[Samba] File deletion auditing

[David Disseldorp]

On Wed, 28 May 2014 10:06:43 -0300 (BRT), Dante Colo wrote:

> Hi David . 
> 
> 
> I'm sorry, i deleted the word "full_audit" accidentally before copy and paste in the email here , i can audit directory deletion, file write, file rename but not file deletion. 

File deletion is handled by the "unlink" audit path. E.g:
  full_audit:success = write mkdir rmdir pwrite rename unlink
  full_audit:failure = write mkdir rmdir pwrite rename unlink

One note, be careful when combining the full audit module with others,
as opaque modules will not pass through the event for auditing.
full_audit should therefore be listed first in the VFS module list.

Cheers, David