4 security IDL structures
10 use the same structure for dom_sid2 as dom_sid. A dom_sid2 is really
11 just a dom sid, but with the sub_auths represented as a conformant
12 array. As with all in-structure conformant arrays, the array length
13 is placed before the start of the structure. That's what gives rise
14 to the extra num_auths elemenent. We don't want the Samba code to
15 have to bother with such esoteric NDR details, so its easier to just
16 define it as a dom_sid and use pidl magic to make it all work. It
17 just means you need to mark a sid as a "dom_sid2" in the IDL when you
18 know it is of the conformant array variety
20 cpp_quote
("#define dom_sid2 dom_sid")
22 /* same struct as dom_sid but inside a 28 bytes fixed buffer in NDR */
23 cpp_quote
("#define dom_sid28 dom_sid")
25 /* same struct as dom_sid but in a variable byte buffer, which is maybe empty in NDR */
26 cpp_quote
("#define dom_sid0 dom_sid")
29 pointer_default(unique)
34 access masks are divided up like this:
37 a = generic rights bits SEC_GENERIC_
39 c = standard rights bits SEC_STD_
40 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
42 common combinations of bits are prefixed with SEC_RIGHTS_
44 const int SEC_MASK_GENERIC
= 0xF0000000;
45 const int SEC_MASK_FLAGS
= 0x0F000000;
46 const int SEC_MASK_STANDARD
= 0x00FF0000;
47 const int SEC_MASK_SPECIFIC
= 0x0000FFFF;
50 const int SEC_GENERIC_ALL
= 0x10000000;
51 const int SEC_GENERIC_EXECUTE
= 0x20000000;
52 const int SEC_GENERIC_WRITE
= 0x40000000;
53 const int SEC_GENERIC_READ
= 0x80000000;
56 const int SEC_FLAG_SYSTEM_SECURITY
= 0x01000000;
57 const int SEC_FLAG_MAXIMUM_ALLOWED
= 0x02000000;
60 const int SEC_STD_DELETE
= 0x00010000;
61 const int SEC_STD_READ_CONTROL
= 0x00020000;
62 const int SEC_STD_WRITE_DAC
= 0x00040000;
63 const int SEC_STD_WRITE_OWNER
= 0x00080000;
64 const int SEC_STD_SYNCHRONIZE
= 0x00100000;
65 const int SEC_STD_REQUIRED
= 0x000F0000;
66 const int SEC_STD_ALL
= 0x001F0000;
68 /* file specific bits */
69 const int SEC_FILE_READ_DATA
= 0x00000001;
70 const int SEC_FILE_WRITE_DATA
= 0x00000002;
71 const int SEC_FILE_APPEND_DATA
= 0x00000004;
72 const int SEC_FILE_READ_EA
= 0x00000008;
73 const int SEC_FILE_WRITE_EA
= 0x00000010;
74 const int SEC_FILE_EXECUTE
= 0x00000020;
75 const int SEC_FILE_READ_ATTRIBUTE
= 0x00000080;
76 const int SEC_FILE_WRITE_ATTRIBUTE
= 0x00000100;
77 const int SEC_FILE_ALL
= 0x000001ff;
79 /* directory specific bits */
80 const int SEC_DIR_LIST
= 0x00000001;
81 const int SEC_DIR_ADD_FILE
= 0x00000002;
82 const int SEC_DIR_ADD_SUBDIR
= 0x00000004;
83 const int SEC_DIR_READ_EA
= 0x00000008;
84 const int SEC_DIR_WRITE_EA
= 0x00000010;
85 const int SEC_DIR_TRAVERSE
= 0x00000020;
86 const int SEC_DIR_DELETE_CHILD
= 0x00000040;
87 const int SEC_DIR_READ_ATTRIBUTE
= 0x00000080;
88 const int SEC_DIR_WRITE_ATTRIBUTE
= 0x00000100;
90 /* registry entry specific bits */
91 const int SEC_REG_QUERY_VALUE
= 0x00000001;
92 const int SEC_REG_SET_VALUE
= 0x00000002;
93 const int SEC_REG_CREATE_SUBKEY
= 0x00000004;
94 const int SEC_REG_ENUM_SUBKEYS
= 0x00000008;
95 const int SEC_REG_NOTIFY
= 0x00000010;
96 const int SEC_REG_CREATE_LINK
= 0x00000020;
98 /* ldap specific access bits */
99 const int SEC_ADS_CREATE_CHILD
= 0x00000001;
100 const int SEC_ADS_DELETE_CHILD
= 0x00000002;
101 const int SEC_ADS_LIST
= 0x00000004;
102 const int SEC_ADS_SELF_WRITE
= 0x00000008;
103 const int SEC_ADS_READ_PROP
= 0x00000010;
104 const int SEC_ADS_WRITE_PROP
= 0x00000020;
105 const int SEC_ADS_DELETE_TREE
= 0x00000040;
106 const int SEC_ADS_LIST_OBJECT
= 0x00000080;
107 const int SEC_ADS_CONTROL_ACCESS
= 0x00000100;
109 /* generic->specific mappings for files */
110 const int SEC_RIGHTS_FILE_READ
= SEC_STD_READ_CONTROL |
111 SEC_STD_SYNCHRONIZE |
113 SEC_FILE_READ_ATTRIBUTE |
116 const int SEC_RIGHTS_FILE_WRITE
= SEC_STD_READ_CONTROL |
117 SEC_STD_SYNCHRONIZE |
118 SEC_FILE_WRITE_DATA |
119 SEC_FILE_WRITE_ATTRIBUTE |
121 SEC_FILE_APPEND_DATA
;
123 const int SEC_RIGHTS_FILE_EXECUTE
= SEC_STD_SYNCHRONIZE |
124 SEC_STD_READ_CONTROL |
125 SEC_FILE_READ_ATTRIBUTE |
128 const int SEC_RIGHTS_FILE_ALL
= SEC_STD_ALL | SEC_FILE_ALL
;
130 /* generic->specific mappings for directories (same as files) */
131 const int SEC_RIGHTS_DIR_READ
= SEC_RIGHTS_FILE_READ
;
132 const int SEC_RIGHTS_DIR_WRITE
= SEC_RIGHTS_FILE_WRITE
;
133 const int SEC_RIGHTS_DIR_EXECUTE
= SEC_RIGHTS_FILE_EXECUTE
;
134 const int SEC_RIGHTS_DIR_ALL
= SEC_RIGHTS_FILE_ALL
;
136 /* combinations of standard masks. */
137 const int STANDARD_RIGHTS_ALL_ACCESS
= SEC_STD_ALL
; /* 0x001f0000 */
138 const int STANDARD_RIGHTS_MODIFY_ACCESS
= SEC_STD_READ_CONTROLS
; /* 0x00020000 */
139 const int STANDARD_RIGHTS_EXECUTE_ACCESS
= SEC_STD_READ_CONTROLS
; /* 0x00020000 */
140 const int STANDARD_RIGHTS_READ_ACCESS
= SEC_STD_READ_CONTROLS
; /* 0x00020000 */
141 const int STANDARD_RIGHTS_WRITE_ACCESS
=
142 (SEC_STD_WRITE_OWNER |
144 SEC_STD_DELETE
); /* 0x000d0000 */
145 const int STANDARD_RIGHTS_REQUIRED_ACCESS
=
147 SEC_STD_READ_CONTROL |
149 SEC_STD_WRITE_OWNER
); /* 0x000f0000 */
151 /***************************************************************/
152 /* WELL KNOWN SIDS */
155 const string SID_NULL
= "S-1-0-0";
157 /* the world domain */
158 const string NAME_WORLD
= "WORLD";
160 const string SID_WORLD_DOMAIN
= "S-1-1";
161 const string SID_WORLD
= "S-1-1-0";
163 /* SECURITY_CREATOR_SID_AUTHORITY */
164 const string SID_CREATOR_OWNER_DOMAIN
= "S-1-3";
165 const string SID_CREATOR_OWNER
= "S-1-3-0";
166 const string SID_CREATOR_GROUP
= "S-1-3-1";
168 /* SECURITY_NT_AUTHORITY */
169 const string NAME_NT_AUTHORITY
= "NT AUTHORITY";
171 const string SID_NT_AUTHORITY
= "S-1-5";
172 const string SID_NT_DIALUP
= "S-1-5-1";
173 const string SID_NT_NETWORK
= "S-1-5-2";
174 const string SID_NT_BATCH
= "S-1-5-3";
175 const string SID_NT_INTERACTIVE
= "S-1-5-4";
176 const string SID_NT_SERVICE
= "S-1-5-6";
177 const string SID_NT_ANONYMOUS
= "S-1-5-7";
178 const string SID_NT_PROXY
= "S-1-5-8";
179 const string SID_NT_ENTERPRISE_DCS
= "S-1-5-9";
180 const string SID_NT_SELF
= "S-1-5-10";
181 const string SID_NT_AUTHENTICATED_USERS
= "S-1-5-11";
182 const string SID_NT_RESTRICTED
= "S-1-5-12";
183 const string SID_NT_TERMINAL_SERVER_USERS
= "S-1-5-13";
184 const string SID_NT_REMOTE_INTERACTIVE
= "S-1-5-14";
185 const string SID_NT_THIS_ORGANISATION
= "S-1-5-15";
186 const string SID_NT_SYSTEM
= "S-1-5-18";
187 const string SID_NT_LOCAL_SERVICE
= "S-1-5-19";
188 const string SID_NT_NETWORK_SERVICE
= "S-1-5-20";
190 /* SECURITY_BUILTIN_DOMAIN_RID */
191 const string NAME_BUILTIN
= "BUILTIN";
193 const string SID_BUILTIN
= "S-1-5-32";
194 const string SID_BUILTIN_ADMINISTRATORS
= "S-1-5-32-544";
195 const string SID_BUILTIN_USERS
= "S-1-5-32-545";
196 const string SID_BUILTIN_GUESTS
= "S-1-5-32-546";
197 const string SID_BUILTIN_POWER_USERS
= "S-1-5-32-547";
198 const string SID_BUILTIN_ACCOUNT_OPERATORS
= "S-1-5-32-548";
199 const string SID_BUILTIN_SERVER_OPERATORS
= "S-1-5-32-549";
200 const string SID_BUILTIN_PRINT_OPERATORS
= "S-1-5-32-550";
201 const string SID_BUILTIN_BACKUP_OPERATORS
= "S-1-5-32-551";
202 const string SID_BUILTIN_REPLICATOR
= "S-1-5-32-552";
203 const string SID_BUILTIN_RAS_SERVERS
= "S-1-5-32-553";
204 const string SID_BUILTIN_PREW2K
= "S-1-5-32-554";
206 /* well-known domain RIDs */
207 const int DOMAIN_RID_LOGON
= 9;
208 const int DOMAIN_RID_ADMINISTRATOR
= 500;
209 const int DOMAIN_RID_GUEST
= 501;
210 const int DOMAIN_RID_ADMINS
= 512;
211 const int DOMAIN_RID_USERS
= 513;
212 const int DOMAIN_RID_DOMAIN_MEMBERS
= 515;
213 const int DOMAIN_RID_DCS
= 516;
214 const int DOMAIN_RID_CERT_ADMINS
= 517;
215 const int DOMAIN_RID_SCHEMA_ADMINS
= 518;
216 const int DOMAIN_RID_ENTERPRISE_ADMINS
= 519;
220 privilege IDs. Please keep the IDs below 64. If we get more
221 than 64 then we need to change security_token
224 SEC_PRIV_SECURITY
= 1,
226 SEC_PRIV_RESTORE
= 3,
227 SEC_PRIV_SYSTEMTIME
= 4,
228 SEC_PRIV_SHUTDOWN
= 5,
229 SEC_PRIV_REMOTE_SHUTDOWN
= 6,
230 SEC_PRIV_TAKE_OWNERSHIP
= 7,
232 SEC_PRIV_SYSTEM_ENVIRONMENT
= 9,
233 SEC_PRIV_SYSTEM_PROFILE
= 10,
234 SEC_PRIV_PROFILE_SINGLE_PROCESS
= 11,
235 SEC_PRIV_INCREASE_BASE_PRIORITY
= 12,
236 SEC_PRIV_LOAD_DRIVER
= 13,
237 SEC_PRIV_CREATE_PAGEFILE
= 14,
238 SEC_PRIV_INCREASE_QUOTA
= 15,
239 SEC_PRIV_CHANGE_NOTIFY
= 16,
240 SEC_PRIV_UNDOCK
= 17,
241 SEC_PRIV_MANAGE_VOLUME
= 18,
242 SEC_PRIV_IMPERSONATE
= 19,
243 SEC_PRIV_CREATE_GLOBAL
= 20,
244 SEC_PRIV_ENABLE_DELEGATION
= 21,
245 SEC_PRIV_INTERACTIVE_LOGON
= 22,
246 SEC_PRIV_NETWORK_LOGON
= 23,
247 SEC_PRIV_REMOTE_INTERACTIVE_LOGON
= 24
250 typedef [bitmap8bit
] bitmap
{
251 SEC_ACE_FLAG_OBJECT_INHERIT
= 0x01,
252 SEC_ACE_FLAG_CONTAINER_INHERIT
= 0x02,
253 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
= 0x04,
254 SEC_ACE_FLAG_INHERIT_ONLY
= 0x08,
255 SEC_ACE_FLAG_INHERITED_ACE
= 0x10,
256 SEC_ACE_FLAG_VALID_INHERIT
= 0x0f,
257 SEC_ACE_FLAG_SUCCESSFUL_ACCESS
= 0x40,
258 SEC_ACE_FLAG_FAILED_ACCESS
= 0x80
259 } security_ace_flags
;
261 typedef [enum8bit
] enum {
262 SEC_ACE_TYPE_ACCESS_ALLOWED
= 0,
263 SEC_ACE_TYPE_ACCESS_DENIED
= 1,
264 SEC_ACE_TYPE_SYSTEM_AUDIT
= 2,
265 SEC_ACE_TYPE_SYSTEM_ALARM
= 3,
266 SEC_ACE_TYPE_ALLOWED_COMPOUND
= 4,
267 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
= 5,
268 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
= 6,
269 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
= 7,
270 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
= 8
273 typedef [bitmap32bit
] bitmap
{
274 SEC_ACE_OBJECT_TYPE_PRESENT
= 0x00000001,
275 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
= 0x00000002
276 } security_ace_object_flags
;
278 typedef [nodiscriminant
] union {
279 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
280 [case(SEC_ACE_OBJECT_TYPE_PRESENT
)] GUID type
;
282 } security_ace_object_type
;
284 typedef [nodiscriminant
] union {
285 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
286 * (of the parent container)
288 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] GUID inherited_type
;
290 } security_ace_object_inherited_type
;
293 security_ace_object_flags flags
;
294 [switch_is(flags
& SEC_ACE_OBJECT_TYPE_PRESENT
)] security_ace_object_type type
;
295 [switch_is(flags
& SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] security_ace_object_inherited_type inherited_type
;
296 } security_ace_object
;
298 typedef [nodiscriminant
] union {
299 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
)] security_ace_object
object;
300 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
)] security_ace_object
object;
301 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
)] security_ace_object
object;
302 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
)] security_ace_object
object;
304 } security_ace_object_ctr
;
306 typedef [public,nopull
,gensize
,nosize
] struct {
307 security_ace_type type
; /* SEC_ACE_TYPE_* */
308 security_ace_flags flags
; /* SEC_ACE_FLAG_* */
309 [value
(ndr_size_security_ace
(r
,ndr
->flags
))] uint16 size
;
311 [switch_is(type
)] security_ace_object_ctr
object;
316 SECURITY_ACL_REVISION_NT4
= 2,
317 SECURITY_ACL_REVISION_ADS
= 4
318 } security_acl_revision
;
320 const uint NT4_ACL_REVISION
= SECURITY_ACL_REVISION_NT4
;
322 typedef [public,gensize
,nosize
] struct {
323 security_acl_revision revision
;
324 [value
(ndr_size_security_acl
(r
,ndr
->flags
))] uint16 size
;
325 [range(0,1000)] uint32 num_aces
;
326 security_ace aces
[num_aces
];
329 /* default revision for new ACLs */
330 typedef [enum8bit
] enum {
331 SECURITY_DESCRIPTOR_REVISION_1
= 1
332 } security_descriptor_revision
;
334 const int SD_REVISION
= SECURITY_DESCRIPTOR_REVISION_1
;
336 /* security_descriptor->type bits */
337 typedef [bitmap16bit
] bitmap
{
338 SEC_DESC_OWNER_DEFAULTED
= 0x0001,
339 SEC_DESC_GROUP_DEFAULTED
= 0x0002,
340 SEC_DESC_DACL_PRESENT
= 0x0004,
341 SEC_DESC_DACL_DEFAULTED
= 0x0008,
342 SEC_DESC_SACL_PRESENT
= 0x0010,
343 SEC_DESC_SACL_DEFAULTED
= 0x0020,
344 SEC_DESC_DACL_TRUSTED
= 0x0040,
345 SEC_DESC_SERVER_SECURITY
= 0x0080,
346 SEC_DESC_DACL_AUTO_INHERIT_REQ
= 0x0100,
347 SEC_DESC_SACL_AUTO_INHERIT_REQ
= 0x0200,
348 SEC_DESC_DACL_AUTO_INHERITED
= 0x0400,
349 SEC_DESC_SACL_AUTO_INHERITED
= 0x0800,
350 SEC_DESC_DACL_PROTECTED
= 0x1000,
351 SEC_DESC_SACL_PROTECTED
= 0x2000,
352 SEC_DESC_RM_CONTROL_VALID
= 0x4000,
353 SEC_DESC_SELF_RELATIVE
= 0x8000
354 } security_descriptor_type
;
356 typedef [gensize
,nosize
,public,flag
(NDR_LITTLE_ENDIAN
)] struct {
357 security_descriptor_revision revision
;
358 security_descriptor_type type
; /* SEC_DESC_xxxx flags */
359 [relative
] dom_sid
*owner_sid
;
360 [relative
] dom_sid
*group_sid
;
361 [relative
] security_acl
*sacl
; /* system ACL */
362 [relative
] security_acl
*dacl
; /* user (discretionary) ACL */
363 } security_descriptor
;
365 typedef [public] struct {
366 [range(0,0x40000),value
(ndr_size_security_descriptor
(sd
,ndr
->flags
))] uint32 sd_size
;
367 [subcontext
(4)] security_descriptor
*sd
;
370 typedef [public] struct {
374 [size_is(num_sids
)] dom_sid
*sids
[*];
375 udlong privilege_mask
;
378 /* bits that determine which parts of a security descriptor
379 are being queried/set */
380 typedef [public,bitmap32bit
] bitmap
{
381 SECINFO_OWNER
= 0x00000001,
382 SECINFO_GROUP
= 0x00000002,
383 SECINFO_DACL
= 0x00000004,
384 SECINFO_SACL
= 0x00000008,
385 SECINFO_UNPROTECTED_SACL
= 0x10000000,
386 SECINFO_UNPROTECTED_DACL
= 0x20000000,
387 SECINFO_PROTECTED_SACL
= 0x40000000,
388 SECINFO_PROTECTED_DACL
= 0x80000000