2 * Time auditing VFS module for samba. Log time taken for VFS call to syslog
5 * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 * This module implements logging for time taken for all Samba VFS operations.
24 * vfs objects = time_audit
31 #define DBGC_CLASS DBGC_VFS
33 static double audit_timeout;
35 static void smb_time_audit_log(const char *syscallname, double elapsed)
37 DEBUG(0, ("WARNING: System call \"%s\" took unexpectedly long "
38 "(%.2f seconds) -- Validate that file and storage "
39 "subsystems are operating normally\n", syscallname,
43 static int smb_time_audit_connect(vfs_handle_struct *handle,
44 const char *svc, const char *user)
47 struct timespec ts1,ts2;
54 clock_gettime_mono(&ts1);
55 result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
56 clock_gettime_mono(&ts2);
57 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
58 if (timediff > audit_timeout) {
59 smb_time_audit_log("connect", timediff);
64 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
66 struct timespec ts1,ts2;
69 clock_gettime_mono(&ts1);
70 SMB_VFS_NEXT_DISCONNECT(handle);
71 clock_gettime_mono(&ts2);
72 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
74 if (timediff > audit_timeout) {
75 smb_time_audit_log("disconnect", timediff);
81 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
83 bool small_query, uint64_t *bsize,
84 uint64_t *dfree, uint64_t *dsize)
87 struct timespec ts1,ts2;
90 clock_gettime_mono(&ts1);
91 result = SMB_VFS_NEXT_DISK_FREE(handle, path, small_query, bsize,
93 clock_gettime_mono(&ts2);
94 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
96 /* Don't have a reasonable notion of failure here */
97 if (timediff > audit_timeout) {
98 smb_time_audit_log("disk_free", timediff);
104 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
105 enum SMB_QUOTA_TYPE qtype, unid_t id,
109 struct timespec ts1,ts2;
112 clock_gettime_mono(&ts1);
113 result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
114 clock_gettime_mono(&ts2);
115 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
117 if (timediff > audit_timeout) {
118 smb_time_audit_log("get_quota", timediff);
123 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
124 enum SMB_QUOTA_TYPE qtype, unid_t id,
128 struct timespec ts1,ts2;
131 clock_gettime_mono(&ts1);
132 result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
133 clock_gettime_mono(&ts2);
134 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
136 if (timediff > audit_timeout) {
137 smb_time_audit_log("set_quota", timediff);
143 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
144 struct files_struct *fsp,
145 SHADOW_COPY_DATA *shadow_copy_data,
149 struct timespec ts1,ts2;
152 clock_gettime_mono(&ts1);
153 result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
154 shadow_copy_data, labels);
155 clock_gettime_mono(&ts2);
156 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
158 if (timediff > audit_timeout) {
159 smb_time_audit_log("get_shadow_copy_data", timediff);
165 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
167 struct vfs_statvfs_struct *statbuf)
170 struct timespec ts1,ts2;
173 clock_gettime_mono(&ts1);
174 result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
175 clock_gettime_mono(&ts2);
176 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
178 if (timediff > audit_timeout) {
179 smb_time_audit_log("statvfs", timediff);
185 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
186 enum timestamp_set_resolution *p_ts_res)
189 struct timespec ts1,ts2;
192 clock_gettime_mono(&ts1);
193 result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
194 clock_gettime_mono(&ts2);
195 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
197 if (timediff > audit_timeout) {
198 smb_time_audit_log("fs_capabilities", timediff);
204 static SMB_STRUCT_DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
206 const char *mask, uint32 attr)
208 SMB_STRUCT_DIR *result;
209 struct timespec ts1,ts2;
212 clock_gettime_mono(&ts1);
213 result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
214 clock_gettime_mono(&ts2);
215 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
217 if (timediff > audit_timeout) {
218 smb_time_audit_log("opendir", timediff);
224 static SMB_STRUCT_DIRENT *smb_time_audit_readdir(vfs_handle_struct *handle,
225 SMB_STRUCT_DIR *dirp,
226 SMB_STRUCT_STAT *sbuf)
228 SMB_STRUCT_DIRENT *result;
229 struct timespec ts1,ts2;
232 clock_gettime_mono(&ts1);
233 result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
234 clock_gettime_mono(&ts2);
235 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
237 if (timediff > audit_timeout) {
238 smb_time_audit_log("readdir", timediff);
244 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
245 SMB_STRUCT_DIR *dirp, long offset)
247 struct timespec ts1,ts2;
250 clock_gettime_mono(&ts1);
251 SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
252 clock_gettime_mono(&ts2);
253 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
255 if (timediff > audit_timeout) {
256 smb_time_audit_log("seekdir", timediff);
262 static long smb_time_audit_telldir(vfs_handle_struct *handle,
263 SMB_STRUCT_DIR *dirp)
266 struct timespec ts1,ts2;
269 clock_gettime_mono(&ts1);
270 result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
271 clock_gettime_mono(&ts2);
272 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
274 if (timediff > audit_timeout) {
275 smb_time_audit_log("telldir", timediff);
281 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
282 SMB_STRUCT_DIR *dirp)
284 struct timespec ts1,ts2;
287 clock_gettime_mono(&ts1);
288 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
289 clock_gettime_mono(&ts2);
290 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
292 if (timediff > audit_timeout) {
293 smb_time_audit_log("rewinddir", timediff);
299 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
300 const char *path, mode_t mode)
303 struct timespec ts1,ts2;
306 clock_gettime_mono(&ts1);
307 result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
308 clock_gettime_mono(&ts2);
309 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
311 if (timediff > audit_timeout) {
312 smb_time_audit_log("mkdir", timediff);
318 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
322 struct timespec ts1,ts2;
325 clock_gettime_mono(&ts1);
326 result = SMB_VFS_NEXT_RMDIR(handle, path);
327 clock_gettime_mono(&ts2);
328 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
330 if (timediff > audit_timeout) {
331 smb_time_audit_log("rmdir", timediff);
337 static int smb_time_audit_closedir(vfs_handle_struct *handle,
338 SMB_STRUCT_DIR *dirp)
341 struct timespec ts1,ts2;
344 clock_gettime_mono(&ts1);
345 result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
346 clock_gettime_mono(&ts2);
347 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
349 if (timediff > audit_timeout) {
350 smb_time_audit_log("closedir", timediff);
356 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
357 SMB_STRUCT_DIR *dirp)
359 struct timespec ts1,ts2;
362 clock_gettime_mono(&ts1);
363 SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
364 clock_gettime_mono(&ts2);
365 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
367 if (timediff > audit_timeout) {
368 smb_time_audit_log("init_search_op", timediff);
373 static int smb_time_audit_open(vfs_handle_struct *handle,
374 struct smb_filename *fname,
376 int flags, mode_t mode)
379 struct timespec ts1,ts2;
382 clock_gettime_mono(&ts1);
383 result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
384 clock_gettime_mono(&ts2);
385 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
387 if (timediff > audit_timeout) {
388 smb_time_audit_log("open", timediff);
394 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
395 struct smb_request *req,
396 uint16_t root_dir_fid,
397 struct smb_filename *fname,
398 uint32_t access_mask,
399 uint32_t share_access,
400 uint32_t create_disposition,
401 uint32_t create_options,
402 uint32_t file_attributes,
403 uint32_t oplock_request,
404 uint64_t allocation_size,
405 uint32_t private_flags,
406 struct security_descriptor *sd,
407 struct ea_list *ea_list,
408 files_struct **result_fsp,
412 struct timespec ts1,ts2;
415 clock_gettime_mono(&ts1);
416 result = SMB_VFS_NEXT_CREATE_FILE(
419 root_dir_fid, /* root_dir_fid */
421 access_mask, /* access_mask */
422 share_access, /* share_access */
423 create_disposition, /* create_disposition*/
424 create_options, /* create_options */
425 file_attributes, /* file_attributes */
426 oplock_request, /* oplock_request */
427 allocation_size, /* allocation_size */
430 ea_list, /* ea_list */
431 result_fsp, /* result */
433 clock_gettime_mono(&ts2);
434 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
436 if (timediff > audit_timeout) {
437 smb_time_audit_log("create_file", timediff);
443 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
446 struct timespec ts1,ts2;
449 clock_gettime_mono(&ts1);
450 result = SMB_VFS_NEXT_CLOSE(handle, fsp);
451 clock_gettime_mono(&ts2);
452 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
454 if (timediff > audit_timeout) {
455 smb_time_audit_log("close", timediff);
461 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
462 files_struct *fsp, void *data, size_t n)
465 struct timespec ts1,ts2;
468 clock_gettime_mono(&ts1);
469 result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
470 clock_gettime_mono(&ts2);
471 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
473 if (timediff > audit_timeout) {
474 smb_time_audit_log("read", timediff);
480 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
482 void *data, size_t n, SMB_OFF_T offset)
485 struct timespec ts1,ts2;
488 clock_gettime_mono(&ts1);
489 result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
490 clock_gettime_mono(&ts2);
491 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
493 if (timediff > audit_timeout) {
494 smb_time_audit_log("pread", timediff);
500 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
502 const void *data, size_t n)
505 struct timespec ts1,ts2;
508 clock_gettime_mono(&ts1);
509 result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
510 clock_gettime_mono(&ts2);
511 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
513 if (timediff > audit_timeout) {
514 smb_time_audit_log("write", timediff);
520 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
522 const void *data, size_t n,
526 struct timespec ts1,ts2;
529 clock_gettime_mono(&ts1);
530 result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
531 clock_gettime_mono(&ts2);
532 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
534 if (timediff > audit_timeout) {
535 smb_time_audit_log("pwrite", timediff);
541 static SMB_OFF_T smb_time_audit_lseek(vfs_handle_struct *handle,
543 SMB_OFF_T offset, int whence)
546 struct timespec ts1,ts2;
549 clock_gettime_mono(&ts1);
550 result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
551 clock_gettime_mono(&ts2);
552 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
554 if (timediff > audit_timeout) {
555 smb_time_audit_log("lseek", timediff);
561 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
562 files_struct *fromfsp,
563 const DATA_BLOB *hdr, SMB_OFF_T offset,
567 struct timespec ts1,ts2;
570 clock_gettime_mono(&ts1);
571 result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
572 clock_gettime_mono(&ts2);
573 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
575 if (timediff > audit_timeout) {
576 smb_time_audit_log("sendfile", timediff);
582 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
588 struct timespec ts1,ts2;
591 clock_gettime_mono(&ts1);
592 result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
593 clock_gettime_mono(&ts2);
594 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
596 if (timediff > audit_timeout) {
597 smb_time_audit_log("recvfile", timediff);
603 static int smb_time_audit_rename(vfs_handle_struct *handle,
604 const struct smb_filename *oldname,
605 const struct smb_filename *newname)
608 struct timespec ts1,ts2;
611 clock_gettime_mono(&ts1);
612 result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
613 clock_gettime_mono(&ts2);
614 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
616 if (timediff > audit_timeout) {
617 smb_time_audit_log("rename", timediff);
623 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
626 struct timespec ts1,ts2;
629 clock_gettime_mono(&ts1);
630 result = SMB_VFS_NEXT_FSYNC(handle, fsp);
631 clock_gettime_mono(&ts2);
632 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
634 if (timediff > audit_timeout) {
635 smb_time_audit_log("fsync", timediff);
641 static int smb_time_audit_stat(vfs_handle_struct *handle,
642 struct smb_filename *fname)
645 struct timespec ts1,ts2;
648 clock_gettime_mono(&ts1);
649 result = SMB_VFS_NEXT_STAT(handle, fname);
650 clock_gettime_mono(&ts2);
651 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
653 if (timediff > audit_timeout) {
654 smb_time_audit_log("stat", timediff);
660 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
661 SMB_STRUCT_STAT *sbuf)
664 struct timespec ts1,ts2;
667 clock_gettime_mono(&ts1);
668 result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
669 clock_gettime_mono(&ts2);
670 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
672 if (timediff > audit_timeout) {
673 smb_time_audit_log("fstat", timediff);
679 static int smb_time_audit_lstat(vfs_handle_struct *handle,
680 struct smb_filename *path)
683 struct timespec ts1,ts2;
686 clock_gettime_mono(&ts1);
687 result = SMB_VFS_NEXT_LSTAT(handle, path);
688 clock_gettime_mono(&ts2);
689 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
691 if (timediff > audit_timeout) {
692 smb_time_audit_log("lstat", timediff);
698 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
700 const SMB_STRUCT_STAT *sbuf)
703 struct timespec ts1,ts2;
706 clock_gettime_mono(&ts1);
707 result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
708 clock_gettime_mono(&ts2);
709 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
711 if (timediff > audit_timeout) {
712 smb_time_audit_log("get_alloc_size", timediff);
718 static int smb_time_audit_unlink(vfs_handle_struct *handle,
719 const struct smb_filename *path)
722 struct timespec ts1,ts2;
725 clock_gettime_mono(&ts1);
726 result = SMB_VFS_NEXT_UNLINK(handle, path);
727 clock_gettime_mono(&ts2);
728 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
730 if (timediff > audit_timeout) {
731 smb_time_audit_log("unlink", timediff);
737 static int smb_time_audit_chmod(vfs_handle_struct *handle,
738 const char *path, mode_t mode)
741 struct timespec ts1,ts2;
744 clock_gettime_mono(&ts1);
745 result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
746 clock_gettime_mono(&ts2);
747 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
749 if (timediff > audit_timeout) {
750 smb_time_audit_log("chmod", timediff);
756 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
760 struct timespec ts1,ts2;
763 clock_gettime_mono(&ts1);
764 result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
765 clock_gettime_mono(&ts2);
766 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
768 if (timediff > audit_timeout) {
769 smb_time_audit_log("fchmod", timediff);
775 static int smb_time_audit_chown(vfs_handle_struct *handle,
776 const char *path, uid_t uid, gid_t gid)
779 struct timespec ts1,ts2;
782 clock_gettime_mono(&ts1);
783 result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
784 clock_gettime_mono(&ts2);
785 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
787 if (timediff > audit_timeout) {
788 smb_time_audit_log("chown", timediff);
794 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
795 uid_t uid, gid_t gid)
798 struct timespec ts1,ts2;
801 clock_gettime_mono(&ts1);
802 result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
803 clock_gettime_mono(&ts2);
804 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
806 if (timediff > audit_timeout) {
807 smb_time_audit_log("fchown", timediff);
813 static int smb_time_audit_lchown(vfs_handle_struct *handle,
814 const char *path, uid_t uid, gid_t gid)
817 struct timespec ts1,ts2;
820 clock_gettime_mono(&ts1);
821 result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
822 clock_gettime_mono(&ts2);
823 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
825 if (timediff > audit_timeout) {
826 smb_time_audit_log("lchown", timediff);
832 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
835 struct timespec ts1,ts2;
838 clock_gettime_mono(&ts1);
839 result = SMB_VFS_NEXT_CHDIR(handle, path);
840 clock_gettime_mono(&ts2);
841 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
843 if (timediff > audit_timeout) {
844 smb_time_audit_log("chdir", timediff);
850 static char *smb_time_audit_getwd(vfs_handle_struct *handle, char *path)
853 struct timespec ts1,ts2;
856 clock_gettime_mono(&ts1);
857 result = SMB_VFS_NEXT_GETWD(handle, path);
858 clock_gettime_mono(&ts2);
859 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
861 if (timediff > audit_timeout) {
862 smb_time_audit_log("getwd", timediff);
868 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
869 const struct smb_filename *path,
870 struct smb_file_time *ft)
873 struct timespec ts1,ts2;
876 clock_gettime_mono(&ts1);
877 result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
878 clock_gettime_mono(&ts2);
879 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
881 if (timediff > audit_timeout) {
882 smb_time_audit_log("ntimes", timediff);
888 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
893 struct timespec ts1,ts2;
896 clock_gettime_mono(&ts1);
897 result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
898 clock_gettime_mono(&ts2);
899 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
901 if (timediff > audit_timeout) {
902 smb_time_audit_log("ftruncate", timediff);
908 static int smb_time_audit_posix_fallocate(vfs_handle_struct *handle,
914 struct timespec ts1,ts2;
917 clock_gettime_mono(&ts1);
918 result = SMB_VFS_NEXT_POSIX_FALLOCATE(handle, fsp, offset, len);
919 clock_gettime_mono(&ts2);
920 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
922 if (timediff > audit_timeout) {
923 smb_time_audit_log("posix_fallocate", timediff);
929 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
930 int op, SMB_OFF_T offset, SMB_OFF_T count,
934 struct timespec ts1,ts2;
937 clock_gettime_mono(&ts1);
938 result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
939 clock_gettime_mono(&ts2);
940 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
942 if (timediff > audit_timeout) {
943 smb_time_audit_log("lock", timediff);
949 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
950 struct files_struct *fsp,
951 uint32 share_mode, uint32 access_mask)
954 struct timespec ts1,ts2;
957 clock_gettime_mono(&ts1);
958 result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
960 clock_gettime_mono(&ts2);
961 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
963 if (timediff > audit_timeout) {
964 smb_time_audit_log("kernel_flock", timediff);
970 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
975 struct timespec ts1,ts2;
978 clock_gettime_mono(&ts1);
979 result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
980 clock_gettime_mono(&ts2);
981 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
983 if (timediff > audit_timeout) {
984 smb_time_audit_log("linux_setlease", timediff);
990 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
992 SMB_OFF_T *poffset, SMB_OFF_T *pcount,
993 int *ptype, pid_t *ppid)
996 struct timespec ts1,ts2;
999 clock_gettime_mono(&ts1);
1000 result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1002 clock_gettime_mono(&ts2);
1003 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1005 if (timediff > audit_timeout) {
1006 smb_time_audit_log("getlock", timediff);
1012 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1013 const char *oldpath, const char *newpath)
1016 struct timespec ts1,ts2;
1019 clock_gettime_mono(&ts1);
1020 result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1021 clock_gettime_mono(&ts2);
1022 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1024 if (timediff > audit_timeout) {
1025 smb_time_audit_log("symlink", timediff);
1031 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1032 const char *path, char *buf, size_t bufsiz)
1035 struct timespec ts1,ts2;
1038 clock_gettime_mono(&ts1);
1039 result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1040 clock_gettime_mono(&ts2);
1041 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1043 if (timediff > audit_timeout) {
1044 smb_time_audit_log("readlink", timediff);
1050 static int smb_time_audit_link(vfs_handle_struct *handle,
1051 const char *oldpath, const char *newpath)
1054 struct timespec ts1,ts2;
1057 clock_gettime_mono(&ts1);
1058 result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1059 clock_gettime_mono(&ts2);
1060 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1062 if (timediff > audit_timeout) {
1063 smb_time_audit_log("link", timediff);
1069 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1070 const char *pathname, mode_t mode,
1074 struct timespec ts1,ts2;
1077 clock_gettime_mono(&ts1);
1078 result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1079 clock_gettime_mono(&ts2);
1080 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1082 if (timediff > audit_timeout) {
1083 smb_time_audit_log("mknod", timediff);
1089 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1093 struct timespec ts1,ts2;
1096 clock_gettime_mono(&ts1);
1097 result = SMB_VFS_NEXT_REALPATH(handle, path);
1098 clock_gettime_mono(&ts2);
1099 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1101 if (timediff > audit_timeout) {
1102 smb_time_audit_log("realpath", timediff);
1108 static NTSTATUS smb_time_audit_notify_watch(struct vfs_handle_struct *handle,
1109 struct sys_notify_context *ctx,
1110 struct notify_entry *e,
1111 void (*callback)(struct sys_notify_context *ctx,
1113 struct notify_event *ev),
1114 void *private_data, void *handle_p)
1117 struct timespec ts1,ts2;
1120 clock_gettime_mono(&ts1);
1121 result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, e, callback,
1122 private_data, handle_p);
1123 clock_gettime_mono(&ts2);
1124 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1126 if (timediff > audit_timeout) {
1127 smb_time_audit_log("notify_watch", timediff);
1133 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1134 const char *path, unsigned int flags)
1137 struct timespec ts1,ts2;
1140 clock_gettime_mono(&ts1);
1141 result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1142 clock_gettime_mono(&ts2);
1143 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1145 if (timediff > audit_timeout) {
1146 smb_time_audit_log("chflags", timediff);
1152 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1153 const SMB_STRUCT_STAT *sbuf)
1155 struct file_id id_zero;
1156 struct file_id result;
1157 struct timespec ts1,ts2;
1160 ZERO_STRUCT(id_zero);
1162 clock_gettime_mono(&ts1);
1163 result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1164 clock_gettime_mono(&ts2);
1165 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1167 if (timediff > audit_timeout) {
1168 smb_time_audit_log("file_id_create", timediff);
1174 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1175 struct files_struct *fsp,
1177 TALLOC_CTX *mem_ctx,
1178 unsigned int *pnum_streams,
1179 struct stream_struct **pstreams)
1182 struct timespec ts1,ts2;
1185 clock_gettime_mono(&ts1);
1186 result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1187 pnum_streams, pstreams);
1188 clock_gettime_mono(&ts2);
1189 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1191 if (timediff > audit_timeout) {
1192 smb_time_audit_log("streaminfo", timediff);
1198 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1201 TALLOC_CTX *mem_ctx,
1205 struct timespec ts1,ts2;
1208 clock_gettime_mono(&ts1);
1209 result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1211 clock_gettime_mono(&ts2);
1212 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1214 if (timediff > audit_timeout) {
1215 smb_time_audit_log("get_real_filename", timediff);
1221 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1225 struct timespec ts1,ts2;
1228 clock_gettime_mono(&ts1);
1229 result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1230 clock_gettime_mono(&ts2);
1231 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1233 if (timediff > audit_timeout) {
1234 smb_time_audit_log("connectpath", timediff);
1240 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1241 struct byte_range_lock *br_lck,
1242 struct lock_struct *plock,
1244 struct blocking_lock_record *blr)
1247 struct timespec ts1,ts2;
1250 clock_gettime_mono(&ts1);
1251 result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1252 blocking_lock, blr);
1253 clock_gettime_mono(&ts2);
1254 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1256 if (timediff > audit_timeout) {
1257 smb_time_audit_log("brl_lock_windows", timediff);
1263 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1264 struct messaging_context *msg_ctx,
1265 struct byte_range_lock *br_lck,
1266 const struct lock_struct *plock)
1269 struct timespec ts1,ts2;
1272 clock_gettime_mono(&ts1);
1273 result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1275 clock_gettime_mono(&ts2);
1276 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1278 if (timediff > audit_timeout) {
1279 smb_time_audit_log("brl_unlock_windows", timediff);
1285 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1286 struct byte_range_lock *br_lck,
1287 struct lock_struct *plock,
1288 struct blocking_lock_record *blr)
1291 struct timespec ts1,ts2;
1294 clock_gettime_mono(&ts1);
1295 result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock, blr);
1296 clock_gettime_mono(&ts2);
1297 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1299 if (timediff > audit_timeout) {
1300 smb_time_audit_log("brl_cancel_windows", timediff);
1306 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1307 struct files_struct *fsp,
1308 struct lock_struct *plock)
1311 struct timespec ts1,ts2;
1314 clock_gettime_mono(&ts1);
1315 result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1316 clock_gettime_mono(&ts2);
1317 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1319 if (timediff > audit_timeout) {
1320 smb_time_audit_log("strict_lock", timediff);
1326 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1327 struct files_struct *fsp,
1328 struct lock_struct *plock)
1330 struct timespec ts1,ts2;
1333 clock_gettime_mono(&ts1);
1334 SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1335 clock_gettime_mono(&ts2);
1336 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1338 if (timediff > audit_timeout) {
1339 smb_time_audit_log("strict_unlock", timediff);
1345 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1347 enum vfs_translate_direction direction,
1348 TALLOC_CTX *mem_ctx,
1352 struct timespec ts1,ts2;
1355 clock_gettime_mono(&ts1);
1356 result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1358 clock_gettime_mono(&ts2);
1359 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1361 if (timediff > audit_timeout) {
1362 smb_time_audit_log("translate_name", timediff);
1368 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
1370 uint32 security_info,
1371 struct security_descriptor **ppdesc)
1374 struct timespec ts1,ts2;
1377 clock_gettime_mono(&ts1);
1378 result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
1379 clock_gettime_mono(&ts2);
1380 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382 if (timediff > audit_timeout) {
1383 smb_time_audit_log("fget_nt_acl", timediff);
1389 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
1391 uint32 security_info,
1392 struct security_descriptor **ppdesc)
1395 struct timespec ts1,ts2;
1398 clock_gettime_mono(&ts1);
1399 result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
1400 clock_gettime_mono(&ts2);
1401 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1403 if (timediff > audit_timeout) {
1404 smb_time_audit_log("get_nt_acl", timediff);
1410 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
1412 uint32 security_info_sent,
1413 const struct security_descriptor *psd)
1416 struct timespec ts1,ts2;
1419 clock_gettime_mono(&ts1);
1420 result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
1422 clock_gettime_mono(&ts2);
1423 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1425 if (timediff > audit_timeout) {
1426 smb_time_audit_log("fset_nt_acl", timediff);
1432 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
1433 const char *path, mode_t mode)
1436 struct timespec ts1,ts2;
1439 clock_gettime_mono(&ts1);
1440 result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1441 clock_gettime_mono(&ts2);
1442 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1444 if (timediff > audit_timeout) {
1445 smb_time_audit_log("chmod_acl", timediff);
1451 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
1452 files_struct *fsp, mode_t mode)
1455 struct timespec ts1,ts2;
1458 clock_gettime_mono(&ts1);
1459 result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1460 clock_gettime_mono(&ts2);
1461 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1463 if (timediff > audit_timeout) {
1464 smb_time_audit_log("fchmod_acl", timediff);
1470 static int smb_time_audit_sys_acl_get_entry(vfs_handle_struct *handle,
1471 SMB_ACL_T theacl, int entry_id,
1472 SMB_ACL_ENTRY_T *entry_p)
1475 struct timespec ts1,ts2;
1478 clock_gettime_mono(&ts1);
1479 result = SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, theacl, entry_id,
1481 clock_gettime_mono(&ts2);
1482 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1484 if (timediff > audit_timeout) {
1485 smb_time_audit_log("sys_acl_get_entry", timediff);
1491 static int smb_time_audit_sys_acl_get_tag_type(vfs_handle_struct *handle,
1492 SMB_ACL_ENTRY_T entry_d,
1493 SMB_ACL_TAG_T *tag_type_p)
1496 struct timespec ts1,ts2;
1499 clock_gettime_mono(&ts1);
1500 result = SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, entry_d,
1502 clock_gettime_mono(&ts2);
1503 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1505 if (timediff > audit_timeout) {
1506 smb_time_audit_log("sys_acl_get_tag_type", timediff);
1512 static int smb_time_audit_sys_acl_get_permset(vfs_handle_struct *handle,
1513 SMB_ACL_ENTRY_T entry_d,
1514 SMB_ACL_PERMSET_T *permset_p)
1517 struct timespec ts1,ts2;
1520 clock_gettime_mono(&ts1);
1521 result = SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, entry_d,
1523 clock_gettime_mono(&ts2);
1524 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1526 if (timediff > audit_timeout) {
1527 smb_time_audit_log("sys_acl_get_permset", timediff);
1533 static void * smb_time_audit_sys_acl_get_qualifier(vfs_handle_struct *handle,
1534 SMB_ACL_ENTRY_T entry_d)
1537 struct timespec ts1,ts2;
1540 clock_gettime_mono(&ts1);
1541 result = SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, entry_d);
1542 clock_gettime_mono(&ts2);
1543 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1545 if (timediff > audit_timeout) {
1546 smb_time_audit_log("sys_acl_get_qualifier", timediff);
1552 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
1554 SMB_ACL_TYPE_T type)
1557 struct timespec ts1,ts2;
1560 clock_gettime_mono(&ts1);
1561 result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
1562 clock_gettime_mono(&ts2);
1563 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1565 if (timediff > audit_timeout) {
1566 smb_time_audit_log("sys_acl_get_file", timediff);
1572 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
1576 struct timespec ts1,ts2;
1579 clock_gettime_mono(&ts1);
1580 result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
1581 clock_gettime_mono(&ts2);
1582 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1584 if (timediff > audit_timeout) {
1585 smb_time_audit_log("sys_acl_get_fd", timediff);
1591 static int smb_time_audit_sys_acl_clear_perms(vfs_handle_struct *handle,
1592 SMB_ACL_PERMSET_T permset)
1595 struct timespec ts1,ts2;
1598 clock_gettime_mono(&ts1);
1599 result = SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, permset);
1600 clock_gettime_mono(&ts2);
1601 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1603 if (timediff > audit_timeout) {
1604 smb_time_audit_log("sys_acl_clear_perms", timediff);
1610 static int smb_time_audit_sys_acl_add_perm(vfs_handle_struct *handle,
1611 SMB_ACL_PERMSET_T permset,
1612 SMB_ACL_PERM_T perm)
1615 struct timespec ts1,ts2;
1618 clock_gettime_mono(&ts1);
1619 result = SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, permset, perm);
1620 clock_gettime_mono(&ts2);
1621 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1623 if (timediff > audit_timeout) {
1624 smb_time_audit_log("sys_acl_add_perm", timediff);
1630 static char * smb_time_audit_sys_acl_to_text(vfs_handle_struct *handle,
1635 struct timespec ts1,ts2;
1638 clock_gettime_mono(&ts1);
1639 result = SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, theacl, plen);
1640 clock_gettime_mono(&ts2);
1641 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1643 if (timediff > audit_timeout) {
1644 smb_time_audit_log("sys_acl_to_text", timediff);
1650 static SMB_ACL_T smb_time_audit_sys_acl_init(vfs_handle_struct *handle,
1654 struct timespec ts1,ts2;
1657 clock_gettime_mono(&ts1);
1658 result = SMB_VFS_NEXT_SYS_ACL_INIT(handle, count);
1659 clock_gettime_mono(&ts2);
1660 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1662 if (timediff > audit_timeout) {
1663 smb_time_audit_log("sys_acl_init", timediff);
1669 static int smb_time_audit_sys_acl_create_entry(vfs_handle_struct *handle,
1671 SMB_ACL_ENTRY_T *pentry)
1674 struct timespec ts1,ts2;
1677 clock_gettime_mono(&ts1);
1678 result = SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, pacl, pentry);
1679 clock_gettime_mono(&ts2);
1680 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1682 if (timediff > audit_timeout) {
1683 smb_time_audit_log("sys_acl_create_entry", timediff);
1689 static int smb_time_audit_sys_acl_set_tag_type(vfs_handle_struct *handle,
1690 SMB_ACL_ENTRY_T entry,
1691 SMB_ACL_TAG_T tagtype)
1694 struct timespec ts1,ts2;
1697 clock_gettime_mono(&ts1);
1698 result = SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, entry,
1700 clock_gettime_mono(&ts2);
1701 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1703 if (timediff > audit_timeout) {
1704 smb_time_audit_log("sys_acl_set_tag_type", timediff);
1710 static int smb_time_audit_sys_acl_set_qualifier(vfs_handle_struct *handle,
1711 SMB_ACL_ENTRY_T entry,
1715 struct timespec ts1,ts2;
1718 clock_gettime_mono(&ts1);
1719 result = SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, entry, qual);
1720 clock_gettime_mono(&ts2);
1721 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1723 if (timediff > audit_timeout) {
1724 smb_time_audit_log("sys_acl_set_qualifier", timediff);
1730 static int smb_time_audit_sys_acl_set_permset(vfs_handle_struct *handle,
1731 SMB_ACL_ENTRY_T entry,
1732 SMB_ACL_PERMSET_T permset)
1735 struct timespec ts1,ts2;
1738 clock_gettime_mono(&ts1);
1739 result = SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, entry, permset);
1740 clock_gettime_mono(&ts2);
1741 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1743 if (timediff > audit_timeout) {
1744 smb_time_audit_log("sys_acl_set_permset", timediff);
1750 static int smb_time_audit_sys_acl_valid(vfs_handle_struct *handle,
1754 struct timespec ts1,ts2;
1757 clock_gettime_mono(&ts1);
1758 result = SMB_VFS_NEXT_SYS_ACL_VALID(handle, theacl);
1759 clock_gettime_mono(&ts2);
1760 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1762 if (timediff > audit_timeout) {
1763 smb_time_audit_log("sys_acl_valid", timediff);
1769 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
1771 SMB_ACL_TYPE_T acltype,
1775 struct timespec ts1,ts2;
1778 clock_gettime_mono(&ts1);
1779 result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
1781 clock_gettime_mono(&ts2);
1782 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1784 if (timediff > audit_timeout) {
1785 smb_time_audit_log("sys_acl_set_file", timediff);
1791 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
1796 struct timespec ts1,ts2;
1799 clock_gettime_mono(&ts1);
1800 result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
1801 clock_gettime_mono(&ts2);
1802 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1804 if (timediff > audit_timeout) {
1805 smb_time_audit_log("sys_acl_set_fd", timediff);
1811 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
1815 struct timespec ts1,ts2;
1818 clock_gettime_mono(&ts1);
1819 result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
1820 clock_gettime_mono(&ts2);
1821 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1823 if (timediff > audit_timeout) {
1824 smb_time_audit_log("sys_acl_delete_def_file", timediff);
1830 static int smb_time_audit_sys_acl_get_perm(vfs_handle_struct *handle,
1831 SMB_ACL_PERMSET_T permset,
1832 SMB_ACL_PERM_T perm)
1835 struct timespec ts1,ts2;
1838 clock_gettime_mono(&ts1);
1839 result = SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, permset, perm);
1840 clock_gettime_mono(&ts2);
1841 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1843 if (timediff > audit_timeout) {
1844 smb_time_audit_log("sys_acl_get_perm", timediff);
1850 static int smb_time_audit_sys_acl_free_text(vfs_handle_struct *handle,
1854 struct timespec ts1,ts2;
1857 clock_gettime_mono(&ts1);
1858 result = SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, text);
1859 clock_gettime_mono(&ts2);
1860 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1862 if (timediff > audit_timeout) {
1863 smb_time_audit_log("sys_acl_free_text", timediff);
1869 static int smb_time_audit_sys_acl_free_acl(vfs_handle_struct *handle,
1870 SMB_ACL_T posix_acl)
1873 struct timespec ts1,ts2;
1876 clock_gettime_mono(&ts1);
1877 result = SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, posix_acl);
1878 clock_gettime_mono(&ts2);
1879 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1881 if (timediff > audit_timeout) {
1882 smb_time_audit_log("sys_acl_free_acl", timediff);
1888 static int smb_time_audit_sys_acl_free_qualifier(vfs_handle_struct *handle,
1890 SMB_ACL_TAG_T tagtype)
1893 struct timespec ts1,ts2;
1896 clock_gettime_mono(&ts1);
1897 result = SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, qualifier,
1899 clock_gettime_mono(&ts2);
1900 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1902 if (timediff > audit_timeout) {
1903 smb_time_audit_log("sys_acl_free_qualifier", timediff);
1909 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
1910 const char *path, const char *name,
1911 void *value, size_t size)
1914 struct timespec ts1,ts2;
1917 clock_gettime_mono(&ts1);
1918 result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
1919 clock_gettime_mono(&ts2);
1920 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1922 if (timediff > audit_timeout) {
1923 smb_time_audit_log("getxattr", timediff);
1929 static ssize_t smb_time_audit_lgetxattr(struct vfs_handle_struct *handle,
1930 const char *path, const char *name,
1931 void *value, size_t size)
1934 struct timespec ts1,ts2;
1937 clock_gettime_mono(&ts1);
1938 result = SMB_VFS_NEXT_LGETXATTR(handle, path, name, value, size);
1939 clock_gettime_mono(&ts2);
1940 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1942 if (timediff > audit_timeout) {
1943 smb_time_audit_log("lgetxattr", timediff);
1949 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
1950 struct files_struct *fsp,
1951 const char *name, void *value,
1955 struct timespec ts1,ts2;
1958 clock_gettime_mono(&ts1);
1959 result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
1960 clock_gettime_mono(&ts2);
1961 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1963 if (timediff > audit_timeout) {
1964 smb_time_audit_log("fgetxattr", timediff);
1970 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
1971 const char *path, char *list,
1975 struct timespec ts1,ts2;
1978 clock_gettime_mono(&ts1);
1979 result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
1980 clock_gettime_mono(&ts2);
1981 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1983 if (timediff > audit_timeout) {
1984 smb_time_audit_log("listxattr", timediff);
1990 static ssize_t smb_time_audit_llistxattr(struct vfs_handle_struct *handle,
1991 const char *path, char *list,
1995 struct timespec ts1,ts2;
1998 clock_gettime_mono(&ts1);
1999 result = SMB_VFS_NEXT_LLISTXATTR(handle, path, list, size);
2000 clock_gettime_mono(&ts2);
2001 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2003 if (timediff > audit_timeout) {
2004 smb_time_audit_log("llistxattr", timediff);
2010 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2011 struct files_struct *fsp, char *list,
2015 struct timespec ts1,ts2;
2018 clock_gettime_mono(&ts1);
2019 result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2020 clock_gettime_mono(&ts2);
2021 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2023 if (timediff > audit_timeout) {
2024 smb_time_audit_log("flistxattr", timediff);
2030 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2031 const char *path, const char *name)
2034 struct timespec ts1,ts2;
2037 clock_gettime_mono(&ts1);
2038 result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2039 clock_gettime_mono(&ts2);
2040 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2042 if (timediff > audit_timeout) {
2043 smb_time_audit_log("removexattr", timediff);
2049 static int smb_time_audit_lremovexattr(struct vfs_handle_struct *handle,
2050 const char *path, const char *name)
2053 struct timespec ts1,ts2;
2056 clock_gettime_mono(&ts1);
2057 result = SMB_VFS_NEXT_LREMOVEXATTR(handle, path, name);
2058 clock_gettime_mono(&ts2);
2059 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2061 if (timediff > audit_timeout) {
2062 smb_time_audit_log("lremovexattr", timediff);
2068 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2069 struct files_struct *fsp,
2073 struct timespec ts1,ts2;
2076 clock_gettime_mono(&ts1);
2077 result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2078 clock_gettime_mono(&ts2);
2079 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2081 if (timediff > audit_timeout) {
2082 smb_time_audit_log("fremovexattr", timediff);
2088 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2089 const char *path, const char *name,
2090 const void *value, size_t size,
2094 struct timespec ts1,ts2;
2097 clock_gettime_mono(&ts1);
2098 result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2100 clock_gettime_mono(&ts2);
2101 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2103 if (timediff > audit_timeout) {
2104 smb_time_audit_log("setxattr", timediff);
2110 static int smb_time_audit_lsetxattr(struct vfs_handle_struct *handle,
2111 const char *path, const char *name,
2112 const void *value, size_t size,
2116 struct timespec ts1,ts2;
2119 clock_gettime_mono(&ts1);
2120 result = SMB_VFS_NEXT_LSETXATTR(handle, path, name, value, size,
2122 clock_gettime_mono(&ts2);
2123 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2125 if (timediff > audit_timeout) {
2126 smb_time_audit_log("lsetxattr", timediff);
2132 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2133 struct files_struct *fsp, const char *name,
2134 const void *value, size_t size, int flags)
2137 struct timespec ts1,ts2;
2140 clock_gettime_mono(&ts1);
2141 result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2142 clock_gettime_mono(&ts2);
2143 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2145 if (timediff > audit_timeout) {
2146 smb_time_audit_log("fsetxattr", timediff);
2152 static int smb_time_audit_aio_read(struct vfs_handle_struct *handle,
2153 struct files_struct *fsp,
2154 SMB_STRUCT_AIOCB *aiocb)
2157 struct timespec ts1,ts2;
2160 clock_gettime_mono(&ts1);
2161 result = SMB_VFS_NEXT_AIO_READ(handle, fsp, aiocb);
2162 clock_gettime_mono(&ts2);
2163 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2165 if (timediff > audit_timeout) {
2166 smb_time_audit_log("aio_read", timediff);
2172 static int smb_time_audit_aio_write(struct vfs_handle_struct *handle,
2173 struct files_struct *fsp,
2174 SMB_STRUCT_AIOCB *aiocb)
2177 struct timespec ts1,ts2;
2180 clock_gettime_mono(&ts1);
2181 result = SMB_VFS_NEXT_AIO_WRITE(handle, fsp, aiocb);
2182 clock_gettime_mono(&ts2);
2183 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2185 if (timediff > audit_timeout) {
2186 smb_time_audit_log("aio_write", timediff);
2192 static ssize_t smb_time_audit_aio_return(struct vfs_handle_struct *handle,
2193 struct files_struct *fsp,
2194 SMB_STRUCT_AIOCB *aiocb)
2197 struct timespec ts1,ts2;
2200 clock_gettime_mono(&ts1);
2201 result = SMB_VFS_NEXT_AIO_RETURN(handle, fsp, aiocb);
2202 clock_gettime_mono(&ts2);
2203 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2205 if (timediff > audit_timeout) {
2206 smb_time_audit_log("aio_return", timediff);
2212 static int smb_time_audit_aio_cancel(struct vfs_handle_struct *handle,
2213 struct files_struct *fsp,
2214 SMB_STRUCT_AIOCB *aiocb)
2217 struct timespec ts1,ts2;
2220 clock_gettime_mono(&ts1);
2221 result = SMB_VFS_NEXT_AIO_CANCEL(handle, fsp, aiocb);
2222 clock_gettime_mono(&ts2);
2223 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2225 if (timediff > audit_timeout) {
2226 smb_time_audit_log("aio_cancel", timediff);
2232 static int smb_time_audit_aio_error(struct vfs_handle_struct *handle,
2233 struct files_struct *fsp,
2234 SMB_STRUCT_AIOCB *aiocb)
2237 struct timespec ts1,ts2;
2240 clock_gettime_mono(&ts1);
2241 result = SMB_VFS_NEXT_AIO_ERROR(handle, fsp, aiocb);
2242 clock_gettime_mono(&ts2);
2243 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2245 if (timediff > audit_timeout) {
2246 smb_time_audit_log("aio_error", timediff);
2252 static int smb_time_audit_aio_fsync(struct vfs_handle_struct *handle,
2253 struct files_struct *fsp, int op,
2254 SMB_STRUCT_AIOCB *aiocb)
2257 struct timespec ts1,ts2;
2260 clock_gettime_mono(&ts1);
2261 result = SMB_VFS_NEXT_AIO_FSYNC(handle, fsp, op, aiocb);
2262 clock_gettime_mono(&ts2);
2263 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2265 if (timediff > audit_timeout) {
2266 smb_time_audit_log("aio_fsync", timediff);
2272 static int smb_time_audit_aio_suspend(struct vfs_handle_struct *handle,
2273 struct files_struct *fsp,
2274 const SMB_STRUCT_AIOCB * const aiocb[],
2275 int n, const struct timespec *ts)
2278 struct timespec ts1,ts2;
2281 clock_gettime_mono(&ts1);
2282 result = SMB_VFS_NEXT_AIO_SUSPEND(handle, fsp, aiocb, n, ts);
2283 clock_gettime_mono(&ts2);
2284 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2286 if (timediff > audit_timeout) {
2287 smb_time_audit_log("aio_suspend", timediff);
2293 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2294 struct files_struct *fsp)
2297 struct timespec ts1,ts2;
2300 clock_gettime_mono(&ts1);
2301 result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2302 clock_gettime_mono(&ts2);
2303 timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2305 if (timediff > audit_timeout) {
2306 smb_time_audit_log("aio_force", timediff);
2314 /* VFS operations */
2316 static struct vfs_fn_pointers vfs_time_audit_fns = {
2317 .connect_fn = smb_time_audit_connect,
2318 .disconnect = smb_time_audit_disconnect,
2319 .disk_free = smb_time_audit_disk_free,
2320 .get_quota = smb_time_audit_get_quota,
2321 .set_quota = smb_time_audit_set_quota,
2322 .get_shadow_copy_data = smb_time_audit_get_shadow_copy_data,
2323 .statvfs = smb_time_audit_statvfs,
2324 .fs_capabilities = smb_time_audit_fs_capabilities,
2325 .opendir = smb_time_audit_opendir,
2326 .readdir = smb_time_audit_readdir,
2327 .seekdir = smb_time_audit_seekdir,
2328 .telldir = smb_time_audit_telldir,
2329 .rewind_dir = smb_time_audit_rewinddir,
2330 .mkdir = smb_time_audit_mkdir,
2331 .rmdir = smb_time_audit_rmdir,
2332 .closedir = smb_time_audit_closedir,
2333 .init_search_op = smb_time_audit_init_search_op,
2334 .open = smb_time_audit_open,
2335 .create_file = smb_time_audit_create_file,
2336 .close_fn = smb_time_audit_close,
2337 .vfs_read = smb_time_audit_read,
2338 .pread = smb_time_audit_pread,
2339 .write = smb_time_audit_write,
2340 .pwrite = smb_time_audit_pwrite,
2341 .lseek = smb_time_audit_lseek,
2342 .sendfile = smb_time_audit_sendfile,
2343 .recvfile = smb_time_audit_recvfile,
2344 .rename = smb_time_audit_rename,
2345 .fsync = smb_time_audit_fsync,
2346 .stat = smb_time_audit_stat,
2347 .fstat = smb_time_audit_fstat,
2348 .lstat = smb_time_audit_lstat,
2349 .get_alloc_size = smb_time_audit_get_alloc_size,
2350 .unlink = smb_time_audit_unlink,
2351 .chmod = smb_time_audit_chmod,
2352 .fchmod = smb_time_audit_fchmod,
2353 .chown = smb_time_audit_chown,
2354 .fchown = smb_time_audit_fchown,
2355 .lchown = smb_time_audit_lchown,
2356 .chdir = smb_time_audit_chdir,
2357 .getwd = smb_time_audit_getwd,
2358 .ntimes = smb_time_audit_ntimes,
2359 .ftruncate = smb_time_audit_ftruncate,
2360 .posix_fallocate = smb_time_audit_posix_fallocate,
2361 .lock = smb_time_audit_lock,
2362 .kernel_flock = smb_time_audit_kernel_flock,
2363 .linux_setlease = smb_time_audit_linux_setlease,
2364 .getlock = smb_time_audit_getlock,
2365 .symlink = smb_time_audit_symlink,
2366 .vfs_readlink = smb_time_audit_readlink,
2367 .link = smb_time_audit_link,
2368 .mknod = smb_time_audit_mknod,
2369 .realpath = smb_time_audit_realpath,
2370 .notify_watch = smb_time_audit_notify_watch,
2371 .chflags = smb_time_audit_chflags,
2372 .file_id_create = smb_time_audit_file_id_create,
2373 .streaminfo = smb_time_audit_streaminfo,
2374 .get_real_filename = smb_time_audit_get_real_filename,
2375 .connectpath = smb_time_audit_connectpath,
2376 .brl_lock_windows = smb_time_audit_brl_lock_windows,
2377 .brl_unlock_windows = smb_time_audit_brl_unlock_windows,
2378 .brl_cancel_windows = smb_time_audit_brl_cancel_windows,
2379 .strict_lock = smb_time_audit_strict_lock,
2380 .strict_unlock = smb_time_audit_strict_unlock,
2381 .translate_name = smb_time_audit_translate_name,
2382 .fget_nt_acl = smb_time_audit_fget_nt_acl,
2383 .get_nt_acl = smb_time_audit_get_nt_acl,
2384 .fset_nt_acl = smb_time_audit_fset_nt_acl,
2385 .chmod_acl = smb_time_audit_chmod_acl,
2386 .fchmod_acl = smb_time_audit_fchmod_acl,
2387 .sys_acl_get_entry = smb_time_audit_sys_acl_get_entry,
2388 .sys_acl_get_tag_type = smb_time_audit_sys_acl_get_tag_type,
2389 .sys_acl_get_permset = smb_time_audit_sys_acl_get_permset,
2390 .sys_acl_get_qualifier = smb_time_audit_sys_acl_get_qualifier,
2391 .sys_acl_get_file = smb_time_audit_sys_acl_get_file,
2392 .sys_acl_get_fd = smb_time_audit_sys_acl_get_fd,
2393 .sys_acl_clear_perms = smb_time_audit_sys_acl_clear_perms,
2394 .sys_acl_add_perm = smb_time_audit_sys_acl_add_perm,
2395 .sys_acl_to_text = smb_time_audit_sys_acl_to_text,
2396 .sys_acl_init = smb_time_audit_sys_acl_init,
2397 .sys_acl_create_entry = smb_time_audit_sys_acl_create_entry,
2398 .sys_acl_set_tag_type = smb_time_audit_sys_acl_set_tag_type,
2399 .sys_acl_set_qualifier = smb_time_audit_sys_acl_set_qualifier,
2400 .sys_acl_set_permset = smb_time_audit_sys_acl_set_permset,
2401 .sys_acl_valid = smb_time_audit_sys_acl_valid,
2402 .sys_acl_set_file = smb_time_audit_sys_acl_set_file,
2403 .sys_acl_set_fd = smb_time_audit_sys_acl_set_fd,
2404 .sys_acl_delete_def_file = smb_time_audit_sys_acl_delete_def_file,
2405 .sys_acl_get_perm = smb_time_audit_sys_acl_get_perm,
2406 .sys_acl_free_text = smb_time_audit_sys_acl_free_text,
2407 .sys_acl_free_acl = smb_time_audit_sys_acl_free_acl,
2408 .sys_acl_free_qualifier = smb_time_audit_sys_acl_free_qualifier,
2409 .getxattr = smb_time_audit_getxattr,
2410 .lgetxattr = smb_time_audit_lgetxattr,
2411 .fgetxattr = smb_time_audit_fgetxattr,
2412 .listxattr = smb_time_audit_listxattr,
2413 .llistxattr = smb_time_audit_llistxattr,
2414 .flistxattr = smb_time_audit_flistxattr,
2415 .removexattr = smb_time_audit_removexattr,
2416 .lremovexattr = smb_time_audit_lremovexattr,
2417 .fremovexattr = smb_time_audit_fremovexattr,
2418 .setxattr = smb_time_audit_setxattr,
2419 .lsetxattr = smb_time_audit_lsetxattr,
2420 .fsetxattr = smb_time_audit_fsetxattr,
2421 .aio_read = smb_time_audit_aio_read,
2422 .aio_write = smb_time_audit_aio_write,
2423 .aio_return_fn = smb_time_audit_aio_return,
2424 .aio_cancel = smb_time_audit_aio_cancel,
2425 .aio_error_fn = smb_time_audit_aio_error,
2426 .aio_fsync = smb_time_audit_aio_fsync,
2427 .aio_suspend = smb_time_audit_aio_suspend,
2428 .aio_force = smb_time_audit_aio_force,
2432 NTSTATUS vfs_time_audit_init(void);
2433 NTSTATUS vfs_time_audit_init(void)
2435 audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2437 return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2438 &vfs_time_audit_fns);