source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_VFS
  33
  34 static double audit_timeout;
  35
  36 static void smb_time_audit_log(const char *syscallname, double elapsed)
  37 {
  38         DEBUG(0, ("WARNING: System call \"%s\" took unexpectedly long "
  39                   "(%.2f seconds) -- Validate that file and storage "
  40                   "subsystems are operating normally\n", syscallname,
  41                   elapsed));
  42 }
  43
  44 static int smb_time_audit_connect(vfs_handle_struct *handle,
  45                                   const char *svc, const char *user)
  46 {
  47         int result;
  48         struct timespec ts1,ts2;
  49         double timediff;
  50
  51         if (!handle) {
  52                 return -1;
  53         }
  54
  55         clock_gettime_mono(&ts1);
  56         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
  57         clock_gettime_mono(&ts2);
  58         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
  59         if (timediff > audit_timeout) {
  60                 smb_time_audit_log("connect", timediff);
  61         }
  62         return result;
  63 }
  64
  65 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
  66 {
  67         struct timespec ts1,ts2;
  68         double timediff;
  69
  70         clock_gettime_mono(&ts1);
  71         SMB_VFS_NEXT_DISCONNECT(handle);
  72         clock_gettime_mono(&ts2);
  73         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
  74
  75         if (timediff > audit_timeout) {
  76                 smb_time_audit_log("disconnect", timediff);
  77         }
  78
  79         return;
  80 }
  81
  82 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
  83                                          const char *path,
  84                                          bool small_query, uint64_t *bsize,
  85                                          uint64_t *dfree, uint64_t *dsize)
  86 {
  87         uint64_t result;
  88         struct timespec ts1,ts2;
  89         double timediff;
  90
  91         clock_gettime_mono(&ts1);
  92         result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
  93                                         dfree, dsize);
  94         clock_gettime_mono(&ts2);
  95         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
  96
  97         /* Don't have a reasonable notion of failure here */
  98         if (timediff > audit_timeout) {
  99                 smb_time_audit_log("disk_free", timediff);
 100         }
 101
 102         return result;
 103 }
 104
 105 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 106                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 107                                     SMB_DISK_QUOTA *qt)
 108 {
 109         int result;
 110         struct timespec ts1,ts2;
 111         double timediff;
 112
 113         clock_gettime_mono(&ts1);
 114         result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
 115         clock_gettime_mono(&ts2);
 116         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 117
 118         if (timediff > audit_timeout) {
 119                 smb_time_audit_log("get_quota", timediff);
 120         }
 121         return result;
 122 }
 123
 124 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 125                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 126                                     SMB_DISK_QUOTA *qt)
 127 {
 128         int result;
 129         struct timespec ts1,ts2;
 130         double timediff;
 131
 132         clock_gettime_mono(&ts1);
 133         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 134         clock_gettime_mono(&ts2);
 135         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 136
 137         if (timediff > audit_timeout) {
 138                 smb_time_audit_log("set_quota", timediff);
 139         }
 140
 141         return result;
 142 }
 143
 144 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 145                                                struct files_struct *fsp,
 146                                                SHADOW_COPY_DATA *shadow_copy_data,
 147                                                bool labels)
 148 {
 149         int result;
 150         struct timespec ts1,ts2;
 151         double timediff;
 152
 153         clock_gettime_mono(&ts1);
 154         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 155                                                    shadow_copy_data, labels);
 156         clock_gettime_mono(&ts2);
 157         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 158
 159         if (timediff > audit_timeout) {
 160                 smb_time_audit_log("get_shadow_copy_data", timediff);
 161         }
 162
 163         return result;
 164 }
 165
 166 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 167                                   const char *path,
 168                                   struct vfs_statvfs_struct *statbuf)
 169 {
 170         int result;
 171         struct timespec ts1,ts2;
 172         double timediff;
 173
 174         clock_gettime_mono(&ts1);
 175         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
 176         clock_gettime_mono(&ts2);
 177         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 178
 179         if (timediff > audit_timeout) {
 180                 smb_time_audit_log("statvfs", timediff);
 181         }
 182
 183         return result;
 184 }
 185
 186 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 187                                                enum timestamp_set_resolution *p_ts_res)
 188 {
 189         uint32_t result;
 190         struct timespec ts1,ts2;
 191         double timediff;
 192
 193         clock_gettime_mono(&ts1);
 194         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 195         clock_gettime_mono(&ts2);
 196         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 197
 198         if (timediff > audit_timeout) {
 199                 smb_time_audit_log("fs_capabilities", timediff);
 200         }
 201
 202         return result;
 203 }
 204
 205 static SMB_STRUCT_DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
 206                                               const char *fname,
 207                                               const char *mask, uint32 attr)
 208 {
 209         SMB_STRUCT_DIR *result;
 210         struct timespec ts1,ts2;
 211         double timediff;
 212
 213         clock_gettime_mono(&ts1);
 214         result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 215         clock_gettime_mono(&ts2);
 216         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 217
 218         if (timediff > audit_timeout) {
 219                 smb_time_audit_log("opendir", timediff);
 220         }
 221
 222         return result;
 223 }
 224
 225 static SMB_STRUCT_DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 226                                               files_struct *fsp,
 227                                               const char *mask, uint32 attr)
 228 {
 229         SMB_STRUCT_DIR *result;
 230         struct timespec ts1,ts2;
 231         double timediff;
 232
 233         clock_gettime_mono(&ts1);
 234         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 235         clock_gettime_mono(&ts2);
 236         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 237
 238         if (timediff > audit_timeout) {
 239                 smb_time_audit_log("fdopendir", timediff);
 240         }
 241
 242         return result;
 243 }
 244
 245 static SMB_STRUCT_DIRENT *smb_time_audit_readdir(vfs_handle_struct *handle,
 246                                                  SMB_STRUCT_DIR *dirp,
 247                                                  SMB_STRUCT_STAT *sbuf)
 248 {
 249         SMB_STRUCT_DIRENT *result;
 250         struct timespec ts1,ts2;
 251         double timediff;
 252
 253         clock_gettime_mono(&ts1);
 254         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 255         clock_gettime_mono(&ts2);
 256         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 257
 258         if (timediff > audit_timeout) {
 259                 smb_time_audit_log("readdir", timediff);
 260         }
 261
 262         return result;
 263 }
 264
 265 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 266                                    SMB_STRUCT_DIR *dirp, long offset)
 267 {
 268         struct timespec ts1,ts2;
 269         double timediff;
 270
 271         clock_gettime_mono(&ts1);
 272         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 273         clock_gettime_mono(&ts2);
 274         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 275
 276         if (timediff > audit_timeout) {
 277                 smb_time_audit_log("seekdir", timediff);
 278         }
 279
 280         return;
 281 }
 282
 283 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 284                                    SMB_STRUCT_DIR *dirp)
 285 {
 286         long result;
 287         struct timespec ts1,ts2;
 288         double timediff;
 289
 290         clock_gettime_mono(&ts1);
 291         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 292         clock_gettime_mono(&ts2);
 293         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 294
 295         if (timediff > audit_timeout) {
 296                 smb_time_audit_log("telldir", timediff);
 297         }
 298
 299         return result;
 300 }
 301
 302 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 303                                      SMB_STRUCT_DIR *dirp)
 304 {
 305         struct timespec ts1,ts2;
 306         double timediff;
 307
 308         clock_gettime_mono(&ts1);
 309         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 310         clock_gettime_mono(&ts2);
 311         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 312
 313         if (timediff > audit_timeout) {
 314                 smb_time_audit_log("rewinddir", timediff);
 315         }
 316
 317         return;
 318 }
 319
 320 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
 321                                 const char *path, mode_t mode)
 322 {
 323         int result;
 324         struct timespec ts1,ts2;
 325         double timediff;
 326
 327         clock_gettime_mono(&ts1);
 328         result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
 329         clock_gettime_mono(&ts2);
 330         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 331
 332         if (timediff > audit_timeout) {
 333                 smb_time_audit_log("mkdir", timediff);
 334         }
 335
 336         return result;
 337 }
 338
 339 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
 340                                 const char *path)
 341 {
 342         int result;
 343         struct timespec ts1,ts2;
 344         double timediff;
 345
 346         clock_gettime_mono(&ts1);
 347         result = SMB_VFS_NEXT_RMDIR(handle, path);
 348         clock_gettime_mono(&ts2);
 349         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 350
 351         if (timediff > audit_timeout) {
 352                 smb_time_audit_log("rmdir", timediff);
 353         }
 354
 355         return result;
 356 }
 357
 358 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 359                                    SMB_STRUCT_DIR *dirp)
 360 {
 361         int result;
 362         struct timespec ts1,ts2;
 363         double timediff;
 364
 365         clock_gettime_mono(&ts1);
 366         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 367         clock_gettime_mono(&ts2);
 368         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 369
 370         if (timediff > audit_timeout) {
 371                 smb_time_audit_log("closedir", timediff);
 372         }
 373
 374         return result;
 375 }
 376
 377 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
 378                                           SMB_STRUCT_DIR *dirp)
 379 {
 380         struct timespec ts1,ts2;
 381         double timediff;
 382
 383         clock_gettime_mono(&ts1);
 384         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
 385         clock_gettime_mono(&ts2);
 386         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 387
 388         if (timediff > audit_timeout) {
 389                 smb_time_audit_log("init_search_op", timediff);
 390         }
 391         return;
 392 }
 393
 394 static int smb_time_audit_open(vfs_handle_struct *handle,
 395                                struct smb_filename *fname,
 396                                files_struct *fsp,
 397                                int flags, mode_t mode)
 398 {
 399         int result;
 400         struct timespec ts1,ts2;
 401         double timediff;
 402
 403         clock_gettime_mono(&ts1);
 404         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
 405         clock_gettime_mono(&ts2);
 406         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 407
 408         if (timediff > audit_timeout) {
 409                 smb_time_audit_log("open", timediff);
 410         }
 411
 412         return result;
 413 }
 414
 415 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 416                                            struct smb_request *req,
 417                                            uint16_t root_dir_fid,
 418                                            struct smb_filename *fname,
 419                                            uint32_t access_mask,
 420                                            uint32_t share_access,
 421                                            uint32_t create_disposition,
 422                                            uint32_t create_options,
 423                                            uint32_t file_attributes,
 424                                            uint32_t oplock_request,
 425                                            uint64_t allocation_size,
 426                                            uint32_t private_flags,
 427                                            struct security_descriptor *sd,
 428                                            struct ea_list *ea_list,
 429                                            files_struct **result_fsp,
 430                                            int *pinfo)
 431 {
 432         NTSTATUS result;
 433         struct timespec ts1,ts2;
 434         double timediff;
 435
 436         clock_gettime_mono(&ts1);
 437         result = SMB_VFS_NEXT_CREATE_FILE(
 438                 handle,                                 /* handle */
 439                 req,                                    /* req */
 440                 root_dir_fid,                           /* root_dir_fid */
 441                 fname,                                  /* fname */
 442                 access_mask,                            /* access_mask */
 443                 share_access,                           /* share_access */
 444                 create_disposition,                     /* create_disposition*/
 445                 create_options,                         /* create_options */
 446                 file_attributes,                        /* file_attributes */
 447                 oplock_request,                         /* oplock_request */
 448                 allocation_size,                        /* allocation_size */
 449                 private_flags,
 450                 sd,                                     /* sd */
 451                 ea_list,                                /* ea_list */
 452                 result_fsp,                             /* result */
 453                 pinfo);
 454         clock_gettime_mono(&ts2);
 455         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 456
 457         if (timediff > audit_timeout) {
 458                 smb_time_audit_log("create_file", timediff);
 459         }
 460
 461         return result;
 462 }
 463
 464 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 465 {
 466         int result;
 467         struct timespec ts1,ts2;
 468         double timediff;
 469
 470         clock_gettime_mono(&ts1);
 471         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 472         clock_gettime_mono(&ts2);
 473         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 474
 475         if (timediff > audit_timeout) {
 476                 smb_time_audit_log("close", timediff);
 477         }
 478
 479         return result;
 480 }
 481
 482 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
 483                                    files_struct *fsp, void *data, size_t n)
 484 {
 485         ssize_t result;
 486         struct timespec ts1,ts2;
 487         double timediff;
 488
 489         clock_gettime_mono(&ts1);
 490         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
 491         clock_gettime_mono(&ts2);
 492         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 493
 494         if (timediff > audit_timeout) {
 495                 smb_time_audit_log("read", timediff);
 496         }
 497
 498         return result;
 499 }
 500
 501 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 502                                     files_struct *fsp,
 503                                     void *data, size_t n, SMB_OFF_T offset)
 504 {
 505         ssize_t result;
 506         struct timespec ts1,ts2;
 507         double timediff;
 508
 509         clock_gettime_mono(&ts1);
 510         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 511         clock_gettime_mono(&ts2);
 512         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 513
 514         if (timediff > audit_timeout) {
 515                 smb_time_audit_log("pread", timediff);
 516         }
 517
 518         return result;
 519 }
 520
 521 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
 522                                     files_struct *fsp,
 523                                     const void *data, size_t n)
 524 {
 525         ssize_t result;
 526         struct timespec ts1,ts2;
 527         double timediff;
 528
 529         clock_gettime_mono(&ts1);
 530         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
 531         clock_gettime_mono(&ts2);
 532         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 533
 534         if (timediff > audit_timeout) {
 535                 smb_time_audit_log("write", timediff);
 536         }
 537
 538         return result;
 539 }
 540
 541 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 542                                      files_struct *fsp,
 543                                      const void *data, size_t n,
 544                                      SMB_OFF_T offset)
 545 {
 546         ssize_t result;
 547         struct timespec ts1,ts2;
 548         double timediff;
 549
 550         clock_gettime_mono(&ts1);
 551         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 552         clock_gettime_mono(&ts2);
 553         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 554
 555         if (timediff > audit_timeout) {
 556                 smb_time_audit_log("pwrite", timediff);
 557         }
 558
 559         return result;
 560 }
 561
 562 static SMB_OFF_T smb_time_audit_lseek(vfs_handle_struct *handle,
 563                                       files_struct *fsp,
 564                                       SMB_OFF_T offset, int whence)
 565 {
 566         ssize_t result;
 567         struct timespec ts1,ts2;
 568         double timediff;
 569
 570         clock_gettime_mono(&ts1);
 571         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 572         clock_gettime_mono(&ts2);
 573         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 574
 575         if (timediff > audit_timeout) {
 576                 smb_time_audit_log("lseek", timediff);
 577         }
 578
 579         return result;
 580 }
 581
 582 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 583                                        files_struct *fromfsp,
 584                                        const DATA_BLOB *hdr, SMB_OFF_T offset,
 585                                        size_t n)
 586 {
 587         ssize_t result;
 588         struct timespec ts1,ts2;
 589         double timediff;
 590
 591         clock_gettime_mono(&ts1);
 592         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 593         clock_gettime_mono(&ts2);
 594         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 595
 596         if (timediff > audit_timeout) {
 597                 smb_time_audit_log("sendfile", timediff);
 598         }
 599
 600         return result;
 601 }
 602
 603 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 604                                        files_struct *tofsp,
 605                                        SMB_OFF_T offset,
 606                                        size_t n)
 607 {
 608         ssize_t result;
 609         struct timespec ts1,ts2;
 610         double timediff;
 611
 612         clock_gettime_mono(&ts1);
 613         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 614         clock_gettime_mono(&ts2);
 615         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 616
 617         if (timediff > audit_timeout) {
 618                 smb_time_audit_log("recvfile", timediff);
 619         }
 620
 621         return result;
 622 }
 623
 624 static int smb_time_audit_rename(vfs_handle_struct *handle,
 625                                  const struct smb_filename *oldname,
 626                                  const struct smb_filename *newname)
 627 {
 628         int result;
 629         struct timespec ts1,ts2;
 630         double timediff;
 631
 632         clock_gettime_mono(&ts1);
 633         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
 634         clock_gettime_mono(&ts2);
 635         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 636
 637         if (timediff > audit_timeout) {
 638                 smb_time_audit_log("rename", timediff);
 639         }
 640
 641         return result;
 642 }
 643
 644 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
 645 {
 646         int result;
 647         struct timespec ts1,ts2;
 648         double timediff;
 649
 650         clock_gettime_mono(&ts1);
 651         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
 652         clock_gettime_mono(&ts2);
 653         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 654
 655         if (timediff > audit_timeout) {
 656                 smb_time_audit_log("fsync", timediff);
 657         }
 658
 659         return result;
 660 }
 661
 662 static int smb_time_audit_stat(vfs_handle_struct *handle,
 663                                struct smb_filename *fname)
 664 {
 665         int result;
 666         struct timespec ts1,ts2;
 667         double timediff;
 668
 669         clock_gettime_mono(&ts1);
 670         result = SMB_VFS_NEXT_STAT(handle, fname);
 671         clock_gettime_mono(&ts2);
 672         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 673
 674         if (timediff > audit_timeout) {
 675                 smb_time_audit_log("stat", timediff);
 676         }
 677
 678         return result;
 679 }
 680
 681 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
 682                                 SMB_STRUCT_STAT *sbuf)
 683 {
 684         int result;
 685         struct timespec ts1,ts2;
 686         double timediff;
 687
 688         clock_gettime_mono(&ts1);
 689         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
 690         clock_gettime_mono(&ts2);
 691         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 692
 693         if (timediff > audit_timeout) {
 694                 smb_time_audit_log("fstat", timediff);
 695         }
 696
 697         return result;
 698 }
 699
 700 static int smb_time_audit_lstat(vfs_handle_struct *handle,
 701                                 struct smb_filename *path)
 702 {
 703         int result;
 704         struct timespec ts1,ts2;
 705         double timediff;
 706
 707         clock_gettime_mono(&ts1);
 708         result = SMB_VFS_NEXT_LSTAT(handle, path);
 709         clock_gettime_mono(&ts2);
 710         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 711
 712         if (timediff > audit_timeout) {
 713                 smb_time_audit_log("lstat", timediff);
 714         }
 715
 716         return result;
 717 }
 718
 719 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
 720                                               files_struct *fsp,
 721                                               const SMB_STRUCT_STAT *sbuf)
 722 {
 723         int result;
 724         struct timespec ts1,ts2;
 725         double timediff;
 726
 727         clock_gettime_mono(&ts1);
 728         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
 729         clock_gettime_mono(&ts2);
 730         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 731
 732         if (timediff > audit_timeout) {
 733                 smb_time_audit_log("get_alloc_size", timediff);
 734         }
 735
 736         return result;
 737 }
 738
 739 static int smb_time_audit_unlink(vfs_handle_struct *handle,
 740                                  const struct smb_filename *path)
 741 {
 742         int result;
 743         struct timespec ts1,ts2;
 744         double timediff;
 745
 746         clock_gettime_mono(&ts1);
 747         result = SMB_VFS_NEXT_UNLINK(handle, path);
 748         clock_gettime_mono(&ts2);
 749         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 750
 751         if (timediff > audit_timeout) {
 752                 smb_time_audit_log("unlink", timediff);
 753         }
 754
 755         return result;
 756 }
 757
 758 static int smb_time_audit_chmod(vfs_handle_struct *handle,
 759                                 const char *path, mode_t mode)
 760 {
 761         int result;
 762         struct timespec ts1,ts2;
 763         double timediff;
 764
 765         clock_gettime_mono(&ts1);
 766         result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
 767         clock_gettime_mono(&ts2);
 768         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 769
 770         if (timediff > audit_timeout) {
 771                 smb_time_audit_log("chmod", timediff);
 772         }
 773
 774         return result;
 775 }
 776
 777 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
 778                                  mode_t mode)
 779 {
 780         int result;
 781         struct timespec ts1,ts2;
 782         double timediff;
 783
 784         clock_gettime_mono(&ts1);
 785         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
 786         clock_gettime_mono(&ts2);
 787         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 788
 789         if (timediff > audit_timeout) {
 790                 smb_time_audit_log("fchmod", timediff);
 791         }
 792
 793         return result;
 794 }
 795
 796 static int smb_time_audit_chown(vfs_handle_struct *handle,
 797                                 const char *path, uid_t uid, gid_t gid)
 798 {
 799         int result;
 800         struct timespec ts1,ts2;
 801         double timediff;
 802
 803         clock_gettime_mono(&ts1);
 804         result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
 805         clock_gettime_mono(&ts2);
 806         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 807
 808         if (timediff > audit_timeout) {
 809                 smb_time_audit_log("chown", timediff);
 810         }
 811
 812         return result;
 813 }
 814
 815 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
 816                                  uid_t uid, gid_t gid)
 817 {
 818         int result;
 819         struct timespec ts1,ts2;
 820         double timediff;
 821
 822         clock_gettime_mono(&ts1);
 823         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
 824         clock_gettime_mono(&ts2);
 825         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 826
 827         if (timediff > audit_timeout) {
 828                 smb_time_audit_log("fchown", timediff);
 829         }
 830
 831         return result;
 832 }
 833
 834 static int smb_time_audit_lchown(vfs_handle_struct *handle,
 835                                  const char *path, uid_t uid, gid_t gid)
 836 {
 837         int result;
 838         struct timespec ts1,ts2;
 839         double timediff;
 840
 841         clock_gettime_mono(&ts1);
 842         result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
 843         clock_gettime_mono(&ts2);
 844         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 845
 846         if (timediff > audit_timeout) {
 847                 smb_time_audit_log("lchown", timediff);
 848         }
 849
 850         return result;
 851 }
 852
 853 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
 854 {
 855         int result;
 856         struct timespec ts1,ts2;
 857         double timediff;
 858
 859         clock_gettime_mono(&ts1);
 860         result = SMB_VFS_NEXT_CHDIR(handle, path);
 861         clock_gettime_mono(&ts2);
 862         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 863
 864         if (timediff > audit_timeout) {
 865                 smb_time_audit_log("chdir", timediff);
 866         }
 867
 868         return result;
 869 }
 870
 871 static char *smb_time_audit_getwd(vfs_handle_struct *handle, char *path)
 872 {
 873         char *result;
 874         struct timespec ts1,ts2;
 875         double timediff;
 876
 877         clock_gettime_mono(&ts1);
 878         result = SMB_VFS_NEXT_GETWD(handle, path);
 879         clock_gettime_mono(&ts2);
 880         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 881
 882         if (timediff > audit_timeout) {
 883                 smb_time_audit_log("getwd", timediff);
 884         }
 885
 886         return result;
 887 }
 888
 889 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
 890                                  const struct smb_filename *path,
 891                                  struct smb_file_time *ft)
 892 {
 893         int result;
 894         struct timespec ts1,ts2;
 895         double timediff;
 896
 897         clock_gettime_mono(&ts1);
 898         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
 899         clock_gettime_mono(&ts2);
 900         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 901
 902         if (timediff > audit_timeout) {
 903                 smb_time_audit_log("ntimes", timediff);
 904         }
 905
 906         return result;
 907 }
 908
 909 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
 910                                     files_struct *fsp,
 911                                     SMB_OFF_T len)
 912 {
 913         int result;
 914         struct timespec ts1,ts2;
 915         double timediff;
 916
 917         clock_gettime_mono(&ts1);
 918         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
 919         clock_gettime_mono(&ts2);
 920         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 921
 922         if (timediff > audit_timeout) {
 923                 smb_time_audit_log("ftruncate", timediff);
 924         }
 925
 926         return result;
 927 }
 928
 929 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
 930                                     files_struct *fsp,
 931                                     enum vfs_fallocate_mode mode,
 932                                     SMB_OFF_T offset,
 933                                     SMB_OFF_T len)
 934 {
 935         int result;
 936         struct timespec ts1,ts2;
 937         double timediff;
 938
 939         clock_gettime_mono(&ts1);
 940         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
 941         clock_gettime_mono(&ts2);
 942         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 943
 944         if (timediff > audit_timeout) {
 945                 smb_time_audit_log("fallocate", timediff);
 946         }
 947
 948         return result;
 949 }
 950
 951 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
 952                                 int op, SMB_OFF_T offset, SMB_OFF_T count,
 953                                 int type)
 954 {
 955         bool result;
 956         struct timespec ts1,ts2;
 957         double timediff;
 958
 959         clock_gettime_mono(&ts1);
 960         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
 961         clock_gettime_mono(&ts2);
 962         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 963
 964         if (timediff > audit_timeout) {
 965                 smb_time_audit_log("lock", timediff);
 966         }
 967
 968         return result;
 969 }
 970
 971 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
 972                                        struct files_struct *fsp,
 973                                        uint32 share_mode, uint32 access_mask)
 974 {
 975         int result;
 976         struct timespec ts1,ts2;
 977         double timediff;
 978
 979         clock_gettime_mono(&ts1);
 980         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
 981                                            access_mask);
 982         clock_gettime_mono(&ts2);
 983         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 984
 985         if (timediff > audit_timeout) {
 986                 smb_time_audit_log("kernel_flock", timediff);
 987         }
 988
 989         return result;
 990 }
 991
 992 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
 993                                          files_struct *fsp,
 994                                          int leasetype)
 995 {
 996         int result;
 997         struct timespec ts1,ts2;
 998         double timediff;
 999
1000         clock_gettime_mono(&ts1);
1001         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1002         clock_gettime_mono(&ts2);
1003         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1004
1005         if (timediff > audit_timeout) {
1006                 smb_time_audit_log("linux_setlease", timediff);
1007         }
1008
1009         return result;
1010 }
1011
1012 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1013                                    files_struct *fsp,
1014                                    SMB_OFF_T *poffset, SMB_OFF_T *pcount,
1015                                    int *ptype, pid_t *ppid)
1016 {
1017         bool result;
1018         struct timespec ts1,ts2;
1019         double timediff;
1020
1021         clock_gettime_mono(&ts1);
1022         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1023                                       ppid);
1024         clock_gettime_mono(&ts2);
1025         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1026
1027         if (timediff > audit_timeout) {
1028                 smb_time_audit_log("getlock", timediff);
1029         }
1030
1031         return result;
1032 }
1033
1034 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1035                                   const char *oldpath, const char *newpath)
1036 {
1037         int result;
1038         struct timespec ts1,ts2;
1039         double timediff;
1040
1041         clock_gettime_mono(&ts1);
1042         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1043         clock_gettime_mono(&ts2);
1044         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1045
1046         if (timediff > audit_timeout) {
1047                 smb_time_audit_log("symlink", timediff);
1048         }
1049
1050         return result;
1051 }
1052
1053 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1054                           const char *path, char *buf, size_t bufsiz)
1055 {
1056         int result;
1057         struct timespec ts1,ts2;
1058         double timediff;
1059
1060         clock_gettime_mono(&ts1);
1061         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1062         clock_gettime_mono(&ts2);
1063         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1064
1065         if (timediff > audit_timeout) {
1066                 smb_time_audit_log("readlink", timediff);
1067         }
1068
1069         return result;
1070 }
1071
1072 static int smb_time_audit_link(vfs_handle_struct *handle,
1073                                const char *oldpath, const char *newpath)
1074 {
1075         int result;
1076         struct timespec ts1,ts2;
1077         double timediff;
1078
1079         clock_gettime_mono(&ts1);
1080         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1081         clock_gettime_mono(&ts2);
1082         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1083
1084         if (timediff > audit_timeout) {
1085                 smb_time_audit_log("link", timediff);
1086         }
1087
1088         return result;
1089 }
1090
1091 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1092                                 const char *pathname, mode_t mode,
1093                                 SMB_DEV_T dev)
1094 {
1095         int result;
1096         struct timespec ts1,ts2;
1097         double timediff;
1098
1099         clock_gettime_mono(&ts1);
1100         result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1101         clock_gettime_mono(&ts2);
1102         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1103
1104         if (timediff > audit_timeout) {
1105                 smb_time_audit_log("mknod", timediff);
1106         }
1107
1108         return result;
1109 }
1110
1111 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1112                                      const char *path)
1113 {
1114         char *result;
1115         struct timespec ts1,ts2;
1116         double timediff;
1117
1118         clock_gettime_mono(&ts1);
1119         result = SMB_VFS_NEXT_REALPATH(handle, path);
1120         clock_gettime_mono(&ts2);
1121         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1122
1123         if (timediff > audit_timeout) {
1124                 smb_time_audit_log("realpath", timediff);
1125         }
1126
1127         return result;
1128 }
1129
1130 static NTSTATUS smb_time_audit_notify_watch(struct vfs_handle_struct *handle,
1131                         struct sys_notify_context *ctx,
1132                         struct notify_entry *e,
1133                         void (*callback)(struct sys_notify_context *ctx,
1134                                         void *private_data,
1135                                         struct notify_event *ev),
1136                         void *private_data, void *handle_p)
1137 {
1138         NTSTATUS result;
1139         struct timespec ts1,ts2;
1140         double timediff;
1141
1142         clock_gettime_mono(&ts1);
1143         result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback,
1144                                            private_data, handle_p);
1145         clock_gettime_mono(&ts2);
1146         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1147
1148         if (timediff > audit_timeout) {
1149                 smb_time_audit_log("notify_watch", timediff);
1150         }
1151
1152         return result;
1153 }
1154
1155 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1156                                   const char *path, unsigned int flags)
1157 {
1158         int result;
1159         struct timespec ts1,ts2;
1160         double timediff;
1161
1162         clock_gettime_mono(&ts1);
1163         result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1164         clock_gettime_mono(&ts2);
1165         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1166
1167         if (timediff > audit_timeout) {
1168                 smb_time_audit_log("chflags", timediff);
1169         }
1170
1171         return result;
1172 }
1173
1174 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1175                                                     const SMB_STRUCT_STAT *sbuf)
1176 {
1177         struct file_id id_zero;
1178         struct file_id result;
1179         struct timespec ts1,ts2;
1180         double timediff;
1181
1182         ZERO_STRUCT(id_zero);
1183
1184         clock_gettime_mono(&ts1);
1185         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1186         clock_gettime_mono(&ts2);
1187         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1188
1189         if (timediff > audit_timeout) {
1190                 smb_time_audit_log("file_id_create", timediff);
1191         }
1192
1193         return result;
1194 }
1195
1196 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1197                                           struct files_struct *fsp,
1198                                           const char *fname,
1199                                           TALLOC_CTX *mem_ctx,
1200                                           unsigned int *pnum_streams,
1201                                           struct stream_struct **pstreams)
1202 {
1203         NTSTATUS result;
1204         struct timespec ts1,ts2;
1205         double timediff;
1206
1207         clock_gettime_mono(&ts1);
1208         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1209                                          pnum_streams, pstreams);
1210         clock_gettime_mono(&ts2);
1211         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1212
1213         if (timediff > audit_timeout) {
1214                 smb_time_audit_log("streaminfo", timediff);
1215         }
1216
1217         return result;
1218 }
1219
1220 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1221                                             const char *path,
1222                                             const char *name,
1223                                             TALLOC_CTX *mem_ctx,
1224                                             char **found_name)
1225 {
1226         int result;
1227         struct timespec ts1,ts2;
1228         double timediff;
1229
1230         clock_gettime_mono(&ts1);
1231         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1232                                                 found_name);
1233         clock_gettime_mono(&ts2);
1234         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1235
1236         if (timediff > audit_timeout) {
1237                 smb_time_audit_log("get_real_filename", timediff);
1238         }
1239
1240         return result;
1241 }
1242
1243 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1244                                               const char *fname)
1245 {
1246         const char *result;
1247         struct timespec ts1,ts2;
1248         double timediff;
1249
1250         clock_gettime_mono(&ts1);
1251         result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1252         clock_gettime_mono(&ts2);
1253         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1254
1255         if (timediff > audit_timeout) {
1256                 smb_time_audit_log("connectpath", timediff);
1257         }
1258
1259         return result;
1260 }
1261
1262 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1263                                                 struct byte_range_lock *br_lck,
1264                                                 struct lock_struct *plock,
1265                                                 bool blocking_lock,
1266                                                 struct blocking_lock_record *blr)
1267 {
1268         NTSTATUS result;
1269         struct timespec ts1,ts2;
1270         double timediff;
1271
1272         clock_gettime_mono(&ts1);
1273         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1274                                                blocking_lock, blr);
1275         clock_gettime_mono(&ts2);
1276         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1277
1278         if (timediff > audit_timeout) {
1279                 smb_time_audit_log("brl_lock_windows", timediff);
1280         }
1281
1282         return result;
1283 }
1284
1285 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1286                                               struct messaging_context *msg_ctx,
1287                                               struct byte_range_lock *br_lck,
1288                                               const struct lock_struct *plock)
1289 {
1290         bool result;
1291         struct timespec ts1,ts2;
1292         double timediff;
1293
1294         clock_gettime_mono(&ts1);
1295         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1296                                                  plock);
1297         clock_gettime_mono(&ts2);
1298         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1299
1300         if (timediff > audit_timeout) {
1301                 smb_time_audit_log("brl_unlock_windows", timediff);
1302         }
1303
1304         return result;
1305 }
1306
1307 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1308                                               struct byte_range_lock *br_lck,
1309                                               struct lock_struct *plock,
1310                                               struct blocking_lock_record *blr)
1311 {
1312         bool result;
1313         struct timespec ts1,ts2;
1314         double timediff;
1315
1316         clock_gettime_mono(&ts1);
1317         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock, blr);
1318         clock_gettime_mono(&ts2);
1319         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1320
1321         if (timediff > audit_timeout) {
1322                 smb_time_audit_log("brl_cancel_windows", timediff);
1323         }
1324
1325         return result;
1326 }
1327
1328 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1329                                        struct files_struct *fsp,
1330                                        struct lock_struct *plock)
1331 {
1332         bool result;
1333         struct timespec ts1,ts2;
1334         double timediff;
1335
1336         clock_gettime_mono(&ts1);
1337         result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1338         clock_gettime_mono(&ts2);
1339         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1340
1341         if (timediff > audit_timeout) {
1342                 smb_time_audit_log("strict_lock", timediff);
1343         }
1344
1345         return result;
1346 }
1347
1348 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1349                                          struct files_struct *fsp,
1350                                          struct lock_struct *plock)
1351 {
1352         struct timespec ts1,ts2;
1353         double timediff;
1354
1355         clock_gettime_mono(&ts1);
1356         SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1357         clock_gettime_mono(&ts2);
1358         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1359
1360         if (timediff > audit_timeout) {
1361                 smb_time_audit_log("strict_unlock", timediff);
1362         }
1363
1364         return;
1365 }
1366
1367 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1368                                               const char *name,
1369                                               enum vfs_translate_direction direction,
1370                                               TALLOC_CTX *mem_ctx,
1371                                               char **mapped_name)
1372 {
1373         NTSTATUS result;
1374         struct timespec ts1,ts2;
1375         double timediff;
1376
1377         clock_gettime_mono(&ts1);
1378         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1379                                              mapped_name);
1380         clock_gettime_mono(&ts2);
1381         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382
1383         if (timediff > audit_timeout) {
1384                 smb_time_audit_log("translate_name", timediff);
1385         }
1386
1387         return result;
1388 }
1389
1390 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
1391                                            files_struct *fsp,
1392                                            uint32 security_info,
1393                                            struct security_descriptor **ppdesc)
1394 {
1395         NTSTATUS result;
1396         struct timespec ts1,ts2;
1397         double timediff;
1398
1399         clock_gettime_mono(&ts1);
1400         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1401         clock_gettime_mono(&ts2);
1402         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1403
1404         if (timediff > audit_timeout) {
1405                 smb_time_audit_log("fget_nt_acl", timediff);
1406         }
1407
1408         return result;
1409 }
1410
1411 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
1412                                           const char *name,
1413                                           uint32 security_info,
1414                                           struct security_descriptor **ppdesc)
1415 {
1416         NTSTATUS result;
1417         struct timespec ts1,ts2;
1418         double timediff;
1419
1420         clock_gettime_mono(&ts1);
1421         result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1422         clock_gettime_mono(&ts2);
1423         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1424
1425         if (timediff > audit_timeout) {
1426                 smb_time_audit_log("get_nt_acl", timediff);
1427         }
1428
1429         return result;
1430 }
1431
1432 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
1433                                            files_struct *fsp,
1434                                            uint32 security_info_sent,
1435                                            const struct security_descriptor *psd)
1436 {
1437         NTSTATUS result;
1438         struct timespec ts1,ts2;
1439         double timediff;
1440
1441         clock_gettime_mono(&ts1);
1442         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
1443                                           psd);
1444         clock_gettime_mono(&ts2);
1445         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1446
1447         if (timediff > audit_timeout) {
1448                 smb_time_audit_log("fset_nt_acl", timediff);
1449         }
1450
1451         return result;
1452 }
1453
1454 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
1455                                     const char *path, mode_t mode)
1456 {
1457         int result;
1458         struct timespec ts1,ts2;
1459         double timediff;
1460
1461         clock_gettime_mono(&ts1);
1462         result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1463         clock_gettime_mono(&ts2);
1464         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1465
1466         if (timediff > audit_timeout) {
1467                 smb_time_audit_log("chmod_acl", timediff);
1468         }
1469
1470         return result;
1471 }
1472
1473 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
1474                                      files_struct *fsp, mode_t mode)
1475 {
1476         int result;
1477         struct timespec ts1,ts2;
1478         double timediff;
1479
1480         clock_gettime_mono(&ts1);
1481         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1482         clock_gettime_mono(&ts2);
1483         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1484
1485         if (timediff > audit_timeout) {
1486                 smb_time_audit_log("fchmod_acl", timediff);
1487         }
1488
1489         return result;
1490 }
1491
1492 static int smb_time_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1493                                             SMB_ACL_T theacl, int entry_id,
1494                                             SMB_ACL_ENTRY_T *entry_p)
1495 {
1496         int result;
1497         struct timespec ts1,ts2;
1498         double timediff;
1499
1500         clock_gettime_mono(&ts1);
1501         result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1502                                                 entry_p);
1503         clock_gettime_mono(&ts2);
1504         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1505
1506         if (timediff > audit_timeout) {
1507                 smb_time_audit_log("sys_acl_get_entry", timediff);
1508         }
1509
1510         return result;
1511 }
1512
1513 static int smb_time_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1514                                                SMB_ACL_ENTRY_T entry_d,
1515                                                SMB_ACL_TAG_T *tag_type_p)
1516 {
1517         int result;
1518         struct timespec ts1,ts2;
1519         double timediff;
1520
1521         clock_gettime_mono(&ts1);
1522         result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1523                                                    tag_type_p);
1524         clock_gettime_mono(&ts2);
1525         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1526
1527         if (timediff > audit_timeout) {
1528                 smb_time_audit_log("sys_acl_get_tag_type", timediff);
1529         }
1530
1531         return result;
1532 }
1533
1534 static int smb_time_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1535                                               SMB_ACL_ENTRY_T entry_d,
1536                                               SMB_ACL_PERMSET_T *permset_p)
1537 {
1538         int result;
1539         struct timespec ts1,ts2;
1540         double timediff;
1541
1542         clock_gettime_mono(&ts1);
1543         result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1544                                                   permset_p);
1545         clock_gettime_mono(&ts2);
1546         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1547
1548         if (timediff > audit_timeout) {
1549                 smb_time_audit_log("sys_acl_get_permset", timediff);
1550         }
1551
1552         return result;
1553 }
1554
1555 static void * smb_time_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1556                                                    SMB_ACL_ENTRY_T entry_d)
1557 {
1558         void *result;
1559         struct timespec ts1,ts2;
1560         double timediff;
1561
1562         clock_gettime_mono(&ts1);
1563         result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1564         clock_gettime_mono(&ts2);
1565         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1566
1567         if (timediff > audit_timeout) {
1568                 smb_time_audit_log("sys_acl_get_qualifier", timediff);
1569         }
1570
1571         return result;
1572 }
1573
1574 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
1575                                                  const char *path_p,
1576                                                  SMB_ACL_TYPE_T type)
1577 {
1578         SMB_ACL_T result;
1579         struct timespec ts1,ts2;
1580         double timediff;
1581
1582         clock_gettime_mono(&ts1);
1583         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1584         clock_gettime_mono(&ts2);
1585         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1586
1587         if (timediff > audit_timeout) {
1588                 smb_time_audit_log("sys_acl_get_file", timediff);
1589         }
1590
1591         return result;
1592 }
1593
1594 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1595                                                files_struct *fsp)
1596 {
1597         SMB_ACL_T result;
1598         struct timespec ts1,ts2;
1599         double timediff;
1600
1601         clock_gettime_mono(&ts1);
1602         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1603         clock_gettime_mono(&ts2);
1604         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1605
1606         if (timediff > audit_timeout) {
1607                 smb_time_audit_log("sys_acl_get_fd", timediff);
1608         }
1609
1610         return result;
1611 }
1612
1613 static int smb_time_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1614                                               SMB_ACL_PERMSET_T permset)
1615 {
1616         int result;
1617         struct timespec ts1,ts2;
1618         double timediff;
1619
1620         clock_gettime_mono(&ts1);
1621         result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1622         clock_gettime_mono(&ts2);
1623         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1624
1625         if (timediff > audit_timeout) {
1626                 smb_time_audit_log("sys_acl_clear_perms", timediff);
1627         }
1628
1629         return result;
1630 }
1631
1632 static int smb_time_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1633                                            SMB_ACL_PERMSET_T permset,
1634                                            SMB_ACL_PERM_T perm)
1635 {
1636         int result;
1637         struct timespec ts1,ts2;
1638         double timediff;
1639
1640         clock_gettime_mono(&ts1);
1641         result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1642         clock_gettime_mono(&ts2);
1643         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1644
1645         if (timediff > audit_timeout) {
1646                 smb_time_audit_log("sys_acl_add_perm", timediff);
1647         }
1648
1649         return result;
1650 }
1651
1652 static char * smb_time_audit_sys_acl_to_text(vfs_handle_struct *handle,
1653                                              SMB_ACL_T theacl,
1654                                              ssize_t *plen)
1655 {
1656         char * result;
1657         struct timespec ts1,ts2;
1658         double timediff;
1659
1660         clock_gettime_mono(&ts1);
1661         result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
1662         clock_gettime_mono(&ts2);
1663         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1664
1665         if (timediff > audit_timeout) {
1666                 smb_time_audit_log("sys_acl_to_text", timediff);
1667         }
1668
1669         return result;
1670 }
1671
1672 static SMB_ACL_T smb_time_audit_sys_acl_init(vfs_handle_struct *handle,
1673                                              int count)
1674 {
1675         SMB_ACL_T result;
1676         struct timespec ts1,ts2;
1677         double timediff;
1678
1679         clock_gettime_mono(&ts1);
1680         result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
1681         clock_gettime_mono(&ts2);
1682         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1683
1684         if (timediff > audit_timeout) {
1685                 smb_time_audit_log("sys_acl_init", timediff);
1686         }
1687
1688         return result;
1689 }
1690
1691 static int smb_time_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1692                                                SMB_ACL_T *pacl,
1693                                                SMB_ACL_ENTRY_T *pentry)
1694 {
1695         int result;
1696         struct timespec ts1,ts2;
1697         double timediff;
1698
1699         clock_gettime_mono(&ts1);
1700         result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
1701         clock_gettime_mono(&ts2);
1702         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1703
1704         if (timediff > audit_timeout) {
1705                 smb_time_audit_log("sys_acl_create_entry", timediff);
1706         }
1707
1708         return result;
1709 }
1710
1711 static int smb_time_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1712                                                SMB_ACL_ENTRY_T entry,
1713                                                SMB_ACL_TAG_T tagtype)
1714 {
1715         int result;
1716         struct timespec ts1,ts2;
1717         double timediff;
1718
1719         clock_gettime_mono(&ts1);
1720         result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
1721                                                    tagtype);
1722         clock_gettime_mono(&ts2);
1723         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1724
1725         if (timediff > audit_timeout) {
1726                 smb_time_audit_log("sys_acl_set_tag_type", timediff);
1727         }
1728
1729         return result;
1730 }
1731
1732 static int smb_time_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1733                                                 SMB_ACL_ENTRY_T entry,
1734                                                 void *qual)
1735 {
1736         int result;
1737         struct timespec ts1,ts2;
1738         double timediff;
1739
1740         clock_gettime_mono(&ts1);
1741         result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
1742         clock_gettime_mono(&ts2);
1743         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1744
1745         if (timediff > audit_timeout) {
1746                 smb_time_audit_log("sys_acl_set_qualifier", timediff);
1747         }
1748
1749         return result;
1750 }
1751
1752 static int smb_time_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1753                                               SMB_ACL_ENTRY_T entry,
1754                                               SMB_ACL_PERMSET_T permset)
1755 {
1756         int result;
1757         struct timespec ts1,ts2;
1758         double timediff;
1759
1760         clock_gettime_mono(&ts1);
1761         result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
1762         clock_gettime_mono(&ts2);
1763         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1764
1765         if (timediff > audit_timeout) {
1766                 smb_time_audit_log("sys_acl_set_permset", timediff);
1767         }
1768
1769         return result;
1770 }
1771
1772 static int smb_time_audit_sys_acl_valid(vfs_handle_struct *handle,
1773                                         SMB_ACL_T theacl)
1774 {
1775         int result;
1776         struct timespec ts1,ts2;
1777         double timediff;
1778
1779         clock_gettime_mono(&ts1);
1780         result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
1781         clock_gettime_mono(&ts2);
1782         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1783
1784         if (timediff > audit_timeout) {
1785                 smb_time_audit_log("sys_acl_valid", timediff);
1786         }
1787
1788         return result;
1789 }
1790
1791 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
1792                                            const char *name,
1793                                            SMB_ACL_TYPE_T acltype,
1794                                            SMB_ACL_T theacl)
1795 {
1796         int result;
1797         struct timespec ts1,ts2;
1798         double timediff;
1799
1800         clock_gettime_mono(&ts1);
1801         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1802                                                theacl);
1803         clock_gettime_mono(&ts2);
1804         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1805
1806         if (timediff > audit_timeout) {
1807                 smb_time_audit_log("sys_acl_set_file", timediff);
1808         }
1809
1810         return result;
1811 }
1812
1813 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
1814                                          files_struct *fsp,
1815                                          SMB_ACL_T theacl)
1816 {
1817         int result;
1818         struct timespec ts1,ts2;
1819         double timediff;
1820
1821         clock_gettime_mono(&ts1);
1822         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1823         clock_gettime_mono(&ts2);
1824         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1825
1826         if (timediff > audit_timeout) {
1827                 smb_time_audit_log("sys_acl_set_fd", timediff);
1828         }
1829
1830         return result;
1831 }
1832
1833 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1834                                                   const char *path)
1835 {
1836         int result;
1837         struct timespec ts1,ts2;
1838         double timediff;
1839
1840         clock_gettime_mono(&ts1);
1841         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
1842         clock_gettime_mono(&ts2);
1843         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1844
1845         if (timediff > audit_timeout) {
1846                 smb_time_audit_log("sys_acl_delete_def_file", timediff);
1847         }
1848
1849         return result;
1850 }
1851
1852 static int smb_time_audit_sys_acl_get_perm(vfs_handle_struct *handle,
1853                                            SMB_ACL_PERMSET_T permset,
1854                                            SMB_ACL_PERM_T perm)
1855 {
1856         int result;
1857         struct timespec ts1,ts2;
1858         double timediff;
1859
1860         clock_gettime_mono(&ts1);
1861         result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
1862         clock_gettime_mono(&ts2);
1863         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1864
1865         if (timediff > audit_timeout) {
1866                 smb_time_audit_log("sys_acl_get_perm", timediff);
1867         }
1868
1869         return result;
1870 }
1871
1872 static int smb_time_audit_sys_acl_free_text(vfs_handle_struct *handle,
1873                                             char *text)
1874 {
1875         int result;
1876         struct timespec ts1,ts2;
1877         double timediff;
1878
1879         clock_gettime_mono(&ts1);
1880         result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
1881         clock_gettime_mono(&ts2);
1882         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1883
1884         if (timediff > audit_timeout) {
1885                 smb_time_audit_log("sys_acl_free_text", timediff);
1886         }
1887
1888         return result;
1889 }
1890
1891 static int smb_time_audit_sys_acl_free_acl(vfs_handle_struct *handle,
1892                                            SMB_ACL_T posix_acl)
1893 {
1894         int result;
1895         struct timespec ts1,ts2;
1896         double timediff;
1897
1898         clock_gettime_mono(&ts1);
1899         result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
1900         clock_gettime_mono(&ts2);
1901         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1902
1903         if (timediff > audit_timeout) {
1904                 smb_time_audit_log("sys_acl_free_acl", timediff);
1905         }
1906
1907         return result;
1908 }
1909
1910 static int smb_time_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
1911                                                  void *qualifier,
1912                                                  SMB_ACL_TAG_T tagtype)
1913 {
1914         int result;
1915         struct timespec ts1,ts2;
1916         double timediff;
1917
1918         clock_gettime_mono(&ts1);
1919         result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
1920                                                      tagtype);
1921         clock_gettime_mono(&ts2);
1922         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1923
1924         if (timediff > audit_timeout) {
1925                 smb_time_audit_log("sys_acl_free_qualifier", timediff);
1926         }
1927
1928         return result;
1929 }
1930
1931 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
1932                                        const char *path, const char *name,
1933                                        void *value, size_t size)
1934 {
1935         ssize_t result;
1936         struct timespec ts1,ts2;
1937         double timediff;
1938
1939         clock_gettime_mono(&ts1);
1940         result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
1941         clock_gettime_mono(&ts2);
1942         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1943
1944         if (timediff > audit_timeout) {
1945                 smb_time_audit_log("getxattr", timediff);
1946         }
1947
1948         return result;
1949 }
1950
1951 static ssize_t smb_time_audit_lgetxattr(struct vfs_handle_struct *handle,
1952                                         const char *path, const char *name,
1953                                         void *value, size_t size)
1954 {
1955         ssize_t result;
1956         struct timespec ts1,ts2;
1957         double timediff;
1958
1959         clock_gettime_mono(&ts1);
1960         result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
1961         clock_gettime_mono(&ts2);
1962         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1963
1964         if (timediff > audit_timeout) {
1965                 smb_time_audit_log("lgetxattr", timediff);
1966         }
1967
1968         return result;
1969 }
1970
1971 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
1972                                         struct files_struct *fsp,
1973                                         const char *name, void *value,
1974                                         size_t size)
1975 {
1976         ssize_t result;
1977         struct timespec ts1,ts2;
1978         double timediff;
1979
1980         clock_gettime_mono(&ts1);
1981         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
1982         clock_gettime_mono(&ts2);
1983         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1984
1985         if (timediff > audit_timeout) {
1986                 smb_time_audit_log("fgetxattr", timediff);
1987         }
1988
1989         return result;
1990 }
1991
1992 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
1993                                         const char *path, char *list,
1994                                         size_t size)
1995 {
1996         ssize_t result;
1997         struct timespec ts1,ts2;
1998         double timediff;
1999
2000         clock_gettime_mono(&ts1);
2001         result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2002         clock_gettime_mono(&ts2);
2003         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2004
2005         if (timediff > audit_timeout) {
2006                 smb_time_audit_log("listxattr", timediff);
2007         }
2008
2009         return result;
2010 }
2011
2012 static ssize_t smb_time_audit_llistxattr(struct vfs_handle_struct *handle,
2013                                          const char *path, char *list,
2014                                          size_t size)
2015 {
2016         ssize_t result;
2017         struct timespec ts1,ts2;
2018         double timediff;
2019
2020         clock_gettime_mono(&ts1);
2021         result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2022         clock_gettime_mono(&ts2);
2023         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2024
2025         if (timediff > audit_timeout) {
2026                 smb_time_audit_log("llistxattr", timediff);
2027         }
2028
2029         return result;
2030 }
2031
2032 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2033                                          struct files_struct *fsp, char *list,
2034                                          size_t size)
2035 {
2036         ssize_t result;
2037         struct timespec ts1,ts2;
2038         double timediff;
2039
2040         clock_gettime_mono(&ts1);
2041         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2042         clock_gettime_mono(&ts2);
2043         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2044
2045         if (timediff > audit_timeout) {
2046                 smb_time_audit_log("flistxattr", timediff);
2047         }
2048
2049         return result;
2050 }
2051
2052 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2053                                       const char *path, const char *name)
2054 {
2055         int result;
2056         struct timespec ts1,ts2;
2057         double timediff;
2058
2059         clock_gettime_mono(&ts1);
2060         result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2061         clock_gettime_mono(&ts2);
2062         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2063
2064         if (timediff > audit_timeout) {
2065                 smb_time_audit_log("removexattr", timediff);
2066         }
2067
2068         return result;
2069 }
2070
2071 static int smb_time_audit_lremovexattr(struct vfs_handle_struct *handle,
2072                                        const char *path, const char *name)
2073 {
2074         int result;
2075         struct timespec ts1,ts2;
2076         double timediff;
2077
2078         clock_gettime_mono(&ts1);
2079         result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2080         clock_gettime_mono(&ts2);
2081         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2082
2083         if (timediff > audit_timeout) {
2084                 smb_time_audit_log("lremovexattr", timediff);
2085         }
2086
2087         return result;
2088 }
2089
2090 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2091                                        struct files_struct *fsp,
2092                                        const char *name)
2093 {
2094         int result;
2095         struct timespec ts1,ts2;
2096         double timediff;
2097
2098         clock_gettime_mono(&ts1);
2099         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2100         clock_gettime_mono(&ts2);
2101         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2102
2103         if (timediff > audit_timeout) {
2104                 smb_time_audit_log("fremovexattr", timediff);
2105         }
2106
2107         return result;
2108 }
2109
2110 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2111                                    const char *path, const char *name,
2112                                    const void *value, size_t size,
2113                                    int flags)
2114 {
2115         int result;
2116         struct timespec ts1,ts2;
2117         double timediff;
2118
2119         clock_gettime_mono(&ts1);
2120         result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2121                                        flags);
2122         clock_gettime_mono(&ts2);
2123         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2124
2125         if (timediff > audit_timeout) {
2126                 smb_time_audit_log("setxattr", timediff);
2127         }
2128
2129         return result;
2130 }
2131
2132 static int smb_time_audit_lsetxattr(struct vfs_handle_struct *handle,
2133                                     const char *path, const char *name,
2134                                     const void *value, size_t size,
2135                                     int flags)
2136 {
2137         int result;
2138         struct timespec ts1,ts2;
2139         double timediff;
2140
2141         clock_gettime_mono(&ts1);
2142         result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2143                                         flags);
2144         clock_gettime_mono(&ts2);
2145         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2146
2147         if (timediff > audit_timeout) {
2148                 smb_time_audit_log("lsetxattr", timediff);
2149         }
2150
2151         return result;
2152 }
2153
2154 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2155                                     struct files_struct *fsp, const char *name,
2156                                     const void *value, size_t size, int flags)
2157 {
2158         int result;
2159         struct timespec ts1,ts2;
2160         double timediff;
2161
2162         clock_gettime_mono(&ts1);
2163         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2164         clock_gettime_mono(&ts2);
2165         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2166
2167         if (timediff > audit_timeout) {
2168                 smb_time_audit_log("fsetxattr", timediff);
2169         }
2170
2171         return result;
2172 }
2173
2174 static int smb_time_audit_aio_read(struct vfs_handle_struct *handle,
2175                                    struct files_struct *fsp,
2176                                    SMB_STRUCT_AIOCB *aiocb)
2177 {
2178         int result;
2179         struct timespec ts1,ts2;
2180         double timediff;
2181
2182         clock_gettime_mono(&ts1);
2183         result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2184         clock_gettime_mono(&ts2);
2185         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2186
2187         if (timediff > audit_timeout) {
2188                 smb_time_audit_log("aio_read", timediff);
2189         }
2190
2191         return result;
2192 }
2193
2194 static int smb_time_audit_aio_write(struct vfs_handle_struct *handle,
2195                                     struct files_struct *fsp,
2196                                     SMB_STRUCT_AIOCB *aiocb)
2197 {
2198         int result;
2199         struct timespec ts1,ts2;
2200         double timediff;
2201
2202         clock_gettime_mono(&ts1);
2203         result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2204         clock_gettime_mono(&ts2);
2205         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2206
2207         if (timediff > audit_timeout) {
2208                 smb_time_audit_log("aio_write", timediff);
2209         }
2210
2211         return result;
2212 }
2213
2214 static ssize_t smb_time_audit_aio_return(struct vfs_handle_struct *handle,
2215                                          struct files_struct *fsp,
2216                                          SMB_STRUCT_AIOCB *aiocb)
2217 {
2218         int result;
2219         struct timespec ts1,ts2;
2220         double timediff;
2221
2222         clock_gettime_mono(&ts1);
2223         result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2224         clock_gettime_mono(&ts2);
2225         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2226
2227         if (timediff > audit_timeout) {
2228                 smb_time_audit_log("aio_return", timediff);
2229         }
2230
2231         return result;
2232 }
2233
2234 static int smb_time_audit_aio_cancel(struct vfs_handle_struct *handle,
2235                                      struct files_struct *fsp,
2236                                      SMB_STRUCT_AIOCB *aiocb)
2237 {
2238         int result;
2239         struct timespec ts1,ts2;
2240         double timediff;
2241
2242         clock_gettime_mono(&ts1);
2243         result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2244         clock_gettime_mono(&ts2);
2245         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2246
2247         if (timediff > audit_timeout) {
2248                 smb_time_audit_log("aio_cancel", timediff);
2249         }
2250
2251         return result;
2252 }
2253
2254 static int smb_time_audit_aio_error(struct vfs_handle_struct *handle,
2255                                     struct files_struct *fsp,
2256                                     SMB_STRUCT_AIOCB *aiocb)
2257 {
2258         int result;
2259         struct timespec ts1,ts2;
2260         double timediff;
2261
2262         clock_gettime_mono(&ts1);
2263         result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2264         clock_gettime_mono(&ts2);
2265         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2266
2267         if (timediff > audit_timeout) {
2268                 smb_time_audit_log("aio_error", timediff);
2269         }
2270
2271         return result;
2272 }
2273
2274 static int smb_time_audit_aio_fsync(struct vfs_handle_struct *handle,
2275                                     struct files_struct *fsp, int op,
2276                                     SMB_STRUCT_AIOCB *aiocb)
2277 {
2278         int result;
2279         struct timespec ts1,ts2;
2280         double timediff;
2281
2282         clock_gettime_mono(&ts1);
2283         result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2284         clock_gettime_mono(&ts2);
2285         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2286
2287         if (timediff > audit_timeout) {
2288                 smb_time_audit_log("aio_fsync", timediff);
2289         }
2290
2291         return result;
2292 }
2293
2294 static int smb_time_audit_aio_suspend(struct vfs_handle_struct *handle,
2295                                       struct files_struct *fsp,
2296                                       const SMB_STRUCT_AIOCB * const aiocb[],
2297                                       int n, const struct timespec *ts)
2298 {
2299         int result;
2300         struct timespec ts1,ts2;
2301         double timediff;
2302
2303         clock_gettime_mono(&ts1);
2304         result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2305         clock_gettime_mono(&ts2);
2306         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2307
2308         if (timediff > audit_timeout) {
2309                 smb_time_audit_log("aio_suspend", timediff);
2310         }
2311
2312         return result;
2313 }
2314
2315 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2316                                      struct files_struct *fsp)
2317 {
2318         bool result;
2319         struct timespec ts1,ts2;
2320         double timediff;
2321
2322         clock_gettime_mono(&ts1);
2323         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2324         clock_gettime_mono(&ts2);
2325         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2326
2327         if (timediff > audit_timeout) {
2328                 smb_time_audit_log("aio_force", timediff);
2329         }
2330
2331         return result;
2332 }
2333
2334
2335
2336 /* VFS operations */
2337
2338 static struct vfs_fn_pointers vfs_time_audit_fns = {
2339         .connect_fn = smb_time_audit_connect,
2340         .disconnect = smb_time_audit_disconnect,
2341         .disk_free = smb_time_audit_disk_free,
2342         .get_quota = smb_time_audit_get_quota,
2343         .set_quota = smb_time_audit_set_quota,
2344         .get_shadow_copy_data = smb_time_audit_get_shadow_copy_data,
2345         .statvfs = smb_time_audit_statvfs,
2346         .fs_capabilities = smb_time_audit_fs_capabilities,
2347         .opendir = smb_time_audit_opendir,
2348         .fdopendir = smb_time_audit_fdopendir,
2349         .readdir = smb_time_audit_readdir,
2350         .seekdir = smb_time_audit_seekdir,
2351         .telldir = smb_time_audit_telldir,
2352         .rewind_dir = smb_time_audit_rewinddir,
2353         .mkdir = smb_time_audit_mkdir,
2354         .rmdir = smb_time_audit_rmdir,
2355         .closedir = smb_time_audit_closedir,
2356         .init_search_op = smb_time_audit_init_search_op,
2357         .open = smb_time_audit_open,
2358         .create_file = smb_time_audit_create_file,
2359         .close_fn = smb_time_audit_close,
2360         .vfs_read = smb_time_audit_read,
2361         .pread = smb_time_audit_pread,
2362         .write = smb_time_audit_write,
2363         .pwrite = smb_time_audit_pwrite,
2364         .lseek = smb_time_audit_lseek,
2365         .sendfile = smb_time_audit_sendfile,
2366         .recvfile = smb_time_audit_recvfile,
2367         .rename = smb_time_audit_rename,
2368         .fsync = smb_time_audit_fsync,
2369         .stat = smb_time_audit_stat,
2370         .fstat = smb_time_audit_fstat,
2371         .lstat = smb_time_audit_lstat,
2372         .get_alloc_size = smb_time_audit_get_alloc_size,
2373         .unlink = smb_time_audit_unlink,
2374         .chmod = smb_time_audit_chmod,
2375         .fchmod = smb_time_audit_fchmod,
2376         .chown = smb_time_audit_chown,
2377         .fchown = smb_time_audit_fchown,
2378         .lchown = smb_time_audit_lchown,
2379         .chdir = smb_time_audit_chdir,
2380         .getwd = smb_time_audit_getwd,
2381         .ntimes = smb_time_audit_ntimes,
2382         .ftruncate = smb_time_audit_ftruncate,
2383         .fallocate = smb_time_audit_fallocate,
2384         .lock = smb_time_audit_lock,
2385         .kernel_flock = smb_time_audit_kernel_flock,
2386         .linux_setlease = smb_time_audit_linux_setlease,
2387         .getlock = smb_time_audit_getlock,
2388         .symlink = smb_time_audit_symlink,
2389         .vfs_readlink = smb_time_audit_readlink,
2390         .link = smb_time_audit_link,
2391         .mknod = smb_time_audit_mknod,
2392         .realpath = smb_time_audit_realpath,
2393         .notify_watch = smb_time_audit_notify_watch,
2394         .chflags = smb_time_audit_chflags,
2395         .file_id_create = smb_time_audit_file_id_create,
2396         .streaminfo = smb_time_audit_streaminfo,
2397         .get_real_filename = smb_time_audit_get_real_filename,
2398         .connectpath = smb_time_audit_connectpath,
2399         .brl_lock_windows = smb_time_audit_brl_lock_windows,
2400         .brl_unlock_windows = smb_time_audit_brl_unlock_windows,
2401         .brl_cancel_windows = smb_time_audit_brl_cancel_windows,
2402         .strict_lock = smb_time_audit_strict_lock,
2403         .strict_unlock = smb_time_audit_strict_unlock,
2404         .translate_name = smb_time_audit_translate_name,
2405         .fget_nt_acl = smb_time_audit_fget_nt_acl,
2406         .get_nt_acl = smb_time_audit_get_nt_acl,
2407         .fset_nt_acl = smb_time_audit_fset_nt_acl,
2408         .chmod_acl = smb_time_audit_chmod_acl,
2409         .fchmod_acl = smb_time_audit_fchmod_acl,
2410         .sys_acl_get_entry = smb_time_audit_sys_acl_get_entry,
2411         .sys_acl_get_tag_type = smb_time_audit_sys_acl_get_tag_type,
2412         .sys_acl_get_permset = smb_time_audit_sys_acl_get_permset,
2413         .sys_acl_get_qualifier = smb_time_audit_sys_acl_get_qualifier,
2414         .sys_acl_get_file = smb_time_audit_sys_acl_get_file,
2415         .sys_acl_get_fd = smb_time_audit_sys_acl_get_fd,
2416         .sys_acl_clear_perms = smb_time_audit_sys_acl_clear_perms,
2417         .sys_acl_add_perm = smb_time_audit_sys_acl_add_perm,
2418         .sys_acl_to_text = smb_time_audit_sys_acl_to_text,
2419         .sys_acl_init = smb_time_audit_sys_acl_init,
2420         .sys_acl_create_entry = smb_time_audit_sys_acl_create_entry,
2421         .sys_acl_set_tag_type = smb_time_audit_sys_acl_set_tag_type,
2422         .sys_acl_set_qualifier = smb_time_audit_sys_acl_set_qualifier,
2423         .sys_acl_set_permset = smb_time_audit_sys_acl_set_permset,
2424         .sys_acl_valid = smb_time_audit_sys_acl_valid,
2425         .sys_acl_set_file = smb_time_audit_sys_acl_set_file,
2426         .sys_acl_set_fd = smb_time_audit_sys_acl_set_fd,
2427         .sys_acl_delete_def_file = smb_time_audit_sys_acl_delete_def_file,
2428         .sys_acl_get_perm = smb_time_audit_sys_acl_get_perm,
2429         .sys_acl_free_text = smb_time_audit_sys_acl_free_text,
2430         .sys_acl_free_acl = smb_time_audit_sys_acl_free_acl,
2431         .sys_acl_free_qualifier = smb_time_audit_sys_acl_free_qualifier,
2432         .getxattr = smb_time_audit_getxattr,
2433         .lgetxattr = smb_time_audit_lgetxattr,
2434         .fgetxattr = smb_time_audit_fgetxattr,
2435         .listxattr = smb_time_audit_listxattr,
2436         .llistxattr = smb_time_audit_llistxattr,
2437         .flistxattr = smb_time_audit_flistxattr,
2438         .removexattr = smb_time_audit_removexattr,
2439         .lremovexattr = smb_time_audit_lremovexattr,
2440         .fremovexattr = smb_time_audit_fremovexattr,
2441         .setxattr = smb_time_audit_setxattr,
2442         .lsetxattr = smb_time_audit_lsetxattr,
2443         .fsetxattr = smb_time_audit_fsetxattr,
2444         .aio_read = smb_time_audit_aio_read,
2445         .aio_write = smb_time_audit_aio_write,
2446         .aio_return_fn = smb_time_audit_aio_return,
2447         .aio_cancel = smb_time_audit_aio_cancel,
2448         .aio_error_fn = smb_time_audit_aio_error,
2449         .aio_fsync = smb_time_audit_aio_fsync,
2450         .aio_suspend = smb_time_audit_aio_suspend,
2451         .aio_force = smb_time_audit_aio_force,
2452 };
2453
2454
2455 NTSTATUS vfs_time_audit_init(void);
2456 NTSTATUS vfs_time_audit_init(void)
2457 {
2458         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2459                                             10000) / 1000.0;
2460         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2461                                 &vfs_time_audit_fns);
2462 }