source4/librpc/idl/security.idl

   1 #include "idl_types.h"
   2
   3 /*
   4   security IDL structures
   5 */
   6
   7 interface security
   8 {
   9         /*
  10           access masks are divided up like this:
  11                 0xabccdddd
  12                 where
  13                    a = generic rights bits        SEC_GENERIC_
  14                    b = flags                      SEC_FLAG_
  15                    c = standard rights bits       SEC_STD_
  16                    d = object type specific bits  SEC_{FILE,DIR,REG,xxx}_
  17
  18           common combinations of bits are prefixed with SEC_RIGHTS_
  19         */
  20         const int SEC_MASK_GENERIC         = 0xF0000000;
  21         const int SEC_MASK_FLAGS           = 0x0F000000;
  22         const int SEC_MASK_STANDARD        = 0x00FF0000;
  23         const int SEC_MASK_SPECIFIC        = 0x0000FFFF;
  24
  25         /* generic bits */
  26         const int SEC_GENERIC_ALL          = 0x10000000;
  27         const int SEC_GENERIC_EXECUTE      = 0x20000000;
  28         const int SEC_GENERIC_WRITE        = 0x40000000;
  29         const int SEC_GENERIC_READ         = 0x80000000;
  30
  31         /* flag bits */
  32         const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
  33         const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
  34
  35         /* standard bits */
  36         const int SEC_STD_DELETE           = 0x00010000;
  37         const int SEC_STD_READ_CONTROL     = 0x00020000;
  38         const int SEC_STD_WRITE_DAC        = 0x00040000;
  39         const int SEC_STD_WRITE_OWNER      = 0x00080000;
  40         const int SEC_STD_SYNCHRONIZE      = 0x00100000;
  41         const int SEC_STD_REQUIRED         = 0x000F0000;
  42         const int SEC_STD_ALL              = 0x001F0000;
  43
  44         /* file specific bits */
  45         const int SEC_FILE_READ_DATA       = 0x00000001;
  46         const int SEC_FILE_WRITE_DATA      = 0x00000002;
  47         const int SEC_FILE_APPEND_DATA     = 0x00000004;
  48         const int SEC_FILE_READ_EA         = 0x00000008;
  49         const int SEC_FILE_WRITE_EA        = 0x00000010;
  50         const int SEC_FILE_EXECUTE         = 0x00000020;
  51         const int SEC_FILE_READ_ATTRIBUTE  = 0x00000080;
  52         const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
  53         const int SEC_FILE_ALL             = 0x000001ff;
  54
  55         /* directory specific bits */
  56         const int SEC_DIR_LIST             = 0x00000001;
  57         const int SEC_DIR_ADD_FILE         = 0x00000002;
  58         const int SEC_DIR_ADD_SUBDIR       = 0x00000004;
  59         const int SEC_DIR_READ_EA          = 0x00000008;
  60         const int SEC_DIR_WRITE_EA         = 0x00000010;
  61         const int SEC_DIR_TRAVERSE         = 0x00000020;
  62         const int SEC_DIR_DELETE_CHILD     = 0x00000040;
  63         const int SEC_DIR_READ_ATTRIBUTE   = 0x00000080;
  64         const int SEC_DIR_WRITE_ATTRIBUTE  = 0x00000100;
  65
  66         /* registry entry specific bits */
  67         const int SEC_REG_QUERY_VALUE      = 0x00000001;
  68         const int SEC_REG_SET_VALUE        = 0x00000002;
  69         const int SEC_REG_CREATE_SUBKEY    = 0x00000004;
  70         const int SEC_REG_ENUM_SUBKEYS     = 0x00000008;
  71         const int SEC_REG_NOTIFY           = 0x00000010;
  72         const int SEC_REG_CREATE_LINK      = 0x00000020;
  73
  74         /* generic->specific mappings for files */
  75         const int SEC_RIGHTS_FILE_READ    = SEC_STD_READ_CONTROL |
  76                                             SEC_STD_SYNCHRONIZE |
  77                                             SEC_FILE_READ_DATA |
  78                                             SEC_FILE_READ_ATTRIBUTE |
  79                                             SEC_FILE_READ_EA;
  80
  81         const int SEC_RIGHTS_FILE_WRITE   = SEC_STD_READ_CONTROL |
  82                                             SEC_STD_SYNCHRONIZE |
  83                                             SEC_FILE_WRITE_DATA |
  84                                             SEC_FILE_WRITE_ATTRIBUTE |
  85                                             SEC_FILE_WRITE_EA |
  86                                             SEC_FILE_APPEND_DATA;
  87
  88         const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
  89                                             SEC_STD_READ_CONTROL |
  90                                             SEC_FILE_READ_ATTRIBUTE |
  91                                             SEC_FILE_EXECUTE;
  92
  93         const int SEC_RIGHTS_FILE_ALL     = SEC_STD_ALL | SEC_FILE_ALL;
  94
  95         /* generic->specific mappings for directories (same as files) */
  96         const int SEC_RIGHTS_DIR_READ     = SEC_RIGHTS_FILE_READ;
  97         const int SEC_RIGHTS_DIR_WRITE    = SEC_RIGHTS_FILE_WRITE;
  98         const int SEC_RIGHTS_DIR_EXECUTE  = SEC_RIGHTS_FILE_EXECUTE;
  99         const int SEC_RIGHTS_DIR_ALL      = SEC_RIGHTS_FILE_ALL;
 100
 101
 102         /***************************************************************/
 103         /* WELL KNOWN SIDS */
 104
 105         /* a NULL sid */
 106         const string SID_NULL = "S-1-0-0";
 107
 108         /* the world domain */
 109         const string SID_WORLD_DOMAIN = "S-1-1";
 110         const string SID_WORLD        = "S-1-1-0";
 111
 112         /* SECURITY_CREATOR_SID_AUTHORITY */
 113         const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
 114         const string SID_CREATOR_OWNER        = "S-1-3-0";
 115         const string SID_CREATOR_GROUP        = "S-1-3-1";
 116
 117         /* SECURITY_NT_AUTHORITY */
 118         const string SID_NT_AUTHORITY        = "S-1-5";
 119         const string SID_NETWORK             = "S-1-5-2";
 120         const string SID_ANONYMOUS           = "S-1-5-7";
 121         const string SID_AUTHENTICATED_USERS = "S-1-5-11";
 122         const string SID_SYSTEM              = "S-1-5-18";
 123
 124         /* SECURITY_BUILTIN_DOMAIN_RID */
 125         const string SID_BUILTIN                   = "S-1-5-32";
 126         const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
 127         const string SID_BUILTIN_USERS             = "S-1-5-32-545";
 128         const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
 129         const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
 130         const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
 131         const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
 132         const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
 133         const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
 134         const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
 135
 136         /* a domain SID. Note that unlike Samba3 this contains a pointer,
 137            so you can't copy them using assignment */
 138         typedef [public,noprint] struct {
 139                 uint8  sid_rev_num;             /**< SID revision number */
 140                 uint8  num_auths;               /**< Number of sub-authorities */
 141                 uint8  id_auth[6];              /**< Identifier Authority */
 142                 uint32 sub_auths[num_auths];
 143         } dom_sid;
 144
 145         const int SEC_ACE_FLAG_OBJECT_INHERIT           = 0x001;
 146         const int SEC_ACE_FLAG_CONTAINER_INHERIT        = 0x002;
 147         const int SEC_ACE_FLAG_NO_PROPAGATE_INHERIT     = 0x004;
 148         const int SEC_ACE_FLAG_INHERIT_ONLY             = 0x008;
 149         const int SEC_ACE_FLAG_INHERITED_ACE            = 0x010;
 150         const int SEC_ACE_FLAG_VALID_INHERIT            = 0x00f;
 151         const int SEC_ACE_FLAG_SUCCESSFUL_ACCESS        = 0x040;
 152         const int SEC_ACE_FLAG_FAILED_ACCESS            = 0x080;
 153
 154         const int SEC_ACE_TYPE_ACCESS_ALLOWED           = 0x0;
 155         const int SEC_ACE_TYPE_ACCESS_DENIED            = 0x1;
 156         const int SEC_ACE_TYPE_SYSTEM_AUDIT             = 0x2;
 157         const int SEC_ACE_TYPE_SYSTEM_ALARM             = 0x3;
 158         const int SEC_ACE_TYPE_ALLOWED_COMPOUND         = 0x4;
 159         const int SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT    = 0x5;
 160         const int SEC_ACE_TYPE_ACCESS_DENIED_OBJECT     = 0x6;
 161         const int SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT      = 0x7;
 162         const int SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT      = 0x8;
 163
 164         typedef [public] struct {
 165                 uint8 type;  /* SEC_ACE_TYPE_* */
 166                 uint8 flags; /* SEC_ACE_FLAG_* */
 167                 [value(ndr_size_security_ace(r))] uint16 size;
 168                 uint32 access_mask;
 169
 170 #if 0
 171                 /* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
 172                 struct {
 173                         uint32 flags;
 174                         GUID object_guid;
 175                         GUID inherit_guid;
 176                 } *obj;
 177 #endif
 178
 179                 dom_sid trustee;
 180         } security_ace;
 181
 182         const int NT4_ACL_REVISION  = 0x2;
 183
 184         typedef [public] struct {
 185                 uint16 revision;
 186                 [value(ndr_size_security_acl(r))] uint16 size;
 187                 uint32 num_aces;
 188                 security_ace aces[num_aces];
 189         } security_acl;
 190
 191         /* default revision for new ACLs */
 192         const int SD_REVISION                    = 1;
 193
 194         /* security_descriptor->type bits */
 195         const int SEC_DESC_OWNER_DEFAULTED       = 0x0001;
 196         const int SEC_DESC_GROUP_DEFAULTED       = 0x0002;
 197         const int SEC_DESC_DACL_PRESENT          = 0x0004;
 198         const int SEC_DESC_DACL_DEFAULTED        = 0x0008;
 199         const int SEC_DESC_SACL_PRESENT          = 0x0010;
 200         const int SEC_DESC_SACL_DEFAULTED        = 0x0020;
 201         const int SEC_DESC_DACL_TRUSTED          = 0x0040;
 202         const int SEC_DESC_SERVER_SECURITY       = 0x0080;
 203         const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
 204         const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
 205         const int SEC_DESC_DACL_AUTO_INHERITED   = 0x0400;
 206         const int SEC_DESC_SACL_AUTO_INHERITED   = 0x0800;
 207         const int SEC_DESC_DACL_PROTECTED        = 0x1000;
 208         const int SEC_DESC_SACL_PROTECTED        = 0x2000;
 209         const int SEC_DESC_RM_CONTROL_VALID      = 0x4000;
 210         const int SEC_DESC_SELF_RELATIVE         = 0x8000;
 211
 212         /* bits that determine which parts of a security descriptor
 213            are being queried/set */
 214         const int SECINFO_OWNER                = 0x00000001;
 215         const int SECINFO_GROUP                = 0x00000002;
 216         const int SECINFO_DACL                 = 0x00000004;
 217         const int SECINFO_SACL                 = 0x00000008;
 218
 219
 220         typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
 221                 uint8 revision;
 222                 uint16 type;     /* SEC_DESC_xxxx flags */
 223                 [relative] dom_sid *owner_sid;
 224                 [relative] dom_sid *group_sid;
 225                 [relative] security_acl *sacl; /* system ACL */
 226                 [relative] security_acl *dacl; /* user (discretionary) ACL */
 227         } security_descriptor;
 228
 229         typedef [public] struct {
 230                 [range(0,0x40000),value(ndr_size_security_descriptor(r->sd))] uint32 sd_size;
 231                 [subcontext(4)] security_descriptor *sd;
 232         } sec_desc_buf;
 233
 234         typedef [public,printonly] struct {
 235                 /* TODO */
 236                 uint32 flags;
 237         } security_privilege;
 238
 239         typedef [public,printonly] struct {
 240                 uint32 flags;
 241                 dom_sid *user_sid;
 242                 dom_sid *group_sid;
 243                 dom_sid *logon_sid;
 244                 uint32 num_sids;
 245                 dom_sid sids[num_sids];
 246                 uint32 num_restricted_sids;
 247                 dom_sid restricted_sids[num_restricted_sids];
 248                 uint32 num_privileges;
 249                 security_privilege privileges[num_privileges];
 250                 security_acl *dacl;
 251         } security_token;
 252
 253 }