Logging Samba: vfs_full_audit crashes smbd?

New! Logging SMB: vfs_full_audit crashes in many configurations
Posted: Mar 16, 2010 2:04 PM
Reply Email

I’m working on a way to do detailed audit logging of SMB shares to fulfill a government requirement. I discovered the vfs_full_audit system built into Samba 3, which could (mostly) do what I want, except for the following.

Here’s a pretty typical simple configuration (from /var/db/samba/smb.shares:

vfs objects = full_audit
full_audit:facility = LOCAL7
full_audit:prefix = %u (%I) %S
full_audit:failure = none
full_audit:success = all

This works, but it logs way too many successful events. the “success” line can be configured to specify the particular SMB operations you wish to log. But if I enter anything but “all”, smbd crashes as soon as a user attempts a login to that particular volume. For instance:

full_audit:success = read

…causes a crash. I’ve tried a large number of operations, and each time I get a crash (and of course, no login). All my login tests were using Mac OS X Leopard’s Samba client, for what it’s worth.

Here’s a sample of a logged crash:

Mar 16 16:36:59 data com.apple.ReportCrash.Root5115: 2010-03-16 16:36:59.151 ReportCrash5115:2903 Saved crash report for smbd5113 version ??? (???) to /Library/Logs/DiagnosticReports/smbd_2010-03-16-163659_localhost.crash

OS Version: Mac OS X Server 10.6.2 (10C540)
Report Version: 6

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Crashed Thread: 0

Application Specific Information:
abort() called
vfs_full_audit.c: name table not in sync with vfs.h
Thread 0 Crashed:
0 libSystem.B.dylib 0x00007fff866bdfe6 __kill + 10
1 libSystem.B.dylib 0x00007fff8675ee32 abort + 83
2 smbd 0x00000001379e96cb dump_core_setup + 0
3 smbd 0x00000001379f95f5 talloc_check_name_abort + 0
4 full_audit.dylib 0x00000001005d7de8 init_module + 10347
5 full_audit.dylib 0x00000001005d7f90 init_module + 10771
6 smbd 0x00000001378d1ea7 set_conn_connectpath + 7015
7 smbd 0x00000001378d276b make_connection + 1403
8 smbd 0x00000001378906eb reply_tcon_and_X + 1132
9 smbd 0x00000001378cdd92 schedule_deferred_open_smb_message + 2356
10 smbd 0x00000001378cf4d7 smbd_process + 2322
11 smbd 0x0000000137a97737 main + 4360
12 smbd 0x000000013785c550 start + 52

Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x0000000000000000 rbx: 0x00000001001196f0 rcx: 0x00007fff5fbfd088 rdx: 0x0000000000000000
rdi: 0x00000000000013f9 rsi: 0x0000000000000006 rbp: 0x00007fff5fbfd0a0 rsp: 0x00007fff5fbfd088
r8: 0x0000000000000000 r9: 0x0000000000000010 r10: 0x00007fff866ba026 r11: 0x0000000000000206
r12: 0x0000000137b9fdf8 r13: 0x00000001005d83e8 r14: 0x00000001005da100 r15: 0x0000000000000001
rip: 0x00007fff866bdfe6 rfl: 0x0000000000000206 cr2: 0x0000000137c0e930

Binary Images:
0x100074000 – 0x100086fff odsam.dylib ??? (???) /usr/lib/samba/pdb/odsam.dylib
0x1000eb000 – 0x1000f8ff7 odsam.dylib ??? (???) <0A88DE73-ABEF-4C78-D473-9C5C707C1C50> /usr/lib/samba/auth/odsam.dylib
0x1005d4000 – 0x1005d9fff full_audit.dylib ??? (???) /usr/lib/samba/vfs/full_audit.dylib
0x13785b000 – 0x137b8aff7 +smbd ??? (???) /usr/sbin/smbd
0x7fff5fc00000 – 0x7fff5fc3bdef dyld 132.1 (???) /usr/lib/dyld
0x7fff8007d000 – 0x7fff800beff7 com.apple.SystemConfiguration 1.10.1 (1.10.1) /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x7fff800bf000 – 0x7fff800d1fe7 libsasl2.2.dylib ??? (???) <76B83C8D-8EFE-4467-0F75-275648AFED97> /usr/lib/libsasl2.2.dylib
0x7fff80a9c000 – 0x7fff80abdfff libresolv.9.dylib ??? (???) <01C7C750-7F6A-89B3-C586-5C50A839019E> /usr/lib/libresolv.9.dylib
0x7fff80b73000 – 0x7fff80badfff libssl.0.9.8.dylib ??? (???) <0714FA32-C193-CD96-80D1-6FCF06A0ED2E> /usr/lib/libssl.0.9.8.dylib
0x7fff80fff000 – 0x7fff81003ff7 libmathCommon.A.dylib ??? (???) <95718673-FEEE-B6ED-B127-BCDBDB60D4E5> /usr/lib/system/libmathCommon.A.dylib
0x7fff810df000 – 0x7fff810e0ff7 com.apple.TrustEvaluationAgent 1.1 (1) <51867586-1C71-AE37-EAAD-535A58DD3550> /System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent
0x7fff81a2d000 – 0x7fff81b25fe7 libiconv.2.dylib ??? (???) /usr/lib/libiconv.2.dylib
0x7fff81bf9000 – 0x7fff81c0afef libz.1.dylib ??? (???) <3A7A4C48-A4C8-A78A-8B87-C0DDF6601AC8> /usr/lib/libz.1.dylib
0x7fff82318000 – 0x7fff82439fe7 libcrypto.0.9.8.dylib ??? (???) <32F2A87F-B146-BBF2-3AD1-494C686F1EE3> /usr/lib/libcrypto.0.9.8.dylib
0x7fff827c3000 – 0x7fff82981fff libicucore.A.dylib ??? (???) <5BD16988-545F-6A8C-9A6F-FB18ACDCAEC2> /usr/lib/libicucore.A.dylib
0x7fff834e0000 – 0x7fff83596fff libobjc.A.dylib ??? (???) /usr/lib/libobjc.A.dylib
0x7fff848dc000 – 0x7fff84b61fe7 com.apple.security 6.1.1 (37594) /System/Library/Frameworks/Security.framework/Versions/A/Security
0x7fff850a2000 – 0x7fff850d7ff7 libcups.2.dylib ??? (???) /usr/lib/libcups.2.dylib
0x7fff8527a000 – 0x7fff8529aff7 com.apple.DirectoryService.Framework 3.6 (621.1) /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
0x7fff862c8000 – 0x7fff86314fff libauto.dylib ??? (???) <072804DF-36AD-2DBE-7EF8-639CFB79077F> /usr/lib/libauto.dylib
0x7fff865b5000 – 0x7fff8666efff libsqlite3.dylib ??? (???) <5A15E12A-AE8F-1A36-BBC7-564E7D7AD0FB> /usr/lib/libsqlite3.dylib
0x7fff8666f000 – 0x7fff8682dff7 libSystem.B.dylib ??? (???) <526DD3E5-2A8B-4512-ED97-01B832369959> /usr/lib/libSystem.B.dylib
0x7fff86a3a000 – 0x7fff86ab7fef libstdc++.6.dylib ??? (???) <35ECA411-2C08-FD7D-11B1-1B7A04921A5C> /usr/lib/libstdc++.6.dylib
0x7fff8762a000 – 0x7fff87640fef libbsm.0.dylib ??? (???) <42D3023A-A1F7-4121-6417-FCC6B51B3E90> /usr/lib/libbsm.0.dylib
0x7fff87641000 – 0x7fff876f0fff edu.mit.Kerberos 6.5.9 (6.5.9) <42364D54-C647-14DE-2B1C-D94DAA03F092> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
0x7fff87703000 – 0x7fff87708fff libpam.2.dylib ??? (???) <53A07D94-9BC7-3F38-E306-320389CACA17> /usr/lib/libpam.2.dylib
0x7fff87944000 – 0x7fff87981fff com.apple.LDAPFramework 2.0 (120.1) <05A853F5-76B9-AF27-6548-A2450AE86451> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
0x7fff88683000 – 0x7fff887f6ff7 com.apple.CoreFoundation 6.6.1 (550.13) <1E952BD9-37C6-16BE-B2F0-CD92A6283D37> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x7fffffe00000 – 0x7fffffe01fff libSystem.B.dylib ??? (???) <526DD3E5-2A8B-4512-ED97-01B832369959> /usr/lib/libSystem.B.dylib