NAS-130418 / Audit filesystem permissions changes (#14124)

This adds basic auditing for API calls that change filesystem permissions.
truenas · Aug 5, 2024 · 0dc6787 · 0dc6787
1 parent d6aca09
commit 0dc6787
Show file tree

Hide file tree

Showing 3 changed files with 62 additions and 5 deletions.
diff --git a/src/middlewared/middlewared/plugins/filesystem.py b/src/middlewared/middlewared/plugins/filesystem.py
@@ -67,7 +67,7 @@ def set_immutable(self, set_flag, path):
             Bool('sparse'),
             register=True
         ),
-    ), roles=['FILESYSTEM_ATTRS_WRITE'])
+    ), roles=['FILESYSTEM_ATTRS_WRITE'], audit='Filesystem set ZFS attributes', audit_extended=lambda data: data['path'])
     @returns()
     def set_zfs_attributes(self, data):
         """

diff --git a/src/middlewared/middlewared/plugins/filesystem_/acl.py b/src/middlewared/middlewared/plugins/filesystem_/acl.py
@@ -131,7 +131,8 @@ def path_get_acltype(self, path):
                 Bool('traverse', default=False)
             )
         ),
-        roles=['FILESYSTEM_ATTRS_WRITE']
+        roles=['FILESYSTEM_ATTRS_WRITE'],
+        audit='Filesystem change owner', audit_extended=lambda data: data['path']
     )
     @returns()
     @job(lock="perm_change")
@@ -208,7 +209,8 @@ def _strip_acl_posix1e(self, path):
                 Bool('traverse', default=False),
             )
         ),
-        roles=['FILESYSTEM_ATTRS_WRITE']
+        roles=['FILESYSTEM_ATTRS_WRITE'],
+        audit='Filesystem set permission', audit_extended=lambda data: data['path']
     )
     @returns()
     @job(lock="perm_change")
@@ -865,7 +867,7 @@ def setacl_posix1e(self, job, data):
                 Bool('traverse', default=False),
                 Bool('canonicalize', default=True)
             )
-        ), roles=['FILESYSTEM_ATTRS_WRITE']
+        ), roles=['FILESYSTEM_ATTRS_WRITE'], audit='Filesystem set ACL', audit_extended=lambda data: data['path']
     )
     @returns()
     @job(lock="perm_change")
@@ -1053,7 +1055,7 @@ def check_acl_for_entry(entry):
             'options',
             Bool('force', default=False),
         )
-    ), roles=['FILESYSTEM_ATTRS_WRITE'])
+    ), roles=['FILESYSTEM_ATTRS_WRITE'], audit='Filesystem add to ACL', audit_extended=lambda data: data['path'])
     @job()
     def add_to_acl(self, job, data):
         """

diff --git a/tests/api2/test_audit_permission.py b/tests/api2/test_audit_permission.py
@@ -0,0 +1,55 @@
+import os
+
+from middlewared.test.integration.assets.pool import dataset
+from middlewared.test.integration.utils import call
+from middlewared.test.integration.utils.audit import expect_audit_method_calls
+
+JENNY = 8675309
+
+
+def test_audit_chown():
+    with dataset('audit_chown') as ds:
+        path = os.path.join('/mnt', ds)
+        payload = {'path': path, 'uid': JENNY}
+
+        with expect_audit_method_calls([{
+            'method': 'filesystem.chown',
+            'params': [payload],
+            'description': f'Filesystem change owner {path}'
+        }]):
+            call('filesystem.chown', payload, job=True)
+
+
+def test_audit_setperm():
+    with dataset('audit_setperm') as ds:
+        path = os.path.join('/mnt', ds)
+        payload = {'path': path, 'mode': '777'}
+
+        with expect_audit_method_calls([{
+            'method': 'filesystem.setperm',
+            'params': [payload],
+            'description': f'Filesystem set permission {path}'
+        }]):
+            call('filesystem.setperm', payload, job=True)
+
+
+def test_audit_setacl():
+    with dataset('audit_setacl', {'share_type': 'SMB'}) as ds:
+        path = os.path.join('/mnt', ds)
+        the_acl = call('filesystem.getacl', os.path.join('/mnt', ds))['acl']
+        the_acl.append({
+            'tag': 'USER',
+            'id': JENNY,
+            'perms': {'BASIC': 'FULL_CONTROL'},
+            'flags': {'BASIC': 'INHERIT'},
+            'type': 'ALLOW'
+        })
+
+        payload = {'path': path, 'dacl': the_acl}
+
+        with expect_audit_method_calls([{
+            'method': 'filesystem.setacl',
+            'params': [payload],
+            'description': f'Filesystem set ACL {path}'
+        }]):
+            call('filesystem.setacl', payload, job=True)