LCOV - code coverage report
Current view: top level - source3/modules - vfs_extd_audit.c (source / functions) Hit Total Coverage
Test: coverage report for abartlet/fix-coverage dd10fb34 Lines: 7 106 6.6 %
Date: 2021-09-23 10:06:22 Functions: 1 11 9.1 %

          Line data    Source code
       1             : /* 
       2             :  * Auditing VFS module for samba.  Log selected file operations to syslog
       3             :  * facility.
       4             :  *
       5             :  * Copyright (C) Tim Potter, 1999-2000
       6             :  * Copyright (C) Alexander Bokovoy, 2002
       7             :  * Copyright (C) John H Terpstra, 2003
       8             :  * Copyright (C) Stefan (metze) Metzmacher, 2003
       9             :  *
      10             :  * This program is free software; you can redistribute it and/or modify
      11             :  * it under the terms of the GNU General Public License as published by
      12             :  * the Free Software Foundation; either version 3 of the License, or
      13             :  * (at your option) any later version.
      14             :  *  
      15             :  * This program is distributed in the hope that it will be useful,
      16             :  * but WITHOUT ANY WARRANTY; without even the implied warranty of
      17             :  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      18             :  * GNU General Public License for more details.
      19             :  *  
      20             :  * You should have received a copy of the GNU General Public License
      21             :  * along with this program; if not, see <http://www.gnu.org/licenses/>.
      22             :  */
      23             : 
      24             : 
      25             : #include "includes.h"
      26             : #include "system/filesys.h"
      27             : #include "system/syslog.h"
      28             : #include "smbd/smbd.h"
      29             : #include "lib/param/loadparm.h"
      30             : 
      31             : static int vfs_extd_audit_debug_level = DBGC_VFS;
      32             : 
      33             : #undef DBGC_CLASS
      34             : #define DBGC_CLASS vfs_extd_audit_debug_level
      35             : 
      36           0 : static int audit_syslog_facility(vfs_handle_struct *handle)
      37             : {
      38             :         static const struct enum_list enum_log_facilities[] = {
      39             : #ifdef LOG_AUTH
      40             :                 { LOG_AUTH,             "AUTH" },
      41             : #endif
      42             : #ifdef LOG_AUTHPRIV
      43             :                 { LOG_AUTHPRIV,         "AUTHPRIV" },
      44             : #endif
      45             : #ifdef LOG_AUDIT
      46             :                 { LOG_AUDIT,            "AUDIT" },
      47             : #endif
      48             : #ifdef LOG_CONSOLE
      49             :                 { LOG_CONSOLE,          "CONSOLE" },
      50             : #endif
      51             : #ifdef LOG_CRON
      52             :                 { LOG_CRON,             "CRON" },
      53             : #endif
      54             : #ifdef LOG_DAEMON
      55             :                 { LOG_DAEMON,           "DAEMON" },
      56             : #endif
      57             : #ifdef LOG_FTP
      58             :                 { LOG_FTP,              "FTP" },
      59             : #endif
      60             : #ifdef LOG_INSTALL
      61             :                 { LOG_INSTALL,          "INSTALL" },
      62             : #endif
      63             : #ifdef LOG_KERN
      64             :                 { LOG_KERN,             "KERN" },
      65             : #endif
      66             : #ifdef LOG_LAUNCHD
      67             :                 { LOG_LAUNCHD,          "LAUNCHD" },
      68             : #endif
      69             : #ifdef LOG_LFMT
      70             :                 { LOG_LFMT,             "LFMT" },
      71             : #endif
      72             : #ifdef LOG_LPR
      73             :                 { LOG_LPR,              "LPR" },
      74             : #endif
      75             : #ifdef LOG_MAIL
      76             :                 { LOG_MAIL,             "MAIL" },
      77             : #endif
      78             : #ifdef LOG_MEGASAFE
      79             :                 { LOG_MEGASAFE,         "MEGASAFE" },
      80             : #endif
      81             : #ifdef LOG_NETINFO
      82             :                 { LOG_NETINFO,          "NETINFO" },
      83             : #endif
      84             : #ifdef LOG_NEWS
      85             :                 { LOG_NEWS,             "NEWS" },
      86             : #endif
      87             : #ifdef LOG_NFACILITIES
      88             :                 { LOG_NFACILITIES,      "NFACILITIES" },
      89             : #endif
      90             : #ifdef LOG_NTP
      91             :                 { LOG_NTP,              "NTP" },
      92             : #endif
      93             : #ifdef LOG_RAS
      94             :                 { LOG_RAS,              "RAS" },
      95             : #endif
      96             : #ifdef LOG_REMOTEAUTH
      97             :                 { LOG_REMOTEAUTH,       "REMOTEAUTH" },
      98             : #endif
      99             : #ifdef LOG_SECURITY
     100             :                 { LOG_SECURITY,         "SECURITY" },
     101             : #endif
     102             : #ifdef LOG_SYSLOG
     103             :                 { LOG_SYSLOG,           "SYSLOG" },
     104             : #endif
     105             : #ifdef LOG_USER
     106             :                 { LOG_USER,             "USER" },
     107             : #endif
     108             : #ifdef LOG_UUCP
     109             :                 { LOG_UUCP,             "UUCP" },
     110             : #endif
     111             :                 { LOG_LOCAL0,           "LOCAL0" },
     112             :                 { LOG_LOCAL1,           "LOCAL1" },
     113             :                 { LOG_LOCAL2,           "LOCAL2" },
     114             :                 { LOG_LOCAL3,           "LOCAL3" },
     115             :                 { LOG_LOCAL4,           "LOCAL4" },
     116             :                 { LOG_LOCAL5,           "LOCAL5" },
     117             :                 { LOG_LOCAL6,           "LOCAL6" },
     118             :                 { LOG_LOCAL7,           "LOCAL7" },
     119             :                 { -1,                   NULL }
     120             :         };
     121             : 
     122             :         int facility;
     123             : 
     124           0 :         facility = lp_parm_enum(SNUM(handle->conn), "extd_audit", "facility", enum_log_facilities, LOG_USER);
     125             : 
     126           0 :         return facility;
     127             : }
     128             : 
     129             : 
     130           0 : static int audit_syslog_priority(vfs_handle_struct *handle)
     131             : {
     132             :         static const struct enum_list enum_log_priorities[] = {
     133             :                 { LOG_EMERG, "EMERG" },
     134             :                 { LOG_ALERT, "ALERT" },
     135             :                 { LOG_CRIT, "CRIT" },
     136             :                 { LOG_ERR, "ERR" },
     137             :                 { LOG_WARNING, "WARNING" },
     138             :                 { LOG_NOTICE, "NOTICE" },
     139             :                 { LOG_INFO, "INFO" },
     140             :                 { LOG_DEBUG, "DEBUG" },
     141             :                 { -1, NULL }
     142             :         };
     143             : 
     144             :         int priority;
     145             : 
     146           0 :         priority = lp_parm_enum(SNUM(handle->conn), "extd_audit", "priority",
     147             :                                 enum_log_priorities, LOG_NOTICE);
     148           0 :         if (priority == -1) {
     149           0 :                 priority = LOG_WARNING;
     150             :         }
     151             : 
     152           0 :         return priority;
     153             : }
     154             : 
     155             : /* Implementation of vfs_ops.  Pass everything on to the default
     156             :    operation but log event first. */
     157             : 
     158           0 : static int audit_connect(vfs_handle_struct *handle, const char *svc, const char *user)
     159             : {
     160           0 :         int result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
     161             : 
     162           0 :         if (result < 0) {
     163           0 :                 return result;
     164             :         }
     165             : 
     166           0 :         openlog("smbd_audit", LOG_PID, audit_syslog_facility(handle));
     167             : 
     168           0 :         if (lp_syslog() > 0) {
     169           0 :                 syslog(audit_syslog_priority(handle),
     170             :                        "connect to service %s by user %s\n",
     171             :                        svc, user);
     172             :         }
     173           0 :         DEBUG(10, ("Connected to service %s as user %s\n",
     174             :                svc, user));
     175             : 
     176           0 :         return 0;
     177             : }
     178             : 
     179           0 : static void audit_disconnect(vfs_handle_struct *handle)
     180             : {
     181           0 :         if (lp_syslog() > 0) {
     182           0 :                 syslog(audit_syslog_priority(handle), "disconnected\n");
     183             :         }
     184           0 :         DEBUG(10, ("Disconnected from VFS module extd_audit\n"));
     185           0 :         SMB_VFS_NEXT_DISCONNECT(handle);
     186             : 
     187           0 :         return;
     188             : }
     189             : 
     190           0 : static int audit_mkdirat(vfs_handle_struct *handle,
     191             :                         struct files_struct *dirfsp,
     192             :                         const struct smb_filename *smb_fname,
     193             :                         mode_t mode)
     194             : {
     195           0 :         struct smb_filename *full_fname = NULL;
     196             :         int result;
     197             : 
     198           0 :         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
     199             :                                                   dirfsp,
     200             :                                                   smb_fname);
     201           0 :         if (full_fname == NULL) {
     202           0 :                 errno = ENOMEM;
     203           0 :                 return -1;
     204             :         }
     205             : 
     206           0 :         result = SMB_VFS_NEXT_MKDIRAT(handle,
     207             :                         dirfsp,
     208             :                         smb_fname,
     209             :                         mode);
     210             : 
     211           0 :         if (lp_syslog() > 0) {
     212           0 :                 syslog(audit_syslog_priority(handle), "mkdirat %s %s%s\n",
     213             :                        full_fname->base_name,
     214             :                        (result < 0) ? "failed: " : "",
     215           0 :                        (result < 0) ? strerror(errno) : "");
     216             :         }
     217           0 :         DEBUG(0, ("vfs_extd_audit: mkdirat %s %s %s\n",
     218             :                full_fname->base_name,
     219             :                (result < 0) ? "failed: " : "",
     220             :                (result < 0) ? strerror(errno) : ""));
     221             : 
     222           0 :         TALLOC_FREE(full_fname);
     223           0 :         return result;
     224             : }
     225             : 
     226           0 : static int audit_openat(vfs_handle_struct *handle,
     227             :                         const struct files_struct *dirfsp,
     228             :                         const struct smb_filename *smb_fname,
     229             :                         files_struct *fsp,
     230             :                         int flags,
     231             :                         mode_t mode)
     232             : {
     233             :         int ret;
     234             : 
     235           0 :         ret = SMB_VFS_NEXT_OPENAT(handle, dirfsp, smb_fname, fsp, flags, mode);
     236             : 
     237           0 :         if (lp_syslog() > 0) {
     238           0 :                 syslog(audit_syslog_priority(handle),
     239             :                        "openat %s/%s (fd %d) %s%s%s\n",
     240           0 :                        smb_fname_str_dbg(fsp->fsp_name),
     241             :                        smb_fname->base_name,
     242             :                        ret,
     243           0 :                        ((flags & O_WRONLY) || (flags & O_RDWR)) ?
     244             :                        "for writing " : "",
     245             :                        (ret < 0) ? "failed: " : "",
     246           0 :                        (ret < 0) ? strerror(errno) : "");
     247             :         }
     248           0 :         DEBUG(2, ("vfs_extd_audit: open %s/%s %s %s\n",
     249             :                smb_fname_str_dbg(fsp->fsp_name),
     250             :                smb_fname_str_dbg(smb_fname),
     251             :                (ret < 0) ? "failed: " : "",
     252             :                (ret < 0) ? strerror(errno) : ""));
     253             : 
     254           0 :         return ret;
     255             : }
     256             : 
     257           0 : static int audit_close(vfs_handle_struct *handle, files_struct *fsp)
     258             : {
     259             :         int result;
     260             : 
     261           0 :         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
     262             : 
     263           0 :         if (lp_syslog() > 0) {
     264           0 :                 syslog(audit_syslog_priority(handle), "close fd %d %s%s\n",
     265             :                        fsp_get_pathref_fd(fsp),
     266             :                        (result < 0) ? "failed: " : "",
     267           0 :                        (result < 0) ? strerror(errno) : "");
     268             :         }
     269           0 :         DEBUG(2, ("vfs_extd_audit: close fd %d %s %s\n",
     270             :                fsp_get_pathref_fd(fsp),
     271             :                (result < 0) ? "failed: " : "",
     272             :                (result < 0) ? strerror(errno) : ""));
     273             : 
     274           0 :         return result;
     275             : }
     276             : 
     277           0 : static int audit_renameat(vfs_handle_struct *handle,
     278             :                         files_struct *srcfsp,
     279             :                         const struct smb_filename *smb_fname_src,
     280             :                         files_struct *dstfsp,
     281             :                         const struct smb_filename *smb_fname_dst)
     282             : {
     283           0 :         struct smb_filename *full_fname_src = NULL;
     284           0 :         struct smb_filename *full_fname_dst = NULL;
     285             :         int result;
     286           0 :         int saved_errno = 0;
     287             : 
     288           0 :         full_fname_src = full_path_from_dirfsp_atname(talloc_tos(),
     289             :                                                       srcfsp,
     290             :                                                       smb_fname_src);
     291           0 :         if (full_fname_src == NULL) {
     292           0 :                 errno = ENOMEM;
     293           0 :                 return -1;
     294             :         }
     295             : 
     296           0 :         full_fname_dst = full_path_from_dirfsp_atname(talloc_tos(),
     297             :                                                       dstfsp,
     298             :                                                       smb_fname_dst);
     299           0 :         if (full_fname_dst == NULL) {
     300           0 :                 TALLOC_FREE(full_fname_src);
     301           0 :                 errno = ENOMEM;
     302           0 :                 return -1;
     303             :         }
     304             : 
     305           0 :         result = SMB_VFS_NEXT_RENAMEAT(handle,
     306             :                         srcfsp,
     307             :                         smb_fname_src,
     308             :                         dstfsp,
     309             :                         smb_fname_dst);
     310           0 :         if (result == -1) {
     311           0 :                 saved_errno = errno;
     312             :         }
     313           0 :         if (lp_syslog() > 0) {
     314           0 :                 syslog(audit_syslog_priority(handle), "renameat %s -> %s %s%s\n",
     315             :                        full_fname_src->base_name,
     316             :                        full_fname_dst->base_name,
     317             :                        (result < 0) ? "failed: " : "",
     318             :                        (result < 0) ? strerror(saved_errno) : "");
     319             :         }
     320           0 :         DEBUG(1, ("vfs_extd_audit: renameat old: %s newname: %s  %s %s\n",
     321             :                 smb_fname_str_dbg(full_fname_src),
     322             :                 smb_fname_str_dbg(full_fname_dst),
     323             :                (result < 0) ? "failed: " : "",
     324             :                (result < 0) ? strerror(saved_errno) : ""));
     325             : 
     326           0 :         TALLOC_FREE(full_fname_src);
     327           0 :         TALLOC_FREE(full_fname_dst);
     328             : 
     329           0 :         if (result == -1)  {
     330           0 :                 errno = saved_errno;
     331             :         }
     332           0 :         return result;
     333             : }
     334             : 
     335           0 : static int audit_unlinkat(vfs_handle_struct *handle,
     336             :                         struct files_struct *dirfsp,
     337             :                         const struct smb_filename *smb_fname,
     338             :                         int flags)
     339             : {
     340           0 :         struct smb_filename *full_fname = NULL;
     341             :         int result;
     342             : 
     343           0 :         full_fname = full_path_from_dirfsp_atname(talloc_tos(),
     344             :                                                   dirfsp,
     345             :                                                   smb_fname);
     346           0 :         if (full_fname == NULL) {
     347           0 :                 return -1;
     348             :         }
     349             : 
     350           0 :         result = SMB_VFS_NEXT_UNLINKAT(handle,
     351             :                         dirfsp,
     352             :                         smb_fname,
     353             :                         flags);
     354             : 
     355           0 :         if (lp_syslog() > 0) {
     356           0 :                 syslog(audit_syslog_priority(handle), "unlinkat %s %s%s\n",
     357             :                        full_fname->base_name,
     358             :                        (result < 0) ? "failed: " : "",
     359           0 :                        (result < 0) ? strerror(errno) : "");
     360             :         }
     361           0 :         DBG_ERR("unlinkat %s %s %s\n",
     362             :                smb_fname_str_dbg(full_fname),
     363             :                (result < 0) ? "failed: " : "",
     364             :                (result < 0) ? strerror(errno) : "");
     365             : 
     366           0 :         TALLOC_FREE(full_fname);
     367           0 :         return result;
     368             : }
     369             : 
     370           0 : static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, mode_t mode)
     371             : {
     372             :         int result;
     373             : 
     374           0 :         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
     375             : 
     376           0 :         if (lp_syslog() > 0) {
     377           0 :                 syslog(audit_syslog_priority(handle), "fchmod %s mode 0x%x %s%s\n",
     378           0 :                        fsp->fsp_name->base_name, mode,
     379             :                        (result < 0) ? "failed: " : "",
     380           0 :                        (result < 0) ? strerror(errno) : "");
     381             :         }
     382           0 :         DEBUG(1, ("vfs_extd_audit: fchmod %s mode 0x%x %s %s",
     383             :                fsp_str_dbg(fsp), (unsigned int)mode,
     384             :                (result < 0) ? "failed: " : "",
     385             :                (result < 0) ? strerror(errno) : ""));
     386             : 
     387           0 :         return result;
     388             : }
     389             : 
     390             : static struct vfs_fn_pointers vfs_extd_audit_fns = {
     391             :         .connect_fn = audit_connect,
     392             :         .disconnect_fn = audit_disconnect,
     393             :         .mkdirat_fn = audit_mkdirat,
     394             :         .openat_fn = audit_openat,
     395             :         .close_fn = audit_close,
     396             :         .renameat_fn = audit_renameat,
     397             :         .unlinkat_fn = audit_unlinkat,
     398             :         .fchmod_fn = audit_fchmod,
     399             : };
     400             : 
     401             : static_decl_vfs;
     402          20 : NTSTATUS vfs_extd_audit_init(TALLOC_CTX *ctx)
     403             : {
     404          20 :         NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION,
     405             :                                         "extd_audit", &vfs_extd_audit_fns);
     406             :         
     407          20 :         if (!NT_STATUS_IS_OK(ret))
     408           0 :                 return ret;
     409             : 
     410          20 :         vfs_extd_audit_debug_level = debug_add_class("extd_audit");
     411          20 :         if (vfs_extd_audit_debug_level == -1) {
     412           0 :                 vfs_extd_audit_debug_level = DBGC_VFS;
     413           0 :                 DEBUG(0, ("vfs_extd_audit: Couldn't register custom debugging class!\n"));
     414             :         } else {
     415          20 :                 DEBUG(10, ("vfs_extd_audit: Debug class number of 'extd_audit': %d\n", vfs_extd_audit_debug_level));
     416             :         }
     417             :         
     418          20 :         return ret;
     419             : }

Generated by: LCOV version 1.13