061 static long smb_full_audit_telldir(vfs_handle_struct *handle,
1062                         SMB_STRUCT_DIR *dirp)
1063 {
1064         long result;
1065
1066         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
1067
1068         do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
1069
1070         return result;
1071 }
1072
1073 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
1074                         SMB_STRUCT_DIR *dirp)
1075 {
1076         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
1077
1078         do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
1079         return;
1080 }
1081
1082 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
1083                        const char *path, mode_t mode)
1084 {
1085         int result;
1086         
1087         result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
1088         
1089         do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s", path);
1090
1091         return result;
1092 }
1093
1094 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
1095                        const char *path)
1096 {
1097         int result;
1098         
1099         result = SMB_VFS_NEXT_RMDIR(handle, path);
1100
1101         do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s", path);
1102
1103         return result;
1104 }
1105
1106 static int smb_full_audit_closedir(vfs_handle_struct *handle,
1107                           SMB_STRUCT_DIR *dirp)
1108 {
1109         int result;
1110
1111         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
1112         
1113         do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
1114
1115         return result;
1116 }
1117
1118 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
1119                         SMB_STRUCT_DIR *dirp)
1120 {
1121         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
1122
1123         do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
1124         return;
1125 }
1126
1127 static int smb_full_audit_open(vfs_handle_struct *handle,
1128                       const char *fname, files_struct *fsp, int flags, mode_t mode)
1129 {
1130         int result;
1131         
1132         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
1133
1134         do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
1135                ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
1136                fname);
1137
1138         return result;
1139 }
1140
1141 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
1142                                       struct smb_request *req,
1143                                       uint16_t root_dir_fid,
1144                                       const char *fname,
1145                                       uint32_t create_file_flags,
1146                                       uint32_t access_mask,
1147                                       uint32_t share_access,
1148                                       uint32_t create_disposition,
1149                                       uint32_t create_options,
1150                                       uint32_t file_attributes,
1151                                       uint32_t oplock_request,
1152                                       uint64_t allocation_size,
1153                                       struct security_descriptor *sd,
1154                                       struct ea_list *ea_list,
1155                                       files_struct **result_fsp,
1156                                       int *pinfo,
1157                                       SMB_STRUCT_STAT *psbuf)
1158 {
1159         NTSTATUS result;
1160
1161         result = SMB_VFS_NEXT_CREATE_FILE(
1162                 handle,                                 /* handle */
1163                 req,                                    /* req */
1164                 root_dir_fid,                           /* root_dir_fid */
1165                 fname,                                  /* fname */
1166                 create_file_flags,                      /* create_file_flags */
1167                 access_mask,                            /* access_mask */
1168                 share_access,                           /* share_access */
1169                 create_disposition,                     /* create_disposition*/
1170                 create_options,                         /* create_options */
1171                 file_attributes,                        /* file_attributes */
1172                 oplock_request,                         /* oplock_request */
1173                 allocation_size,                        /* allocation_size */
1174                 sd,                                     /* sd */
1175                 ea_list,                                /* ea_list */
1176                 result_fsp,                             /* result */
1177                 pinfo,                                  /* pinfo */
1178                 psbuf);                                 /* psbuf */
1179
1180         do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle, "0x%x|%s",
1181                access_mask, fname);
1182
1183         return result;
1184 }
1185
1186 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1187 {
1188         int result;
1189         
1190         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1191
1192         do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s", fsp->fsp_name);
1193
1194         return result;
1195 }
1196
1197 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
1198                           void *data, size_t n)
1199 {
1200         ssize_t result;
1201
1202         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
1203
1204         do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s", fsp->fsp_name);
1205
1206         return result;
1207 }
1208
1209 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1210                            void *data, size_t n, SMB_OFF_T offset)
1211 {
1212         ssize_t result;
1213
1214         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1215
1216         do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s", fsp->fsp_name);
1217
1218         return result;
1219 }
1220
1221 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
1222                            const void *data, size_t n)
1223 {
1224         ssize_t result;
1225
1226         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
1227
1228         do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1229
1230         return result;
1231 }
1232
1233 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1234                             const void *data, size_t n,
1235                             SMB_OFF_T offset)
1236 {
1237         ssize_t result;
1238
1239         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1240
1241         do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s", fsp->fsp_name);
1242
1243         return result;
1244 }
1245
1246 static SMB_OFF_T smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1247                              SMB_OFF_T offset, int whence)
1248 {
1249         ssize_t result;
1250
1251         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1252
1253         do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1254                "%s", fsp->fsp_name);
1255
1256         return result;
1257 }
1258
1259 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1260                               files_struct *fromfsp,
1261                               const DATA_BLOB *hdr, SMB_OFF_T offset,
1262                               size_t n)
1263 {
1264         ssize_t result;
1265
1266         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1267
1268         do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1269                "%s", fromfsp->fsp_name);
1270
1271         return result;
1272 }
1273
1274 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1275                       files_struct *tofsp,
1276                               SMB_OFF_T offset,
1277                               size_t n)
1278 {
1279         ssize_t result;
1280
1281         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1282
1283         do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1284                "%s", tofsp->fsp_name);
1285
1286         return result;
1287 }
1288
1289 static int smb_full_audit_rename(vfs_handle_struct *handle,
1290                         const char *oldname, const char *newname)
1291 {
1292         int result;
1293         
1294         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
1295
1296         do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s", oldname, newname);
1297
1298         return result;    
1299 }
1300
1301 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1302 {
1303         int result;
1304         
1305         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1306
1307         do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s", fsp->fsp_name);
1308
1309         return result;    
1310 }
1311
1312 static int smb_full_audit_stat(vfs_handle_struct *handle,
1313                       const char *fname, SMB_STRUCT_STAT *sbuf)
1314 {
1315         int result;
1316         
1317         result = SMB_VFS_NEXT_STAT(handle, fname, sbuf);
1318
1319         do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s", fname);
1320
1321         return result;    
1322 }
1323
1324 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1325                        SMB_STRUCT_STAT *sbuf)
1326 {
1327         int result;
1328         
1329         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1330
1331         do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s", fsp->fsp_name);
1332
1333         return result;
1334 }
1335
1336 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1337                        const char *path, SMB_STRUCT_STAT *sbuf)
1338 {
1339         int result;
1340         
1341         result = SMB_VFS_NEXT_LSTAT(handle, path, sbuf);
1342
1343         do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s", path);
1344
1345         return result;    
1346 }
1347
1348 static int smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1349                        files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1350 {
1351         int result;
1352
1353         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1354
1355         do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result >= 0), handle, "%d", result);
1356
1357         return result;
1358 }
1359
1360 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1361                         const char *path)
1362 {
1363         int result;
1364         
1365         result = SMB_VFS_NEXT_UNLINK(handle, path);
1366
1367         do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s", path);
1368
1369         return result;
1370 }
1371
1372 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1373                        const char *path, mode_t mode)
1374 {
1375         int result;
1376
1377         result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1378
1379         do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o", path, mode);
1380
1381         return result;
1382 }
1383
1384 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1385                         mode_t mode)
1386 {
1387         int result;
1388         
1389         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1390
1391         do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1392                "%s|%o", fsp->fsp_name, mode);
1393
1394         return result;
1395 }
1396
1397 static int smb_full_audit_chown(vfs_handle_struct *handle,
1398                        const char *path, uid_t uid, gid_t gid)
1399 {
1400         int result;
1401
1402         result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1403
1404         do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1405                path, (long int)uid, (long int)gid);
1406
1407         return result;
1408 }
1409
1410 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1411                         uid_t uid, gid_t gid)
1412 {
1413         int result;
1414
1415         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1416
1417         do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1418                fsp->fsp_name, (long int)uid, (long int)gid);
1419
1420         return result;
1421 }
1422
1423 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1424                        const char *path, uid_t uid, gid_t gid)
1425 {
1426         int result;
1427
1428         result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1429
1430         do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1431                path, (long int)uid, (long int)gid);
1432
1433         return result;
1434 }
1435
1436 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1437                        const char *path)
1438 {
1439         int result;
1440
1441         result = SMB_VFS_NEXT_CHDIR(handle, path);
1442
1443         do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s", path);
1444
1445         return result;
1446 }
1447
1448 static char *smb_full_audit_getwd(vfs_handle_struct *handle,
1449                          char *path)
1450 {
1451         char *result;
1452
1453         result = SMB_VFS_NEXT_GETWD(handle, path);
1454         
1455         do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s", path);
1456
1457         return result;
1458 }
1459
1460 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1461                        const char *path, struct smb_file_time *ft)
1462 {
1463         int result;
1464
1465         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1466
1467         do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s", path);
1468
1469         return result;
1470 }
1471
1472 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1473                            SMB_OFF_T len)
1474 {
1475         int result;
1476
1477         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1478
1479         do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1480                "%s", fsp->fsp_name);
1481
1482         return result;
1483 }
1484
1485 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1486                        int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1487 {
1488         bool result;
1489
1490         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1491
1492         do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp->fsp_name);
1493
1494         return result;
1495 }
1496
1497 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1498                                        struct files_struct *fsp,
1499                                        uint32 share_mode)
1500 {
1501         int result;
1502
1503         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode);
1504
1505         do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1506                fsp->fsp_name);
1507
1508         return result;
1509 }
1510
1511 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1512                                  int leasetype)
1513 {
1514         int result;
1515
1516         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1517
1518         do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1519                fsp->fsp_name);
1520
1521         return result;
1522 }
1523
1524 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1525                        SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid)
1526 {
1527         bool result;
1528
1529         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1530
1531         do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp->fsp_name);
1532
1533         return result;
1534 }
1535
1536 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1537                          const char *oldpath, const char *newpath)
1538 {
1539         int result;
1540
1541         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1542
1543         do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1544                "%s|%s", oldpath, newpath);
1545
1546         return result;
1547 }
1548
1549 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1550                           const char *path, char *buf, size_t bufsiz)
1551 {
1552         int result;
1553
1554         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1555
1556         do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s", path);
1557
1558         return result;
1559 }
1560
1561 static int smb_full_audit_link(vfs_handle_struct *handle,
1562                       const char *oldpath, const char *newpath)
1563 {
1564         int result;
1565
1566         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1567
1568         do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1569                "%s|%s", oldpath, newpath);
1570
1571         return result;
1572 }
1573
1574 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1575                        const char *pathname, mode_t mode, SMB_DEV_T dev)
1576 {
1577         int result;
1578
1579         result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1580
1581         do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s", pathname);
1582
1583         return result;
1584 }
1585
1586 static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1587                             const char *path, char *resolved_path)
1588 {
1589         char *result;
1590
1591         result = SMB_VFS_NEXT_REALPATH(handle, path, resolved_path);
1592
1593         do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1594
1595         return result;
1596 }
1597
1598 static NTSTATUS smb_full_audit_notify_watch(struct vfs_handle_struct *handle,
1599                         struct sys_notify_context *ctx,
1600                         struct notify_entry *e,
1601                         void (*callback)(struct sys_notify_context *ctx,
1602                                         void *private_data,
1603                                         struct notify_event *ev),
1604                         void *private_data, void *handle_p)
1605 {
1606         NTSTATUS result;
1607
1608         result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback, private_data, handle_p);
1609
1610         do_log(SMB_VFS_OP_NOTIFY_WATCH, NT_STATUS_IS_OK(result), handle, "");
1611
1612         return result;
1613 }
1614
1615 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1616                             const char *path, unsigned int flags)
1617 {
1618         int result;
1619
1620         result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1621
1622         do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s", path);
1623
1624         return result;
1625 }
1626
1627 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1628                                                     SMB_DEV_T dev, SMB_INO_T inode)
1629 {
1630         struct file_id id_zero;
1631         struct file_id result;
1632
1633         ZERO_STRUCT(id_zero);
1634
1635         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, dev, inode);
1636
1637         do_log(SMB_VFS_OP_FILE_ID_CREATE,
1638                !file_id_equal(&id_zero, &result),
1639                handle, "%s", file_id_string_tos(&result));
1640
1641         return result;
1642 }
1643
1644 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1645                                           struct files_struct *fsp,
1646                                           const char *fname,
1647                                           TALLOC_CTX *mem_ctx,
1648                                           unsigned int *pnum_streams,
1649                                           struct stream_struct **pstreams)
1650 {
1651         NTSTATUS result;
1652
1653         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1654                                          pnum_streams, pstreams);
1655
1656         do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1657                "%s", fname);
1658
1659         return result;
1660 }
1661
1662 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1663                                             const char *path,
1664                                             const char *name,
1665                                             TALLOC_CTX *mem_ctx,
1666                                             char **found_name)
1667 {
1668         int result;
1669
1670         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1671                                                 found_name);
1672
1673         do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1674                "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1675
1676         return result;
1677 }
1678
1679 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1680                                 uint32 security_info,
1681                                 SEC_DESC **ppdesc)
1682 {
1683         NTSTATUS result;
1684
1685         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1686
1687         do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1688                "%s", fsp->fsp_name);
1689
1690         return result;
1691 }
1692
1693 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1694                                           const char *name,
1695                                           uint32 security_info,
1696                                           SEC_DESC **ppdesc)
1697 {
1698         NTSTATUS result;
1699
1700         result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1701
1702         do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
1703                "%s", name);
1704
1705         return result;
1706 }
1707
1708 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1709                               uint32 security_info_sent,
1710                               const SEC_DESC *psd)
1711 {
1712         NTSTATUS result;
1713
1714         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
1715
1716         do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle, "%s", fsp->fsp_name);
1717
1718         return result;
1719 }
1720
1721 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
1722                            const char *path, mode_t mode)
1723 {
1724         int result;
1725         
1726         result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1727
1728         do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
1729                "%s|%o", path, mode);
1730
1731         return result;
1732 }
1733
1734 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
1735                                      mode_t mode)
1736 {
1737         int result;
1738         
1739         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1740
1741         do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
1742                "%s|%o", fsp->fsp_name, mode);
1743
1744         return result;
1745 }
1746
1747 static int smb_full_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1748
1749                                    SMB_ACL_T theacl, int entry_id,
1750                                    SMB_ACL_ENTRY_T *entry_p)
1751 {
1752         int result;
1753
1754         result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1755                                                 entry_p);
1756
1757         do_log(SMB_VFS_OP_SYS_ACL_GET_ENTRY, (result >= 0), handle,
1758                "");
1759
1760         return result;
1761 }
1762
1763 static int smb_full_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1764
1765                                       SMB_ACL_ENTRY_T entry_d,
1766                                       SMB_ACL_TAG_T *tag_type_p)
1767 {
1768         int result;
1769
1770         result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1771                                                    tag_type_p);
1772
1773         do_log(SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, (result >= 0), handle,
1774                "");
1775
1776         return result;
1777 }
1778
1779 static int smb_full_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1780
1781                                      SMB_ACL_ENTRY_T entry_d,
1782                                      SMB_ACL_PERMSET_T *permset_p)
1783 {
1784         int result;
1785
1786         result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1787                                                   permset_p);
1788
1789         do_log(SMB_VFS_OP_SYS_ACL_GET_PERMSET, (result >= 0), handle,
1790                "");
1791
1792         return result;
1793 }
1794
1795 static void * smb_full_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1796
1797                                           SMB_ACL_ENTRY_T entry_d)
1798 {
1799         void *result;
1800
1801         result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1802
1803         do_log(SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, (result != NULL), handle,
1804                "");
1805
1806         return result;
1807 }
1808
1809 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
1810                                         const char *path_p,
1811                                         SMB_ACL_TYPE_T type)
1812 {
1813         SMB_ACL_T result;
1814
1815         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1816
1817         do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
1818                "%s", path_p);
1819
1820         return result;
1821 }
1822
1823 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1824                                       files_struct *fsp)
1825 {
1826         SMB_ACL_T result;
1827
1828         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1829
1830         do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
1831                "%s", fsp->fsp_name);
1832
1833         return result;
1834 }
1835
1836 static int smb_full_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1837
1838                                      SMB_ACL_PERMSET_T permset)
1839 {
1840         int result;
1841
1842         result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1843
1844         do_log(SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, (result >= 0), handle,
1845                "");
1846
1847         return result;
1848 }
1849
1850 static int smb_full_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1851
1852                                   SMB_ACL_PERMSET_T permset,
1853                                   SMB_ACL_PERM_T perm)
1854 {
1855         int result;
1856
1857         result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1858
1859         do_log(SMB_VFS_OP_SYS_ACL_ADD_PERM, (result >= 0), handle,
1860                "");
1861
1862         return result;
1863 }
1864
1865 static char * smb_full_audit_sys_acl_to_text(vfs_handle_struct *handle,
1866                                     SMB_ACL_T theacl,
1867                                     ssize_t *plen)
1868 {
1869         char * result;
1870
1871         result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
1872
1873         do_log(SMB_VFS_OP_SYS_ACL_TO_TEXT, (result != NULL), handle,
1874                "");
1875
1876         return result;
1877 }
1878
1879 static SMB_ACL_T smb_full_audit_sys_acl_init(vfs_handle_struct *handle,
1880
1881                                     int count)
1882 {
1883         SMB_ACL_T result;
1884
1885         result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
1886
1887         do_log(SMB_VFS_OP_SYS_ACL_INIT, (result != NULL), handle,
1888                "");
1889
1890         return result;
1891 }
1892
1893 static int smb_full_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1894                                       SMB_ACL_T *pacl,
1895                                       SMB_ACL_ENTRY_T *pentry)
1896 {
1897         int result;
1898
1899         result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
1900
1901         do_log(SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, (result >= 0), handle,
1902                "");
1903
1904         return result;
1905 }
1906
1907 static int smb_full_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1908
1909                                       SMB_ACL_ENTRY_T entry,
1910                                       SMB_ACL_TAG_T tagtype)
1911 {
1912         int result;
1913
1914         result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
1915                                                    tagtype);
1916
1917         do_log(SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, (result >= 0), handle,
1918                "");
1919
1920         return result;
1921 }
1922
1923 static int smb_full_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1924
1925                                        SMB_ACL_ENTRY_T entry,
1926                                        void *qual)
1927 {
1928         int result;
1929
1930         result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
1931
1932         do_log(SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, (result >= 0), handle,
1933                "");
1934
1935         return result;
1936 }
1937
1938 static int smb_full_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1939
1940                                      SMB_ACL_ENTRY_T entry,
1941                                      SMB_ACL_PERMSET_T permset)
1942 {
1943         int result;
1944
1945         result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
1946
1947         do_log(SMB_VFS_OP_SYS_ACL_SET_PERMSET, (result >= 0), handle,
1948                "");
1949
1950         return result;
1951 }
1952
1953 static int smb_full_audit_sys_acl_valid(vfs_handle_struct *handle,
1954
1955                                SMB_ACL_T theacl )
1956 {
1957         int result;
1958
1959         result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
1960
1961         do_log(SMB_VFS_OP_SYS_ACL_VALID, (result >= 0), handle,
1962                "");
1963
1964         return result;
1965 }
1966
1967 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
1968
1969                                   const char *name, SMB_ACL_TYPE_T acltype,
1970                                   SMB_ACL_T theacl)
1971 {
1972         int result;
1973
1974         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1975                                                theacl);
1976
1977         do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
1978                "%s", name);
1979
1980         return result;
1981 }
1982
1983 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
1984                                 SMB_ACL_T theacl)
1985 {
1986         int result;
1987
1988         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1989
1990         do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
1991                "%s", fsp->fsp_name);
1992
1993         return result;
1994 }
1995
1996 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1997
1998                                          const char *path)
1999 {
2000         int result;
2001
2002         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2003
2004         do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2005                "%s", path);
2006
2007         return result;
2008 }
2009
2010 static int smb_full_audit_sys_acl_get_perm(vfs_handle_struct *handle,
2011
2012                                   SMB_ACL_PERMSET_T permset,
2013                                   SMB_ACL_PERM_T perm)
2014 {
2015         int result;
2016
2017         result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
2018
2019         do_log(SMB_VFS_OP_SYS_ACL_GET_PERM, (result >= 0), handle,
2020                "");
2021
2022         return result;
2023 }
2024
2025 static int smb_full_audit_sys_acl_free_text(vfs_handle_struct *handle,
2026
2027                                    char *text)
2028 {
2029         int result;
2030
2031         result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
2032
2033         do_log(SMB_VFS_OP_SYS_ACL_FREE_TEXT, (result >= 0), handle,
2034                "");
2035
2036         return result;
2037 }
2038
2039 static int smb_full_audit_sys_acl_free_acl(vfs_handle_struct *handle,
2040
2041                                   SMB_ACL_T posix_acl)
2042 {
2043         int result;
2044
2045         result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
2046
2047         do_log(SMB_VFS_OP_SYS_ACL_FREE_ACL, (result >= 0), handle,
2048                "");
2049
2050         return result;
2051 }
2052
2053 static int smb_full_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
2054                                         void *qualifier,
2055                                         SMB_ACL_TAG_T tagtype)
2056 {
2057         int result;
2058
2059         result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
2060                                                      tagtype);
2061
2062         do_log(SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, (result >= 0), handle,
2063                "");
2064
2065         return result;
2066 }
2067
2068 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2069                               const char *path,
2070                               const char *name, void *value, size_t size)
2071 {
2072         ssize_t result;
2073
2074         result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2075
2076         do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2077                "%s|%s", path, name);
2078
2079         return result;
2080 }
2081
2082 static ssize_t smb_full_audit_lgetxattr(struct vfs_handle_struct *handle,
2083                                const char *path, const char *name,
2084                                void *value, size_t size)
2085 {
2086         ssize_t result;
2087
2088         result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
2089
2090         do_log(SMB_VFS_OP_LGETXATTR, (result >= 0), handle,
2091                "%s|%s", path, name);
2092
2093         return result;
2094 }
2095
2096 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2097                                struct files_struct *fsp,
2098                                const char *name, void *value, size_t size)
2099 {
2100         ssize_t result;
2101
2102         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2103
2104         do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2105                "%s|%s", fsp->fsp_name, name);
2106
2107         return result;
2108 }
2109
2110 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2111                                const char *path, char *list, size_t size)
2112 {
2113         ssize_t result;
2114
2115         result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2116
2117         do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s", path);
2118
2119         return result;
2120 }
2121
2122 static ssize_t smb_full_audit_llistxattr(struct vfs_handle_struct *handle,
2123                                 const char *path, char *list, size_t size)
2124 {
2125         ssize_t result;
2126
2127         result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2128
2129         do_log(SMB_VFS_OP_LLISTXATTR, (result >= 0), handle, "%s", path);
2130
2131         return result;
2132 }
2133
2134 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2135                                 struct files_struct *fsp, char *list,
2136                                 size_t size)
2137 {
2138         ssize_t result;
2139
2140         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2141
2142         do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2143                "%s", fsp->fsp_name);
2144
2145         return result;
2146 }
2147
2148 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2149                              const char *path,
2150                              const char *name)
2151 {
2152         int result;
2153
2154         result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2155
2156         do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2157                "%s|%s", path, name);
2158
2159         return result;
2160 }
2161
2162 static int smb_full_audit_lremovexattr(struct vfs_handle_struct *handle,
2163                               const char *path,
2164                               const char *name)
2165 {
2166         int result;
2167
2168         result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2169
2170         do_log(SMB_VFS_OP_LREMOVEXATTR, (result >= 0), handle,
2171                "%s|%s", path, name);
2172
2173         return result;
2174 }
2175
2176 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2177                               struct files_struct *fsp,
2178                               const char *name)
2179 {
2180         int result;
2181
2182         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2183
2184         do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2185                "%s|%s", fsp->fsp_name, name);
2186
2187         return result;
2188 }
2189
2190 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2191                           const char *path,
2192                           const char *name, const void *value, size_t size,
2193                           int flags)
2194 {
2195         int result;
2196
2197         result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2198                                        flags);
2199
2200         do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2201                "%s|%s", path, name);
2202
2203         return result;
2204 }
2205
2206 static int smb_full_audit_lsetxattr(struct vfs_handle_struct *handle,
2207                            const char *path,
2208                            const char *name, const void *value, size_t size,
2209                            int flags)
2210 {
2211         int result;
2212
2213         result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2214                                         flags);
2215
2216         do_log(SMB_VFS_OP_LSETXATTR, (result >= 0), handle,
2217                "%s|%s", path, name);
2218
2219         return result;
2220 }
2221
2222 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2223                            struct files_struct *fsp, const char *name,
2224                            const void *value, size_t size, int flags)
2225 {
2226         int result;
2227
2228         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2229
2230         do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2231                "%s|%s", fsp->fsp_name, name);
2232
2233         return result;
2234 }
2235
2236 static int smb_full_audit_aio_read(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2237 {
2238         int result;
2239
2240         result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2241         do_log(SMB_VFS_OP_AIO_READ, (result >= 0), handle,
2242                 "%s", fsp->fsp_name);
2243
2244         return result;
2245 }
2246
2247 static int smb_full_audit_aio_write(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2248 {
2249         int result;
2250
2251         result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2252         do_log(SMB_VFS_OP_AIO_WRITE, (result >= 0), handle,
2253                 "%s", fsp->fsp_name);
2254
2255         return result;
2256 }
2257
2258 static ssize_t smb_full_audit_aio_return(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2259 {
2260         int result;
2261
2262         result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2263         do_log(SMB_VFS_OP_AIO_RETURN, (result >= 0), handle,
2264                 "%s", fsp->fsp_name);
2265
2266         return result;
2267 }
2268
2269 static int smb_full_audit_aio_cancel(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2270 {
2271         int result;
2272
2273         result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2274         do_log(SMB_VFS_OP_AIO_CANCEL, (result >= 0), handle,
2275                 "%s", fsp->fsp_name);
2276
2277         return result;
2278 }
2279
2280 static int smb_full_audit_aio_error(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_STRUCT_AIOCB *aiocb)
2281 {
2282         int result;
2283
2284         result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2285         do_log(SMB_VFS_OP_AIO_ERROR, (result >= 0), handle,
2286                 "%s", fsp->fsp_name);
2287
2288         return result;
2289 }
2290
2291 static int smb_full_audit_aio_fsync(struct vfs_handle_struct *handle, struct files_struct *fsp, int op, SMB_STRUCT_AIOCB *aiocb)
2292 {
2293         int result;
2294
2295         result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2296         do_log(SMB_VFS_OP_AIO_FSYNC, (result >= 0), handle,
2297                 "%s", fsp->fsp_name);
2298
2299         return result;
2300 }
2301
2302 static int smb_full_audit_aio_suspend(struct vfs_handle_struct *handle, struct files_struct *fsp, const SMB_STRUCT_AIOCB * const aiocb[], int n, const struct timespec *ts)
2303 {
2304         int result;
2305
2306         result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2307         do_log(SMB_VFS_OP_AIO_SUSPEND, (result >= 0), handle,
2308                 "%s", fsp->fsp_name);
2309
2310         return result;
2311 }
2312
2313
2314 NTSTATUS vfs_full_audit_init(void);
2315 NTSTATUS vfs_full_audit_init(void)
2316 {
2317         NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
2318                                         "full_audit", audit_op_tuples);
2319         
2320         if (!NT_STATUS_IS_OK(ret))
2321                 return ret;
2322
2323         vfs_full_audit_debug_level = debug_add_class("full_audit");
2324         if (vfs_full_audit_debug_level == -1) {
2325                 vfs_full_audit_debug_level = DBGC_VFS;
2326                 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2327                           "class!\n"));
2328         } else {
2329                 DEBUG(10, ("vfs_full_audit: Debug class number of "
2330                            "'full_audit': %d\n", vfs_full_audit_debug_level));
2331         }
2332         
2333         return ret;
2334 }