vfs_audit.c
Maznichenko Sergey
msb at atlantis-pak.ru
Fri Apr 29 08:14:33 GMT 2005
I did new version of vfs_audit.c
I think it is very usefull. But I have some problems with Windows XP SP2
ans Windows 2003 Server clients, since samba >= 3.0.13 (samba 3.0.12
works good).
Problem description:
User can't run any ".exe" file from samba share (permission
denited), but can read/write this.
I found decision of this problem but I did'nt like that.
May be samba-team help me?
attached files:
vfs_audit.c - my version samba audit module (not working with Windows XP
SP2 ans Windows 2003 Server clients since samba >= 3.0.13)
vfs_audit.path - workaround path (working with samba >= 3.0.13)
-------------- next part --------------
/*
* Auditing VFS module for samba. Log selected file operations to syslog
* facility.
*
* Copyright (C) Tim Potter 1999-2000
* Copyright (C) Alexander Bokovoy 2002
* Copyright (C) Stefan (metze) Metzmacher 2002
* Copyright (C) Sergey Maznichenko 2005
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_VFS
/* Function prototypes */
static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user);
static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn);
static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname);
static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode);
static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path);
static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode);
static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd);
static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new);
static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path);
static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode);
static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode);
static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode);
static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode);
/* VFS operations */
static vfs_op_tuple audit_op_tuples[] = {
/* Disk operations */
{SMB_VFS_OP(audit_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_LOGGER},
/* Directory operations */
{SMB_VFS_OP(audit_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_LOGGER},
/* File operations */
{SMB_VFS_OP(audit_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_close), SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_fchmod), SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_LOGGER},
{SMB_VFS_OP(audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_LOGGER},
/* Finish VFS operations definition */
{SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP}
};
static int audit_syslog_facility(vfs_handle_struct *handle)
{
/* fix me: let this be configurable by:
* lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"audit"),"syslog facility",
* audit_enum_facility,LOG_USER);
*/
return LOG_LOCAL3;
}
static int audit_syslog_priority(vfs_handle_struct *handle)
{
/* fix me: let this be configurable by:
* lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"audit"),"syslog priority",
* audit_enum_priority,LOG_NOTICE);
*/
return LOG_NOTICE;
}
/* Implementation of vfs_ops. Pass everything on to the default
operation but log event first. */
static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user)
{
int result;
openlog("smbd_audit", LOG_PID, audit_syslog_facility(handle));
result = SMB_VFS_NEXT_CONNECT(handle, conn, svc, user);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"connect",
"",
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn)
{
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"disconnected"
);
SMB_VFS_NEXT_DISCONNECT(handle, conn);
return;
}
static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname)
{
DIR *result;
result = SMB_VFS_NEXT_OPENDIR(handle, conn, fname);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"opendir",
fname,
( result == NULL ) ? "FAILED: " : "",
( result == NULL ) ? strerror( errno ) : ""
);
return result;
}
static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_MKDIR(handle, conn, path, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"mkdir",
path,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path)
{
int result;
result = SMB_VFS_NEXT_RMDIR(handle, conn, path);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"rmdir",
path,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s%s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"open",
fname,
((flags & O_WRONLY) || (flags & O_RDWR)) ? " for writing" : "",
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
{
int result;
result = SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(handle->conn->uid),
gidtoname(handle->conn->gid),
global_myname(),
lp_servicename(SNUM(handle->conn)),
client_addr(),
"close",
fsp->fsp_name,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new)
{
int result;
result = SMB_VFS_NEXT_RENAME(handle, conn, old, new);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s -> %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"rename",
old,
new,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path)
{
int result;
result = SMB_VFS_NEXT_UNLINK(handle, conn, path);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"delete",
path,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_CHMOD(handle, conn, path, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s mode 0x%x %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"chmod",
path,
mode,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_CHMOD_ACL(handle, conn, path, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s mode 0x%x %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
lp_servicename(SNUM(conn)),
client_addr(),
"chmod_acl",
path,
mode,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s mode 0x%x %s%s",
uidtoname(handle->conn->uid),
gidtoname(handle->conn->gid),
global_myname(),
lp_servicename(SNUM(handle->conn)),
client_addr(),
"fchmod",
fsp->fsp_name,
mode,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode)
{
int result;
result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode);
syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s mode 0x%x %s%s",
uidtoname(handle->conn->uid),
gidtoname(handle->conn->gid),
global_myname(),
lp_servicename(SNUM(handle->conn)),
client_addr(),
"fchmod",
fsp->fsp_name,
mode,
( result < 0 ) ? "FAILED: " : "",
( result < 0 ) ? strerror( errno ) : ""
);
return result;
}
NTSTATUS vfs_audit_init(void)
{
return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "audit", audit_op_tuples);
}
-------------- next part --------------
--- vfs_audit.c.bug Fri Apr 29 11:12:00 2005
+++ vfs_audit.c Fri Apr 29 11:13:00 2005
@@ -210,7 +210,21 @@
result = SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode);
- syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s%s %s%s",
+
+ if (result < 0) {
+
+ syslog(audit_syslog_priority(handle), "%d/%d \\\\%s\\%s %s open %s %s\n",
+ conn->uid,
+ conn->gid,
+ global_myname(),
+ lp_servicename(SNUM(conn)),
+ client_addr(),
+ fname,
+ ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "");
+
+ } else {
+
+ syslog(audit_syslog_priority(handle), "%s/%s \\\\%s\\%s %s %s %s%s %s%s",
uidtoname(conn->uid),
gidtoname(conn->gid),
global_myname(),
@@ -219,9 +233,10 @@
"open",
fname,
((flags & O_WRONLY) || (flags & O_RDWR)) ? " for writing" : "",
- ( result < 0 ) ? "FAILED: " : "",
- ( result < 0 ) ? strerror( errno ) : ""
- );
+ "FAILED: ",
+ strerror( errno ));
+
+ }
return result;
}
More information about the samba-technical
mailing list