samba - Apr 2022 - HEX-value in log during audit

Hi to all,

short question:
If I activate auditing in smb.conf like this:
--------
    full_audit:failure = none
    full_audit:success = renameat create_file write
    full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
    full_audit:facility = local5
    full_audit:priority = NOTICE
--------
I see

.....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx

-------
What is the meaning of the HEX value "0x100081"

Thank's

Stefan

On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba
wrote:
> Hi to all,
> 
> short question:
> If I activate auditing in smb.conf like this:
> --------
>     full_audit:failure = none
>     full_audit:success = renameat create_file write
>     full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
>     full_audit:facility = local5
>     full_audit:priority = NOTICE
> --------
> I see
> 
> .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx
> 
> -------
> What is the meaning of the HEX value "0x100081"
That is the "desired access" from the create request. In this case,
the
client is asking to open the file with READ_DATA and READ_ATTRIBUTES
(and SYNCHRONIZE which is basically ignored).

Christof