← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to source3/modules/vfs_full_audit.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/modules/vfs_full_audit.c
58
58
 
59
59
 
60
60
#include "includes.h"
 
61
#include "system/filesys.h"
 
62
#include "system/syslog.h"
 
63
#include "smbd/smbd.h"
 
64
#include "../librpc/gen_ndr/ndr_netlogon.h"
 
65
#include "auth.h"
 
66
#include "ntioctl.h"
61
67
 
62
68
static int vfs_full_audit_debug_level = DBGC_VFS;
63
69
 
86
92
        /* Directory operations */
87
93
 
88
94
        SMB_VFS_OP_OPENDIR,
 
95
        SMB_VFS_OP_FDOPENDIR,
89
96
        SMB_VFS_OP_READDIR,
90
97
        SMB_VFS_OP_SEEKDIR,
91
98
        SMB_VFS_OP_TELLDIR,
123
130
        SMB_VFS_OP_GETWD,
124
131
        SMB_VFS_OP_NTIMES,
125
132
        SMB_VFS_OP_FTRUNCATE,
 
133
        SMB_VFS_OP_FALLOCATE,
126
134
        SMB_VFS_OP_LOCK,
127
135
        SMB_VFS_OP_KERNEL_FLOCK,
128
136
        SMB_VFS_OP_LINUX_SETLEASE,
227
235
        { SMB_VFS_OP_STATVFS,   "statvfs" },
228
236
        { SMB_VFS_OP_FS_CAPABILITIES,   "fs_capabilities" },
229
237
        { SMB_VFS_OP_OPENDIR,   "opendir" },
 
238
        { SMB_VFS_OP_FDOPENDIR, "fdopendir" },
230
239
        { SMB_VFS_OP_READDIR,   "readdir" },
231
240
        { SMB_VFS_OP_SEEKDIR,   "seekdir" },
232
241
        { SMB_VFS_OP_TELLDIR,   "telldir" },
261
270
        { SMB_VFS_OP_GETWD,     "getwd" },
262
271
        { SMB_VFS_OP_NTIMES,    "ntimes" },
263
272
        { SMB_VFS_OP_FTRUNCATE, "ftruncate" },
 
273
        { SMB_VFS_OP_FALLOCATE,"fallocate" },
264
274
        { SMB_VFS_OP_LOCK,      "lock" },
265
275
        { SMB_VFS_OP_KERNEL_FLOCK,      "kernel_flock" },
266
276
        { SMB_VFS_OP_LINUX_SETLEASE, "linux_setlease" },
329
339
        { SMB_VFS_OP_AIO_FSYNC, "aio_fsync" },
330
340
        { SMB_VFS_OP_AIO_SUSPEND,"aio_suspend" },
331
341
        { SMB_VFS_OP_AIO_FORCE, "aio_force" },
332
 
        { SMB_VFS_OP_IS_OFFLINE, "aio_is_offline" },
333
 
        { SMB_VFS_OP_SET_OFFLINE, "aio_set_offline" },
 
342
        { SMB_VFS_OP_IS_OFFLINE, "is_offline" },
 
343
        { SMB_VFS_OP_SET_OFFLINE, "set_offline" },
334
344
        { SMB_VFS_OP_LAST, NULL }
335
345
};
336
346
 
392
402
        }
393
403
        result = talloc_sub_advanced(ctx,
394
404
                        lp_servicename(SNUM(conn)),
395
 
                        conn->server_info->unix_name,
 
405
                        conn->session_info->unix_name,
396
406
                        conn->connectpath,
397
 
                        conn->server_info->utok.gid,
398
 
                        conn->server_info->sanitized_username,
399
 
                        pdb_get_domain(conn->server_info->sam_account),
 
407
                        conn->session_info->utok.gid,
 
408
                        conn->session_info->sanitized_username,
 
409
                        conn->session_info->info3->base.domain.string,
400
410
                        prefix);
401
411
        TALLOC_FREE(prefix);
402
412
        return result;
431
441
        return bitmap_query(pd->failure_ops, op);
432
442
}
433
443
 
434
 
static void init_bitmap(struct bitmap **bm, const char **ops)
 
444
static struct bitmap *init_bitmap(TALLOC_CTX *mem_ctx, const char **ops)
435
445
{
436
 
        bool log_all = False;
437
 
 
438
 
        if (*bm != NULL)
439
 
                return;
440
 
 
441
 
        *bm = bitmap_allocate(SMB_VFS_OP_LAST);
442
 
 
443
 
        if (*bm == NULL) {
 
446
        struct bitmap *bm;
 
447
 
 
448
        if (ops == NULL) {
 
449
                return NULL;
 
450
        }
 
451
 
 
452
        bm = bitmap_talloc(mem_ctx, SMB_VFS_OP_LAST);
 
453
        if (bm == NULL) {
444
454
                DEBUG(0, ("Could not alloc bitmap -- "
445
455
                          "defaulting to logging everything\n"));
446
 
                return;
 
456
                return NULL;
447
457
        }
448
458
 
449
 
        while (*ops != NULL) {
 
459
        for (; *ops != NULL; ops += 1) {
450
460
                int i;
451
 
                bool found = False;
 
461
                bool neg = false;
 
462
                const char *op;
452
463
 
453
464
                if (strequal(*ops, "all")) {
454
 
                        log_all = True;
455
 
                        break;
 
465
                        for (i=0; i<SMB_VFS_OP_LAST; i++) {
 
466
                                bitmap_set(bm, i);
 
467
                        }
 
468
                        continue;
456
469
                }
457
470
 
458
471
                if (strequal(*ops, "none")) {
459
472
                        break;
460
473
                }
461
474
 
 
475
                op = ops[0];
 
476
                if (op[0] == '!') {
 
477
                        neg = true;
 
478
                        op += 1;
 
479
                }
 
480
 
462
481
                for (i=0; i<SMB_VFS_OP_LAST; i++) {
463
482
                        if (vfs_op_names[i].name == NULL) {
464
483
                                smb_panic("vfs_full_audit.c: name table not "
465
484
                                          "in sync with vfs.h\n");
466
485
                        }
467
 
 
468
 
                        if (strequal(*ops, vfs_op_names[i].name)) {
469
 
                                bitmap_set(*bm, i);
470
 
                                found = True;
 
486
                        if (strequal(op, vfs_op_names[i].name)) {
 
487
                                if (neg) {
 
488
                                        bitmap_clear(bm, i);
 
489
                                } else {
 
490
                                        bitmap_set(bm, i);
 
491
                                }
 
492
                                break;
471
493
                        }
472
494
                }
473
 
                if (!found) {
 
495
                if (i == SMB_VFS_OP_LAST) {
474
496
                        DEBUG(0, ("Could not find opname %s, logging all\n",
475
497
                                  *ops));
476
 
                        log_all = True;
477
 
                        break;
 
498
                        TALLOC_FREE(bm);
 
499
                        return NULL;
478
500
                }
479
 
                ops += 1;
480
 
        }
481
 
 
482
 
        if (log_all) {
483
 
                /* The query functions default to True */
484
 
                bitmap_free(*bm);
485
 
                *bm = NULL;
486
 
        }
 
501
        }
 
502
        return bm;
487
503
}
488
504
 
489
505
static const char *audit_opname(vfs_op_type op)
579
595
        return smb_fname_str_do_log(fsp->fsp_name);
580
596
}
581
597
 
582
 
/* Free function for the private data. */
583
 
 
584
 
static void free_private_data(void **p_data)
585
 
{
586
 
        struct vfs_full_audit_private_data *pd = *(struct vfs_full_audit_private_data **)p_data;
587
 
 
588
 
        if (pd->success_ops) {
589
 
                bitmap_free(pd->success_ops);
590
 
        }
591
 
        if (pd->failure_ops) {
592
 
                bitmap_free(pd->failure_ops);
593
 
        }
594
 
        SAFE_FREE(pd);
595
 
        *p_data = NULL;
596
 
}
597
 
 
598
598
/* Implementation of vfs_ops.  Pass everything on to the default
599
599
   operation but log event first. */
600
600
 
603
603
{
604
604
        int result;
605
605
        struct vfs_full_audit_private_data *pd = NULL;
606
 
        const char *none[] = { NULL };
607
 
        const char *all [] = { "all" };
608
606
 
609
607
        result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
610
608
        if (result < 0) {
611
609
                return result;
612
610
        }
613
611
 
614
 
        pd = SMB_MALLOC_P(struct vfs_full_audit_private_data);
 
612
        pd = TALLOC_ZERO_P(handle, struct vfs_full_audit_private_data);
615
613
        if (!pd) {
616
614
                SMB_VFS_NEXT_DISCONNECT(handle);
617
615
                return -1;
618
616
        }
619
 
        ZERO_STRUCTP(pd);
620
617
 
621
618
#ifndef WITH_SYSLOG
622
619
        openlog("smbd_audit", 0, audit_syslog_facility(handle));
623
620
#endif
624
621
 
625
 
        init_bitmap(&pd->success_ops,
626
 
                    lp_parm_string_list(SNUM(handle->conn), "full_audit", "success",
627
 
                                        none));
628
 
        init_bitmap(&pd->failure_ops,
629
 
                    lp_parm_string_list(SNUM(handle->conn), "full_audit", "failure",
630
 
                                        all));
 
622
        pd->success_ops = init_bitmap(
 
623
                pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
 
624
                                        "success", NULL));
 
625
        pd->failure_ops = init_bitmap(
 
626
                pd, lp_parm_string_list(SNUM(handle->conn), "full_audit",
 
627
                                        "failure", NULL));
631
628
 
632
629
        /* Store the private data. */
633
 
        SMB_VFS_HANDLE_SET_DATA(handle, pd, free_private_data,
 
630
        SMB_VFS_HANDLE_SET_DATA(handle, pd, NULL,
634
631
                                struct vfs_full_audit_private_data, return -1);
635
632
 
636
633
        do_log(SMB_VFS_OP_CONNECT, True, handle,
698
695
 
699
696
static int smb_full_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
700
697
                                struct files_struct *fsp,
701
 
                                SHADOW_COPY_DATA *shadow_copy_data, bool labels)
 
698
                                struct shadow_copy_data *shadow_copy_data,
 
699
                                bool labels)
702
700
{
703
701
        int result;
704
702
 
745
743
        return result;
746
744
}
747
745
 
 
746
static SMB_STRUCT_DIR *smb_full_audit_fdopendir(vfs_handle_struct *handle,
 
747
                          files_struct *fsp, const char *mask, uint32 attr)
 
748
{
 
749
        SMB_STRUCT_DIR *result;
 
750
 
 
751
        result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 
752
 
 
753
        do_log(SMB_VFS_OP_FDOPENDIR, (result != NULL), handle, "%s",
 
754
                        fsp_str_do_log(fsp));
 
755
 
 
756
        return result;
 
757
}
 
758
 
748
759
static SMB_STRUCT_DIRENT *smb_full_audit_readdir(vfs_handle_struct *handle,
749
760
                                    SMB_STRUCT_DIR *dirp, SMB_STRUCT_STAT *sbuf)
750
761
{
861
872
                                      uint32_t file_attributes,
862
873
                                      uint32_t oplock_request,
863
874
                                      uint64_t allocation_size,
 
875
                                      uint32_t private_flags,
864
876
                                      struct security_descriptor *sd,
865
877
                                      struct ea_list *ea_list,
866
878
                                      files_struct **result_fsp,
904
916
                file_attributes,                        /* file_attributes */
905
917
                oplock_request,                         /* oplock_request */
906
918
                allocation_size,                        /* allocation_size */
 
919
                private_flags,
907
920
                sd,                                     /* sd */
908
921
                ea_list,                                /* ea_list */
909
922
                result_fsp,                             /* result */
1098
1111
 
1099
1112
        result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1100
1113
 
1101
 
        do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result >= 0), handle, "%d", result);
 
1114
        do_log(SMB_VFS_OP_GET_ALLOC_SIZE, (result != (uint64_t)-1), handle,
 
1115
                        "%llu", result);
1102
1116
 
1103
1117
        return result;
1104
1118
}
1231
1245
        return result;
1232
1246
}
1233
1247
 
 
1248
static int smb_full_audit_fallocate(vfs_handle_struct *handle, files_struct *fsp,
 
1249
                           enum vfs_fallocate_mode mode,
 
1250
                           SMB_OFF_T offset,
 
1251
                           SMB_OFF_T len)
 
1252
{
 
1253
        int result;
 
1254
 
 
1255
        result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
 
1256
 
 
1257
        do_log(SMB_VFS_OP_FALLOCATE, (result >= 0), handle,
 
1258
               "%s", fsp_str_do_log(fsp));
 
1259
 
 
1260
        return result;
 
1261
}
 
1262
 
1234
1263
static bool smb_full_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1235
1264
                       int op, SMB_OFF_T offset, SMB_OFF_T count, int type)
1236
1265
{
1333
1362
}
1334
1363
 
1335
1364
static char *smb_full_audit_realpath(vfs_handle_struct *handle,
1336
 
                            const char *path, char *resolved_path)
 
1365
                            const char *path)
1337
1366
{
1338
1367
        char *result;
1339
1368
 
1340
 
        result = SMB_VFS_NEXT_REALPATH(handle, path, resolved_path);
 
1369
        result = SMB_VFS_NEXT_REALPATH(handle, path);
1341
1370
 
1342
1371
        do_log(SMB_VFS_OP_REALPATH, (result != NULL), handle, "%s", path);
1343
1372
 
1535
1564
 
1536
1565
static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1537
1566
                                uint32 security_info,
1538
 
                                SEC_DESC **ppdesc)
 
1567
                                struct security_descriptor **ppdesc)
1539
1568
{
1540
1569
        NTSTATUS result;
1541
1570
 
1550
1579
static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
1551
1580
                                          const char *name,
1552
1581
                                          uint32 security_info,
1553
 
                                          SEC_DESC **ppdesc)
 
1582
                                          struct security_descriptor **ppdesc)
1554
1583
{
1555
1584
        NTSTATUS result;
1556
1585
 
1564
1593
 
1565
1594
static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
1566
1595
                              uint32 security_info_sent,
1567
 
                              const SEC_DESC *psd)
 
1596
                              const struct security_descriptor *psd)
1568
1597
{
1569
1598
        NTSTATUS result;
1570
1599
 
2180
2209
        return result;
2181
2210
}
2182
2211
 
 
2212
static bool smb_full_audit_is_offline(struct vfs_handle_struct *handle,
 
2213
                                      const struct smb_filename *fname,
 
2214
                                      SMB_STRUCT_STAT *sbuf)
 
2215
{
 
2216
        bool result;
 
2217
 
 
2218
        result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
 
2219
        do_log(SMB_VFS_OP_IS_OFFLINE, result, handle, "%s",
 
2220
               smb_fname_str_do_log(fname));
 
2221
        return result;
 
2222
}
 
2223
 
 
2224
static int smb_full_audit_set_offline(struct vfs_handle_struct *handle,
 
2225
                                      const struct smb_filename *fname)
 
2226
{
 
2227
        int result;
 
2228
 
 
2229
        result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
 
2230
        do_log(SMB_VFS_OP_SET_OFFLINE, result >= 0, handle, "%s",
 
2231
               smb_fname_str_do_log(fname));
 
2232
        return result;
 
2233
}
 
2234
 
2183
2235
static struct vfs_fn_pointers vfs_full_audit_fns = {
2184
2236
 
2185
2237
        /* Disk operations */
2193
2245
        .statvfs = smb_full_audit_statvfs,
2194
2246
        .fs_capabilities = smb_full_audit_fs_capabilities,
2195
2247
        .opendir = smb_full_audit_opendir,
 
2248
        .fdopendir = smb_full_audit_fdopendir,
2196
2249
        .readdir = smb_full_audit_readdir,
2197
2250
        .seekdir = smb_full_audit_seekdir,
2198
2251
        .telldir = smb_full_audit_telldir,
2201
2254
        .rmdir = smb_full_audit_rmdir,
2202
2255
        .closedir = smb_full_audit_closedir,
2203
2256
        .init_search_op = smb_full_audit_init_search_op,
2204
 
        .open = smb_full_audit_open,
 
2257
        .open_fn = smb_full_audit_open,
2205
2258
        .create_file = smb_full_audit_create_file,
2206
2259
        .close_fn = smb_full_audit_close,
2207
2260
        .vfs_read = smb_full_audit_read,
2227
2280
        .getwd = smb_full_audit_getwd,
2228
2281
        .ntimes = smb_full_audit_ntimes,
2229
2282
        .ftruncate = smb_full_audit_ftruncate,
 
2283
        .fallocate = smb_full_audit_fallocate,
2230
2284
        .lock = smb_full_audit_lock,
2231
2285
        .kernel_flock = smb_full_audit_kernel_flock,
2232
2286
        .linux_setlease = smb_full_audit_linux_setlease,
2295
2349
        .aio_fsync = smb_full_audit_aio_fsync,
2296
2350
        .aio_suspend = smb_full_audit_aio_suspend,
2297
2351
        .aio_force = smb_full_audit_aio_force,
 
2352
        .is_offline = smb_full_audit_is_offline,
 
2353
        .set_offline = smb_full_audit_set_offline,
2298
2354
};
2299
2355
 
2300
2356
NTSTATUS vfs_full_audit_init(void)