?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix a debug message
[Samba/gebeck_regimport.git] / librpc / idl / security.idl
blob2b6efc5318480606f19f6fe25976fe9514114fbc
1 #include "idl_types.h"
2
3 /*
4 security IDL structures
5 */
6
7 import "misc.idl";
8
9 /*
10 use the same structure for dom_sid2 as dom_sid. A dom_sid2 is really
11 just a dom sid, but with the sub_auths represented as a conformant
12 array. As with all in-structure conformant arrays, the array length
13 is placed before the start of the structure. That's what gives rise
14 to the extra num_auths elemenent. We don't want the Samba code to
15 have to bother with such esoteric NDR details, so its easier to just
16 define it as a dom_sid and use pidl magic to make it all work. It
17 just means you need to mark a sid as a "dom_sid2" in the IDL when you
18 know it is of the conformant array variety
19 */
20 cpp_quote("#define dom_sid2 dom_sid")
21
22 /* same struct as dom_sid but inside a 28 bytes fixed buffer in NDR */
23 cpp_quote("#define dom_sid28 dom_sid")
24
25 /* same struct as dom_sid but in a variable byte buffer, which is maybe empty in NDR */
26 cpp_quote("#define dom_sid0 dom_sid")
27
28 [
29 pyhelper("librpc/ndr/py_security.c"),
30 pointer_default(unique)
31 ]
32 interface security
33 {
34
35 typedef bitmap lsa_SystemAccessModeFlags lsa_SystemAccessModeFlags;
36
37 typedef [public,gensize,noprint,nosize,nopull,nopush] struct {
38 uint8 sid_rev_num; /**< SID revision number */
39 [range(0,15)] int8 num_auths; /**< Number of sub-authorities */
40 uint8 id_auth[6]; /**< Identifier Authority */
41 uint32 sub_auths[15];
42 } dom_sid;
43 /*
44 access masks are divided up like this:
45 0xabccdddd
46 where
47 a = generic rights bits SEC_GENERIC_
48 b = flags SEC_FLAG_
49 c = standard rights bits SEC_STD_
50 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
51
52 common combinations of bits are prefixed with SEC_RIGHTS_
53 */
54 const int SEC_MASK_GENERIC = 0xF0000000;
55 const int SEC_MASK_FLAGS = 0x0F000000;
56 const int SEC_MASK_STANDARD = 0x00FF0000;
57 const int SEC_MASK_SPECIFIC = 0x0000FFFF;
58
59 /* generic bits */
60 const int SEC_GENERIC_ALL = 0x10000000;
61 const int SEC_GENERIC_EXECUTE = 0x20000000;
62 const int SEC_GENERIC_WRITE = 0x40000000;
63 const int SEC_GENERIC_READ = 0x80000000;
64
65 /* flag bits */
66 const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
67 const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
68
69 /* standard bits */
70 const int SEC_STD_DELETE = 0x00010000;
71 const int SEC_STD_READ_CONTROL = 0x00020000;
72 const int SEC_STD_WRITE_DAC = 0x00040000;
73 const int SEC_STD_WRITE_OWNER = 0x00080000;
74 const int SEC_STD_SYNCHRONIZE = 0x00100000;
75 const int SEC_STD_REQUIRED = 0x000F0000;
76 const int SEC_STD_ALL = 0x001F0000;
77
78 /* file specific bits */
79 const int SEC_FILE_READ_DATA = 0x00000001;
80 const int SEC_FILE_WRITE_DATA = 0x00000002;
81 const int SEC_FILE_APPEND_DATA = 0x00000004;
82 const int SEC_FILE_READ_EA = 0x00000008;
83 const int SEC_FILE_WRITE_EA = 0x00000010;
84 const int SEC_FILE_EXECUTE = 0x00000020;
85 const int SEC_FILE_READ_ATTRIBUTE = 0x00000080;
86 const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
87 const int SEC_FILE_ALL = 0x000001ff;
88
89 /* directory specific bits */
90 const int SEC_DIR_LIST = 0x00000001;
91 const int SEC_DIR_ADD_FILE = 0x00000002;
92 const int SEC_DIR_ADD_SUBDIR = 0x00000004;
93 const int SEC_DIR_READ_EA = 0x00000008;
94 const int SEC_DIR_WRITE_EA = 0x00000010;
95 const int SEC_DIR_TRAVERSE = 0x00000020;
96 const int SEC_DIR_DELETE_CHILD = 0x00000040;
97 const int SEC_DIR_READ_ATTRIBUTE = 0x00000080;
98 const int SEC_DIR_WRITE_ATTRIBUTE = 0x00000100;
99
100 /* registry entry specific bits */
101 const int SEC_REG_QUERY_VALUE = 0x00000001;
102 const int SEC_REG_SET_VALUE = 0x00000002;
103 const int SEC_REG_CREATE_SUBKEY = 0x00000004;
104 const int SEC_REG_ENUM_SUBKEYS = 0x00000008;
105 const int SEC_REG_NOTIFY = 0x00000010;
106 const int SEC_REG_CREATE_LINK = 0x00000020;
107
108 /* ldap specific access bits */
109 const int SEC_ADS_CREATE_CHILD = 0x00000001;
110 const int SEC_ADS_DELETE_CHILD = 0x00000002;
111 const int SEC_ADS_LIST = 0x00000004;
112 const int SEC_ADS_SELF_WRITE = 0x00000008;
113 const int SEC_ADS_READ_PROP = 0x00000010;
114 const int SEC_ADS_WRITE_PROP = 0x00000020;
115 const int SEC_ADS_DELETE_TREE = 0x00000040;
116 const int SEC_ADS_LIST_OBJECT = 0x00000080;
117 const int SEC_ADS_CONTROL_ACCESS = 0x00000100;
118
119 /* invalid bits */
120 const int SEC_MASK_INVALID = 0x0ce0fe00;
121
122 /* generic->specific mappings for files */
123 const int SEC_RIGHTS_FILE_READ = SEC_STD_READ_CONTROL |
124 SEC_STD_SYNCHRONIZE |
125 SEC_FILE_READ_DATA |
126 SEC_FILE_READ_ATTRIBUTE |
127 SEC_FILE_READ_EA;
128
129 const int SEC_RIGHTS_FILE_WRITE = SEC_STD_READ_CONTROL |
130 SEC_STD_SYNCHRONIZE |
131 SEC_FILE_WRITE_DATA |
132 SEC_FILE_WRITE_ATTRIBUTE |
133 SEC_FILE_WRITE_EA |
134 SEC_FILE_APPEND_DATA;
135
136 const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
137 SEC_STD_READ_CONTROL |
138 SEC_FILE_READ_ATTRIBUTE |
139 SEC_FILE_EXECUTE;
140
141 const int SEC_RIGHTS_FILE_ALL = SEC_STD_ALL | SEC_FILE_ALL;
142
143 /* generic->specific mappings for directories (same as files) */
144 const int SEC_RIGHTS_DIR_READ = SEC_RIGHTS_FILE_READ;
145 const int SEC_RIGHTS_DIR_WRITE = SEC_RIGHTS_FILE_WRITE;
146 const int SEC_RIGHTS_DIR_EXECUTE = SEC_RIGHTS_FILE_EXECUTE;
147 const int SEC_RIGHTS_DIR_ALL = SEC_RIGHTS_FILE_ALL;
148
149 /* rights granted by some specific privileges */
150 const int SEC_RIGHTS_PRIV_BACKUP = SEC_STD_READ_CONTROL |
151 SEC_FLAG_SYSTEM_SECURITY |
152 SEC_GENERIC_READ;
153 const int SEC_RIGHTS_DIR_PRIV_BACKUP = SEC_RIGHTS_PRIV_BACKUP
154 | SEC_DIR_TRAVERSE;
155
156 const int SEC_RIGHTS_PRIV_RESTORE = SEC_STD_WRITE_DAC |
157 SEC_STD_WRITE_OWNER |
158 SEC_FLAG_SYSTEM_SECURITY |
159 SEC_STD_DELETE;
160 const int SEC_RIGHTS_DIR_PRIV_RESTORE = SEC_RIGHTS_PRIV_RESTORE |
161 SEC_DIR_ADD_FILE |
162 SEC_DIR_ADD_SUBDIR;
163
164 /* combinations of standard masks. */
165 const int STANDARD_RIGHTS_ALL_ACCESS = SEC_STD_ALL; /* 0x001f0000 */
166 const int STANDARD_RIGHTS_MODIFY_ACCESS = SEC_STD_READ_CONTROL; /* 0x00020000 */
167 const int STANDARD_RIGHTS_EXECUTE_ACCESS = SEC_STD_READ_CONTROL; /* 0x00020000 */
168 const int STANDARD_RIGHTS_READ_ACCESS = SEC_STD_READ_CONTROL; /* 0x00020000 */
169 const int STANDARD_RIGHTS_WRITE_ACCESS =
170 (SEC_STD_WRITE_OWNER |
171 SEC_STD_WRITE_DAC |
172 SEC_STD_DELETE); /* 0x000d0000 */
173 const int STANDARD_RIGHTS_REQUIRED_ACCESS =
174 (SEC_STD_DELETE |
175 SEC_STD_READ_CONTROL |
176 SEC_STD_WRITE_DAC |
177 SEC_STD_WRITE_OWNER); /* 0x000f0000 */
178
179 /* generic->specific mappings for Directory Service objects */
180 /* directory specific part of GENERIC_ALL */
181 const int SEC_ADS_GENERIC_ALL_DS =
182 (SEC_STD_DELETE |
183 SEC_STD_WRITE_DAC |
184 SEC_STD_WRITE_OWNER |
185 SEC_ADS_CREATE_CHILD |
186 SEC_ADS_DELETE_CHILD |
187 SEC_ADS_DELETE_TREE |
188 SEC_ADS_CONTROL_ACCESS);
189 const int SEC_ADS_GENERIC_EXECUTE = SEC_STD_READ_CONTROL | SEC_ADS_LIST;
190 const int SEC_ADS_GENERIC_WRITE =
191 (SEC_STD_READ_CONTROL |
192 SEC_ADS_SELF_WRITE |
193 SEC_ADS_WRITE_PROP);
194 const int SEC_ADS_GENERIC_READ =
195 (SEC_STD_READ_CONTROL |
196 SEC_ADS_LIST |
197 SEC_ADS_READ_PROP |
198 SEC_ADS_LIST_OBJECT);
199 const int SEC_ADS_GENERIC_ALL =
200 (SEC_ADS_GENERIC_EXECUTE |
201 SEC_ADS_GENERIC_WRITE |
202 SEC_ADS_GENERIC_READ |
203 SEC_ADS_GENERIC_ALL_DS);
204
205 /***************************************************************/
206 /* WELL KNOWN SIDS */
207
208 /* a NULL sid */
209 const string SID_NULL = "S-1-0-0";
210
211 /* the world domain */
212 const string NAME_WORLD = "WORLD";
213
214 const string SID_WORLD_DOMAIN = "S-1-1";
215 const string SID_WORLD = "S-1-1-0";
216
217 /* SECURITY_CREATOR_SID_AUTHORITY */
218 const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
219 const string SID_CREATOR_OWNER = "S-1-3-0";
220 const string SID_CREATOR_GROUP = "S-1-3-1";
221 const string SID_OWNER_RIGHTS = "S-1-3-4";
222
223 /* SECURITY_NT_AUTHORITY */
224 const string NAME_NT_AUTHORITY = "NT AUTHORITY";
225
226 const string SID_NT_AUTHORITY = "S-1-5";
227 const string SID_NT_DIALUP = "S-1-5-1";
228 const string SID_NT_NETWORK = "S-1-5-2";
229 const string SID_NT_BATCH = "S-1-5-3";
230 const string SID_NT_INTERACTIVE = "S-1-5-4";
231 const string SID_NT_SERVICE = "S-1-5-6";
232 const string SID_NT_ANONYMOUS = "S-1-5-7";
233 const string SID_NT_PROXY = "S-1-5-8";
234 const string SID_NT_ENTERPRISE_DCS = "S-1-5-9";
235 const string SID_NT_SELF = "S-1-5-10";
236 const string SID_NT_AUTHENTICATED_USERS = "S-1-5-11";
237 const string SID_NT_RESTRICTED = "S-1-5-12";
238 const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
239 const string SID_NT_REMOTE_INTERACTIVE = "S-1-5-14";
240 const string SID_NT_THIS_ORGANISATION = "S-1-5-15";
241 const string SID_NT_IUSR = "S-1-5-17";
242 const string SID_NT_SYSTEM = "S-1-5-18";
243 const string SID_NT_LOCAL_SERVICE = "S-1-5-19";
244 const string SID_NT_NETWORK_SERVICE = "S-1-5-20";
245 const string SID_NT_DIGEST_AUTHENTICATION = "S-1-5-64-21";
246 const string SID_NT_NTLM_AUTHENTICATION = "S-1-5-64-10";
247 const string SID_NT_SCHANNEL_AUTHENTICATION = "S-1-5-64-14";
248 const string SID_NT_OTHER_ORGANISATION = "S-1-5-1000";
249
250 /* SECURITY_BUILTIN_DOMAIN_RID */
251 const string NAME_BUILTIN = "BUILTIN";
252
253 const string SID_BUILTIN = "S-1-5-32";
254 const string SID_BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
255 const string SID_BUILTIN_USERS = "S-1-5-32-545";
256 const string SID_BUILTIN_GUESTS = "S-1-5-32-546";
257 const string SID_BUILTIN_POWER_USERS = "S-1-5-32-547";
258 const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
259 const string SID_BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
260 const string SID_BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
261 const string SID_BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
262 const string SID_BUILTIN_REPLICATOR = "S-1-5-32-552";
263 const string SID_BUILTIN_RAS_SERVERS = "S-1-5-32-553";
264 const string SID_BUILTIN_PREW2K = "S-1-5-32-554";
265 const string SID_BUILTIN_REMOTE_DESKTOP_USERS = "S-1-5-32-555";
266 const string SID_BUILTIN_NETWORK_CONF_OPERATORS = "S-1-5-32-556";
267 const string SID_BUILTIN_INCOMING_FOREST_TRUST = "S-1-5-32-557";
268 const string SID_BUILTIN_PERFMON_USERS = "S-1-5-32-558";
269 const string SID_BUILTIN_PERFLOG_USERS = "S-1-5-32-559";
270 const string SID_BUILTIN_AUTH_ACCESS = "S-1-5-32-560";
271 const string SID_BUILTIN_TS_LICENSE_SERVERS = "S-1-5-32-561";
272 const string SID_BUILTIN_DISTRIBUTED_COM_USERS = "S-1-5-32-562";
273 const string SID_BUILTIN_CRYPTO_OPERATORS = "S-1-5-32-569";
274 const string SID_BUILTIN_EVENT_LOG_READERS = "S-1-5-32-573";
275 const string SID_BUILTIN_CERT_SERV_DCOM_ACCESS = "S-1-5-32-574";
276
277 /* SECURITY_NT_SERVICE */
278 const string NAME_NT_SERVICE = "NT SERVICE";
279
280 const string SID_NT_NT_SERVICE = "S-1-5-80";
281 const string SID_NT_TRUSTED_INSTALLER =
282 "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464";
283
284 /* well-known domain RIDs */
285 const int DOMAIN_RID_LOGON = 9;
286 const int DOMAIN_RID_ENTERPRISE_READONLY_DCS = 498;
287 const int DOMAIN_RID_ADMINISTRATOR = 500;
288 const int DOMAIN_RID_GUEST = 501;
289 const int DOMAIN_RID_KRBTGT = 502;
290 const int DOMAIN_RID_ADMINS = 512;
291 const int DOMAIN_RID_USERS = 513;
292 const int DOMAIN_RID_GUESTS = 514;
293 const int DOMAIN_RID_DOMAIN_MEMBERS = 515;
294 const int DOMAIN_RID_DCS = 516;
295 const int DOMAIN_RID_CERT_ADMINS = 517;
296 const int DOMAIN_RID_SCHEMA_ADMINS = 518;
297 const int DOMAIN_RID_ENTERPRISE_ADMINS = 519;
298 const int DOMAIN_RID_POLICY_ADMINS = 520;
299 const int DOMAIN_RID_READONLY_DCS = 521;
300 const int DOMAIN_RID_RAS_SERVERS = 553;
301 const int DOMAIN_RID_RODC_ALLOW = 571;
302 const int DOMAIN_RID_RODC_DENY = 572;
303
304 /* well-known builtin RIDs */
305 const int BUILTIN_RID_ADMINISTRATORS = 544;
306 const int BUILTIN_RID_USERS = 545;
307 const int BUILTIN_RID_GUESTS = 546;
308 const int BUILTIN_RID_POWER_USERS = 547;
309 const int BUILTIN_RID_ACCOUNT_OPERATORS = 548;
310 const int BUILTIN_RID_SERVER_OPERATORS = 549;
311 const int BUILTIN_RID_PRINT_OPERATORS = 550;
312 const int BUILTIN_RID_BACKUP_OPERATORS = 551;
313 const int BUILTIN_RID_REPLICATOR = 552;
314 const int BUILTIN_RID_RAS_SERVERS = 553;
315 const int BUILTIN_RID_PRE_2K_ACCESS = 554;
316 const int BUILTIN_RID_REMOTE_DESKTOP_USERS = 555;
317 const int BUILTIN_RID_NETWORK_CONF_OPERATORS = 556;
318 const int BUILTIN_RID_INCOMING_FOREST_TRUST = 557;
319 const int BUILTIN_RID_PERFMON_USERS = 558;
320 const int BUILTIN_RID_PERFLOG_USERS = 559;
321 const int BUILTIN_RID_AUTH_ACCESS = 560;
322 const int BUILTIN_RID_TS_LICENSE_SERVERS = 561;
323 const int BUILTIN_RID_DISTRIBUTED_COM_USERS = 562;
324 const int BUILTIN_RID_CRYPTO_OPERATORS = 569;
325 const int BUILTIN_RID_EVENT_LOG_READERS = 573;
326 const int BUILTIN_RID_CERT_SERV_DCOM_ACCESS = 574;
327
328 /********************************************************************
329 This is a list of privileges reported by a WIndows 2008 R2 DC
330 just for reference purposes (and I know the LUID is not guaranteed
331 across reboots):
332
333 0x00000002 SeCreateTokenPrivilege "Create a token object"
334 0x00000003 SeAssignPrimaryTokenPrivilege "Replace a process level token"
335 0x00000004 SeLockMemoryPrivilege "Lock pages in memory"
336 0x00000005 SeIncreaseQuotaPrivilege "Adjust memory quotas for a process"
337 0x00000006 SeMachineAccountPrivilege "Add workstations to domain"
338 0x00000007 SeTcbPrivilege "Act as part of the operating system"
339 0x00000008 SeSecurityPrivilege "Manage auditing and security log"
340 0x00000009 SeTakeOwnershipPrivilege "Take ownership of files or other objects"
341 0x0000000a SeLoadDriverPrivilege "Load and unload device drivers"
342 0x0000000b SeSystemProfilePrivilege "Profile system performance"
343 0x0000000c SeSystemtimePrivilege "Change the system time"
344 0x0000000d SeProfileSingleProcessPrivilege "Profile single process"
345 0x0000000e SeIncreaseBasePriorityPrivilege "Increase scheduling priority"
346 0x0000000f SeCreatePagefilePrivilege "Create a pagefile"
347 0x00000010 SeCreatePermanentPrivilege "Create permanent shared objects"
348 0x00000011 SeBackupPrivilege "Back up files and directories"
349 0x00000012 SeRestorePrivilege "Restore files and directories"
350 0x00000013 SeShutdownPrivilege "Shut down the system"
351 0x00000014 SeDebugPrivilege "Debug programs"
352 0x00000015 SeAuditPrivilege "Generate security audits"
353 0x00000016 SeSystemEnvironmentPrivilege "Modify firmware environment values"
354 0x00000017 SeChangeNotifyPrivilege "Bypass traverse checking"
355 0x00000018 SeRemoteShutdownPrivilege "Force shutdown from a remote system"
356 0x00000019 SeUndockPrivilege "Remove computer from docking station"
357 0x0000001a SeSyncAgentPrivilege "Synchronize directory service data"
358 0x0000001b SeEnableDelegationPrivilege "Enable computer and user accounts to be trusted for delegation"
359 0x0000001c SeManageVolumePrivilege "Perform volume maintenance tasks"
360 0x0000001d SeImpersonatePrivilege "Impersonate a client after authentication"
361 0x0000001e SeCreateGlobalPrivilege "Create global objects"
362 0x0000001f SeTrustedCredManAccessPrivilege "Access Credential Manager as a trusted caller"
363 0x00000020 SeRelabelPrivilege "Modify an object label"
364 0x00000021 SeIncreaseWorkingSetPrivilege "Increase a process working set"
365 0x00000022 SeTimeZonePrivilege "Change the time zone"
366 0x00000023 SeCreateSymbolicLinkPrivilege "Create symbolic links"
367
368 ********************************************************************/
369
370 /* LUID values for privileges known about by Samba (bottom 32 bits of enum, top bits are 0) */
371
372 /* we have to define the LUID here due to a horrible check by printmig.exe
373 that requires the SeBackupPrivilege match what is in Windows. So match
374 those that we implement and start Samba privileges at 0x1001 */
375
376 typedef enum {
377 SEC_PRIV_INVALID = 0x0,
378 SEC_PRIV_INCREASE_QUOTA = 0x5,
379 SEC_PRIV_MACHINE_ACCOUNT = 0x6,
380 SEC_PRIV_SECURITY = 0x8,
381 SEC_PRIV_TAKE_OWNERSHIP = 0x09,
382 SEC_PRIV_LOAD_DRIVER = 0x0a,
383 SEC_PRIV_SYSTEM_PROFILE = 0x0b,
384 SEC_PRIV_SYSTEMTIME = 0x0c,
385 SEC_PRIV_PROFILE_SINGLE_PROCESS = 0x0d,
386 SEC_PRIV_INCREASE_BASE_PRIORITY = 0x0e,
387 SEC_PRIV_CREATE_PAGEFILE = 0x0f,
388 SEC_PRIV_BACKUP = 0x11,
389 SEC_PRIV_RESTORE = 0x12,
390 SEC_PRIV_SHUTDOWN = 0x13,
391 SEC_PRIV_DEBUG = 0x14,
392 SEC_PRIV_SYSTEM_ENVIRONMENT = 0x16,
393 SEC_PRIV_CHANGE_NOTIFY = 0x17,
394 SEC_PRIV_REMOTE_SHUTDOWN = 0x18,
395 SEC_PRIV_UNDOCK = 0x19,
396 SEC_PRIV_ENABLE_DELEGATION = 0x1b,
397 SEC_PRIV_MANAGE_VOLUME = 0x1c,
398 SEC_PRIV_IMPERSONATE = 0x1d,
399 SEC_PRIV_CREATE_GLOBAL = 0x1e,
400 /* Samba-specific privs */
401 SEC_PRIV_PRINT_OPERATOR = 0x1001,
402 SEC_PRIV_ADD_USERS = 0x1002,
403 SEC_PRIV_DISK_OPERATOR = 0x1003
404 } sec_privilege;
405
406
407 /* Bitmap of privilege values for internal use only. We need
408 * our own bitmap here as privilages.tdb records these values
409 * as a bitmap (privilages.ldb uses the string forms).
410 */
411 typedef [bitmap64bit] bitmap {
412 SEC_PRIV_MACHINE_ACCOUNT_BIT = 0x00000010,
413
414 /* Samba-specific privs */
415 SEC_PRIV_PRINT_OPERATOR_BIT = 0x00000020,
416 SEC_PRIV_ADD_USERS_BIT = 0x00000040,
417 SEC_PRIV_DISK_OPERATOR_BIT = 0x00000080,
418
419 SEC_PRIV_REMOTE_SHUTDOWN_BIT = 0x00000100,
420 SEC_PRIV_BACKUP_BIT = 0x00000200,
421 SEC_PRIV_RESTORE_BIT = 0x00000400,
422 SEC_PRIV_TAKE_OWNERSHIP_BIT = 0x00000800,
423 /* End of privilages implemented before merge to common code */
424
425 SEC_PRIV_INCREASE_QUOTA_BIT = 0x00001000,
426 SEC_PRIV_SECURITY_BIT = 0x00002000,
427 SEC_PRIV_LOAD_DRIVER_BIT = 0x00004000,
428 SEC_PRIV_SYSTEM_PROFILE_BIT = 0x00008000,
429 SEC_PRIV_SYSTEMTIME_BIT = 0x00010000,
430 SEC_PRIV_PROFILE_SINGLE_PROCESS_BIT = 0x00020000,
431 SEC_PRIV_INCREASE_BASE_PRIORITY_BIT = 0x00040000,
432 SEC_PRIV_CREATE_PAGEFILE_BIT = 0x00080000,
433 SEC_PRIV_SHUTDOWN_BIT = 0x00100000,
434 SEC_PRIV_DEBUG_BIT = 0x00200000,
435 SEC_PRIV_SYSTEM_ENVIRONMENT_BIT = 0x00400000,
436 SEC_PRIV_CHANGE_NOTIFY_BIT = 0x00800000,
437 SEC_PRIV_UNDOCK_BIT = 0x01000000,
438 SEC_PRIV_ENABLE_DELEGATION_BIT = 0x02000000,
439 SEC_PRIV_MANAGE_VOLUME_BIT = 0x04000000,
440 SEC_PRIV_IMPERSONATE_BIT = 0x08000000,
441 SEC_PRIV_CREATE_GLOBAL_BIT = 0x10000000
442 } se_privilege;
443
444 typedef [bitmap32bit] bitmap {
445 LSA_POLICY_MODE_INTERACTIVE = 0x00000001,
446 LSA_POLICY_MODE_NETWORK = 0x00000002,
447 LSA_POLICY_MODE_BATCH = 0x00000004,
448 LSA_POLICY_MODE_SERVICE = 0x00000010,
449 LSA_POLICY_MODE_PROXY = 0x00000020,
450 LSA_POLICY_MODE_DENY_INTERACTIVE = 0x00000040,
451 LSA_POLICY_MODE_DENY_NETWORK = 0x00000080,
452 LSA_POLICY_MODE_DENY_BATCH = 0x00000100,
453 LSA_POLICY_MODE_DENY_SERVICE = 0x00000200,
454 LSA_POLICY_MODE_REMOTE_INTERACTIVE = 0x00000400,
455 LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE = 0x00000800,
456 LSA_POLICY_MODE_ALL = 0x00000FF7,
457 LSA_POLICY_MODE_ALL_NT4 = 0x00000037
458 } lsa_SystemAccessModeFlags;
459
460 typedef [public,bitmap8bit] bitmap {
461 SEC_ACE_FLAG_OBJECT_INHERIT = 0x01,
462 SEC_ACE_FLAG_CONTAINER_INHERIT = 0x02,
463 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT = 0x04,
464 SEC_ACE_FLAG_INHERIT_ONLY = 0x08,
465 SEC_ACE_FLAG_INHERITED_ACE = 0x10,
466 SEC_ACE_FLAG_VALID_INHERIT = 0x0f,
467 SEC_ACE_FLAG_SUCCESSFUL_ACCESS = 0x40,
468 SEC_ACE_FLAG_FAILED_ACCESS = 0x80
469 } security_ace_flags;
470
471 typedef [public,enum8bit] enum {
472 SEC_ACE_TYPE_ACCESS_ALLOWED = 0,
473 SEC_ACE_TYPE_ACCESS_DENIED = 1,
474 SEC_ACE_TYPE_SYSTEM_AUDIT = 2,
475 SEC_ACE_TYPE_SYSTEM_ALARM = 3,
476 SEC_ACE_TYPE_ALLOWED_COMPOUND = 4,
477 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT = 5,
478 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT = 6,
479 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT = 7,
480 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT = 8
481 } security_ace_type;
482
483 typedef [bitmap32bit] bitmap {
484 SEC_ACE_OBJECT_TYPE_PRESENT = 0x00000001,
485 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x00000002
486 } security_ace_object_flags;
487
488 typedef [nodiscriminant] union {
489 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
490 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
491 [default];
492 } security_ace_object_type;
493
494 typedef [nodiscriminant] union {
495 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
496 * (of the parent container)
497 */
498 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
499 [default];
500 } security_ace_object_inherited_type;
501
502 typedef struct {
503 security_ace_object_flags flags;
504 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
505 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
506 } security_ace_object;
507
508 typedef [public,nodiscriminant] union {
509 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
510 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
511 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
512 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
513 [default];
514 } security_ace_object_ctr;
515
516 typedef [public,nopull,gensize,nosize] struct {
517 security_ace_type type; /* SEC_ACE_TYPE_* */
518 security_ace_flags flags; /* SEC_ACE_FLAG_* */
519 [value(ndr_size_security_ace(r,ndr->flags))] uint16 size;
520 uint32 access_mask;
521 [switch_is(type)] security_ace_object_ctr object;
522 dom_sid trustee;
523 } security_ace;
524
525 typedef enum {
526 SECURITY_ACL_REVISION_NT4 = 2,
527 SECURITY_ACL_REVISION_ADS = 4
528 } security_acl_revision;
529
530 const uint NT4_ACL_REVISION = SECURITY_ACL_REVISION_NT4;
531
532 typedef [public,gensize,nosize] struct {
533 security_acl_revision revision;
534 [value(ndr_size_security_acl(r,ndr->flags))] uint16 size;
535 [range(0,1000)] uint32 num_aces;
536 security_ace aces[num_aces];
537 } security_acl;
538
539 /* default revision for new ACLs */
540 typedef [public,enum8bit] enum {
541 SECURITY_DESCRIPTOR_REVISION_1 = 1
542 } security_descriptor_revision;
543
544 const int SD_REVISION = SECURITY_DESCRIPTOR_REVISION_1;
545
546 /* security_descriptor->type bits */
547 typedef [public,bitmap16bit] bitmap {
548 SEC_DESC_OWNER_DEFAULTED = 0x0001,
549 SEC_DESC_GROUP_DEFAULTED = 0x0002,
550 SEC_DESC_DACL_PRESENT = 0x0004,
551 SEC_DESC_DACL_DEFAULTED = 0x0008,
552 SEC_DESC_SACL_PRESENT = 0x0010,
553 SEC_DESC_SACL_DEFAULTED = 0x0020,
554 SEC_DESC_DACL_TRUSTED = 0x0040,
555 SEC_DESC_SERVER_SECURITY = 0x0080,
556 SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100,
557 SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200,
558 SEC_DESC_DACL_AUTO_INHERITED = 0x0400,
559 SEC_DESC_SACL_AUTO_INHERITED = 0x0800,
560 SEC_DESC_DACL_PROTECTED = 0x1000,
561 SEC_DESC_SACL_PROTECTED = 0x2000,
562 SEC_DESC_RM_CONTROL_VALID = 0x4000,
563 SEC_DESC_SELF_RELATIVE = 0x8000
564 } security_descriptor_type;
565
566 typedef [gensize,nosize,public,flag(NDR_LITTLE_ENDIAN)] struct {
567 security_descriptor_revision revision;
568 security_descriptor_type type; /* SEC_DESC_xxxx flags */
569 [relative] dom_sid *owner_sid;
570 [relative] dom_sid *group_sid;
571 [relative] security_acl *sacl; /* system ACL */
572 [relative] security_acl *dacl; /* user (discretionary) ACL */
573 } security_descriptor;
574
575 typedef [public] struct {
576 [range(0,0x40000),value(ndr_size_security_descriptor(sd,ndr->flags))] uint32 sd_size;
577 [subcontext(4)] security_descriptor *sd;
578 } sec_desc_buf;
579
580 /* This is not yet sent over the network, but is simply defined in IDL */
581 typedef [public] struct {
582 uint32 num_sids;
583 [size_is(num_sids)] dom_sid sids[*];
584 se_privilege privilege_mask;
585 lsa_SystemAccessModeFlags rights_mask;
586 } security_token;
587
588 /* This is not yet sent over the network, but is simply defined in IDL */
589 typedef [public] struct {
590 uid_t uid;
591 gid_t gid;
592 uint32 ngroups;
593 [size_is(ngroups)] gid_t groups[*];
594 } security_unix_token;
595
596 /* bits that determine which parts of a security descriptor
597 are being queried/set */
598 typedef [public,bitmap32bit] bitmap {
599 SECINFO_OWNER = 0x00000001,
600 SECINFO_GROUP = 0x00000002,
601 SECINFO_DACL = 0x00000004,
602 SECINFO_SACL = 0x00000008,
603 SECINFO_UNPROTECTED_SACL = 0x10000000,
604 SECINFO_UNPROTECTED_DACL = 0x20000000,
605 SECINFO_PROTECTED_SACL = 0x40000000,
606 SECINFO_PROTECTED_DACL = 0x80000000
607 } security_secinfo;
608
609 typedef [public,bitmap32bit] bitmap {
610 KERB_ENCTYPE_DES_CBC_CRC = 0x00000001,
611 KERB_ENCTYPE_DES_CBC_MD5 = 0x00000002,
612 KERB_ENCTYPE_RC4_HMAC_MD5 = 0x00000004,
613 KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 = 0x00000008,
614 KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 = 0x00000010
615 } kerb_EncTypes;
616
617 typedef [public,bitmap32bit] bitmap {
618 SEC_DACL_AUTO_INHERIT = 0x00000001,
619 SEC_SACL_AUTO_INHERIT = 0x00000002,
620 SEC_DEFAULT_DESCRIPTOR = 0x00000004,
621 SEC_OWNER_FROM_PARENT = 0x00000008,
622 SEC_GROUP_FROM_PARENT = 0x00000010
623 } security_autoinherit;
624
625 /***************************************************************/
626 /* Extended right guids */
627
628 const string GUID_DRS_ALLOCATE_RIDS = "1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd";
629 const string GUID_DRS_CHANGE_DOMAIN_MASTER = "014bf69c-7b3b-11d1-85f6-08002be74fab";
630 const string GUID_DRS_CHANGE_INFR_MASTER = "cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd";
631 const string GUID_DRS_CHANGE_PDC = "bae50096-4752-11d1-9052-00c04fc2d4cf";
632 const string GUID_DRS_CHANGE_RID_MASTER = "d58d5f36-0a98-11d1-adbb-00c04fd8d5cd";
633 const string GUID_DRS_CHANGE_SCHEMA_MASTER = "e12b56b6-0a95-11d1-adbb-00c04fd8d5cd";
634 const string GUID_DRS_GET_CHANGES = "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2";
635 const string GUID_DRS_GET_ALL_CHANGES = "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2";
636 const string GUID_DRS_GET_FILTERED_ATTRIBUTES = "89e95b76-444d-4c62-991a-0facbeda640c";
637 const string GUID_DRS_MANAGE_TOPOLOGY = "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2";
638 const string GUID_DRS_MONITOR_TOPOLOGY = "f98340fb-7c5b-4cdb-a00b-2ebdfa115a96";
639 const string GUID_DRS_REPL_SYNCRONIZE = "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2";
640 const string GUID_DRS_RO_REPL_SECRET_SYNC = "1131f6ae-9c07-11d1-f79f-00c04fc2dcd2";
641 const string GUID_DRS_USER_CHANGE_PASSWORD = "ab721a53-1e2f-11d0-9819-00aa0040529b";
642 const string GUID_DRS_FORCE_CHANGE_PASSWORD = "00299570-246d-11d0-a768-00aa006e0529";
643
644 /***************************************************************/
645 /* validated writes guids */
646 const string GUID_DRS_VALIDATE_SPN = "f3a64788-5306-11d1-a9c5-0000f80367c1";
647 const string GUID_DRS_SELF_MEMBERSHIP = "bf9679c0-0de6-11d0-a285-00aa003049e2";
648 const string GUID_DRS_DNS_HOST_NAME = "72e39547-7b18-11d1-adef-00c04fd8d5cd";
649 const string GUID_DRS_ADD_DNS_HOST_NAME = "80863791-dbe9-4eb8-837e-7f0ab55d9ac7";
650 const string GUID_DRS_BEHAVIOR_VERSION = "d31a8757-2447-4545-8081-3bb610cacbf2";
651
652 /* A type to describe the mapping of generic access rights to object
653 specific access rights. */
654
655 typedef struct {
656 uint32 generic_read;
657 uint32 generic_write;
658 uint32 generic_execute;
659 uint32 generic_all;
660 } generic_mapping;
661
662 typedef struct {
663 uint32 std_read;
664 uint32 std_write;
665 uint32 std_execute;
666 uint32 std_all;
667 } standard_mapping;
668 }
reg import