librpc/idl/security.idl

   1 #include "idl_types.h"
   2
   3 /*
   4   security IDL structures
   5 */
   6
   7 import "misc.idl";
   8 import "dom_sid.idl";
   9
  10 [
  11         helper("librpc/gen_ndr/ndr_dom_sid.h"),
  12         pointer_default(unique)
  13 ]
  14 interface security
  15 {
  16         /*
  17           access masks are divided up like this:
  18                 0xabccdddd
  19                 where
  20                    a = generic rights bits        SEC_GENERIC_
  21                    b = flags                      SEC_FLAG_
  22                    c = standard rights bits       SEC_STD_
  23                    d = object type specific bits  SEC_{FILE,DIR,REG,xxx}_
  24
  25           common combinations of bits are prefixed with SEC_RIGHTS_
  26         */
  27         const int SEC_MASK_GENERIC         = 0xF0000000;
  28         const int SEC_MASK_FLAGS           = 0x0F000000;
  29         const int SEC_MASK_STANDARD        = 0x00FF0000;
  30         const int SEC_MASK_SPECIFIC        = 0x0000FFFF;
  31
  32         /* generic bits */
  33         const int SEC_GENERIC_ALL          = 0x10000000;
  34         const int SEC_GENERIC_EXECUTE      = 0x20000000;
  35         const int SEC_GENERIC_WRITE        = 0x40000000;
  36         const int SEC_GENERIC_READ         = 0x80000000;
  37
  38         /* flag bits */
  39         const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
  40         const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
  41
  42         /* standard bits */
  43         const int SEC_STD_DELETE           = 0x00010000;
  44         const int SEC_STD_READ_CONTROL     = 0x00020000;
  45         const int SEC_STD_WRITE_DAC        = 0x00040000;
  46         const int SEC_STD_WRITE_OWNER      = 0x00080000;
  47         const int SEC_STD_SYNCHRONIZE      = 0x00100000;
  48         const int SEC_STD_REQUIRED         = 0x000F0000;
  49         const int SEC_STD_ALL              = 0x001F0000;
  50
  51         /* file specific bits */
  52         const int SEC_FILE_READ_DATA       = 0x00000001;
  53         const int SEC_FILE_WRITE_DATA      = 0x00000002;
  54         const int SEC_FILE_APPEND_DATA     = 0x00000004;
  55         const int SEC_FILE_READ_EA         = 0x00000008;
  56         const int SEC_FILE_WRITE_EA        = 0x00000010;
  57         const int SEC_FILE_EXECUTE         = 0x00000020;
  58         const int SEC_FILE_READ_ATTRIBUTE  = 0x00000080;
  59         const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
  60         const int SEC_FILE_ALL             = 0x000001ff;
  61
  62         /* directory specific bits */
  63         const int SEC_DIR_LIST             = 0x00000001;
  64         const int SEC_DIR_ADD_FILE         = 0x00000002;
  65         const int SEC_DIR_ADD_SUBDIR       = 0x00000004;
  66         const int SEC_DIR_READ_EA          = 0x00000008;
  67         const int SEC_DIR_WRITE_EA         = 0x00000010;
  68         const int SEC_DIR_TRAVERSE         = 0x00000020;
  69         const int SEC_DIR_DELETE_CHILD     = 0x00000040;
  70         const int SEC_DIR_READ_ATTRIBUTE   = 0x00000080;
  71         const int SEC_DIR_WRITE_ATTRIBUTE  = 0x00000100;
  72
  73         /* registry entry specific bits */
  74         const int SEC_REG_QUERY_VALUE      = 0x00000001;
  75         const int SEC_REG_SET_VALUE        = 0x00000002;
  76         const int SEC_REG_CREATE_SUBKEY    = 0x00000004;
  77         const int SEC_REG_ENUM_SUBKEYS     = 0x00000008;
  78         const int SEC_REG_NOTIFY           = 0x00000010;
  79         const int SEC_REG_CREATE_LINK      = 0x00000020;
  80
  81         /* ldap specific access bits */
  82         const int SEC_ADS_CREATE_CHILD     = 0x00000001;
  83         const int SEC_ADS_DELETE_CHILD     = 0x00000002;
  84         const int SEC_ADS_LIST             = 0x00000004;
  85         const int SEC_ADS_SELF_WRITE       = 0x00000008;
  86         const int SEC_ADS_READ_PROP        = 0x00000010;
  87         const int SEC_ADS_WRITE_PROP       = 0x00000020;
  88         const int SEC_ADS_DELETE_TREE      = 0x00000040;
  89         const int SEC_ADS_LIST_OBJECT      = 0x00000080;
  90         const int SEC_ADS_CONTROL_ACCESS   = 0x00000100;
  91
  92         /* invalid bits */
  93         const int SEC_MASK_INVALID         = 0x0ce0fe00;
  94
  95         /* generic->specific mappings for files */
  96         const int SEC_RIGHTS_FILE_READ    = SEC_STD_READ_CONTROL |
  97                                             SEC_STD_SYNCHRONIZE |
  98                                             SEC_FILE_READ_DATA |
  99                                             SEC_FILE_READ_ATTRIBUTE |
 100                                             SEC_FILE_READ_EA;
 101
 102         const int SEC_RIGHTS_FILE_WRITE   = SEC_STD_READ_CONTROL |
 103                                             SEC_STD_SYNCHRONIZE |
 104                                             SEC_FILE_WRITE_DATA |
 105                                             SEC_FILE_WRITE_ATTRIBUTE |
 106                                             SEC_FILE_WRITE_EA |
 107                                             SEC_FILE_APPEND_DATA;
 108
 109         const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
 110                                             SEC_STD_READ_CONTROL |
 111                                             SEC_FILE_READ_ATTRIBUTE |
 112                                             SEC_FILE_EXECUTE;
 113
 114         const int SEC_RIGHTS_FILE_ALL     = SEC_STD_ALL | SEC_FILE_ALL;
 115
 116         /* generic->specific mappings for directories (same as files) */
 117         const int SEC_RIGHTS_DIR_READ     = SEC_RIGHTS_FILE_READ;
 118         const int SEC_RIGHTS_DIR_WRITE    = SEC_RIGHTS_FILE_WRITE;
 119         const int SEC_RIGHTS_DIR_EXECUTE  = SEC_RIGHTS_FILE_EXECUTE;
 120         const int SEC_RIGHTS_DIR_ALL      = SEC_RIGHTS_FILE_ALL;
 121
 122         /* combinations of standard masks. */
 123         const int STANDARD_RIGHTS_ALL_ACCESS            = SEC_STD_ALL; /* 0x001f0000 */
 124         const int STANDARD_RIGHTS_MODIFY_ACCESS         = SEC_STD_READ_CONTROL; /* 0x00020000 */
 125         const int STANDARD_RIGHTS_EXECUTE_ACCESS        = SEC_STD_READ_CONTROL; /* 0x00020000 */
 126         const int STANDARD_RIGHTS_READ_ACCESS           = SEC_STD_READ_CONTROL; /* 0x00020000 */
 127         const int STANDARD_RIGHTS_WRITE_ACCESS =
 128                 (SEC_STD_WRITE_OWNER            |
 129                  SEC_STD_WRITE_DAC              |
 130                  SEC_STD_DELETE);       /* 0x000d0000 */
 131         const int STANDARD_RIGHTS_REQUIRED_ACCESS =
 132                 (SEC_STD_DELETE                 |
 133                  SEC_STD_READ_CONTROL           |
 134                  SEC_STD_WRITE_DAC              |
 135                  SEC_STD_WRITE_OWNER);  /* 0x000f0000 */
 136
 137         /***************************************************************/
 138         /* WELL KNOWN SIDS */
 139
 140         /* a NULL sid */
 141         const string SID_NULL = "S-1-0-0";
 142
 143         /* the world domain */
 144         const string NAME_WORLD       = "WORLD";
 145
 146         const string SID_WORLD_DOMAIN = "S-1-1";
 147         const string SID_WORLD        = "S-1-1-0";
 148
 149         /* SECURITY_CREATOR_SID_AUTHORITY */
 150         const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
 151         const string SID_CREATOR_OWNER        = "S-1-3-0";
 152         const string SID_CREATOR_GROUP        = "S-1-3-1";
 153         const string SID_OWNER_RIGHTS         = "S-1-3-4";
 154
 155         /* SECURITY_NT_AUTHORITY */
 156         const string NAME_NT_AUTHORITY            = "NT AUTHORITY";
 157
 158         const string SID_NT_AUTHORITY             = "S-1-5";
 159         const string SID_NT_DIALUP                = "S-1-5-1";
 160         const string SID_NT_NETWORK               = "S-1-5-2";
 161         const string SID_NT_BATCH                 = "S-1-5-3";
 162         const string SID_NT_INTERACTIVE           = "S-1-5-4";
 163         const string SID_NT_SERVICE               = "S-1-5-6";
 164         const string SID_NT_ANONYMOUS             = "S-1-5-7";
 165         const string SID_NT_PROXY                 = "S-1-5-8";
 166         const string SID_NT_ENTERPRISE_DCS        = "S-1-5-9";
 167         const string SID_NT_SELF                  = "S-1-5-10";
 168         const string SID_NT_AUTHENTICATED_USERS   = "S-1-5-11";
 169         const string SID_NT_RESTRICTED            = "S-1-5-12";
 170         const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
 171         const string SID_NT_REMOTE_INTERACTIVE    = "S-1-5-14";
 172         const string SID_NT_THIS_ORGANISATION     = "S-1-5-15";
 173         const string SID_NT_IUSR                  = "S-1-5-17";
 174         const string SID_NT_SYSTEM                = "S-1-5-18";
 175         const string SID_NT_LOCAL_SERVICE         = "S-1-5-19";
 176         const string SID_NT_NETWORK_SERVICE       = "S-1-5-20";
 177         const string SID_NT_DIGEST_AUTHENTICATION = "S-1-5-64-21";
 178         const string SID_NT_NTLM_AUTHENTICATION   = "S-1-5-64-10";
 179         const string SID_NT_SCHANNEL_AUTHENTICATION = "S-1-5-64-14";
 180         const string SID_NT_OTHER_ORGANISATION    = "S-1-5-1000";
 181
 182         /* SECURITY_BUILTIN_DOMAIN_RID */
 183         const string NAME_BUILTIN                  = "BUILTIN";
 184
 185         const string SID_BUILTIN                   = "S-1-5-32";
 186         const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
 187         const string SID_BUILTIN_USERS             = "S-1-5-32-545";
 188         const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
 189         const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
 190         const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
 191         const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
 192         const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
 193         const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
 194         const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
 195         const string SID_BUILTIN_RAS_SERVERS       = "S-1-5-32-553";
 196         const string SID_BUILTIN_PREW2K            = "S-1-5-32-554";
 197
 198         /* well-known domain RIDs */
 199         const int DOMAIN_RID_LOGON                 = 9;
 200         const int DOMAIN_RID_ADMINISTRATOR         = 500;
 201         const int DOMAIN_RID_GUEST                 = 501;
 202         const int DOMAIN_RID_ADMINS                = 512;
 203         const int DOMAIN_RID_USERS                 = 513;
 204         const int DOMAIN_RID_DOMAIN_MEMBERS        = 515;
 205         const int DOMAIN_RID_DCS                   = 516;
 206         const int DOMAIN_RID_CERT_ADMINS           = 517;
 207         const int DOMAIN_RID_SCHEMA_ADMINS         = 518;
 208         const int DOMAIN_RID_ENTERPRISE_ADMINS     = 519;
 209
 210
 211         /*
 212           privilege IDs. Please keep the IDs below 64. If we get more
 213           than 64 then we need to change security_token
 214         */
 215         typedef enum {
 216                 SEC_PRIV_SECURITY                  = 1,
 217                 SEC_PRIV_BACKUP                    = 2,
 218                 SEC_PRIV_RESTORE                   = 3,
 219                 SEC_PRIV_SYSTEMTIME                = 4,
 220                 SEC_PRIV_SHUTDOWN                  = 5,
 221                 SEC_PRIV_REMOTE_SHUTDOWN           = 6,
 222                 SEC_PRIV_TAKE_OWNERSHIP            = 7,
 223                 SEC_PRIV_DEBUG                     = 8,
 224                 SEC_PRIV_SYSTEM_ENVIRONMENT        = 9,
 225                 SEC_PRIV_SYSTEM_PROFILE            = 10,
 226                 SEC_PRIV_PROFILE_SINGLE_PROCESS    = 11,
 227                 SEC_PRIV_INCREASE_BASE_PRIORITY    = 12,
 228                 SEC_PRIV_LOAD_DRIVER               = 13,
 229                 SEC_PRIV_CREATE_PAGEFILE           = 14,
 230                 SEC_PRIV_INCREASE_QUOTA            = 15,
 231                 SEC_PRIV_CHANGE_NOTIFY             = 16,
 232                 SEC_PRIV_UNDOCK                    = 17,
 233                 SEC_PRIV_MANAGE_VOLUME             = 18,
 234                 SEC_PRIV_IMPERSONATE               = 19,
 235                 SEC_PRIV_CREATE_GLOBAL             = 20,
 236                 SEC_PRIV_ENABLE_DELEGATION         = 21,
 237                 SEC_PRIV_INTERACTIVE_LOGON         = 22,
 238                 SEC_PRIV_NETWORK_LOGON             = 23,
 239                 SEC_PRIV_REMOTE_INTERACTIVE_LOGON  = 24
 240         } sec_privilege;
 241
 242
 243         typedef [public,bitmap8bit] bitmap {
 244                 SEC_ACE_FLAG_OBJECT_INHERIT             = 0x01,
 245                 SEC_ACE_FLAG_CONTAINER_INHERIT          = 0x02,
 246                 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT       = 0x04,
 247                 SEC_ACE_FLAG_INHERIT_ONLY               = 0x08,
 248                 SEC_ACE_FLAG_INHERITED_ACE              = 0x10,
 249                 SEC_ACE_FLAG_VALID_INHERIT              = 0x0f,
 250                 SEC_ACE_FLAG_SUCCESSFUL_ACCESS          = 0x40,
 251                 SEC_ACE_FLAG_FAILED_ACCESS              = 0x80
 252         } security_ace_flags;
 253
 254         typedef [public,enum8bit] enum {
 255                 SEC_ACE_TYPE_ACCESS_ALLOWED             = 0,
 256                 SEC_ACE_TYPE_ACCESS_DENIED              = 1,
 257                 SEC_ACE_TYPE_SYSTEM_AUDIT               = 2,
 258                 SEC_ACE_TYPE_SYSTEM_ALARM               = 3,
 259                 SEC_ACE_TYPE_ALLOWED_COMPOUND           = 4,
 260                 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT      = 5,
 261                 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT       = 6,
 262                 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT        = 7,
 263                 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT        = 8
 264         } security_ace_type;
 265
 266         typedef [bitmap32bit] bitmap {
 267                 SEC_ACE_OBJECT_TYPE_PRESENT             = 0x00000001,
 268                 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT   = 0x00000002
 269         } security_ace_object_flags;
 270
 271         typedef [nodiscriminant] union {
 272                 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
 273                 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
 274                 [default];
 275         } security_ace_object_type;
 276
 277         typedef [nodiscriminant] union {
 278                 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
 279                  * (of the parent container)
 280                  */
 281                 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
 282                 [default];
 283         } security_ace_object_inherited_type;
 284
 285         typedef struct {
 286                 security_ace_object_flags flags;
 287                 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
 288                 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
 289         } security_ace_object;
 290
 291         typedef [public,nodiscriminant] union {
 292                 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
 293                 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
 294                 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
 295                 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
 296                 [default];
 297         } security_ace_object_ctr;
 298
 299         typedef [public,nopull,gensize,nosize] struct {
 300                 security_ace_type type;  /* SEC_ACE_TYPE_* */
 301                 security_ace_flags flags; /* SEC_ACE_FLAG_* */
 302                 [value(ndr_size_security_ace(r,ndr->flags))] uint16 size;
 303                 uint32 access_mask;
 304                 [switch_is(type)] security_ace_object_ctr object;
 305                 dom_sid trustee;
 306         } security_ace;
 307
 308         typedef enum {
 309                 SECURITY_ACL_REVISION_NT4       = 2,
 310                 SECURITY_ACL_REVISION_ADS       = 4
 311         } security_acl_revision;
 312
 313         const uint NT4_ACL_REVISION     = SECURITY_ACL_REVISION_NT4;
 314
 315         typedef [public,gensize,nosize] struct {
 316                 security_acl_revision revision;
 317                 [value(ndr_size_security_acl(r,ndr->flags))] uint16 size;
 318                 [range(0,1000)] uint32 num_aces;
 319                 security_ace aces[num_aces];
 320         } security_acl;
 321
 322         /* default revision for new ACLs */
 323         typedef [enum8bit] enum {
 324                 SECURITY_DESCRIPTOR_REVISION_1 = 1
 325         } security_descriptor_revision;
 326
 327         const int SD_REVISION                    = SECURITY_DESCRIPTOR_REVISION_1;
 328
 329         /* security_descriptor->type bits */
 330         typedef [bitmap16bit] bitmap {
 331                 SEC_DESC_OWNER_DEFAULTED        = 0x0001,
 332                 SEC_DESC_GROUP_DEFAULTED        = 0x0002,
 333                 SEC_DESC_DACL_PRESENT           = 0x0004,
 334                 SEC_DESC_DACL_DEFAULTED         = 0x0008,
 335                 SEC_DESC_SACL_PRESENT           = 0x0010,
 336                 SEC_DESC_SACL_DEFAULTED         = 0x0020,
 337                 SEC_DESC_DACL_TRUSTED           = 0x0040,
 338                 SEC_DESC_SERVER_SECURITY        = 0x0080,
 339                 SEC_DESC_DACL_AUTO_INHERIT_REQ  = 0x0100,
 340                 SEC_DESC_SACL_AUTO_INHERIT_REQ  = 0x0200,
 341                 SEC_DESC_DACL_AUTO_INHERITED    = 0x0400,
 342                 SEC_DESC_SACL_AUTO_INHERITED    = 0x0800,
 343                 SEC_DESC_DACL_PROTECTED         = 0x1000,
 344                 SEC_DESC_SACL_PROTECTED         = 0x2000,
 345                 SEC_DESC_RM_CONTROL_VALID       = 0x4000,
 346                 SEC_DESC_SELF_RELATIVE          = 0x8000
 347         } security_descriptor_type;
 348
 349         typedef [gensize,nosize,public,flag(NDR_LITTLE_ENDIAN)] struct {
 350                 security_descriptor_revision revision;
 351                 security_descriptor_type type;     /* SEC_DESC_xxxx flags */
 352                 [relative] dom_sid *owner_sid;
 353                 [relative] dom_sid *group_sid;
 354                 [relative] security_acl *sacl; /* system ACL */
 355                 [relative] security_acl *dacl; /* user (discretionary) ACL */
 356         } security_descriptor;
 357
 358         typedef [public] struct {
 359                 [range(0,0x40000),value(ndr_size_security_descriptor(sd,ndr->flags))] uint32 sd_size;
 360                 [subcontext(4)] security_descriptor *sd;
 361         } sec_desc_buf;
 362
 363         typedef [public] struct {
 364                 dom_sid *user_sid;
 365                 dom_sid *group_sid;
 366                 uint32 num_sids;
 367                 [size_is(num_sids)] dom_sid *sids[*];
 368                 udlong privilege_mask;
 369         } security_token;
 370
 371         /* bits that determine which parts of a security descriptor
 372            are being queried/set */
 373         typedef [public,bitmap32bit] bitmap {
 374                 SECINFO_OWNER                = 0x00000001,
 375                 SECINFO_GROUP                = 0x00000002,
 376                 SECINFO_DACL                 = 0x00000004,
 377                 SECINFO_SACL                 = 0x00000008,
 378                 SECINFO_UNPROTECTED_SACL     = 0x10000000,
 379                 SECINFO_UNPROTECTED_DACL     = 0x20000000,
 380                 SECINFO_PROTECTED_SACL       = 0x40000000,
 381                 SECINFO_PROTECTED_DACL       = 0x80000000
 382         } security_secinfo;
 383
 384         typedef [public,bitmap32bit] bitmap {
 385                 KERB_ENCTYPE_DES_CBC_CRC             = 0x00000001,
 386                 KERB_ENCTYPE_DES_CBC_MD5             = 0x00000002,
 387                 KERB_ENCTYPE_RC4_HMAC_MD5            = 0x00000004,
 388                 KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 = 0x00000008,
 389                 KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 = 0x00000010
 390         } kerb_EncTypes;
 391 }