source3/modules/vfs_full_audit.c

   1 /*
   2  * Auditing VFS module for samba.  Log selected file operations to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Tim Potter, 1999-2000
   6  * Copyright (C) Alexander Bokovoy, 2002
   7  * Copyright (C) John H Terpstra, 2003
   8  * Copyright (C) Stefan (metze) Metzmacher, 2003
   9  * Copyright (C) Volker Lendecke, 2004
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 3 of the License, or
  14  * (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /*
  26  * This module implements parseable logging for all Samba VFS operations.
  27  *
  28  * You use it as follows:
  29  *
  30  * [tmp]
  31  * path = /tmp
  32  * vfs objects = full_audit
  33  * full_audit:prefix = %u|%I
  34  * full_audit:success = open opendir
  35  * full_audit:failure = all
  36  *
  37  * vfs op can be "all" which means log all operations.
  38  * vfs op can be "none" which means no logging.
  39  *
  40  * This leads to syslog entries of the form:
  41  * smbd_audit: nobody|192.168.234.1|opendir|ok|.
  42  * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
  43  *
  44  * where "nobody" is the connected username and "192.168.234.1" is the
  45  * client's IP address.
  46  *
  47  * Options:
  48  *
  49  * prefix: A macro expansion template prepended to the syslog entry.
  50  *
  51  * success: A list of VFS operations for which a successful completion should
  52  * be logged. Defaults to no logging at all. The special operation "all" logs
  53  * - you guessed it - everything.
  54  *
  55  * failure: A list of VFS operations for which failure to complete should be
  56  * logged. Defaults to logging everything.
  57  */
  58
  59
  60 #include "includes.h"
  61 #include "system/filesys.h"
  62 #include "system/syslog.h"
  63 #include "smbd/smbd.h"
  64 #include "../librpc/gen_ndr/ndr_netlogon.h"
  65 #include "auth.h"
  66 #include "ntioctl.h"
  67 #include "lib/param/loadparm.h"
  68 #include "lib/util/bitmap.h"
  69 #include "lib/util/tevent_unix.h"
  70 #include "libcli/security/sddl.h"
  71 #include "passdb/machine_sid.h"
  72
  73 static int vfs_full_audit_debug_level = DBGC_VFS;
  74
  75 struct vfs_full_audit_private_data {
  76         struct bitmap *success_ops;
  77         struct bitmap *failure_ops;
  78         int syslog_facility;
  79         int syslog_priority;
  80         bool log_secdesc;
  81         bool do_syslog;
  82 };
  83
  84 #undef DBGC_CLASS
  85 #define DBGC_CLASS vfs_full_audit_debug_level
  86
  87 typedef enum _vfs_op_type {
  88         SMB_VFS_OP_NOOP = -1,
  89
  90         /* Disk operations */
  91
  92         SMB_VFS_OP_CONNECT = 0,
  93         SMB_VFS_OP_DISCONNECT,
  94         SMB_VFS_OP_DISK_FREE,
  95         SMB_VFS_OP_GET_QUOTA,
  96         SMB_VFS_OP_SET_QUOTA,
  97         SMB_VFS_OP_GET_SHADOW_COPY_DATA,
  98         SMB_VFS_OP_STATVFS,
  99         SMB_VFS_OP_FS_CAPABILITIES,
 100         SMB_VFS_OP_GET_DFS_REFERRALS,
 101
 102         /* Directory operations */
 103
 104         SMB_VFS_OP_OPENDIR,
 105         SMB_VFS_OP_FDOPENDIR,
 106         SMB_VFS_OP_READDIR,
 107         SMB_VFS_OP_SEEKDIR,
 108         SMB_VFS_OP_TELLDIR,
 109         SMB_VFS_OP_REWINDDIR,
 110         SMB_VFS_OP_MKDIR,
 111         SMB_VFS_OP_RMDIR,
 112         SMB_VFS_OP_CLOSEDIR,
 113         SMB_VFS_OP_INIT_SEARCH_OP,
 114
 115         /* File operations */
 116
 117         SMB_VFS_OP_OPEN,
 118         SMB_VFS_OP_CREATE_FILE,
 119         SMB_VFS_OP_CLOSE,
 120         SMB_VFS_OP_READ,
 121         SMB_VFS_OP_PREAD,
 122         SMB_VFS_OP_PREAD_SEND,
 123         SMB_VFS_OP_PREAD_RECV,
 124         SMB_VFS_OP_WRITE,
 125         SMB_VFS_OP_PWRITE,
 126         SMB_VFS_OP_PWRITE_SEND,
 127         SMB_VFS_OP_PWRITE_RECV,
 128         SMB_VFS_OP_LSEEK,
 129         SMB_VFS_OP_SENDFILE,
 130         SMB_VFS_OP_RECVFILE,
 131         SMB_VFS_OP_RENAME,
 132         SMB_VFS_OP_FSYNC,
 133         SMB_VFS_OP_FSYNC_SEND,
 134         SMB_VFS_OP_FSYNC_RECV,
 135         SMB_VFS_OP_STAT,
 136         SMB_VFS_OP_FSTAT,
 137         SMB_VFS_OP_LSTAT,
 138         SMB_VFS_OP_GET_ALLOC_SIZE,
 139         SMB_VFS_OP_UNLINK,
 140         SMB_VFS_OP_CHMOD,
 141         SMB_VFS_OP_FCHMOD,
 142         SMB_VFS_OP_CHOWN,
 143         SMB_VFS_OP_FCHOWN,
 144         SMB_VFS_OP_LCHOWN,
 145         SMB_VFS_OP_CHDIR,
 146         SMB_VFS_OP_GETWD,
 147         SMB_VFS_OP_NTIMES,
 148         SMB_VFS_OP_FTRUNCATE,
 149         SMB_VFS_OP_FALLOCATE,
 150         SMB_VFS_OP_LOCK,
 151         SMB_VFS_OP_KERNEL_FLOCK,
 152         SMB_VFS_OP_LINUX_SETLEASE,
 153         SMB_VFS_OP_GETLOCK,
 154         SMB_VFS_OP_SYMLINK,
 155         SMB_VFS_OP_READLINK,
 156         SMB_VFS_OP_LINK,
 157         SMB_VFS_OP_MKNOD,
 158         SMB_VFS_OP_REALPATH,
 159         SMB_VFS_OP_CHFLAGS,
 160         SMB_VFS_OP_FILE_ID_CREATE,
 161         SMB_VFS_OP_STREAMINFO,
 162         SMB_VFS_OP_GET_REAL_FILENAME,
 163         SMB_VFS_OP_CONNECTPATH,
 164         SMB_VFS_OP_BRL_LOCK_WINDOWS,
 165         SMB_VFS_OP_BRL_UNLOCK_WINDOWS,
 166         SMB_VFS_OP_BRL_CANCEL_WINDOWS,
 167         SMB_VFS_OP_STRICT_LOCK,
 168         SMB_VFS_OP_STRICT_UNLOCK,
 169         SMB_VFS_OP_TRANSLATE_NAME,
 170         SMB_VFS_OP_FSCTL,
 171         SMB_VFS_OP_OFFLOAD_READ_SEND,
 172         SMB_VFS_OP_OFFLOAD_READ_RECV,
 173         SMB_VFS_OP_OFFLOAD_WRITE_SEND,
 174         SMB_VFS_OP_OFFLOAD_WRITE_RECV,
 175         SMB_VFS_OP_GET_COMPRESSION,
 176         SMB_VFS_OP_SET_COMPRESSION,
 177         SMB_VFS_OP_SNAP_CHECK_PATH,
 178         SMB_VFS_OP_SNAP_CREATE,
 179         SMB_VFS_OP_SNAP_DELETE,
 180
 181         /* DOS attribute operations. */
 182         SMB_VFS_OP_GET_DOS_ATTRIBUTES,
 183         SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
 184         SMB_VFS_OP_SET_DOS_ATTRIBUTES,
 185         SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
 186
 187         /* NT ACL operations. */
 188
 189         SMB_VFS_OP_FGET_NT_ACL,
 190         SMB_VFS_OP_GET_NT_ACL,
 191         SMB_VFS_OP_FSET_NT_ACL,
 192         SMB_VFS_OP_AUDIT_FILE,
 193
 194         /* POSIX ACL operations. */
 195
 196         SMB_VFS_OP_CHMOD_ACL,
 197         SMB_VFS_OP_FCHMOD_ACL,
 198
 199         SMB_VFS_OP_SYS_ACL_GET_FILE,
 200         SMB_VFS_OP_SYS_ACL_GET_FD,
 201         SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE,
 202         SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,
 203         SMB_VFS_OP_SYS_ACL_SET_FILE,
 204         SMB_VFS_OP_SYS_ACL_SET_FD,
 205         SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,
 206
 207         /* EA operations. */
 208         SMB_VFS_OP_GETXATTR,
 209         SMB_VFS_OP_FGETXATTR,
 210         SMB_VFS_OP_LISTXATTR,
 211         SMB_VFS_OP_FLISTXATTR,
 212         SMB_VFS_OP_REMOVEXATTR,
 213         SMB_VFS_OP_FREMOVEXATTR,
 214         SMB_VFS_OP_SETXATTR,
 215         SMB_VFS_OP_FSETXATTR,
 216
 217         /* aio operations */
 218         SMB_VFS_OP_AIO_FORCE,
 219
 220         /* offline operations */
 221         SMB_VFS_OP_IS_OFFLINE,
 222         SMB_VFS_OP_SET_OFFLINE,
 223
 224         /* Durable handle operations. */
 225         SMB_VFS_OP_DURABLE_COOKIE,
 226         SMB_VFS_OP_DURABLE_DISCONNECT,
 227         SMB_VFS_OP_DURABLE_RECONNECT,
 228
 229         SMB_VFS_OP_READDIR_ATTR,
 230
 231         /* This should always be last enum value */
 232
 233         SMB_VFS_OP_LAST
 234 } vfs_op_type;
 235
 236 /* The following array *must* be in the same order as defined in vfs_op_type */
 237
 238 static struct {
 239         vfs_op_type type;
 240         const char *name;
 241 } vfs_op_names[] = {
 242         { SMB_VFS_OP_CONNECT,   "connect" },
 243         { SMB_VFS_OP_DISCONNECT,        "disconnect" },
 244         { SMB_VFS_OP_DISK_FREE, "disk_free" },
 245         { SMB_VFS_OP_GET_QUOTA, "get_quota" },
 246         { SMB_VFS_OP_SET_QUOTA, "set_quota" },
 247         { SMB_VFS_OP_GET_SHADOW_COPY_DATA,      "get_shadow_copy_data" },
 248         { SMB_VFS_OP_STATVFS,   "statvfs" },
 249         { SMB_VFS_OP_FS_CAPABILITIES,   "fs_capabilities" },
 250         { SMB_VFS_OP_GET_DFS_REFERRALS, "get_dfs_referrals" },
 251         { SMB_VFS_OP_OPENDIR,   "opendir" },
 252         { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
 253         { SMB_VFS_OP_READDIR,   "readdir" },
 254         { SMB_VFS_OP_SEEKDIR,   "seekdir" },
 255         { SMB_VFS_OP_TELLDIR,   "telldir" },
 256         { SMB_VFS_OP_REWINDDIR, "rewinddir" },
 257         { SMB_VFS_OP_MKDIR,     "mkdir" },
 258         { SMB_VFS_OP_RMDIR,     "rmdir" },
 259         { SMB_VFS_OP_CLOSEDIR,  "closedir" },
 260         { SMB_VFS_OP_INIT_SEARCH_OP, "init_search_op" },
 261         { SMB_VFS_OP_OPEN,      "open" },
 262         { SMB_VFS_OP_CREATE_FILE, "create_file" },
 263         { SMB_VFS_OP_CLOSE,     "close" },
 264         { SMB_VFS_OP_READ,      "read" },
 265         { SMB_VFS_OP_PREAD,     "pread" },
 266         { SMB_VFS_OP_PREAD_SEND,        "pread_send" },
 267         { SMB_VFS_OP_PREAD_RECV,        "pread_recv" },
 268         { SMB_VFS_OP_WRITE,     "write" },
 269         { SMB_VFS_OP_PWRITE,    "pwrite" },
 270         { SMB_VFS_OP_PWRITE_SEND,       "pwrite_send" },
 271         { SMB_VFS_OP_PWRITE_RECV,       "pwrite_recv" },
 272         { SMB_VFS_OP_LSEEK,     "lseek" },
 273         { SMB_VFS_OP_SENDFILE,  "sendfile" },
 274         { SMB_VFS_OP_RECVFILE,  "recvfile" },
 275         { SMB_VFS_OP_RENAME,    "rename" },
 276         { SMB_VFS_OP_FSYNC,     "fsync" },
 277         { SMB_VFS_OP_FSYNC_SEND,        "fsync_send" },
 278         { SMB_VFS_OP_FSYNC_RECV,        "fsync_recv" },
 279         { SMB_VFS_OP_STAT,      "stat" },
 280         { SMB_VFS_OP_FSTAT,     "fstat" },
 281         { SMB_VFS_OP_LSTAT,     "lstat" },
 282         { SMB_VFS_OP_GET_ALLOC_SIZE,    "get_alloc_size" },
 283         { SMB_VFS_OP_UNLINK,    "unlink" },
 284         { SMB_VFS_OP_CHMOD,     "chmod" },
 285         { SMB_VFS_OP_FCHMOD,    "fchmod" },
 286         { SMB_VFS_OP_CHOWN,     "chown" },
 287         { SMB_VFS_OP_FCHOWN,    "fchown" },
 288         { SMB_VFS_OP_LCHOWN,    "lchown" },
 289         { SMB_VFS_OP_CHDIR,     "chdir" },
 290         { SMB_VFS_OP_GETWD,     "getwd" },
 291         { SMB_VFS_OP_NTIMES,    "ntimes" },
 292         { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
 293         { SMB_VFS_OP_FALLOCATE,"fallocate" },
 294         { SMB_VFS_OP_LOCK,      "lock" },
 295         { SMB_VFS_OP_KERNEL_FLOCK,      "kernel_flock" },
 296         { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
 297         { SMB_VFS_OP_GETLOCK,   "getlock" },
 298         { SMB_VFS_OP_SYMLINK,   "symlink" },
 299         { SMB_VFS_OP_READLINK,  "readlink" },
 300         { SMB_VFS_OP_LINK,      "link" },
 301         { SMB_VFS_OP_MKNOD,     "mknod" },
 302         { SMB_VFS_OP_REALPATH,  "realpath" },
 303         { SMB_VFS_OP_CHFLAGS,   "chflags" },
 304         { SMB_VFS_OP_FILE_ID_CREATE,    "file_id_create" },
 305         { SMB_VFS_OP_STREAMINFO,        "streaminfo" },
 306         { SMB_VFS_OP_GET_REAL_FILENAME, "get_real_filename" },
 307         { SMB_VFS_OP_CONNECTPATH,       "connectpath" },
 308         { SMB_VFS_OP_BRL_LOCK_WINDOWS,  "brl_lock_windows" },
 309         { SMB_VFS_OP_BRL_UNLOCK_WINDOWS, "brl_unlock_windows" },
 310         { SMB_VFS_OP_BRL_CANCEL_WINDOWS, "brl_cancel_windows" },
 311         { SMB_VFS_OP_STRICT_LOCK, "strict_lock" },
 312         { SMB_VFS_OP_STRICT_UNLOCK, "strict_unlock" },
 313         { SMB_VFS_OP_TRANSLATE_NAME,    "translate_name" },
 314         { SMB_VFS_OP_FSCTL,             "fsctl" },
 315         { SMB_VFS_OP_OFFLOAD_READ_SEND, "offload_read_send" },
 316         { SMB_VFS_OP_OFFLOAD_READ_RECV, "offload_read_recv" },
 317         { SMB_VFS_OP_OFFLOAD_WRITE_SEND,        "offload_write_send" },
 318         { SMB_VFS_OP_OFFLOAD_WRITE_RECV,        "offload_write_recv" },
 319         { SMB_VFS_OP_GET_COMPRESSION,   "get_compression" },
 320         { SMB_VFS_OP_SET_COMPRESSION,   "set_compression" },
 321         { SMB_VFS_OP_SNAP_CHECK_PATH, "snap_check_path" },
 322         { SMB_VFS_OP_SNAP_CREATE, "snap_create" },
 323         { SMB_VFS_OP_SNAP_DELETE, "snap_delete" },
 324         { SMB_VFS_OP_GET_DOS_ATTRIBUTES, "get_dos_attributes" },
 325         { SMB_VFS_OP_FGET_DOS_ATTRIBUTES, "fget_dos_attributes" },
 326         { SMB_VFS_OP_SET_DOS_ATTRIBUTES, "set_dos_attributes" },
 327         { SMB_VFS_OP_FSET_DOS_ATTRIBUTES, "fset_dos_attributes" },
 328         { SMB_VFS_OP_FGET_NT_ACL,       "fget_nt_acl" },
 329         { SMB_VFS_OP_GET_NT_ACL,        "get_nt_acl" },
 330         { SMB_VFS_OP_FSET_NT_ACL,       "fset_nt_acl" },
 331         { SMB_VFS_OP_AUDIT_FILE,        "audit_file" },
 332         { SMB_VFS_OP_CHMOD_ACL, "chmod_acl" },
 333         { SMB_VFS_OP_FCHMOD_ACL,        "fchmod_acl" },
 334         { SMB_VFS_OP_SYS_ACL_GET_FILE,  "sys_acl_get_file" },
 335         { SMB_VFS_OP_SYS_ACL_GET_FD,    "sys_acl_get_fd" },
 336         { SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE,     "sys_acl_blob_get_file" },
 337         { SMB_VFS_OP_SYS_ACL_BLOB_GET_FD,       "sys_acl_blob_get_fd" },
 338         { SMB_VFS_OP_SYS_ACL_SET_FILE,  "sys_acl_set_file" },
 339         { SMB_VFS_OP_SYS_ACL_SET_FD,    "sys_acl_set_fd" },
 340         { SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE,   "sys_acl_delete_def_file" },
 341         { SMB_VFS_OP_GETXATTR,  "getxattr" },
 342         { SMB_VFS_OP_FGETXATTR, "fgetxattr" },
 343         { SMB_VFS_OP_LISTXATTR, "listxattr" },
 344         { SMB_VFS_OP_FLISTXATTR,        "flistxattr" },
 345         { SMB_VFS_OP_REMOVEXATTR,       "removexattr" },
 346         { SMB_VFS_OP_FREMOVEXATTR,      "fremovexattr" },
 347         { SMB_VFS_OP_SETXATTR,  "setxattr" },
 348         { SMB_VFS_OP_FSETXATTR, "fsetxattr" },
 349         { SMB_VFS_OP_AIO_FORCE, "aio_force" },
 350         { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
 351         { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
 352         { SMB_VFS_OP_DURABLE_COOKIE, "durable_cookie" },
 353         { SMB_VFS_OP_DURABLE_DISCONNECT, "durable_disconnect" },
 354         { SMB_VFS_OP_DURABLE_RECONNECT, "durable_reconnect" },
 355         { SMB_VFS_OP_READDIR_ATTR,      "readdir_attr" },
 356         { SMB_VFS_OP_LAST, NULL }
 357 };
 358
 359 static int audit_syslog_facility(vfs_handle_struct *handle)
 360 {
 361         static const struct enum_list enum_log_facilities[] = {
 362                 { LOG_USER, "USER" },
 363                 { LOG_LOCAL0, "LOCAL0" },
 364                 { LOG_LOCAL1, "LOCAL1" },
 365                 { LOG_LOCAL2, "LOCAL2" },
 366                 { LOG_LOCAL3, "LOCAL3" },
 367                 { LOG_LOCAL4, "LOCAL4" },
 368                 { LOG_LOCAL5, "LOCAL5" },
 369                 { LOG_LOCAL6, "LOCAL6" },
 370                 { LOG_LOCAL7, "LOCAL7" },
 371                 { -1, NULL}
 372         };
 373
 374         int facility;
 375
 376         facility = lp_parm_enum(SNUM(handle->conn), "full_audit", "facility", enum_log_facilities, LOG_USER);
 377
 378         return facility;
 379 }
 380
 381 static int audit_syslog_priority(vfs_handle_struct *handle)
 382 {
 383         static const struct enum_list enum_log_priorities[] = {
 384                 { LOG_EMERG, "EMERG" },
 385                 { LOG_ALERT, "ALERT" },
 386                 { LOG_CRIT, "CRIT" },
 387                 { LOG_ERR, "ERR" },
 388                 { LOG_WARNING, "WARNING" },
 389                 { LOG_NOTICE, "NOTICE" },
 390                 { LOG_INFO, "INFO" },
 391                 { LOG_DEBUG, "DEBUG" },
 392                 { -1, NULL}
 393         };
 394
 395         int priority;
 396
 397         priority = lp_parm_enum(SNUM(handle->conn), "full_audit", "priority",
 398                                 enum_log_priorities, LOG_NOTICE);
 399         if (priority == -1) {
 400                 priority = LOG_WARNING;
 401         }
 402
 403         return priority;
 404 }
 405
 406 static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
 407 {
 408         char *prefix = NULL;
 409         char *result;
 410
 411         prefix = talloc_strdup(ctx,
 412                         lp_parm_const_string(SNUM(conn), "full_audit",
 413                                              "prefix", "%u|%I"));
 414         if (!prefix) {
 415                 return NULL;
 416         }
 417         result = talloc_sub_advanced(ctx,
 418                         lp_servicename(talloc_tos(), SNUM(conn)),
 419                         conn->session_info->unix_info->unix_name,
 420                         conn->connectpath,
 421                         conn->session_info->unix_token->gid,
 422                         conn->session_info->unix_info->sanitized_username,
 423                         conn->session_info->info->domain_name,
 424                         prefix);
 425         TALLOC_FREE(prefix);
 426         return result;
 427 }
 428
 429 static bool log_success(struct vfs_full_audit_private_data *pd, vfs_op_type op)
 430 {
 431         if (pd->success_ops == NULL) {
 432                 return True;
 433         }
 434
 435         return bitmap_query(pd->success_ops, op);
 436 }
 437
 438 static bool log_failure(struct vfs_full_audit_private_data *pd, vfs_op_type op)
 439 {
 440         if (pd->failure_ops == NULL)
 441                 return True;
 442
 443         return bitmap_query(pd->failure_ops, op);
 444 }
 445
 446 static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
 447 {
 448         struct bitmap *bm;
 449
 450         if (ops == NULL) {
 451                 return NULL;
 452         }
 453
 454         bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
 455         if (bm == NULL) {
 456                 DEBUG(0, ("Could not alloc bitmap -- "
 457                           "defaulting to logging everything\n"));
 458                 return NULL;
 459         }
 460
 461         for (; *ops != NULL; ops += 1) {
 462                 int i;
 463                 bool neg = false;
 464                 const char *op;
 465
 466                 if (strequal(*ops, "all")) {
 467                         for (i=0; i<SMB_VFS_OP_LAST; i++) {
 468                                 bitmap_set(bm, i);
 469                         }
 470                         continue;
 471                 }
 472
 473                 if (strequal(*ops, "none")) {
 474                         break;
 475                 }
 476
 477                 op = ops[0];
 478                 if (op[0] == '!') {
 479                         neg = true;
 480                         op += 1;
 481                 }
 482
 483                 for (i=0; i<SMB_VFS_OP_LAST; i++) {
 484                         if ((vfs_op_names[i].name == NULL)
 485                          || (vfs_op_names[i].type != i)) {
 486                                 smb_panic("vfs_full_audit.c: name table not "
 487                                           "in sync with vfs_op_type enums\n");
 488                         }
 489                         if (strequal(op, vfs_op_names[i].name)) {
 490                                 if (neg) {
 491                                         bitmap_clear(bm, i);
 492                                 } else {
 493                                         bitmap_set(bm, i);
 494                                 }
 495                                 break;
 496                         }
 497                 }
 498                 if (i == SMB_VFS_OP_LAST) {
 499                         DEBUG(0, ("Could not find opname %s, logging all\n",
 500                                   *ops));
 501                         TALLOC_FREE(bm);
 502                         return NULL;
 503                 }
 504         }
 505         return bm;
 506 }
 507
 508 static const char *audit_opname(vfs_op_type op)
 509 {
 510         if (op >= SMB_VFS_OP_LAST)
 511                 return "INVALID VFS OP";
 512         return vfs_op_names[op].name;
 513 }
 514
 515 static TALLOC_CTX *tmp_do_log_ctx;
 516 /*
 517  * Get us a temporary talloc context usable just for DEBUG arguments
 518  */
 519 static TALLOC_CTX *do_log_ctx(void)
 520 {
 521         if (tmp_do_log_ctx == NULL) {
 522                 tmp_do_log_ctx = talloc_named_const(NULL, 0, "do_log_ctx");
 523         }
 524         return tmp_do_log_ctx;
 525 }
 526
 527 static void do_log(vfs_op_type op, bool success, vfs_handle_struct *handle,
 528                    const char *format, ...)
 529 {
 530         struct vfs_full_audit_private_data *pd;
 531         fstring err_msg;
 532         char *audit_pre = NULL;
 533         va_list ap;
 534         char *op_msg = NULL;
 535
 536         SMB_VFS_HANDLE_GET_DATA(handle, pd,
 537                                 struct vfs_full_audit_private_data,
 538                                 return;);
 539
 540         if (success && (!log_success(pd, op)))
 541                 goto out;
 542
 543         if (!success && (!log_failure(pd, op)))
 544                 goto out;
 545
 546         if (success)
 547                 fstrcpy(err_msg, "ok");
 548         else
 549                 fstr_sprintf(err_msg, "fail (%s)", strerror(errno));
 550
 551         va_start(ap, format);
 552         op_msg = talloc_vasprintf(talloc_tos(), format, ap);
 553         va_end(ap);
 554
 555         if (!op_msg) {
 556                 goto out;
 557         }
 558
 559         audit_pre = audit_prefix(talloc_tos(), handle->conn);
 560
 561         if (pd->do_syslog) {
 562                 int priority;
 563
 564                 /*
 565                  * Specify the facility to interoperate with other syslog
 566                  * callers (smbd for example).
 567                  */
 568                 priority = pd->syslog_priority | pd->syslog_facility;
 569
 570                 syslog(priority, "%s|%s|%s|%s\n",
 571                        audit_pre ? audit_pre : "",
 572                        audit_opname(op), err_msg, op_msg);
 573         } else {
 574                 DEBUG(1, ("%s|%s|%s|%s\n",
 575                           audit_pre ? audit_pre : "",
 576                           audit_opname(op), err_msg, op_msg));
 577         }
 578  out:
 579         TALLOC_FREE(audit_pre);
 580         TALLOC_FREE(op_msg);
 581         TALLOC_FREE(tmp_do_log_ctx);
 582 }
 583
 584 /**
 585  * Return a string using the do_log_ctx()
 586  */
 587 static const char *smb_fname_str_do_log(const struct smb_filename *smb_fname)
 588 {
 589         char *fname = NULL;
 590         NTSTATUS status;
 591
 592         if (smb_fname == NULL) {
 593                 return "";
 594         }
 595         status = get_full_smb_filename(do_log_ctx(), smb_fname, &fname);
 596         if (!NT_STATUS_IS_OK(status)) {
 597                 return "";
 598         }
 599         return fname;
 600 }
 601
 602 /**
 603  * Return an fsp debug string using the do_log_ctx()
 604  */
 605 static const char *fsp_str_do_log(const struct files_struct *fsp)
 606 {
 607         return smb_fname_str_do_log(fsp->fsp_name);
 608 }
 609
 610 /* Implementation of vfs_ops.  Pass everything on to the default
 611    operation but log event first. */
 612
 613 static int smb_full_audit_connect(vfs_handle_struct *handle,
 614                          const char *svc, const char *user)
 615 {
 616         int result;
 617         struct vfs_full_audit_private_data *pd = NULL;
 618
 619         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 620         if (result < 0) {
 621                 return result;
 622         }
 623
 624         pd = talloc_zero(handle, struct vfs_full_audit_private_data);
 625         if (!pd) {
 626                 SMB_VFS_NEXT_DISCONNECT(handle);
 627                 return -1;
 628         }
 629
 630         pd->syslog_facility = audit_syslog_facility(handle);
 631         if (pd->syslog_facility == -1) {
 632                 DEBUG(1, ("%s: Unknown facility %s\n", __func__,
 633                           lp_parm_const_string(SNUM(handle->conn),
 634                                                "full_audit", "facility",
 635                                                "USER")));
 636                 SMB_VFS_NEXT_DISCONNECT(handle);
 637                 return -1;
 638         }
 639
 640         pd->syslog_priority = audit_syslog_priority(handle);
 641
 642         pd->log_secdesc = lp_parm_bool(SNUM(handle->conn),
 643                                        "full_audit", "log_secdesc", false);
 644
 645         pd->do_syslog = lp_parm_bool(SNUM(handle->conn),
 646                                      "full_audit", "syslog", true);
 647
 648 #ifdef WITH_SYSLOG
 649         if (pd->do_syslog) {
 650                 openlog("smbd_audit", 0, pd->syslog_facility);
 651         }
 652 #endif
 653
 654         pd->success_ops = init_bitmap(
 655                 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
 656                                         "success", NULL));
 657         pd->failure_ops = init_bitmap(
 658                 pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
 659                                         "failure", NULL));
 660
 661         /* Store the private data. */
 662         SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
 663                                 struct vfs_full_audit_private_data, return -1);
 664
 665         do_log(SMB_VFS_OP_CONNECT, True, handle,
 666                "%s", svc);
 667
 668         return 0;
 669 }
 670
 671 static void smb_full_audit_disconnect(vfs_handle_struct *handle)
 672 {
 673         SMB_VFS_NEXT_DISCONNECT(handle);
 674
 675         do_log(SMB_VFS_OP_DISCONNECT, True, handle,
 676                "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
 677
 678         /* The bitmaps will be disconnected when the private
 679            data is deleted. */
 680 }
 681
 682 static uint64_t smb_full_audit_disk_free(vfs_handle_struct *handle,
 683                                 const struct smb_filename *smb_fname,
 684                                 uint64_t *bsize,
 685                                 uint64_t *dfree,
 686                                 uint64_t *dsize)
 687 {
 688         uint64_t result;
 689
 690         result = SMB_VFS_NEXT_DISK_FREE(handle, smb_fname, bsize, dfree, dsize);
 691
 692         /* Don't have a reasonable notion of failure here */
 693
 694         do_log(SMB_VFS_OP_DISK_FREE, True, handle, "%s", smb_fname->base_name);
 695
 696         return result;
 697 }
 698
 699 static int smb_full_audit_get_quota(struct vfs_handle_struct *handle,
 700                                 const struct smb_filename *smb_fname,
 701                                 enum SMB_QUOTA_TYPE qtype,
 702                                 unid_t id,
 703                                 SMB_DISK_QUOTA *qt)
 704 {
 705         int result;
 706
 707         result = SMB_VFS_NEXT_GET_QUOTA(handle, smb_fname, qtype, id, qt);
 708
 709         do_log(SMB_VFS_OP_GET_QUOTA, (result >= 0), handle, "%s",
 710                         smb_fname->base_name);
 711
 712         return result;
 713 }
 714
 715 static int smb_full_audit_set_quota(struct vfs_handle_struct *handle,
 716                            enum SMB_QUOTA_TYPE qtype, unid_t id,
 717                            SMB_DISK_QUOTA *qt)
 718 {
 719         int result;
 720
 721         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 722
 723         do_log(SMB_VFS_OP_SET_QUOTA, (result >= 0), handle, "");
 724
 725         return result;
 726 }
 727
 728 static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 729                                 struct files_struct *fsp,
 730                                 struct shadow_copy_data *shadow_copy_data,
 731                                 bool labels)
 732 {
 733         int result;
 734
 735         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels);
 736
 737         do_log(SMB_VFS_OP_GET_SHADOW_COPY_DATA, (result >= 0), handle, "");
 738
 739         return result;
 740 }
 741
 742 static int smb_full_audit_statvfs(struct vfs_handle_struct *handle,
 743                                 const struct smb_filename *smb_fname,
 744                                 struct vfs_statvfs_struct *statbuf)
 745 {
 746         int result;
 747
 748         result = SMB_VFS_NEXT_STATVFS(handle, smb_fname, statbuf);
 749
 750         do_log(SMB_VFS_OP_STATVFS, (result >= 0), handle, "");
 751
 752         return result;
 753 }
 754
 755 static uint32_t smb_full_audit_fs_capabilities(struct vfs_handle_struct *handle, enum timestamp_set_resolution *p_ts_res)
 756 {
 757         int result;
 758
 759         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 760
 761         do_log(SMB_VFS_OP_FS_CAPABILITIES, true, handle, "");
 762
 763         return result;
 764 }
 765
 766 static NTSTATUS smb_full_audit_get_dfs_referrals(
 767                                 struct vfs_handle_struct *handle,
 768                                 struct dfs_GetDFSReferral *r)
 769 {
 770         NTSTATUS status;
 771
 772         status = SMB_VFS_NEXT_GET_DFS_REFERRALS(handle, r);
 773
 774         do_log(SMB_VFS_OP_GET_DFS_REFERRALS, NT_STATUS_IS_OK(status),
 775                handle, "");
 776
 777         return status;
 778 }
 779
 780 static NTSTATUS smb_full_audit_snap_check_path(struct vfs_handle_struct *handle,
 781                                                TALLOC_CTX *mem_ctx,
 782                                                const char *service_path,
 783                                                char **base_volume)
 784 {
 785         NTSTATUS status;
 786
 787         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 788                                               base_volume);
 789         do_log(SMB_VFS_OP_SNAP_CHECK_PATH, NT_STATUS_IS_OK(status),
 790                handle, "");
 791
 792         return status;
 793 }
 794
 795 static NTSTATUS smb_full_audit_snap_create(struct vfs_handle_struct *handle,
 796                                            TALLOC_CTX *mem_ctx,
 797                                            const char *base_volume,
 798                                            time_t *tstamp,
 799                                            bool rw,
 800                                            char **base_path,
 801                                            char **snap_path)
 802 {
 803         NTSTATUS status;
 804
 805         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 806                                           rw, base_path, snap_path);
 807         do_log(SMB_VFS_OP_SNAP_CREATE, NT_STATUS_IS_OK(status), handle, "");
 808
 809         return status;
 810 }
 811
 812 static NTSTATUS smb_full_audit_snap_delete(struct vfs_handle_struct *handle,
 813                                            TALLOC_CTX *mem_ctx,
 814                                            char *base_path,
 815                                            char *snap_path)
 816 {
 817         NTSTATUS status;
 818
 819         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 820                                           snap_path);
 821         do_log(SMB_VFS_OP_SNAP_DELETE, NT_STATUS_IS_OK(status), handle, "");
 822
 823         return status;
 824 }
 825
 826 static DIR *smb_full_audit_opendir(vfs_handle_struct *handle,
 827                         const struct smb_filename *smb_fname,
 828                         const char *mask,
 829                         uint32_t attr)
 830 {
 831         DIR *result;
 832
 833         result = SMB_VFS_NEXT_OPENDIR(handle, smb_fname, mask, attr);
 834
 835         do_log(SMB_VFS_OP_OPENDIR, (result != NULL), handle, "%s",
 836                 smb_fname->base_name);
 837
 838         return result;
 839 }
 840
 841 static DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
 842                           files_struct *fsp, const char *mask, uint32_t attr)
 843 {
 844         DIR *result;
 845
 846         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 847
 848         do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
 849                         fsp_str_do_log(fsp));
 850
 851         return result;
 852 }
 853
 854 static struct dirent *smb_full_audit_readdir(vfs_handle_struct *handle,
 855                                     DIR *dirp, SMB_STRUCT_STAT *sbuf)
 856 {
 857         struct dirent *result;
 858
 859         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 860
 861         /* This operation has no reasonable error condition
 862          * (End of dir is also failure), so always succeed.
 863          */
 864         do_log(SMB_VFS_OP_READDIR, True, handle, "");
 865
 866         return result;
 867 }
 868
 869 static void smb_full_audit_seekdir(vfs_handle_struct *handle,
 870                         DIR *dirp, long offset)
 871 {
 872         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 873
 874         do_log(SMB_VFS_OP_SEEKDIR, True, handle, "");
 875 }
 876
 877 static long smb_full_audit_telldir(vfs_handle_struct *handle,
 878                         DIR *dirp)
 879 {
 880         long result;
 881
 882         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 883
 884         do_log(SMB_VFS_OP_TELLDIR, True, handle, "");
 885
 886         return result;
 887 }
 888
 889 static void smb_full_audit_rewinddir(vfs_handle_struct *handle,
 890                         DIR *dirp)
 891 {
 892         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 893
 894         do_log(SMB_VFS_OP_REWINDDIR, True, handle, "");
 895 }
 896
 897 static int smb_full_audit_mkdir(vfs_handle_struct *handle,
 898                        const struct smb_filename *smb_fname, mode_t mode)
 899 {
 900         int result;
 901
 902         result = SMB_VFS_NEXT_MKDIR(handle, smb_fname, mode);
 903
 904         do_log(SMB_VFS_OP_MKDIR, (result >= 0), handle, "%s",
 905                 smb_fname->base_name);
 906
 907         return result;
 908 }
 909
 910 static int smb_full_audit_rmdir(vfs_handle_struct *handle,
 911                        const struct smb_filename *smb_fname)
 912 {
 913         int result;
 914
 915         result = SMB_VFS_NEXT_RMDIR(handle, smb_fname);
 916
 917         do_log(SMB_VFS_OP_RMDIR, (result >= 0), handle, "%s",
 918                 smb_fname->base_name);
 919
 920         return result;
 921 }
 922
 923 static int smb_full_audit_closedir(vfs_handle_struct *handle,
 924                           DIR *dirp)
 925 {
 926         int result;
 927
 928         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 929
 930         do_log(SMB_VFS_OP_CLOSEDIR, (result >= 0), handle, "");
 931
 932         return result;
 933 }
 934
 935 static void smb_full_audit_init_search_op(vfs_handle_struct *handle,
 936                         DIR *dirp)
 937 {
 938         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
 939
 940         do_log(SMB_VFS_OP_INIT_SEARCH_OP, True, handle, "");
 941 }
 942
 943 static int smb_full_audit_open(vfs_handle_struct *handle,
 944                                struct smb_filename *smb_fname,
 945                                files_struct *fsp, int flags, mode_t mode)
 946 {
 947         int result;
 948
 949         result = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 950
 951         do_log(SMB_VFS_OP_OPEN, (result >= 0), handle, "%s|%s",
 952                ((flags & O_WRONLY) || (flags & O_RDWR))?"w":"r",
 953                smb_fname_str_do_log(smb_fname));
 954
 955         return result;
 956 }
 957
 958 static NTSTATUS smb_full_audit_create_file(vfs_handle_struct *handle,
 959                                       struct smb_request *req,
 960                                       uint16_t root_dir_fid,
 961                                       struct smb_filename *smb_fname,
 962                                       uint32_t access_mask,
 963                                       uint32_t share_access,
 964                                       uint32_t create_disposition,
 965                                       uint32_t create_options,
 966                                       uint32_t file_attributes,
 967                                       uint32_t oplock_request,
 968                                       struct smb2_lease *lease,
 969                                       uint64_t allocation_size,
 970                                       uint32_t private_flags,
 971                                       struct security_descriptor *sd,
 972                                       struct ea_list *ea_list,
 973                                       files_struct **result_fsp,
 974                                       int *pinfo,
 975                                       const struct smb2_create_blobs *in_context_blobs,
 976                                       struct smb2_create_blobs *out_context_blobs)
 977 {
 978         NTSTATUS result;
 979         const char* str_create_disposition;
 980
 981         switch (create_disposition) {
 982         case FILE_SUPERSEDE:
 983                 str_create_disposition = "supersede";
 984                 break;
 985         case FILE_OVERWRITE_IF:
 986                 str_create_disposition = "overwrite_if";
 987                 break;
 988         case FILE_OPEN:
 989                 str_create_disposition = "open";
 990                 break;
 991         case FILE_OVERWRITE:
 992                 str_create_disposition = "overwrite";
 993                 break;
 994         case FILE_CREATE:
 995                 str_create_disposition = "create";
 996                 break;
 997         case FILE_OPEN_IF:
 998                 str_create_disposition = "open_if";
 999                 break;
1000         default:
1001                 str_create_disposition = "unknown";
1002         }
1003
1004         result = SMB_VFS_NEXT_CREATE_FILE(
1005                 handle,                                 /* handle */
1006                 req,                                    /* req */
1007                 root_dir_fid,                           /* root_dir_fid */
1008                 smb_fname,                              /* fname */
1009                 access_mask,                            /* access_mask */
1010                 share_access,                           /* share_access */
1011                 create_disposition,                     /* create_disposition*/
1012                 create_options,                         /* create_options */
1013                 file_attributes,                        /* file_attributes */
1014                 oplock_request,                         /* oplock_request */
1015                 lease,                                  /* lease */
1016                 allocation_size,                        /* allocation_size */
1017                 private_flags,
1018                 sd,                                     /* sd */
1019                 ea_list,                                /* ea_list */
1020                 result_fsp,                             /* result */
1021                 pinfo,                                  /* pinfo */
1022                 in_context_blobs, out_context_blobs);   /* create context */
1023
1024         do_log(SMB_VFS_OP_CREATE_FILE, (NT_STATUS_IS_OK(result)), handle,
1025                "0x%x|%s|%s|%s", access_mask,
1026                create_options & FILE_DIRECTORY_FILE ? "dir" : "file",
1027                str_create_disposition, smb_fname_str_do_log(smb_fname));
1028
1029         return result;
1030 }
1031
1032 static int smb_full_audit_close(vfs_handle_struct *handle, files_struct *fsp)
1033 {
1034         int result;
1035
1036         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
1037
1038         do_log(SMB_VFS_OP_CLOSE, (result >= 0), handle, "%s",
1039                fsp_str_do_log(fsp));
1040
1041         return result;
1042 }
1043
1044 static ssize_t smb_full_audit_read(vfs_handle_struct *handle, files_struct *fsp,
1045                           void *data, size_t n)
1046 {
1047         ssize_t result;
1048
1049         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
1050
1051         do_log(SMB_VFS_OP_READ, (result >= 0), handle, "%s",
1052                fsp_str_do_log(fsp));
1053
1054         return result;
1055 }
1056
1057 static ssize_t smb_full_audit_pread(vfs_handle_struct *handle, files_struct *fsp,
1058                            void *data, size_t n, off_t offset)
1059 {
1060         ssize_t result;
1061
1062         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
1063
1064         do_log(SMB_VFS_OP_PREAD, (result >= 0), handle, "%s",
1065                fsp_str_do_log(fsp));
1066
1067         return result;
1068 }
1069
1070 struct smb_full_audit_pread_state {
1071         vfs_handle_struct *handle;
1072         files_struct *fsp;
1073         ssize_t ret;
1074         struct vfs_aio_state vfs_aio_state;
1075 };
1076
1077 static void smb_full_audit_pread_done(struct tevent_req *subreq);
1078
1079 static struct tevent_req *smb_full_audit_pread_send(
1080         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1081         struct tevent_context *ev, struct files_struct *fsp,
1082         void *data, size_t n, off_t offset)
1083 {
1084         struct tevent_req *req, *subreq;
1085         struct smb_full_audit_pread_state *state;
1086
1087         req = tevent_req_create(mem_ctx, &state,
1088                                 struct smb_full_audit_pread_state);
1089         if (req == NULL) {
1090                 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1091                        fsp_str_do_log(fsp));
1092                 return NULL;
1093         }
1094         state->handle = handle;
1095         state->fsp = fsp;
1096
1097         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
1098                                          n, offset);
1099         if (tevent_req_nomem(subreq, req)) {
1100                 do_log(SMB_VFS_OP_PREAD_SEND, false, handle, "%s",
1101                        fsp_str_do_log(fsp));
1102                 return tevent_req_post(req, ev);
1103         }
1104         tevent_req_set_callback(subreq, smb_full_audit_pread_done, req);
1105
1106         do_log(SMB_VFS_OP_PREAD_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1107         return req;
1108 }
1109
1110 static void smb_full_audit_pread_done(struct tevent_req *subreq)
1111 {
1112         struct tevent_req *req = tevent_req_callback_data(
1113                 subreq, struct tevent_req);
1114         struct smb_full_audit_pread_state *state = tevent_req_data(
1115                 req, struct smb_full_audit_pread_state);
1116
1117         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->vfs_aio_state);
1118         TALLOC_FREE(subreq);
1119         tevent_req_done(req);
1120 }
1121
1122 static ssize_t smb_full_audit_pread_recv(struct tevent_req *req,
1123                                          struct vfs_aio_state *vfs_aio_state)
1124 {
1125         struct smb_full_audit_pread_state *state = tevent_req_data(
1126                 req, struct smb_full_audit_pread_state);
1127
1128         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1129                 do_log(SMB_VFS_OP_PREAD_RECV, false, state->handle, "%s",
1130                        fsp_str_do_log(state->fsp));
1131                 return -1;
1132         }
1133
1134         do_log(SMB_VFS_OP_PREAD_RECV, (state->ret >= 0), state->handle, "%s",
1135                fsp_str_do_log(state->fsp));
1136
1137         *vfs_aio_state = state->vfs_aio_state;
1138         return state->ret;
1139 }
1140
1141 static ssize_t smb_full_audit_write(vfs_handle_struct *handle, files_struct *fsp,
1142                            const void *data, size_t n)
1143 {
1144         ssize_t result;
1145
1146         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
1147
1148         do_log(SMB_VFS_OP_WRITE, (result >= 0), handle, "%s",
1149                fsp_str_do_log(fsp));
1150
1151         return result;
1152 }
1153
1154 static ssize_t smb_full_audit_pwrite(vfs_handle_struct *handle, files_struct *fsp,
1155                             const void *data, size_t n,
1156                             off_t offset)
1157 {
1158         ssize_t result;
1159
1160         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
1161
1162         do_log(SMB_VFS_OP_PWRITE, (result >= 0), handle, "%s",
1163                fsp_str_do_log(fsp));
1164
1165         return result;
1166 }
1167
1168 struct smb_full_audit_pwrite_state {
1169         vfs_handle_struct *handle;
1170         files_struct *fsp;
1171         ssize_t ret;
1172         struct vfs_aio_state vfs_aio_state;
1173 };
1174
1175 static void smb_full_audit_pwrite_done(struct tevent_req *subreq);
1176
1177 static struct tevent_req *smb_full_audit_pwrite_send(
1178         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1179         struct tevent_context *ev, struct files_struct *fsp,
1180         const void *data, size_t n, off_t offset)
1181 {
1182         struct tevent_req *req, *subreq;
1183         struct smb_full_audit_pwrite_state *state;
1184
1185         req = tevent_req_create(mem_ctx, &state,
1186                                 struct smb_full_audit_pwrite_state);
1187         if (req == NULL) {
1188                 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1189                        fsp_str_do_log(fsp));
1190                 return NULL;
1191         }
1192         state->handle = handle;
1193         state->fsp = fsp;
1194
1195         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
1196                                          n, offset);
1197         if (tevent_req_nomem(subreq, req)) {
1198                 do_log(SMB_VFS_OP_PWRITE_SEND, false, handle, "%s",
1199                        fsp_str_do_log(fsp));
1200                 return tevent_req_post(req, ev);
1201         }
1202         tevent_req_set_callback(subreq, smb_full_audit_pwrite_done, req);
1203
1204         do_log(SMB_VFS_OP_PWRITE_SEND, true, handle, "%s",
1205                fsp_str_do_log(fsp));
1206         return req;
1207 }
1208
1209 static void smb_full_audit_pwrite_done(struct tevent_req *subreq)
1210 {
1211         struct tevent_req *req = tevent_req_callback_data(
1212                 subreq, struct tevent_req);
1213         struct smb_full_audit_pwrite_state *state = tevent_req_data(
1214                 req, struct smb_full_audit_pwrite_state);
1215
1216         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->vfs_aio_state);
1217         TALLOC_FREE(subreq);
1218         tevent_req_done(req);
1219 }
1220
1221 static ssize_t smb_full_audit_pwrite_recv(struct tevent_req *req,
1222                                           struct vfs_aio_state *vfs_aio_state)
1223 {
1224         struct smb_full_audit_pwrite_state *state = tevent_req_data(
1225                 req, struct smb_full_audit_pwrite_state);
1226
1227         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1228                 do_log(SMB_VFS_OP_PWRITE_RECV, false, state->handle, "%s",
1229                        fsp_str_do_log(state->fsp));
1230                 return -1;
1231         }
1232
1233         do_log(SMB_VFS_OP_PWRITE_RECV, (state->ret >= 0), state->handle, "%s",
1234                fsp_str_do_log(state->fsp));
1235
1236         *vfs_aio_state = state->vfs_aio_state;
1237         return state->ret;
1238 }
1239
1240 static off_t smb_full_audit_lseek(vfs_handle_struct *handle, files_struct *fsp,
1241                              off_t offset, int whence)
1242 {
1243         ssize_t result;
1244
1245         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
1246
1247         do_log(SMB_VFS_OP_LSEEK, (result != (ssize_t)-1), handle,
1248                "%s", fsp_str_do_log(fsp));
1249
1250         return result;
1251 }
1252
1253 static ssize_t smb_full_audit_sendfile(vfs_handle_struct *handle, int tofd,
1254                               files_struct *fromfsp,
1255                               const DATA_BLOB *hdr, off_t offset,
1256                               size_t n)
1257 {
1258         ssize_t result;
1259
1260         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
1261
1262         do_log(SMB_VFS_OP_SENDFILE, (result >= 0), handle,
1263                "%s", fsp_str_do_log(fromfsp));
1264
1265         return result;
1266 }
1267
1268 static ssize_t smb_full_audit_recvfile(vfs_handle_struct *handle, int fromfd,
1269                       files_struct *tofsp,
1270                               off_t offset,
1271                               size_t n)
1272 {
1273         ssize_t result;
1274
1275         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
1276
1277         do_log(SMB_VFS_OP_RECVFILE, (result >= 0), handle,
1278                "%s", fsp_str_do_log(tofsp));
1279
1280         return result;
1281 }
1282
1283 static int smb_full_audit_rename(vfs_handle_struct *handle,
1284                                  const struct smb_filename *smb_fname_src,
1285                                  const struct smb_filename *smb_fname_dst)
1286 {
1287         int result;
1288
1289         result = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
1290
1291         do_log(SMB_VFS_OP_RENAME, (result >= 0), handle, "%s|%s",
1292                smb_fname_str_do_log(smb_fname_src),
1293                smb_fname_str_do_log(smb_fname_dst));
1294
1295         return result;
1296 }
1297
1298 static int smb_full_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
1299 {
1300         int result;
1301
1302         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
1303
1304         do_log(SMB_VFS_OP_FSYNC, (result >= 0), handle, "%s",
1305                fsp_str_do_log(fsp));
1306
1307         return result;
1308 }
1309
1310 struct smb_full_audit_fsync_state {
1311         vfs_handle_struct *handle;
1312         files_struct *fsp;
1313         int ret;
1314         struct vfs_aio_state vfs_aio_state;
1315 };
1316
1317 static void smb_full_audit_fsync_done(struct tevent_req *subreq);
1318
1319 static struct tevent_req *smb_full_audit_fsync_send(
1320         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
1321         struct tevent_context *ev, struct files_struct *fsp)
1322 {
1323         struct tevent_req *req, *subreq;
1324         struct smb_full_audit_fsync_state *state;
1325
1326         req = tevent_req_create(mem_ctx, &state,
1327                                 struct smb_full_audit_fsync_state);
1328         if (req == NULL) {
1329                 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1330                        fsp_str_do_log(fsp));
1331                 return NULL;
1332         }
1333         state->handle = handle;
1334         state->fsp = fsp;
1335
1336         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
1337         if (tevent_req_nomem(subreq, req)) {
1338                 do_log(SMB_VFS_OP_FSYNC_SEND, false, handle, "%s",
1339                        fsp_str_do_log(fsp));
1340                 return tevent_req_post(req, ev);
1341         }
1342         tevent_req_set_callback(subreq, smb_full_audit_fsync_done, req);
1343
1344         do_log(SMB_VFS_OP_FSYNC_SEND, true, handle, "%s", fsp_str_do_log(fsp));
1345         return req;
1346 }
1347
1348 static void smb_full_audit_fsync_done(struct tevent_req *subreq)
1349 {
1350         struct tevent_req *req = tevent_req_callback_data(
1351                 subreq, struct tevent_req);
1352         struct smb_full_audit_fsync_state *state = tevent_req_data(
1353                 req, struct smb_full_audit_fsync_state);
1354
1355         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->vfs_aio_state);
1356         TALLOC_FREE(subreq);
1357         tevent_req_done(req);
1358 }
1359
1360 static int smb_full_audit_fsync_recv(struct tevent_req *req,
1361                                      struct vfs_aio_state *vfs_aio_state)
1362 {
1363         struct smb_full_audit_fsync_state *state = tevent_req_data(
1364                 req, struct smb_full_audit_fsync_state);
1365
1366         if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) {
1367                 do_log(SMB_VFS_OP_FSYNC_RECV, false, state->handle, "%s",
1368                        fsp_str_do_log(state->fsp));
1369                 return -1;
1370         }
1371
1372         do_log(SMB_VFS_OP_FSYNC_RECV, (state->ret >= 0), state->handle, "%s",
1373                fsp_str_do_log(state->fsp));
1374
1375         *vfs_aio_state = state->vfs_aio_state;
1376         return state->ret;
1377 }
1378
1379 static int smb_full_audit_stat(vfs_handle_struct *handle,
1380                                struct smb_filename *smb_fname)
1381 {
1382         int result;
1383
1384         result = SMB_VFS_NEXT_STAT(handle, smb_fname);
1385
1386         do_log(SMB_VFS_OP_STAT, (result >= 0), handle, "%s",
1387                smb_fname_str_do_log(smb_fname));
1388
1389         return result;
1390 }
1391
1392 static int smb_full_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1393                        SMB_STRUCT_STAT *sbuf)
1394 {
1395         int result;
1396
1397         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1398
1399         do_log(SMB_VFS_OP_FSTAT, (result >= 0), handle, "%s",
1400                fsp_str_do_log(fsp));
1401
1402         return result;
1403 }
1404
1405 static int smb_full_audit_lstat(vfs_handle_struct *handle,
1406                                 struct smb_filename *smb_fname)
1407 {
1408         int result;
1409
1410         result = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
1411
1412         do_log(SMB_VFS_OP_LSTAT, (result >= 0), handle, "%s",
1413                smb_fname_str_do_log(smb_fname));
1414
1415         return result;
1416 }
1417
1418 static uint64_t smb_full_audit_get_alloc_size(vfs_handle_struct *handle,
1419                        files_struct *fsp, const SMB_STRUCT_STAT *sbuf)
1420 {
1421         uint64_t result;
1422
1423         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1424
1425         do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
1426                         "%llu", result);
1427
1428         return result;
1429 }
1430
1431 static int smb_full_audit_unlink(vfs_handle_struct *handle,
1432                                  const struct smb_filename *smb_fname)
1433 {
1434         int result;
1435
1436         result = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
1437
1438         do_log(SMB_VFS_OP_UNLINK, (result >= 0), handle, "%s",
1439                smb_fname_str_do_log(smb_fname));
1440
1441         return result;
1442 }
1443
1444 static int smb_full_audit_chmod(vfs_handle_struct *handle,
1445                                 const struct smb_filename *smb_fname,
1446                                 mode_t mode)
1447 {
1448         int result;
1449
1450         result = SMB_VFS_NEXT_CHMOD(handle, smb_fname, mode);
1451
1452         do_log(SMB_VFS_OP_CHMOD, (result >= 0), handle, "%s|%o",
1453                 smb_fname->base_name,
1454                 mode);
1455
1456         return result;
1457 }
1458
1459 static int smb_full_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1460                         mode_t mode)
1461 {
1462         int result;
1463
1464         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1465
1466         do_log(SMB_VFS_OP_FCHMOD, (result >= 0), handle,
1467                "%s|%o", fsp_str_do_log(fsp), mode);
1468
1469         return result;
1470 }
1471
1472 static int smb_full_audit_chown(vfs_handle_struct *handle,
1473                         const struct smb_filename *smb_fname,
1474                         uid_t uid,
1475                         gid_t gid)
1476 {
1477         int result;
1478
1479         result = SMB_VFS_NEXT_CHOWN(handle, smb_fname, uid, gid);
1480
1481         do_log(SMB_VFS_OP_CHOWN, (result >= 0), handle, "%s|%ld|%ld",
1482                smb_fname->base_name, (long int)uid, (long int)gid);
1483
1484         return result;
1485 }
1486
1487 static int smb_full_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1488                         uid_t uid, gid_t gid)
1489 {
1490         int result;
1491
1492         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1493
1494         do_log(SMB_VFS_OP_FCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1495                fsp_str_do_log(fsp), (long int)uid, (long int)gid);
1496
1497         return result;
1498 }
1499
1500 static int smb_full_audit_lchown(vfs_handle_struct *handle,
1501                         const struct smb_filename *smb_fname,
1502                         uid_t uid,
1503                         gid_t gid)
1504 {
1505         int result;
1506
1507         result = SMB_VFS_NEXT_LCHOWN(handle, smb_fname, uid, gid);
1508
1509         do_log(SMB_VFS_OP_LCHOWN, (result >= 0), handle, "%s|%ld|%ld",
1510                smb_fname->base_name, (long int)uid, (long int)gid);
1511
1512         return result;
1513 }
1514
1515 static int smb_full_audit_chdir(vfs_handle_struct *handle,
1516                         const struct smb_filename *smb_fname)
1517 {
1518         int result;
1519
1520         result = SMB_VFS_NEXT_CHDIR(handle, smb_fname);
1521
1522         do_log(SMB_VFS_OP_CHDIR, (result >= 0), handle, "chdir|%s",
1523                 smb_fname->base_name);
1524
1525         return result;
1526 }
1527
1528 static struct smb_filename *smb_full_audit_getwd(vfs_handle_struct *handle,
1529                                 TALLOC_CTX *ctx)
1530 {
1531         struct smb_filename *result;
1532
1533         result = SMB_VFS_NEXT_GETWD(handle, ctx);
1534
1535         do_log(SMB_VFS_OP_GETWD, (result != NULL), handle, "%s",
1536                 result == NULL? "" : result->base_name);
1537
1538         return result;
1539 }
1540
1541 static int smb_full_audit_ntimes(vfs_handle_struct *handle,
1542                                  const struct smb_filename *smb_fname,
1543                                  struct smb_file_time *ft)
1544 {
1545         int result;
1546
1547         result = SMB_VFS_NEXT_NTIMES(handle, smb_fname, ft);
1548
1549         do_log(SMB_VFS_OP_NTIMES, (result >= 0), handle, "%s",
1550                smb_fname_str_do_log(smb_fname));
1551
1552         return result;
1553 }
1554
1555 static int smb_full_audit_ftruncate(vfs_handle_struct *handle, files_struct *fsp,
1556                            off_t len)
1557 {
1558         int result;
1559
1560         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1561
1562         do_log(SMB_VFS_OP_FTRUNCATE, (result >= 0), handle,
1563                "%s", fsp_str_do_log(fsp));
1564
1565         return result;
1566 }
1567
1568 static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
1569                            uint32_t mode,
1570                            off_t offset,
1571                            off_t len)
1572 {
1573         int result;
1574
1575         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1576
1577         do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
1578                "%s", fsp_str_do_log(fsp));
1579
1580         return result;
1581 }
1582
1583 static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1584                        int op, off_t offset, off_t count, int type)
1585 {
1586         bool result;
1587
1588         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1589
1590         do_log(SMB_VFS_OP_LOCK, result, handle, "%s", fsp_str_do_log(fsp));
1591
1592         return result;
1593 }
1594
1595 static int smb_full_audit_kernel_flock(struct vfs_handle_struct *handle,
1596                                        struct files_struct *fsp,
1597                                        uint32_t share_mode, uint32_t access_mask)
1598 {
1599         int result;
1600
1601         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode, access_mask);
1602
1603         do_log(SMB_VFS_OP_KERNEL_FLOCK, (result >= 0), handle, "%s",
1604                fsp_str_do_log(fsp));
1605
1606         return result;
1607 }
1608
1609 static int smb_full_audit_linux_setlease(vfs_handle_struct *handle, files_struct *fsp,
1610                                  int leasetype)
1611 {
1612         int result;
1613
1614         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1615
1616         do_log(SMB_VFS_OP_LINUX_SETLEASE, (result >= 0), handle, "%s",
1617                fsp_str_do_log(fsp));
1618
1619         return result;
1620 }
1621
1622 static bool smb_full_audit_getlock(vfs_handle_struct *handle, files_struct *fsp,
1623                        off_t *poffset, off_t *pcount, int *ptype, pid_t *ppid)
1624 {
1625         bool result;
1626
1627         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype, ppid);
1628
1629         do_log(SMB_VFS_OP_GETLOCK, result, handle, "%s", fsp_str_do_log(fsp));
1630
1631         return result;
1632 }
1633
1634 static int smb_full_audit_symlink(vfs_handle_struct *handle,
1635                         const char *link_contents,
1636                         const struct smb_filename *new_smb_fname)
1637 {
1638         int result;
1639
1640         result = SMB_VFS_NEXT_SYMLINK(handle, link_contents, new_smb_fname);
1641
1642         do_log(SMB_VFS_OP_SYMLINK, (result >= 0), handle,
1643                "%s|%s", link_contents, new_smb_fname->base_name);
1644
1645         return result;
1646 }
1647
1648 static int smb_full_audit_readlink(vfs_handle_struct *handle,
1649                         const struct smb_filename *smb_fname,
1650                         char *buf,
1651                         size_t bufsiz)
1652 {
1653         int result;
1654
1655         result = SMB_VFS_NEXT_READLINK(handle, smb_fname, buf, bufsiz);
1656
1657         do_log(SMB_VFS_OP_READLINK, (result >= 0), handle, "%s",
1658                         smb_fname->base_name);
1659
1660         return result;
1661 }
1662
1663 static int smb_full_audit_link(vfs_handle_struct *handle,
1664                         const struct smb_filename *old_smb_fname,
1665                         const struct smb_filename *new_smb_fname)
1666 {
1667         int result;
1668
1669         result = SMB_VFS_NEXT_LINK(handle, old_smb_fname, new_smb_fname);
1670
1671         do_log(SMB_VFS_OP_LINK, (result >= 0), handle,
1672                "%s|%s", old_smb_fname->base_name, new_smb_fname->base_name);
1673
1674         return result;
1675 }
1676
1677 static int smb_full_audit_mknod(vfs_handle_struct *handle,
1678                         const struct smb_filename *smb_fname,
1679                         mode_t mode,
1680                         SMB_DEV_T dev)
1681 {
1682         int result;
1683
1684         result = SMB_VFS_NEXT_MKNOD(handle, smb_fname, mode, dev);
1685
1686         do_log(SMB_VFS_OP_MKNOD, (result >= 0), handle, "%s",
1687                 smb_fname->base_name);
1688
1689         return result;
1690 }
1691
1692 static struct smb_filename *smb_full_audit_realpath(vfs_handle_struct *handle,
1693                                 TALLOC_CTX *ctx,
1694                                 const struct smb_filename *smb_fname)
1695 {
1696         struct smb_filename *result_fname = NULL;
1697
1698         result_fname = SMB_VFS_NEXT_REALPATH(handle, ctx, smb_fname);
1699
1700         do_log(SMB_VFS_OP_REALPATH, (result_fname != NULL), handle, "%s",
1701                         smb_fname->base_name);
1702
1703         return result_fname;
1704 }
1705
1706 static int smb_full_audit_chflags(vfs_handle_struct *handle,
1707                         const struct smb_filename *smb_fname,
1708                         unsigned int flags)
1709 {
1710         int result;
1711
1712         result = SMB_VFS_NEXT_CHFLAGS(handle, smb_fname, flags);
1713
1714         do_log(SMB_VFS_OP_CHFLAGS, (result != 0), handle, "%s",
1715                 smb_fname->base_name);
1716
1717         return result;
1718 }
1719
1720 static struct file_id smb_full_audit_file_id_create(struct vfs_handle_struct *handle,
1721                                                     const SMB_STRUCT_STAT *sbuf)
1722 {
1723         struct file_id id_zero;
1724         struct file_id result;
1725
1726         ZERO_STRUCT(id_zero);
1727
1728         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1729
1730         do_log(SMB_VFS_OP_FILE_ID_CREATE,
1731                !file_id_equal(&id_zero, &result),
1732                handle, "%s", file_id_string_tos(&result));
1733
1734         return result;
1735 }
1736
1737 static NTSTATUS smb_full_audit_streaminfo(vfs_handle_struct *handle,
1738                                           struct files_struct *fsp,
1739                                           const struct smb_filename *smb_fname,
1740                                           TALLOC_CTX *mem_ctx,
1741                                           unsigned int *pnum_streams,
1742                                           struct stream_struct **pstreams)
1743 {
1744         NTSTATUS result;
1745
1746         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, smb_fname, mem_ctx,
1747                                          pnum_streams, pstreams);
1748
1749         do_log(SMB_VFS_OP_STREAMINFO, NT_STATUS_IS_OK(result), handle,
1750                "%s", smb_fname->base_name);
1751
1752         return result;
1753 }
1754
1755 static int smb_full_audit_get_real_filename(struct vfs_handle_struct *handle,
1756                                             const char *path,
1757                                             const char *name,
1758                                             TALLOC_CTX *mem_ctx,
1759                                             char **found_name)
1760 {
1761         int result;
1762
1763         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1764                                                 found_name);
1765
1766         do_log(SMB_VFS_OP_GET_REAL_FILENAME, (result == 0), handle,
1767                "%s/%s->%s", path, name, (result == 0) ? "" : *found_name);
1768
1769         return result;
1770 }
1771
1772 static const char *smb_full_audit_connectpath(vfs_handle_struct *handle,
1773                                         const struct smb_filename *smb_fname)
1774 {
1775         const char *result;
1776
1777         result = SMB_VFS_NEXT_CONNECTPATH(handle, smb_fname);
1778
1779         do_log(SMB_VFS_OP_CONNECTPATH, result != NULL, handle,
1780                "%s", smb_fname->base_name);
1781
1782         return result;
1783 }
1784
1785 static NTSTATUS smb_full_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1786                                                 struct byte_range_lock *br_lck,
1787                                                 struct lock_struct *plock,
1788                                                 bool blocking_lock)
1789 {
1790         NTSTATUS result;
1791
1792         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1793                                                blocking_lock);
1794
1795         do_log(SMB_VFS_OP_BRL_LOCK_WINDOWS, NT_STATUS_IS_OK(result), handle,
1796             "%s:%llu-%llu. type=%d. blocking=%d",
1797                fsp_str_do_log(brl_fsp(br_lck)),
1798             plock->start, plock->size, plock->lock_type, blocking_lock);
1799
1800         return result;
1801 }
1802
1803 static bool smb_full_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1804                                               struct messaging_context *msg_ctx,
1805                                               struct byte_range_lock *br_lck,
1806                                               const struct lock_struct *plock)
1807 {
1808         bool result;
1809
1810         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1811             plock);
1812
1813         do_log(SMB_VFS_OP_BRL_UNLOCK_WINDOWS, (result == 0), handle,
1814                "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1815                plock->start,
1816             plock->size, plock->lock_type);
1817
1818         return result;
1819 }
1820
1821 static bool smb_full_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1822                                               struct byte_range_lock *br_lck,
1823                                               struct lock_struct *plock)
1824 {
1825         bool result;
1826
1827         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1828
1829         do_log(SMB_VFS_OP_BRL_CANCEL_WINDOWS, (result == 0), handle,
1830                "%s:%llu-%llu:%d", fsp_str_do_log(brl_fsp(br_lck)),
1831                plock->start,
1832             plock->size, plock->lock_type);
1833
1834         return result;
1835 }
1836
1837 static bool smb_full_audit_strict_lock(struct vfs_handle_struct *handle,
1838                                        struct files_struct *fsp,
1839                                        struct lock_struct *plock)
1840 {
1841         bool result;
1842
1843         result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1844
1845         do_log(SMB_VFS_OP_STRICT_LOCK, result, handle,
1846             "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1847             plock->size, plock->lock_type);
1848
1849         return result;
1850 }
1851
1852 static void smb_full_audit_strict_unlock(struct vfs_handle_struct *handle,
1853                                          struct files_struct *fsp,
1854                                          struct lock_struct *plock)
1855 {
1856         SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1857
1858         do_log(SMB_VFS_OP_STRICT_UNLOCK, true, handle,
1859             "%s:%llu-%llu:%d", fsp_str_do_log(fsp), plock->start,
1860             plock->size, plock->lock_type);
1861 }
1862
1863 static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
1864                                               const char *name,
1865                                               enum vfs_translate_direction direction,
1866                                               TALLOC_CTX *mem_ctx,
1867                                               char **mapped_name)
1868 {
1869         NTSTATUS result;
1870
1871         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1872                                              mapped_name);
1873
1874         do_log(SMB_VFS_OP_TRANSLATE_NAME, NT_STATUS_IS_OK(result), handle, "");
1875
1876         return result;
1877 }
1878
1879 static NTSTATUS smb_full_audit_fsctl(struct vfs_handle_struct *handle,
1880                                 struct files_struct *fsp,
1881                                 TALLOC_CTX *ctx,
1882                                 uint32_t function,
1883                                 uint16_t req_flags,
1884                                 const uint8_t *_in_data,
1885                                 uint32_t in_len,
1886                                 uint8_t **_out_data,
1887                                 uint32_t max_out_len,
1888                                 uint32_t *out_len)
1889 {
1890         NTSTATUS result;
1891
1892         result = SMB_VFS_NEXT_FSCTL(handle,
1893                                 fsp,
1894                                 ctx,
1895                                 function,
1896                                 req_flags,
1897                                 _in_data,
1898                                 in_len,
1899                                 _out_data,
1900                                 max_out_len,
1901                                 out_len);
1902
1903         do_log(SMB_VFS_OP_FSCTL, NT_STATUS_IS_OK(result), handle, "");
1904
1905         return result;
1906 }
1907
1908 static struct tevent_req *smb_full_audit_offload_read_send(
1909         TALLOC_CTX *mem_ctx,
1910         struct tevent_context *ev,
1911         struct vfs_handle_struct *handle,
1912         struct files_struct *fsp,
1913         uint32_t fsctl,
1914         uint32_t ttl,
1915         off_t offset,
1916         size_t to_copy)
1917 {
1918         struct tevent_req *req = NULL;
1919
1920         req = SMB_VFS_NEXT_OFFLOAD_READ_SEND(mem_ctx, ev, handle, fsp,
1921                                              fsctl, ttl, offset, to_copy);
1922
1923         do_log(SMB_VFS_OP_OFFLOAD_READ_SEND, req, handle, "");
1924
1925         return req;
1926 }
1927
1928 static NTSTATUS smb_full_audit_offload_read_recv(
1929         struct tevent_req *req,
1930         struct vfs_handle_struct *handle,
1931         TALLOC_CTX *mem_ctx,
1932         DATA_BLOB *_token_blob)
1933 {
1934         NTSTATUS status;
1935
1936         status = SMB_VFS_NEXT_OFFLOAD_READ_RECV(req, handle, mem_ctx,
1937                                                 _token_blob);
1938
1939         do_log(SMB_VFS_OP_OFFLOAD_READ_RECV, NT_STATUS_IS_OK(status), handle, "");
1940
1941         return status;
1942 }
1943
1944 static struct tevent_req *smb_full_audit_offload_write_send(struct vfs_handle_struct *handle,
1945                                                          TALLOC_CTX *mem_ctx,
1946                                                          struct tevent_context *ev,
1947                                                          uint32_t fsctl,
1948                                                          DATA_BLOB *token,
1949                                                          off_t transfer_offset,
1950                                                          struct files_struct *dest_fsp,
1951                                                          off_t dest_off,
1952                                                          off_t num,
1953                                                          uint32_t flags)
1954 {
1955         struct tevent_req *req;
1956
1957         req = SMB_VFS_NEXT_OFFLOAD_WRITE_SEND(handle, mem_ctx, ev,
1958                                            fsctl, token, transfer_offset,
1959                                            dest_fsp, dest_off, num,
1960                                            flags);
1961
1962         do_log(SMB_VFS_OP_OFFLOAD_WRITE_SEND, req, handle, "");
1963
1964         return req;
1965 }
1966
1967 static NTSTATUS smb_full_audit_offload_write_recv(struct vfs_handle_struct *handle,
1968                                                struct tevent_req *req,
1969                                                off_t *copied)
1970 {
1971         NTSTATUS result;
1972
1973         result = SMB_VFS_NEXT_OFFLOAD_WRITE_RECV(handle, req, copied);
1974
1975         do_log(SMB_VFS_OP_OFFLOAD_WRITE_RECV, NT_STATUS_IS_OK(result), handle, "");
1976
1977         return result;
1978 }
1979
1980 static NTSTATUS smb_full_audit_get_compression(vfs_handle_struct *handle,
1981                                                TALLOC_CTX *mem_ctx,
1982                                                struct files_struct *fsp,
1983                                                struct smb_filename *smb_fname,
1984                                                uint16_t *_compression_fmt)
1985 {
1986         NTSTATUS result;
1987
1988         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1989                                               _compression_fmt);
1990
1991         do_log(SMB_VFS_OP_GET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
1992                "%s",
1993                (fsp ? fsp_str_do_log(fsp) : smb_fname_str_do_log(smb_fname)));
1994
1995         return result;
1996 }
1997
1998 static NTSTATUS smb_full_audit_set_compression(vfs_handle_struct *handle,
1999                                                TALLOC_CTX *mem_ctx,
2000                                                struct files_struct *fsp,
2001                                                uint16_t compression_fmt)
2002 {
2003         NTSTATUS result;
2004
2005         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
2006                                               compression_fmt);
2007
2008         do_log(SMB_VFS_OP_SET_COMPRESSION, NT_STATUS_IS_OK(result), handle,
2009                "%s", fsp_str_do_log(fsp));
2010
2011         return result;
2012 }
2013
2014 static NTSTATUS smb_full_audit_readdir_attr(struct vfs_handle_struct *handle,
2015                                             const struct smb_filename *fname,
2016                                             TALLOC_CTX *mem_ctx,
2017                                             struct readdir_attr_data **pattr_data)
2018 {
2019         NTSTATUS status;
2020
2021         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
2022
2023         do_log(SMB_VFS_OP_READDIR_ATTR, NT_STATUS_IS_OK(status), handle, "%s",
2024                smb_fname_str_do_log(fname));
2025
2026         return status;
2027 }
2028
2029 static NTSTATUS smb_full_audit_get_dos_attributes(
2030                                 struct vfs_handle_struct *handle,
2031                                 struct smb_filename *smb_fname,
2032                                 uint32_t *dosmode)
2033 {
2034         NTSTATUS status;
2035
2036         status = SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
2037                                 smb_fname,
2038                                 dosmode);
2039
2040         do_log(SMB_VFS_OP_GET_DOS_ATTRIBUTES,
2041                 NT_STATUS_IS_OK(status),
2042                 handle,
2043                 "%s",
2044                 smb_fname_str_do_log(smb_fname));
2045
2046         return status;
2047 }
2048
2049 static NTSTATUS smb_full_audit_fget_dos_attributes(
2050                                 struct vfs_handle_struct *handle,
2051                                 struct files_struct *fsp,
2052                                 uint32_t *dosmode)
2053 {
2054         NTSTATUS status;
2055
2056         status = SMB_VFS_NEXT_FGET_DOS_ATTRIBUTES(handle,
2057                                 fsp,
2058                                 dosmode);
2059
2060         do_log(SMB_VFS_OP_FGET_DOS_ATTRIBUTES,
2061                 NT_STATUS_IS_OK(status),
2062                 handle,
2063                 "%s",
2064                 fsp_str_do_log(fsp));
2065
2066         return status;
2067 }
2068
2069 static NTSTATUS smb_full_audit_set_dos_attributes(
2070                                 struct vfs_handle_struct *handle,
2071                                 const struct smb_filename *smb_fname,
2072                                 uint32_t dosmode)
2073 {
2074         NTSTATUS status;
2075
2076         status = SMB_VFS_NEXT_SET_DOS_ATTRIBUTES(handle,
2077                                 smb_fname,
2078                                 dosmode);
2079
2080         do_log(SMB_VFS_OP_SET_DOS_ATTRIBUTES,
2081                 NT_STATUS_IS_OK(status),
2082                 handle,
2083                 "%s",
2084                 smb_fname_str_do_log(smb_fname));
2085
2086         return status;
2087 }
2088
2089 static NTSTATUS smb_full_audit_fset_dos_attributes(
2090                                 struct vfs_handle_struct *handle,
2091                                 struct files_struct *fsp,
2092                                 uint32_t dosmode)
2093 {
2094         NTSTATUS status;
2095
2096         status = SMB_VFS_NEXT_FSET_DOS_ATTRIBUTES(handle,
2097                                 fsp,
2098                                 dosmode);
2099
2100         do_log(SMB_VFS_OP_FSET_DOS_ATTRIBUTES,
2101                 NT_STATUS_IS_OK(status),
2102                 handle,
2103                 "%s",
2104                 fsp_str_do_log(fsp));
2105
2106         return status;
2107 }
2108
2109 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2110                                            uint32_t security_info,
2111                                            TALLOC_CTX *mem_ctx,
2112                                            struct security_descriptor **ppdesc)
2113 {
2114         NTSTATUS result;
2115
2116         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
2117                                           mem_ctx, ppdesc);
2118
2119         do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2120                "%s", fsp_str_do_log(fsp));
2121
2122         return result;
2123 }
2124
2125 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
2126                                           const struct smb_filename *smb_fname,
2127                                           uint32_t security_info,
2128                                           TALLOC_CTX *mem_ctx,
2129                                           struct security_descriptor **ppdesc)
2130 {
2131         NTSTATUS result;
2132
2133         result = SMB_VFS_NEXT_GET_NT_ACL(handle, smb_fname, security_info,
2134                                          mem_ctx, ppdesc);
2135
2136         do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2137                "%s", smb_fname_str_do_log(smb_fname));
2138
2139         return result;
2140 }
2141
2142 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
2143                               uint32_t security_info_sent,
2144                               const struct security_descriptor *psd)
2145 {
2146         struct vfs_full_audit_private_data *pd;
2147         NTSTATUS result;
2148         char *sd = NULL;
2149
2150         SMB_VFS_HANDLE_GET_DATA(handle, pd,
2151                                 struct vfs_full_audit_private_data,
2152                                 return NT_STATUS_INTERNAL_ERROR);
2153
2154         if (pd->log_secdesc) {
2155                 sd = sddl_encode(talloc_tos(), psd, get_global_sam_sid());
2156         }
2157
2158         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
2159
2160         do_log(SMB_VFS_OP_FSET_NT_ACL, NT_STATUS_IS_OK(result), handle,
2161                "%s [%s]", fsp_str_do_log(fsp), sd ? sd : "");
2162
2163         TALLOC_FREE(sd);
2164
2165         return result;
2166 }
2167
2168 static NTSTATUS smb_full_audit_audit_file(struct vfs_handle_struct *handle,
2169                                 struct smb_filename *file,
2170                                 struct security_acl *sacl,
2171                                 uint32_t access_requested,
2172                                 uint32_t access_denied)
2173 {
2174         NTSTATUS result;
2175
2176         result = SMB_VFS_NEXT_AUDIT_FILE(handle,
2177                                         file,
2178                                         sacl,
2179                                         access_requested,
2180                                         access_denied);
2181
2182         do_log(SMB_VFS_OP_AUDIT_FILE, NT_STATUS_IS_OK(result), handle,
2183                         "%s", smb_fname_str_do_log(file));
2184
2185         return result;
2186 }
2187
2188 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
2189                                 const struct smb_filename *smb_fname,
2190                                 mode_t mode)
2191 {
2192         int result;
2193
2194         result = SMB_VFS_NEXT_CHMOD_ACL(handle, smb_fname, mode);
2195
2196         do_log(SMB_VFS_OP_CHMOD_ACL, (result >= 0), handle,
2197                "%s|%o", smb_fname->base_name, mode);
2198
2199         return result;
2200 }
2201
2202 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
2203                                      mode_t mode)
2204 {
2205         int result;
2206
2207         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
2208
2209         do_log(SMB_VFS_OP_FCHMOD_ACL, (result >= 0), handle,
2210                "%s|%o", fsp_str_do_log(fsp), mode);
2211
2212         return result;
2213 }
2214
2215 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
2216                                 const struct smb_filename *smb_fname,
2217                                 SMB_ACL_TYPE_T type,
2218                                 TALLOC_CTX *mem_ctx)
2219 {
2220         SMB_ACL_T result;
2221
2222         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, smb_fname,
2223                                 type, mem_ctx);
2224
2225         do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
2226                "%s", smb_fname->base_name);
2227
2228         return result;
2229 }
2230
2231 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2232                                                files_struct *fsp, TALLOC_CTX *mem_ctx)
2233 {
2234         SMB_ACL_T result;
2235
2236         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2237
2238         do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
2239                "%s", fsp_str_do_log(fsp));
2240
2241         return result;
2242 }
2243
2244 static int smb_full_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2245                                 const struct smb_filename *smb_fname,
2246                                 TALLOC_CTX *mem_ctx,
2247                                 char **blob_description,
2248                                 DATA_BLOB *blob)
2249 {
2250         int result;
2251
2252         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, smb_fname,
2253                         mem_ctx, blob_description, blob);
2254
2255         do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FILE, (result >= 0), handle,
2256                "%s", smb_fname->base_name);
2257
2258         return result;
2259 }
2260
2261 static int smb_full_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2262                                               files_struct *fsp,
2263                                               TALLOC_CTX *mem_ctx,
2264                                               char **blob_description,
2265                                               DATA_BLOB *blob)
2266 {
2267         int result;
2268
2269         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2270
2271         do_log(SMB_VFS_OP_SYS_ACL_BLOB_GET_FD, (result >= 0), handle,
2272                "%s", fsp_str_do_log(fsp));
2273
2274         return result;
2275 }
2276
2277 static int smb_full_audit_sys_acl_set_file(vfs_handle_struct *handle,
2278                                 const struct smb_filename *smb_fname,
2279                                 SMB_ACL_TYPE_T acltype,
2280                                 SMB_ACL_T theacl)
2281 {
2282         int result;
2283
2284         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype,
2285                                                theacl);
2286
2287         do_log(SMB_VFS_OP_SYS_ACL_SET_FILE, (result >= 0), handle,
2288                "%s", smb_fname->base_name);
2289
2290         return result;
2291 }
2292
2293 static int smb_full_audit_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
2294                                 SMB_ACL_T theacl)
2295 {
2296         int result;
2297
2298         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2299
2300         do_log(SMB_VFS_OP_SYS_ACL_SET_FD, (result >= 0), handle,
2301                "%s", fsp_str_do_log(fsp));
2302
2303         return result;
2304 }
2305
2306 static int smb_full_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2307                                 const struct smb_filename *smb_fname)
2308 {
2309         int result;
2310
2311         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, smb_fname);
2312
2313         do_log(SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, (result >= 0), handle,
2314                "%s", smb_fname->base_name);
2315
2316         return result;
2317 }
2318
2319 static ssize_t smb_full_audit_getxattr(struct vfs_handle_struct *handle,
2320                               const struct smb_filename *smb_fname,
2321                               const char *name, void *value, size_t size)
2322 {
2323         ssize_t result;
2324
2325         result = SMB_VFS_NEXT_GETXATTR(handle, smb_fname, name, value, size);
2326
2327         do_log(SMB_VFS_OP_GETXATTR, (result >= 0), handle,
2328                "%s|%s", smb_fname->base_name, name);
2329
2330         return result;
2331 }
2332
2333 static ssize_t smb_full_audit_fgetxattr(struct vfs_handle_struct *handle,
2334                                struct files_struct *fsp,
2335                                const char *name, void *value, size_t size)
2336 {
2337         ssize_t result;
2338
2339         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2340
2341         do_log(SMB_VFS_OP_FGETXATTR, (result >= 0), handle,
2342                "%s|%s", fsp_str_do_log(fsp), name);
2343
2344         return result;
2345 }
2346
2347 static ssize_t smb_full_audit_listxattr(struct vfs_handle_struct *handle,
2348                                 const struct smb_filename *smb_fname,
2349                                 char *list,
2350                                 size_t size)
2351 {
2352         ssize_t result;
2353
2354         result = SMB_VFS_NEXT_LISTXATTR(handle, smb_fname, list, size);
2355
2356         do_log(SMB_VFS_OP_LISTXATTR, (result >= 0), handle, "%s",
2357                         smb_fname->base_name);
2358
2359         return result;
2360 }
2361
2362 static ssize_t smb_full_audit_flistxattr(struct vfs_handle_struct *handle,
2363                                 struct files_struct *fsp, char *list,
2364                                 size_t size)
2365 {
2366         ssize_t result;
2367
2368         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2369
2370         do_log(SMB_VFS_OP_FLISTXATTR, (result >= 0), handle,
2371                "%s", fsp_str_do_log(fsp));
2372
2373         return result;
2374 }
2375
2376 static int smb_full_audit_removexattr(struct vfs_handle_struct *handle,
2377                              const struct smb_filename *smb_fname,
2378                              const char *name)
2379 {
2380         int result;
2381
2382         result = SMB_VFS_NEXT_REMOVEXATTR(handle, smb_fname, name);
2383
2384         do_log(SMB_VFS_OP_REMOVEXATTR, (result >= 0), handle,
2385                "%s|%s", smb_fname->base_name, name);
2386
2387         return result;
2388 }
2389
2390 static int smb_full_audit_fremovexattr(struct vfs_handle_struct *handle,
2391                               struct files_struct *fsp,
2392                               const char *name)
2393 {
2394         int result;
2395
2396         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2397
2398         do_log(SMB_VFS_OP_FREMOVEXATTR, (result >= 0), handle,
2399                "%s|%s", fsp_str_do_log(fsp), name);
2400
2401         return result;
2402 }
2403
2404 static int smb_full_audit_setxattr(struct vfs_handle_struct *handle,
2405                           const struct smb_filename *smb_fname,
2406                           const char *name, const void *value, size_t size,
2407                           int flags)
2408 {
2409         int result;
2410
2411         result = SMB_VFS_NEXT_SETXATTR(handle, smb_fname, name, value, size,
2412                                        flags);
2413
2414         do_log(SMB_VFS_OP_SETXATTR, (result >= 0), handle,
2415                "%s|%s", smb_fname->base_name, name);
2416
2417         return result;
2418 }
2419
2420 static int smb_full_audit_fsetxattr(struct vfs_handle_struct *handle,
2421                            struct files_struct *fsp, const char *name,
2422                            const void *value, size_t size, int flags)
2423 {
2424         int result;
2425
2426         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2427
2428         do_log(SMB_VFS_OP_FSETXATTR, (result >= 0), handle,
2429                "%s|%s", fsp_str_do_log(fsp), name);
2430
2431         return result;
2432 }
2433
2434 static bool smb_full_audit_aio_force(struct vfs_handle_struct *handle,
2435                                      struct files_struct *fsp)
2436 {
2437         bool result;
2438
2439         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2440         do_log(SMB_VFS_OP_AIO_FORCE, result, handle,
2441                 "%s", fsp_str_do_log(fsp));
2442
2443         return result;
2444 }
2445
2446 static NTSTATUS smb_full_audit_durable_cookie(struct vfs_handle_struct *handle,
2447                                 struct files_struct *fsp,
2448                                 TALLOC_CTX *mem_ctx,
2449                                 DATA_BLOB *cookie)
2450 {
2451         NTSTATUS result;
2452
2453         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle,
2454                                         fsp,
2455                                         mem_ctx,
2456                                         cookie);
2457
2458         do_log(SMB_VFS_OP_DURABLE_COOKIE, NT_STATUS_IS_OK(result), handle,
2459                         "%s", fsp_str_do_log(fsp));
2460
2461         return result;
2462 }
2463
2464 static NTSTATUS smb_full_audit_durable_disconnect(
2465                                 struct vfs_handle_struct *handle,
2466                                 struct files_struct *fsp,
2467                                 const DATA_BLOB old_cookie,
2468                                 TALLOC_CTX *mem_ctx,
2469                                 DATA_BLOB *new_cookie)
2470 {
2471         NTSTATUS result;
2472
2473         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle,
2474                                         fsp,
2475                                         old_cookie,
2476                                         mem_ctx,
2477                                         new_cookie);
2478
2479         do_log(SMB_VFS_OP_DURABLE_DISCONNECT, NT_STATUS_IS_OK(result), handle,
2480                         "%s", fsp_str_do_log(fsp));
2481
2482         return result;
2483 }
2484
2485 static NTSTATUS smb_full_audit_durable_reconnect(
2486                                 struct vfs_handle_struct *handle,
2487                                 struct smb_request *smb1req,
2488                                 struct smbXsrv_open *op,
2489                                 const DATA_BLOB old_cookie,
2490                                 TALLOC_CTX *mem_ctx,
2491                                 struct files_struct **fsp,
2492                                 DATA_BLOB *new_cookie)
2493 {
2494         NTSTATUS result;
2495
2496         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle,
2497                                         smb1req,
2498                                         op,
2499                                         old_cookie,
2500                                         mem_ctx,
2501                                         fsp,
2502                                         new_cookie);
2503
2504         do_log(SMB_VFS_OP_DURABLE_RECONNECT,
2505                         NT_STATUS_IS_OK(result),
2506                         handle,
2507                         "");
2508
2509         return result;
2510 }
2511
2512 static struct vfs_fn_pointers vfs_full_audit_fns = {
2513
2514         /* Disk operations */
2515
2516         .connect_fn = smb_full_audit_connect,
2517         .disconnect_fn = smb_full_audit_disconnect,
2518         .disk_free_fn = smb_full_audit_disk_free,
2519         .get_quota_fn = smb_full_audit_get_quota,
2520         .set_quota_fn = smb_full_audit_set_quota,
2521         .get_shadow_copy_data_fn = smb_full_audit_get_shadow_copy_data,
2522         .statvfs_fn = smb_full_audit_statvfs,
2523         .fs_capabilities_fn = smb_full_audit_fs_capabilities,
2524         .get_dfs_referrals_fn = smb_full_audit_get_dfs_referrals,
2525         .opendir_fn = smb_full_audit_opendir,
2526         .fdopendir_fn = smb_full_audit_fdopendir,
2527         .readdir_fn = smb_full_audit_readdir,
2528         .seekdir_fn = smb_full_audit_seekdir,
2529         .telldir_fn = smb_full_audit_telldir,
2530         .rewind_dir_fn = smb_full_audit_rewinddir,
2531         .mkdir_fn = smb_full_audit_mkdir,
2532         .rmdir_fn = smb_full_audit_rmdir,
2533         .closedir_fn = smb_full_audit_closedir,
2534         .init_search_op_fn = smb_full_audit_init_search_op,
2535         .open_fn = smb_full_audit_open,
2536         .create_file_fn = smb_full_audit_create_file,
2537         .close_fn = smb_full_audit_close,
2538         .read_fn = smb_full_audit_read,
2539         .pread_fn = smb_full_audit_pread,
2540         .pread_send_fn = smb_full_audit_pread_send,
2541         .pread_recv_fn = smb_full_audit_pread_recv,
2542         .write_fn = smb_full_audit_write,
2543         .pwrite_fn = smb_full_audit_pwrite,
2544         .pwrite_send_fn = smb_full_audit_pwrite_send,
2545         .pwrite_recv_fn = smb_full_audit_pwrite_recv,
2546         .lseek_fn = smb_full_audit_lseek,
2547         .sendfile_fn = smb_full_audit_sendfile,
2548         .recvfile_fn = smb_full_audit_recvfile,
2549         .rename_fn = smb_full_audit_rename,
2550         .fsync_fn = smb_full_audit_fsync,
2551         .fsync_send_fn = smb_full_audit_fsync_send,
2552         .fsync_recv_fn = smb_full_audit_fsync_recv,
2553         .stat_fn = smb_full_audit_stat,
2554         .fstat_fn = smb_full_audit_fstat,
2555         .lstat_fn = smb_full_audit_lstat,
2556         .get_alloc_size_fn = smb_full_audit_get_alloc_size,
2557         .unlink_fn = smb_full_audit_unlink,
2558         .chmod_fn = smb_full_audit_chmod,
2559         .fchmod_fn = smb_full_audit_fchmod,
2560         .chown_fn = smb_full_audit_chown,
2561         .fchown_fn = smb_full_audit_fchown,
2562         .lchown_fn = smb_full_audit_lchown,
2563         .chdir_fn = smb_full_audit_chdir,
2564         .getwd_fn = smb_full_audit_getwd,
2565         .ntimes_fn = smb_full_audit_ntimes,
2566         .ftruncate_fn = smb_full_audit_ftruncate,
2567         .fallocate_fn = smb_full_audit_fallocate,
2568         .lock_fn = smb_full_audit_lock,
2569         .kernel_flock_fn = smb_full_audit_kernel_flock,
2570         .linux_setlease_fn = smb_full_audit_linux_setlease,
2571         .getlock_fn = smb_full_audit_getlock,
2572         .symlink_fn = smb_full_audit_symlink,
2573         .readlink_fn = smb_full_audit_readlink,
2574         .link_fn = smb_full_audit_link,
2575         .mknod_fn = smb_full_audit_mknod,
2576         .realpath_fn = smb_full_audit_realpath,
2577         .chflags_fn = smb_full_audit_chflags,
2578         .file_id_create_fn = smb_full_audit_file_id_create,
2579         .offload_read_send_fn = smb_full_audit_offload_read_send,
2580         .offload_read_recv_fn = smb_full_audit_offload_read_recv,
2581         .offload_write_send_fn = smb_full_audit_offload_write_send,
2582         .offload_write_recv_fn = smb_full_audit_offload_write_recv,
2583         .get_compression_fn = smb_full_audit_get_compression,
2584         .set_compression_fn = smb_full_audit_set_compression,
2585         .snap_check_path_fn =  smb_full_audit_snap_check_path,
2586         .snap_create_fn = smb_full_audit_snap_create,
2587         .snap_delete_fn = smb_full_audit_snap_delete,
2588         .streaminfo_fn = smb_full_audit_streaminfo,
2589         .get_real_filename_fn = smb_full_audit_get_real_filename,
2590         .connectpath_fn = smb_full_audit_connectpath,
2591         .brl_lock_windows_fn = smb_full_audit_brl_lock_windows,
2592         .brl_unlock_windows_fn = smb_full_audit_brl_unlock_windows,
2593         .brl_cancel_windows_fn = smb_full_audit_brl_cancel_windows,
2594         .strict_lock_fn = smb_full_audit_strict_lock,
2595         .strict_unlock_fn = smb_full_audit_strict_unlock,
2596         .translate_name_fn = smb_full_audit_translate_name,
2597         .fsctl_fn = smb_full_audit_fsctl,
2598         .get_dos_attributes_fn = smb_full_audit_get_dos_attributes,
2599         .fget_dos_attributes_fn = smb_full_audit_fget_dos_attributes,
2600         .set_dos_attributes_fn = smb_full_audit_set_dos_attributes,
2601         .fset_dos_attributes_fn = smb_full_audit_fset_dos_attributes,
2602         .fget_nt_acl_fn = smb_full_audit_fget_nt_acl,
2603         .get_nt_acl_fn = smb_full_audit_get_nt_acl,
2604         .fset_nt_acl_fn = smb_full_audit_fset_nt_acl,
2605         .audit_file_fn = smb_full_audit_audit_file,
2606         .chmod_acl_fn = smb_full_audit_chmod_acl,
2607         .fchmod_acl_fn = smb_full_audit_fchmod_acl,
2608         .sys_acl_get_file_fn = smb_full_audit_sys_acl_get_file,
2609         .sys_acl_get_fd_fn = smb_full_audit_sys_acl_get_fd,
2610         .sys_acl_blob_get_file_fn = smb_full_audit_sys_acl_blob_get_file,
2611         .sys_acl_blob_get_fd_fn = smb_full_audit_sys_acl_blob_get_fd,
2612         .sys_acl_set_file_fn = smb_full_audit_sys_acl_set_file,
2613         .sys_acl_set_fd_fn = smb_full_audit_sys_acl_set_fd,
2614         .sys_acl_delete_def_file_fn = smb_full_audit_sys_acl_delete_def_file,
2615         .getxattr_fn = smb_full_audit_getxattr,
2616         .fgetxattr_fn = smb_full_audit_fgetxattr,
2617         .listxattr_fn = smb_full_audit_listxattr,
2618         .flistxattr_fn = smb_full_audit_flistxattr,
2619         .removexattr_fn = smb_full_audit_removexattr,
2620         .fremovexattr_fn = smb_full_audit_fremovexattr,
2621         .setxattr_fn = smb_full_audit_setxattr,
2622         .fsetxattr_fn = smb_full_audit_fsetxattr,
2623         .aio_force_fn = smb_full_audit_aio_force,
2624         .durable_cookie_fn = smb_full_audit_durable_cookie,
2625         .durable_disconnect_fn = smb_full_audit_durable_disconnect,
2626         .durable_reconnect_fn = smb_full_audit_durable_reconnect,
2627         .readdir_attr_fn = smb_full_audit_readdir_attr
2628
2629 };
2630
2631 static_decl_vfs;
2632 NTSTATUS vfs_full_audit_init(TALLOC_CTX *ctx)
2633 {
2634         NTSTATUS ret;
2635
2636         smb_vfs_assert_all_fns(&vfs_full_audit_fns, "full_audit");
2637
2638         ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "full_audit",
2639                                &vfs_full_audit_fns);
2640
2641         if (!NT_STATUS_IS_OK(ret))
2642                 return ret;
2643
2644         vfs_full_audit_debug_level = debug_add_class("full_audit");
2645         if (vfs_full_audit_debug_level == -1) {
2646                 vfs_full_audit_debug_level = DBGC_VFS;
2647                 DEBUG(0, ("vfs_full_audit: Couldn't register custom debugging "
2648                           "class!\n"));
2649         } else {
2650                 DEBUG(10, ("vfs_full_audit: Debug class number of "
2651                            "'full_audit': %d\n", vfs_full_audit_debug_level));
2652         }
2653
2654         return ret;
2655 }