[stable9] Backport auditing app

.gitignore

@@ -22,6 +22,7 @@
 !/apps/user_ldap
 !/apps/provisioning_api
 !/apps/systemtags
+!/apps/admin_audit
 !/apps/updatenotification
 /apps/files_external/3rdparty/irodsphp/PHPUnitTest
 /apps/files_external/3rdparty/irodsphp/web

apps/admin_audit/appinfo/app.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+$logger = \OC::$server->getLogger();
+$userSession = \OC::$server->getUserSession();
+$groupManager = \OC::$server->getGroupManager();
+
+$auditLogger = new \OCA\Admin_Audit\AuditLogger($logger, $userSession, $groupManager);
+$auditLogger->registerHooks();

apps/admin_audit/appinfo/info.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<info>
+	<id>admin_audit</id>
+	<name>Auditing / Logging</name>
+	<description>Provides logging abilities for Nextcloud such as logging file
+				accesses or otherwise sensitive actions.
+	</description>
+	<licence>AGPL</licence>
+	<author>Nextcloud</author>
+	<version>1.0.0</version>
+	<dependencies>
+		<owncloud min-version="9.0" max-version="9.1" />
+	</dependencies>
+	<types>
+		<logging/>
+	</types>
+	<default_enable/>
+</info>

apps/admin_audit/lib/actions/action.php

@@ -0,0 +1,76 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Admin_Audit\Actions;
+
+use OCP\ILogger;
+
+class Action {
+	/** @var ILogger */
+	private $logger;
+
+	/**
+	 * @param ILogger $logger
+	 */
+	public function __construct(ILogger $logger) {
+		$this->logger = $logger;
+	}
+
+	/**
+	 * Log a single action with a log level of info
+	 *
+	 * @param string $text
+	 * @param array $params
+	 * @param array $elements
+	 */
+	public function log($text,
+						array $params,
+						array $elements) {
+		foreach($elements as $element) {
+			if(!isset($params[$element])) {
+				$this->logger->critical(
+					sprintf(
+						'$params["'.$element.'"] was missing. Transferred value: %s',
+						print_r($params, true)
+					)
+				);
+				return;
+			}
+		}
+
+		$replaceArray = [];
+		foreach($elements as $element) {
+			if($params[$element] instanceof \DateTime) {
+				$params[$element] = $params[$element]->format('Y-m-d H:i:s');
+			}
+			$replaceArray[] = $params[$element];
+		}
+
+		$this->logger->info(
+			vsprintf(
+				$text,
+				$replaceArray
+			),
+			[
+				'app' => 'admin_audit'
+			]
+		);
+	}
+}

apps/admin_audit/lib/actions/auth.php

@@ -0,0 +1,56 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Admin_Audit\Actions;
+
+/**
+ * Class Auth logs all auth related actions
+ *
+ * @package OCA\Admin_Audit\Actions
+ */
+class Auth extends Action {
+	public function loginAttempt(array $params) {
+		$this->log(
+			'Login attempt: "%s"',
+			$params,
+			[
+				'uid',
+			]
+		);
+	}
+
+	public function loginSuccessful(array $params) {
+		$this->log(
+			'Login successful: "%s"',
+			$params,
+			[
+				'uid',
+			]
+		);
+	}
+
+	public function logout(array $params) {
+		$this->log(
+			'Logout occurred',
+			[],
+			[]
+		);
+	}
+}

apps/admin_audit/lib/actions/files.php

@@ -0,0 +1,135 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Admin_Audit\Actions;
+
+/**
+ * Class Files logs the actions to files
+ *
+ * @package OCA\Admin_Audit\Actions
+ */
+class Files extends Action {
+	/**
+	 * Logs file read actions
+	 *
+	 * @param array $params
+	 */
+	public function read(array $params) {
+		$this->log(
+			'File accessed: "%s"',
+			$params,
+			[
+				'path',
+			]
+		);
+	}
+
+	/**
+	 * Logs rename actions of files
+	 *
+	 * @param array $params
+	 */
+	public function rename(array $params) {
+		$this->log(
+			'File renamed: "%s" to "%s"',
+			$params,
+			[
+				'oldpath',
+				'newpath',
+			]
+		);
+	}
+
+	/**
+	 * Logs creation of files
+	 *
+	 * @param array $params
+	 */
+	public function create(array $params) {
+		$this->log(
+			'File created: "%s"',
+			$params,
+			[
+				'path',
+			]
+		);
+	}
+
+	/**
+	 * Logs copying of files
+	 *
+	 * @param array $params
+	 */
+	public function copy(array $params) {
+		$this->log(
+			'File copied: "%s" to "%s"',
+			$params,
+			[
+				'oldpath',
+				'newpath',
+			]
+		);
+	}
+
+	/**
+	 * Logs writing of files
+	 *
+	 * @param array $params
+	 */
+	public function write(array $params) {
+		$this->log(
+			'File written to: "%s"',
+			$params,
+			[
+				'path',
+			]
+		);
+	}
+
+	/**
+	 * Logs update of files
+	 *
+	 * @param array $params
+	 */
+	public function update(array $params) {
+		$this->log(
+			'File updated: "%s"',
+			$params,
+			[
+				'path',
+			]
+		);
+	}
+
+	/**
+	 * Logs deletions of files
+	 *
+	 * @param array $params
+	 */
+	public function delete(array $params) {
+		$this->log(
+			'File deleted: "%s"',
+			$params,
+			[
+				'path',
+			]
+		);
+	}
+}

apps/admin_audit/lib/actions/groupmanagement.php

@@ -0,0 +1,73 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+namespace OCA\Admin_Audit\Actions;
+
+
+use OCA\Admin_Audit\Actions\Action;
+use OCP\IGroup;
+use OCP\IUser;
+
+/**
+ * Class GroupManagement logs all group manager related events
+ *
+ * @package OCA\Admin_Audit
+ */
+class GroupManagement extends Action {
+
+	/**
+	 * log add user to group event
+	 *
+	 * @param IGroup $group
+	 * @param IUser $user
+	 */
+	public function addUser(IGroup $group, IUser $user) {
+		$this->log('User "%s" added to group "%s"',
+			[
+				'group' => $group->getGID(),
+				'user' => $user->getUID()
+			],
+			[
+				'user', 'group'
+			]
+		);
+	}
+
+	/**
+	 * log remove user from group event
+	 *
+	 * @param IGroup $group
+	 * @param IUser $user
+	 */
+	public function removeUser(IGroup $group, IUser $user) {
+		$this->log('User "%s" removed from group "%s"',
+			[
+				'group' => $group->getGID(),
+				'user' => $user->getUID()
+			],
+			[
+				'user', 'group'
+			]
+		);
+	}
+
+}