?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
LSA Patch for User Manager
[Samba/ekacnet.git] / source4 / librpc / idl / security.idl
blob40aa698176684266168715c955c909b1c2102e0b
1 #include "idl_types.h"
2
3 /*
4 security IDL structures
5 */
6
7 import "misc.idl";
8
9 /*
10 use the same structure for dom_sid2 as dom_sid. A dom_sid2 is really
11 just a dom sid, but with the sub_auths represented as a conformant
12 array. As with all in-structure conformant arrays, the array length
13 is placed before the start of the structure. That's what gives rise
14 to the extra num_auths elemenent. We don't want the Samba code to
15 have to bother with such esoteric NDR details, so its easier to just
16 define it as a dom_sid and use pidl magic to make it all work. It
17 just means you need to mark a sid as a "dom_sid2" in the IDL when you
18 know it is of the conformant array variety
19 */
20 cpp_quote("#define dom_sid2 dom_sid")
21
22 /* same struct as dom_sid but inside a 28 bytes fixed buffer in NDR */
23 cpp_quote("#define dom_sid28 dom_sid")
24
25 /* same struct as dom_sid but in a variable byte buffer, which is maybe empty in NDR */
26 cpp_quote("#define dom_sid0 dom_sid")
27
28 [
29 pointer_default(unique)
30 ]
31 interface security
32 {
33 /*
34 access masks are divided up like this:
35 0xabccdddd
36 where
37 a = generic rights bits SEC_GENERIC_
38 b = flags SEC_FLAG_
39 c = standard rights bits SEC_STD_
40 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
41
42 common combinations of bits are prefixed with SEC_RIGHTS_
43 */
44 const int SEC_MASK_GENERIC = 0xF0000000;
45 const int SEC_MASK_FLAGS = 0x0F000000;
46 const int SEC_MASK_STANDARD = 0x00FF0000;
47 const int SEC_MASK_SPECIFIC = 0x0000FFFF;
48
49 /* generic bits */
50 const int SEC_GENERIC_ALL = 0x10000000;
51 const int SEC_GENERIC_EXECUTE = 0x20000000;
52 const int SEC_GENERIC_WRITE = 0x40000000;
53 const int SEC_GENERIC_READ = 0x80000000;
54
55 /* flag bits */
56 const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
57 const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
58
59 /* standard bits */
60 const int SEC_STD_DELETE = 0x00010000;
61 const int SEC_STD_READ_CONTROL = 0x00020000;
62 const int SEC_STD_WRITE_DAC = 0x00040000;
63 const int SEC_STD_WRITE_OWNER = 0x00080000;
64 const int SEC_STD_SYNCHRONIZE = 0x00100000;
65 const int SEC_STD_REQUIRED = 0x000F0000;
66 const int SEC_STD_ALL = 0x001F0000;
67
68 /* file specific bits */
69 const int SEC_FILE_READ_DATA = 0x00000001;
70 const int SEC_FILE_WRITE_DATA = 0x00000002;
71 const int SEC_FILE_APPEND_DATA = 0x00000004;
72 const int SEC_FILE_READ_EA = 0x00000008;
73 const int SEC_FILE_WRITE_EA = 0x00000010;
74 const int SEC_FILE_EXECUTE = 0x00000020;
75 const int SEC_FILE_READ_ATTRIBUTE = 0x00000080;
76 const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
77 const int SEC_FILE_ALL = 0x000001ff;
78
79 /* directory specific bits */
80 const int SEC_DIR_LIST = 0x00000001;
81 const int SEC_DIR_ADD_FILE = 0x00000002;
82 const int SEC_DIR_ADD_SUBDIR = 0x00000004;
83 const int SEC_DIR_READ_EA = 0x00000008;
84 const int SEC_DIR_WRITE_EA = 0x00000010;
85 const int SEC_DIR_TRAVERSE = 0x00000020;
86 const int SEC_DIR_DELETE_CHILD = 0x00000040;
87 const int SEC_DIR_READ_ATTRIBUTE = 0x00000080;
88 const int SEC_DIR_WRITE_ATTRIBUTE = 0x00000100;
89
90 /* registry entry specific bits */
91 const int SEC_REG_QUERY_VALUE = 0x00000001;
92 const int SEC_REG_SET_VALUE = 0x00000002;
93 const int SEC_REG_CREATE_SUBKEY = 0x00000004;
94 const int SEC_REG_ENUM_SUBKEYS = 0x00000008;
95 const int SEC_REG_NOTIFY = 0x00000010;
96 const int SEC_REG_CREATE_LINK = 0x00000020;
97
98 /* ldap specific access bits */
99 const int SEC_ADS_CREATE_CHILD = 0x00000001;
100 const int SEC_ADS_DELETE_CHILD = 0x00000002;
101 const int SEC_ADS_LIST = 0x00000004;
102 const int SEC_ADS_SELF_WRITE = 0x00000008;
103 const int SEC_ADS_READ_PROP = 0x00000010;
104 const int SEC_ADS_WRITE_PROP = 0x00000020;
105 const int SEC_ADS_DELETE_TREE = 0x00000040;
106 const int SEC_ADS_LIST_OBJECT = 0x00000080;
107 const int SEC_ADS_CONTROL_ACCESS = 0x00000100;
108
109 /* invalid bits */
110 const int SEC_MASK_INVALID = 0x0ce0fe00;
111
112 /* generic->specific mappings for files */
113 const int SEC_RIGHTS_FILE_READ = SEC_STD_READ_CONTROL |
114 SEC_STD_SYNCHRONIZE |
115 SEC_FILE_READ_DATA |
116 SEC_FILE_READ_ATTRIBUTE |
117 SEC_FILE_READ_EA;
118
119 const int SEC_RIGHTS_FILE_WRITE = SEC_STD_READ_CONTROL |
120 SEC_STD_SYNCHRONIZE |
121 SEC_FILE_WRITE_DATA |
122 SEC_FILE_WRITE_ATTRIBUTE |
123 SEC_FILE_WRITE_EA |
124 SEC_FILE_APPEND_DATA;
125
126 const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
127 SEC_STD_READ_CONTROL |
128 SEC_FILE_READ_ATTRIBUTE |
129 SEC_FILE_EXECUTE;
130
131 const int SEC_RIGHTS_FILE_ALL = SEC_STD_ALL | SEC_FILE_ALL;
132
133 /* generic->specific mappings for directories (same as files) */
134 const int SEC_RIGHTS_DIR_READ = SEC_RIGHTS_FILE_READ;
135 const int SEC_RIGHTS_DIR_WRITE = SEC_RIGHTS_FILE_WRITE;
136 const int SEC_RIGHTS_DIR_EXECUTE = SEC_RIGHTS_FILE_EXECUTE;
137 const int SEC_RIGHTS_DIR_ALL = SEC_RIGHTS_FILE_ALL;
138
139
140 /***************************************************************/
141 /* WELL KNOWN SIDS */
142
143 /* a NULL sid */
144 const string SID_NULL = "S-1-0-0";
145
146 /* the world domain */
147 const string NAME_WORLD = "WORLD";
148
149 const string SID_WORLD_DOMAIN = "S-1-1";
150 const string SID_WORLD = "S-1-1-0";
151
152 /* SECURITY_CREATOR_SID_AUTHORITY */
153 const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
154 const string SID_CREATOR_OWNER = "S-1-3-0";
155 const string SID_CREATOR_GROUP = "S-1-3-1";
156 const string SID_OWNER_RIGHTS = "S-1-3-4";
157
158 /* SECURITY_NT_AUTHORITY */
159 const string NAME_NT_AUTHORITY = "NT AUTHORITY";
160
161 const string SID_NT_AUTHORITY = "S-1-5";
162 const string SID_NT_DIALUP = "S-1-5-1";
163 const string SID_NT_NETWORK = "S-1-5-2";
164 const string SID_NT_BATCH = "S-1-5-3";
165 const string SID_NT_INTERACTIVE = "S-1-5-4";
166 const string SID_NT_SERVICE = "S-1-5-6";
167 const string SID_NT_ANONYMOUS = "S-1-5-7";
168 const string SID_NT_PROXY = "S-1-5-8";
169 const string SID_NT_ENTERPRISE_DCS = "S-1-5-9";
170 const string SID_NT_SELF = "S-1-5-10";
171 const string SID_NT_AUTHENTICATED_USERS = "S-1-5-11";
172 const string SID_NT_RESTRICTED = "S-1-5-12";
173 const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
174 const string SID_NT_REMOTE_INTERACTIVE = "S-1-5-14";
175 const string SID_NT_THIS_ORGANISATION = "S-1-5-15";
176 const string SID_NT_IUSR = "S-1-5-17";
177 const string SID_NT_SYSTEM = "S-1-5-18";
178 const string SID_NT_LOCAL_SERVICE = "S-1-5-19";
179 const string SID_NT_NETWORK_SERVICE = "S-1-5-20";
180 const string SID_NT_DIGEST_AUTHENTICATION = "S-1-5-64-21";
181 const string SID_NT_NTLM_AUTHENTICATION = "S-1-5-64-10";
182 const string SID_NT_SCHANNEL_AUTHENTICATION = "S-1-5-64-14";
183 const string SID_NT_OTHER_ORGANISATION = "S-1-5-1000";
184
185 /* SECURITY_BUILTIN_DOMAIN_RID */
186 const string NAME_BUILTIN = "BUILTIN";
187
188 const string SID_BUILTIN = "S-1-5-32";
189 const string SID_BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
190 const string SID_BUILTIN_USERS = "S-1-5-32-545";
191 const string SID_BUILTIN_GUESTS = "S-1-5-32-546";
192 const string SID_BUILTIN_POWER_USERS = "S-1-5-32-547";
193 const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
194 const string SID_BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
195 const string SID_BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
196 const string SID_BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
197 const string SID_BUILTIN_REPLICATOR = "S-1-5-32-552";
198 const string SID_BUILTIN_RAS_SERVERS = "S-1-5-32-553";
199 const string SID_BUILTIN_PREW2K = "S-1-5-32-554";
200
201 /* well-known domain RIDs */
202 const int DOMAIN_RID_LOGON = 9;
203 const int DOMAIN_RID_ADMINISTRATOR = 500;
204 const int DOMAIN_RID_GUEST = 501;
205 const int DOMAIN_RID_ADMINS = 512;
206 const int DOMAIN_RID_USERS = 513;
207 const int DOMAIN_RID_DOMAIN_MEMBERS = 515;
208 const int DOMAIN_RID_DCS = 516;
209 const int DOMAIN_RID_CERT_ADMINS = 517;
210 const int DOMAIN_RID_SCHEMA_ADMINS = 518;
211 const int DOMAIN_RID_ENTERPRISE_ADMINS = 519;
212
213
214 /*
215 privilege IDs. Please keep the IDs below 64. If we get more
216 than 64 then we need to change security_token
217 */
218 typedef enum {
219 SEC_PRIV_SECURITY = 1,
220 SEC_PRIV_BACKUP = 2,
221 SEC_PRIV_RESTORE = 3,
222 SEC_PRIV_SYSTEMTIME = 4,
223 SEC_PRIV_SHUTDOWN = 5,
224 SEC_PRIV_REMOTE_SHUTDOWN = 6,
225 SEC_PRIV_TAKE_OWNERSHIP = 7,
226 SEC_PRIV_DEBUG = 8,
227 SEC_PRIV_SYSTEM_ENVIRONMENT = 9,
228 SEC_PRIV_SYSTEM_PROFILE = 10,
229 SEC_PRIV_PROFILE_SINGLE_PROCESS = 11,
230 SEC_PRIV_INCREASE_BASE_PRIORITY = 12,
231 SEC_PRIV_LOAD_DRIVER = 13,
232 SEC_PRIV_CREATE_PAGEFILE = 14,
233 SEC_PRIV_INCREASE_QUOTA = 15,
234 SEC_PRIV_CHANGE_NOTIFY = 16,
235 SEC_PRIV_UNDOCK = 17,
236 SEC_PRIV_MANAGE_VOLUME = 18,
237 SEC_PRIV_IMPERSONATE = 19,
238 SEC_PRIV_CREATE_GLOBAL = 20,
239 SEC_PRIV_ENABLE_DELEGATION = 21,
240 SEC_PRIV_INTERACTIVE_LOGON = 22,
241 SEC_PRIV_NETWORK_LOGON = 23,
242 SEC_PRIV_REMOTE_INTERACTIVE_LOGON = 24
243 } sec_privilege;
244
245
246 /* a domain SID. Note that unlike Samba3 this contains a pointer,
247 so you can't copy them using assignment */
248 typedef [public,gensize,noprint,noejs,nosize] struct {
249 uint8 sid_rev_num; /**< SID revision number */
250 [range(0,15)] int8 num_auths; /**< Number of sub-authorities */
251 uint8 id_auth[6]; /**< Identifier Authority */
252 uint32 sub_auths[num_auths];
253 } dom_sid;
254
255 /* id used to identify a endpoint, possibly in a cluster */
256 typedef [public] struct {
257 hyper id;
258 uint32 id2;
259 uint32 node;
260 } server_id;
261
262 typedef [bitmap8bit] bitmap {
263 SEC_ACE_FLAG_OBJECT_INHERIT = 0x01,
264 SEC_ACE_FLAG_CONTAINER_INHERIT = 0x02,
265 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT = 0x04,
266 SEC_ACE_FLAG_INHERIT_ONLY = 0x08,
267 SEC_ACE_FLAG_INHERITED_ACE = 0x10,
268 SEC_ACE_FLAG_VALID_INHERIT = 0x0f,
269 SEC_ACE_FLAG_SUCCESSFUL_ACCESS = 0x40,
270 SEC_ACE_FLAG_FAILED_ACCESS = 0x80
271 } security_ace_flags;
272
273 typedef [enum8bit] enum {
274 SEC_ACE_TYPE_ACCESS_ALLOWED = 0,
275 SEC_ACE_TYPE_ACCESS_DENIED = 1,
276 SEC_ACE_TYPE_SYSTEM_AUDIT = 2,
277 SEC_ACE_TYPE_SYSTEM_ALARM = 3,
278 SEC_ACE_TYPE_ALLOWED_COMPOUND = 4,
279 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT = 5,
280 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT = 6,
281 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT = 7,
282 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT = 8
283 } security_ace_type;
284
285 typedef [bitmap32bit] bitmap {
286 SEC_ACE_OBJECT_TYPE_PRESENT = 0x00000001,
287 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x00000002
288 } security_ace_object_flags;
289
290 typedef [nodiscriminant] union {
291 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
292 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
293 [default];
294 } security_ace_object_type;
295
296 typedef [nodiscriminant] union {
297 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
298 * (of the parent container)
299 */
300 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
301 [default];
302 } security_ace_object_inherited_type;
303
304 typedef struct {
305 security_ace_object_flags flags;
306 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
307 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
308 } security_ace_object;
309
310 typedef [nodiscriminant] union {
311 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
312 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
313 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
314 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
315 [default];
316 } security_ace_object_ctr;
317
318 typedef [public,gensize,nosize] struct {
319 security_ace_type type; /* SEC_ACE_TYPE_* */
320 security_ace_flags flags; /* SEC_ACE_FLAG_* */
321 [value(ndr_size_security_ace(r,ndr->flags))] uint16 size;
322 uint32 access_mask;
323 [switch_is(type)] security_ace_object_ctr object;
324 dom_sid trustee;
325 } security_ace;
326
327 typedef enum {
328 SECURITY_ACL_REVISION_NT4 = 2,
329 SECURITY_ACL_REVISION_ADS = 4
330 } security_acl_revision;
331
332 const uint NT4_ACL_REVISION = SECURITY_ACL_REVISION_NT4;
333
334 typedef [public,gensize,nosize] struct {
335 security_acl_revision revision;
336 [value(ndr_size_security_acl(r,ndr->flags))] uint16 size;
337 [range(0,1000)] uint32 num_aces;
338 security_ace aces[num_aces];
339 } security_acl;
340
341 /* default revision for new ACLs */
342 typedef [enum8bit] enum {
343 SECURITY_DESCRIPTOR_REVISION_1 = 1
344 } security_descriptor_revision;
345
346 const int SD_REVISION = SECURITY_DESCRIPTOR_REVISION_1;
347
348 /* security_descriptor->type bits */
349 typedef [bitmap16bit] bitmap {
350 SEC_DESC_OWNER_DEFAULTED = 0x0001,
351 SEC_DESC_GROUP_DEFAULTED = 0x0002,
352 SEC_DESC_DACL_PRESENT = 0x0004,
353 SEC_DESC_DACL_DEFAULTED = 0x0008,
354 SEC_DESC_SACL_PRESENT = 0x0010,
355 SEC_DESC_SACL_DEFAULTED = 0x0020,
356 SEC_DESC_DACL_TRUSTED = 0x0040,
357 SEC_DESC_SERVER_SECURITY = 0x0080,
358 SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100,
359 SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200,
360 SEC_DESC_DACL_AUTO_INHERITED = 0x0400,
361 SEC_DESC_SACL_AUTO_INHERITED = 0x0800,
362 SEC_DESC_DACL_PROTECTED = 0x1000,
363 SEC_DESC_SACL_PROTECTED = 0x2000,
364 SEC_DESC_RM_CONTROL_VALID = 0x4000,
365 SEC_DESC_SELF_RELATIVE = 0x8000
366 } security_descriptor_type;
367
368 typedef [gensize,nosize,public,flag(NDR_LITTLE_ENDIAN)] struct {
369 security_descriptor_revision revision;
370 security_descriptor_type type; /* SEC_DESC_xxxx flags */
371 [relative] dom_sid *owner_sid;
372 [relative] dom_sid *group_sid;
373 [relative] security_acl *sacl; /* system ACL */
374 [relative] security_acl *dacl; /* user (discretionary) ACL */
375 } security_descriptor;
376
377 typedef [public] struct {
378 [range(0,0x40000),value(ndr_size_security_descriptor(sd,ndr->flags))] uint32 sd_size;
379 [subcontext(4)] security_descriptor *sd;
380 } sec_desc_buf;
381
382 typedef [public] struct {
383 dom_sid *user_sid;
384 dom_sid *group_sid;
385 uint32 num_sids;
386 [size_is(num_sids)] dom_sid *sids[*];
387 udlong privilege_mask;
388 } security_token;
389
390 /* bits that determine which parts of a security descriptor
391 are being queried/set */
392 typedef [public,bitmap32bit] bitmap {
393 SECINFO_OWNER = 0x00000001,
394 SECINFO_GROUP = 0x00000002,
395 SECINFO_DACL = 0x00000004,
396 SECINFO_SACL = 0x00000008,
397 SECINFO_UNPROTECTED_SACL = 0x10000000,
398 SECINFO_UNPROTECTED_DACL = 0x20000000,
399 SECINFO_PROTECTED_SACL = 0x40000000,
400 SECINFO_PROTECTED_DACL = 0x80000000
401 } security_secinfo;
402
403 typedef [public,bitmap32bit] bitmap {
404 KERB_ENCTYPE_DES_CBC_CRC = 0x00000001,
405 KERB_ENCTYPE_DES_CBC_MD5 = 0x00000002,
406 KERB_ENCTYPE_RC4_HMAC_MD5 = 0x00000004,
407 KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 = 0x00000008,
408 KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 = 0x00000010
409 } kerb_EncTypes;
410 }