4 security IDL structures
8 pointer_default(unique),
14 access masks are divided up like this:
17 a = generic rights bits SEC_GENERIC_
19 c = standard rights bits SEC_STD_
20 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
22 common combinations of bits are prefixed with SEC_RIGHTS_
24 const int SEC_MASK_GENERIC
= 0xF0000000;
25 const int SEC_MASK_FLAGS
= 0x0F000000;
26 const int SEC_MASK_STANDARD
= 0x00FF0000;
27 const int SEC_MASK_SPECIFIC
= 0x0000FFFF;
30 const int SEC_GENERIC_ALL
= 0x10000000;
31 const int SEC_GENERIC_EXECUTE
= 0x20000000;
32 const int SEC_GENERIC_WRITE
= 0x40000000;
33 const int SEC_GENERIC_READ
= 0x80000000;
36 const int SEC_FLAG_SYSTEM_SECURITY
= 0x01000000;
37 const int SEC_FLAG_MAXIMUM_ALLOWED
= 0x02000000;
40 const int SEC_STD_DELETE
= 0x00010000;
41 const int SEC_STD_READ_CONTROL
= 0x00020000;
42 const int SEC_STD_WRITE_DAC
= 0x00040000;
43 const int SEC_STD_WRITE_OWNER
= 0x00080000;
44 const int SEC_STD_SYNCHRONIZE
= 0x00100000;
45 const int SEC_STD_REQUIRED
= 0x000F0000;
46 const int SEC_STD_ALL
= 0x001F0000;
48 /* file specific bits */
49 const int SEC_FILE_READ_DATA
= 0x00000001;
50 const int SEC_FILE_WRITE_DATA
= 0x00000002;
51 const int SEC_FILE_APPEND_DATA
= 0x00000004;
52 const int SEC_FILE_READ_EA
= 0x00000008;
53 const int SEC_FILE_WRITE_EA
= 0x00000010;
54 const int SEC_FILE_EXECUTE
= 0x00000020;
55 const int SEC_FILE_READ_ATTRIBUTE
= 0x00000080;
56 const int SEC_FILE_WRITE_ATTRIBUTE
= 0x00000100;
57 const int SEC_FILE_ALL
= 0x000001ff;
59 /* directory specific bits */
60 const int SEC_DIR_LIST
= 0x00000001;
61 const int SEC_DIR_ADD_FILE
= 0x00000002;
62 const int SEC_DIR_ADD_SUBDIR
= 0x00000004;
63 const int SEC_DIR_READ_EA
= 0x00000008;
64 const int SEC_DIR_WRITE_EA
= 0x00000010;
65 const int SEC_DIR_TRAVERSE
= 0x00000020;
66 const int SEC_DIR_DELETE_CHILD
= 0x00000040;
67 const int SEC_DIR_READ_ATTRIBUTE
= 0x00000080;
68 const int SEC_DIR_WRITE_ATTRIBUTE
= 0x00000100;
70 /* registry entry specific bits */
71 const int SEC_REG_QUERY_VALUE
= 0x00000001;
72 const int SEC_REG_SET_VALUE
= 0x00000002;
73 const int SEC_REG_CREATE_SUBKEY
= 0x00000004;
74 const int SEC_REG_ENUM_SUBKEYS
= 0x00000008;
75 const int SEC_REG_NOTIFY
= 0x00000010;
76 const int SEC_REG_CREATE_LINK
= 0x00000020;
78 /* ldap specific access bits */
79 const int SEC_ADS_CREATE_CHILD
= 0x00000001;
80 const int SEC_ADS_DELETE_CHILD
= 0x00000002;
81 const int SEC_ADS_LIST
= 0x00000004;
82 const int SEC_ADS_SELF_WRITE
= 0x00000008;
83 const int SEC_ADS_READ_PROP
= 0x00000010;
84 const int SEC_ADS_WRITE_PROP
= 0x00000020;
85 const int SEC_ADS_DELETE_TREE
= 0x00000040;
86 const int SEC_ADS_LIST_OBJECT
= 0x00000080;
87 const int SEC_ADS_CONTROL_ACCESS
= 0x00000100;
89 /* generic->specific mappings for files */
90 const int SEC_RIGHTS_FILE_READ
= SEC_STD_READ_CONTROL |
93 SEC_FILE_READ_ATTRIBUTE |
96 const int SEC_RIGHTS_FILE_WRITE
= SEC_STD_READ_CONTROL |
99 SEC_FILE_WRITE_ATTRIBUTE |
101 SEC_FILE_APPEND_DATA
;
103 const int SEC_RIGHTS_FILE_EXECUTE
= SEC_STD_SYNCHRONIZE |
104 SEC_STD_READ_CONTROL |
105 SEC_FILE_READ_ATTRIBUTE |
108 const int SEC_RIGHTS_FILE_ALL
= SEC_STD_ALL | SEC_FILE_ALL
;
110 /* generic->specific mappings for directories (same as files) */
111 const int SEC_RIGHTS_DIR_READ
= SEC_RIGHTS_FILE_READ
;
112 const int SEC_RIGHTS_DIR_WRITE
= SEC_RIGHTS_FILE_WRITE
;
113 const int SEC_RIGHTS_DIR_EXECUTE
= SEC_RIGHTS_FILE_EXECUTE
;
114 const int SEC_RIGHTS_DIR_ALL
= SEC_RIGHTS_FILE_ALL
;
117 /***************************************************************/
118 /* WELL KNOWN SIDS */
121 const string SID_NULL
= "S-1-0-0";
123 /* the world domain */
124 const string SID_WORLD_DOMAIN
= "S-1-1";
125 const string SID_WORLD
= "S-1-1-0";
127 /* SECURITY_CREATOR_SID_AUTHORITY */
128 const string SID_CREATOR_OWNER_DOMAIN
= "S-1-3";
129 const string SID_CREATOR_OWNER
= "S-1-3-0";
130 const string SID_CREATOR_GROUP
= "S-1-3-1";
132 /* SECURITY_NT_AUTHORITY */
133 const string SID_NT_AUTHORITY
= "S-1-5";
134 const string SID_NT_DIALUP
= "S-1-5-1";
135 const string SID_NT_NETWORK
= "S-1-5-2";
136 const string SID_NT_BATCH
= "S-1-5-3";
137 const string SID_NT_INTERACTIVE
= "S-1-5-4";
138 const string SID_NT_SERVICE
= "S-1-5-6";
139 const string SID_NT_ANONYMOUS
= "S-1-5-7";
140 const string SID_NT_PROXY
= "S-1-5-8";
141 const string SID_NT_ENTERPRISE_DCS
= "S-1-5-9";
142 const string SID_NT_SELF
= "S-1-5-10";
143 const string SID_NT_AUTHENTICATED_USERS
= "S-1-5-11";
144 const string SID_NT_RESTRICTED
= "S-1-5-12";
145 const string SID_NT_TERMINAL_SERVER_USERS
= "S-1-5-13";
146 const string SID_NT_REMOTE_INTERACTIVE
= "S-1-5-14";
147 const string SID_NT_THIS_ORGANISATION
= "S-1-5-15";
148 const string SID_NT_SYSTEM
= "S-1-5-18";
149 const string SID_NT_LOCAL_SERVICE
= "S-1-5-19";
150 const string SID_NT_NETWORK_SERVICE
= "S-1-5-20";
152 /* SECURITY_BUILTIN_DOMAIN_RID */
153 const string SID_BUILTIN
= "S-1-5-32";
154 const string SID_BUILTIN_ADMINISTRATORS
= "S-1-5-32-544";
155 const string SID_BUILTIN_USERS
= "S-1-5-32-545";
156 const string SID_BUILTIN_GUESTS
= "S-1-5-32-546";
157 const string SID_BUILTIN_POWER_USERS
= "S-1-5-32-547";
158 const string SID_BUILTIN_ACCOUNT_OPERATORS
= "S-1-5-32-548";
159 const string SID_BUILTIN_SERVER_OPERATORS
= "S-1-5-32-549";
160 const string SID_BUILTIN_PRINT_OPERATORS
= "S-1-5-32-550";
161 const string SID_BUILTIN_BACKUP_OPERATORS
= "S-1-5-32-551";
162 const string SID_BUILTIN_REPLICATOR
= "S-1-5-32-552";
163 const string SID_BUILTIN_RAS_SERVERS
= "S-1-5-32-553";
164 const string SID_BUILTIN_PREW2K
= "S-1-5-32-554";
166 /* well-known domain RIDs */
167 const int DOMAIN_RID_LOGON
= 9;
168 const int DOMAIN_RID_ADMINISTRATOR
= 500;
169 const int DOMAIN_RID_GUEST
= 501;
170 const int DOMAIN_RID_ADMINS
= 512;
171 const int DOMAIN_RID_USERS
= 513;
172 const int DOMAIN_RID_DCS
= 516;
173 const int DOMAIN_RID_CERT_ADMINS
= 517;
174 const int DOMAIN_RID_SCHEMA_ADMINS
= 518;
175 const int DOMAIN_RID_ENTERPRISE_ADMINS
= 519;
179 privilege IDs. Please keep the IDs below 64. If we get more
180 than 64 then we need to change security_token
183 SEC_PRIV_SECURITY
= 1,
185 SEC_PRIV_RESTORE
= 3,
186 SEC_PRIV_SYSTEMTIME
= 4,
187 SEC_PRIV_SHUTDOWN
= 5,
188 SEC_PRIV_REMOTE_SHUTDOWN
= 6,
189 SEC_PRIV_TAKE_OWNERSHIP
= 7,
191 SEC_PRIV_SYSTEM_ENVIRONMENT
= 9,
192 SEC_PRIV_SYSTEM_PROFILE
= 10,
193 SEC_PRIV_PROFILE_SINGLE_PROCESS
= 11,
194 SEC_PRIV_INCREASE_BASE_PRIORITY
= 12,
195 SEC_PRIV_LOAD_DRIVER
= 13,
196 SEC_PRIV_CREATE_PAGEFILE
= 14,
197 SEC_PRIV_INCREASE_QUOTA
= 15,
198 SEC_PRIV_CHANGE_NOTIFY
= 16,
199 SEC_PRIV_UNDOCK
= 17,
200 SEC_PRIV_MANAGE_VOLUME
= 18,
201 SEC_PRIV_IMPERSONATE
= 19,
202 SEC_PRIV_CREATE_GLOBAL
= 20,
203 SEC_PRIV_ENABLE_DELEGATION
= 21,
204 SEC_PRIV_INTERACTIVE_LOGON
= 22,
205 SEC_PRIV_NETWORK_LOGON
= 23,
206 SEC_PRIV_REMOTE_INTERACTIVE_LOGON
= 24
210 /* a domain SID. Note that unlike Samba3 this contains a pointer,
211 so you can't copy them using assignment */
212 typedef [public,gensize
,noprint
,noejs
,nosize
] struct {
213 uint8 sid_rev_num
; /**< SID revision number */
214 [range(0,15)] int8 num_auths
; /**< Number of sub-authorities */
215 uint8 id_auth
[6]; /**< Identifier Authority */
216 uint32 sub_auths
[num_auths
];
219 typedef [bitmap8bit
] bitmap
{
220 SEC_ACE_FLAG_OBJECT_INHERIT
= 0x01,
221 SEC_ACE_FLAG_CONTAINER_INHERIT
= 0x02,
222 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
= 0x04,
223 SEC_ACE_FLAG_INHERIT_ONLY
= 0x08,
224 SEC_ACE_FLAG_INHERITED_ACE
= 0x10,
225 SEC_ACE_FLAG_VALID_INHERIT
= 0x0f,
226 SEC_ACE_FLAG_SUCCESSFUL_ACCESS
= 0x40,
227 SEC_ACE_FLAG_FAILED_ACCESS
= 0x80
228 } security_ace_flags
;
230 typedef [enum8bit
] enum {
231 SEC_ACE_TYPE_ACCESS_ALLOWED
= 0,
232 SEC_ACE_TYPE_ACCESS_DENIED
= 1,
233 SEC_ACE_TYPE_SYSTEM_AUDIT
= 2,
234 SEC_ACE_TYPE_SYSTEM_ALARM
= 3,
235 SEC_ACE_TYPE_ALLOWED_COMPOUND
= 4,
236 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
= 5,
237 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
= 6,
238 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
= 7,
239 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
= 8
243 SEC_ACE_OBJECT_TYPE_PRESENT
= 0x00000001,
244 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
= 0x00000002
245 } security_ace_object_flags
;
247 typedef [nodiscriminant
] union {
248 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
249 [case(SEC_ACE_OBJECT_TYPE_PRESENT
)] GUID type
;
251 } security_ace_object_type
;
253 typedef [nodiscriminant
] union {
254 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
255 * (of the parent container)
257 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] GUID inherited_type
;
259 } security_ace_object_inherited_type
;
262 security_ace_object_flags flags
;
263 [switch_is(flags
& SEC_ACE_OBJECT_TYPE_PRESENT
)] security_ace_object_type type
;
264 [switch_is(flags
& SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] security_ace_object_inherited_type inherited_type
;
265 } security_ace_object
;
267 typedef [nodiscriminant
] union {
268 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
)] security_ace_object
object;
269 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
)] security_ace_object
object;
270 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
)] security_ace_object
object;
271 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
)] security_ace_object
object;
273 } security_ace_object_ctr
;
275 typedef [public,gensize
,nosize
] struct {
276 security_ace_type type
; /* SEC_ACE_TYPE_* */
277 security_ace_flags flags
; /* SEC_ACE_FLAG_* */
278 [value
(ndr_size_security_ace
(r
,ndr
->flags
))] uint16 size
;
280 [switch_is(type
)] security_ace_object_ctr
object;
285 SECURITY_ACL_REVISION_NT4
= 2,
286 SECURITY_ACL_REVISION_ADS
= 4
287 } security_acl_revision
;
289 const uint NT4_ACL_REVISION
= SECURITY_ACL_REVISION_NT4
;
291 typedef [public,gensize
,nosize
] struct {
292 security_acl_revision revision
;
293 [value
(ndr_size_security_acl
(r
,ndr
->flags
))] uint16 size
;
294 [range(0,1000)] uint32 num_aces
;
295 security_ace aces
[num_aces
];
298 /* default revision for new ACLs */
299 typedef [enum8bit
] enum {
300 SECURITY_DESCRIPTOR_REVISION_1
= 1
301 } security_descriptor_revision
;
303 const int SD_REVISION
= SECURITY_DESCRIPTOR_REVISION_1
;
305 /* security_descriptor->type bits */
306 typedef [bitmap16bit
] bitmap
{
307 SEC_DESC_OWNER_DEFAULTED
= 0x0001,
308 SEC_DESC_GROUP_DEFAULTED
= 0x0002,
309 SEC_DESC_DACL_PRESENT
= 0x0004,
310 SEC_DESC_DACL_DEFAULTED
= 0x0008,
311 SEC_DESC_SACL_PRESENT
= 0x0010,
312 SEC_DESC_SACL_DEFAULTED
= 0x0020,
313 SEC_DESC_DACL_TRUSTED
= 0x0040,
314 SEC_DESC_SERVER_SECURITY
= 0x0080,
315 SEC_DESC_DACL_AUTO_INHERIT_REQ
= 0x0100,
316 SEC_DESC_SACL_AUTO_INHERIT_REQ
= 0x0200,
317 SEC_DESC_DACL_AUTO_INHERITED
= 0x0400,
318 SEC_DESC_SACL_AUTO_INHERITED
= 0x0800,
319 SEC_DESC_DACL_PROTECTED
= 0x1000,
320 SEC_DESC_SACL_PROTECTED
= 0x2000,
321 SEC_DESC_RM_CONTROL_VALID
= 0x4000,
322 SEC_DESC_SELF_RELATIVE
= 0x8000
323 } security_descriptor_type
;
325 typedef [gensize
,nosize
,public,flag
(NDR_LITTLE_ENDIAN
)] struct {
326 security_descriptor_revision revision
;
327 security_descriptor_type type
; /* SEC_DESC_xxxx flags */
328 [relative
] dom_sid
*owner_sid
;
329 [relative
] dom_sid
*group_sid
;
330 [relative
] security_acl
*sacl
; /* system ACL */
331 [relative
] security_acl
*dacl
; /* user (discretionary) ACL */
332 } security_descriptor
;
334 typedef [public] struct {
335 [range(0,0x40000),value
(ndr_size_security_descriptor
(sd
,ndr
->flags
))] uint32 sd_size
;
336 [subcontext
(4)] security_descriptor
*sd
;
339 typedef [public] struct {
343 [size_is(num_sids
)] dom_sid
*sids
[*];
344 udlong privilege_mask
;
347 /* bits that determine which parts of a security descriptor
348 are being queried/set */
349 typedef [public,bitmap32bit
] bitmap
{
350 SECINFO_OWNER
= 0x00000001,
351 SECINFO_GROUP
= 0x00000002,
352 SECINFO_DACL
= 0x00000004,
353 SECINFO_SACL
= 0x00000008