source4/librpc/idl/security.idl

   1 #include "idl_types.h"
   2
   3 /*
   4   security IDL structures
   5 */
   6
   7 [
   8         pointer_default(unique)
   9 ]
  10 interface security
  11 {
  12         /*
  13           access masks are divided up like this:
  14                 0xabccdddd
  15                 where
  16                    a = generic rights bits        SEC_GENERIC_
  17                    b = flags                      SEC_FLAG_
  18                    c = standard rights bits       SEC_STD_
  19                    d = object type specific bits  SEC_{FILE,DIR,REG,xxx}_
  20
  21           common combinations of bits are prefixed with SEC_RIGHTS_
  22         */
  23         const int SEC_MASK_GENERIC         = 0xF0000000;
  24         const int SEC_MASK_FLAGS           = 0x0F000000;
  25         const int SEC_MASK_STANDARD        = 0x00FF0000;
  26         const int SEC_MASK_SPECIFIC        = 0x0000FFFF;
  27
  28         /* generic bits */
  29         const int SEC_GENERIC_ALL          = 0x10000000;
  30         const int SEC_GENERIC_EXECUTE      = 0x20000000;
  31         const int SEC_GENERIC_WRITE        = 0x40000000;
  32         const int SEC_GENERIC_READ         = 0x80000000;
  33
  34         /* flag bits */
  35         const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
  36         const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
  37
  38         /* standard bits */
  39         const int SEC_STD_DELETE           = 0x00010000;
  40         const int SEC_STD_READ_CONTROL     = 0x00020000;
  41         const int SEC_STD_WRITE_DAC        = 0x00040000;
  42         const int SEC_STD_WRITE_OWNER      = 0x00080000;
  43         const int SEC_STD_SYNCHRONIZE      = 0x00100000;
  44         const int SEC_STD_REQUIRED         = 0x000F0000;
  45         const int SEC_STD_ALL              = 0x001F0000;
  46
  47         /* file specific bits */
  48         const int SEC_FILE_READ_DATA       = 0x00000001;
  49         const int SEC_FILE_WRITE_DATA      = 0x00000002;
  50         const int SEC_FILE_APPEND_DATA     = 0x00000004;
  51         const int SEC_FILE_READ_EA         = 0x00000008;
  52         const int SEC_FILE_WRITE_EA        = 0x00000010;
  53         const int SEC_FILE_EXECUTE         = 0x00000020;
  54         const int SEC_FILE_READ_ATTRIBUTE  = 0x00000080;
  55         const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
  56         const int SEC_FILE_ALL             = 0x000001ff;
  57
  58         /* directory specific bits */
  59         const int SEC_DIR_LIST             = 0x00000001;
  60         const int SEC_DIR_ADD_FILE         = 0x00000002;
  61         const int SEC_DIR_ADD_SUBDIR       = 0x00000004;
  62         const int SEC_DIR_READ_EA          = 0x00000008;
  63         const int SEC_DIR_WRITE_EA         = 0x00000010;
  64         const int SEC_DIR_TRAVERSE         = 0x00000020;
  65         const int SEC_DIR_DELETE_CHILD     = 0x00000040;
  66         const int SEC_DIR_READ_ATTRIBUTE   = 0x00000080;
  67         const int SEC_DIR_WRITE_ATTRIBUTE  = 0x00000100;
  68
  69         /* registry entry specific bits */
  70         const int SEC_REG_QUERY_VALUE      = 0x00000001;
  71         const int SEC_REG_SET_VALUE        = 0x00000002;
  72         const int SEC_REG_CREATE_SUBKEY    = 0x00000004;
  73         const int SEC_REG_ENUM_SUBKEYS     = 0x00000008;
  74         const int SEC_REG_NOTIFY           = 0x00000010;
  75         const int SEC_REG_CREATE_LINK      = 0x00000020;
  76
  77         /* generic->specific mappings for files */
  78         const int SEC_RIGHTS_FILE_READ    = SEC_STD_READ_CONTROL |
  79                                             SEC_STD_SYNCHRONIZE |
  80                                             SEC_FILE_READ_DATA |
  81                                             SEC_FILE_READ_ATTRIBUTE |
  82                                             SEC_FILE_READ_EA;
  83
  84         const int SEC_RIGHTS_FILE_WRITE   = SEC_STD_READ_CONTROL |
  85                                             SEC_STD_SYNCHRONIZE |
  86                                             SEC_FILE_WRITE_DATA |
  87                                             SEC_FILE_WRITE_ATTRIBUTE |
  88                                             SEC_FILE_WRITE_EA |
  89                                             SEC_FILE_APPEND_DATA;
  90
  91         const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
  92                                             SEC_STD_READ_CONTROL |
  93                                             SEC_FILE_READ_ATTRIBUTE |
  94                                             SEC_FILE_EXECUTE;
  95
  96         const int SEC_RIGHTS_FILE_ALL     = SEC_STD_ALL | SEC_FILE_ALL;
  97
  98         /* generic->specific mappings for directories (same as files) */
  99         const int SEC_RIGHTS_DIR_READ     = SEC_RIGHTS_FILE_READ;
 100         const int SEC_RIGHTS_DIR_WRITE    = SEC_RIGHTS_FILE_WRITE;
 101         const int SEC_RIGHTS_DIR_EXECUTE  = SEC_RIGHTS_FILE_EXECUTE;
 102         const int SEC_RIGHTS_DIR_ALL      = SEC_RIGHTS_FILE_ALL;
 103
 104
 105         /***************************************************************/
 106         /* WELL KNOWN SIDS */
 107
 108         /* a NULL sid */
 109         const string SID_NULL = "S-1-0-0";
 110
 111         /* the world domain */
 112         const string SID_WORLD_DOMAIN = "S-1-1";
 113         const string SID_WORLD        = "S-1-1-0";
 114
 115         /* SECURITY_CREATOR_SID_AUTHORITY */
 116         const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
 117         const string SID_CREATOR_OWNER        = "S-1-3-0";
 118         const string SID_CREATOR_GROUP        = "S-1-3-1";
 119
 120         /* SECURITY_NT_AUTHORITY */
 121         const string SID_NT_AUTHORITY             = "S-1-5";
 122         const string SID_NT_DIALUP                = "S-1-5-1";
 123         const string SID_NT_NETWORK               = "S-1-5-2";
 124         const string SID_NT_BATCH                 = "S-1-5-3";
 125         const string SID_NT_INTERACTIVE           = "S-1-5-4";
 126         const string SID_NT_SERVICE               = "S-1-5-6";
 127         const string SID_NT_ANONYMOUS             = "S-1-5-7";
 128         const string SID_NT_PROXY                 = "S-1-5-8";
 129         const string SID_NT_ENTERPRISE_DCS        = "S-1-5-9";
 130         const string SID_NT_SELF                  = "S-1-5-10";
 131         const string SID_NT_AUTHENTICATED_USERS   = "S-1-5-11";
 132         const string SID_NT_RESTRICTED            = "S-1-5-12";
 133         const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
 134         const string SID_NT_REMOTE_INTERACTIVE    = "S-1-5-14";
 135         const string SID_NT_THIS_ORGANISATION     = "S-1-5-15";
 136         const string SID_NT_SYSTEM                = "S-1-5-18";
 137         const string SID_NT_LOCAL_SERVICE         = "S-1-5-19";
 138         const string SID_NT_NETWORK_SERVICE       = "S-1-5-20";
 139
 140         /* SECURITY_BUILTIN_DOMAIN_RID */
 141         const string SID_BUILTIN                   = "S-1-5-32";
 142         const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
 143         const string SID_BUILTIN_USERS             = "S-1-5-32-545";
 144         const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
 145         const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
 146         const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
 147         const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
 148         const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
 149         const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
 150         const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
 151
 152
 153         /*
 154           privilege IDs. Please keep the IDs below 64. If we get more
 155           than 64 then we need to change security_token
 156         */
 157         typedef enum {
 158                 SEC_PRIV_SECURITY                  = 1,
 159                 SEC_PRIV_BACKUP                    = 2,
 160                 SEC_PRIV_RESTORE                   = 3,
 161                 SEC_PRIV_SYSTEMTIME                = 4,
 162                 SEC_PRIV_SHUTDOWN                  = 5,
 163                 SEC_PRIV_REMOTE_SHUTDOWN           = 6,
 164                 SEC_PRIV_TAKE_OWNERSHIP            = 7,
 165                 SEC_PRIV_DEBUG                     = 8,
 166                 SEC_PRIV_SYSTEM_ENVIRONMENT        = 9,
 167                 SEC_PRIV_SYSTEM_PROFILE            = 10,
 168                 SEC_PRIV_PROFILE_SINGLE_PROCESS    = 11,
 169                 SEC_PRIV_INCREASE_BASE_PRIORITY    = 12,
 170                 SEC_PRIV_LOAD_DRIVER               = 13,
 171                 SEC_PRIV_CREATE_PAGEFILE           = 14,
 172                 SEC_PRIV_INCREASE_QUOTA            = 15,
 173                 SEC_PRIV_CHANGE_NOTIFY             = 16,
 174                 SEC_PRIV_UNDOCK                    = 17,
 175                 SEC_PRIV_MANAGE_VOLUME             = 18,
 176                 SEC_PRIV_IMPERSONATE               = 19,
 177                 SEC_PRIV_CREATE_GLOBAL             = 20,
 178                 SEC_PRIV_ENABLE_DELEGATION         = 21,
 179                 SEC_PRIV_INTERACTIVE_LOGON         = 22,
 180                 SEC_PRIV_NETWORK_LOGON             = 23,
 181                 SEC_PRIV_REMOTE_INTERACTIVE_LOGON  = 24
 182         } sec_privilege;
 183
 184
 185         /* a domain SID. Note that unlike Samba3 this contains a pointer,
 186            so you can't copy them using assignment */
 187         typedef [public,noprint,noejs] struct {
 188                 uint8  sid_rev_num;             /**< SID revision number */
 189                 [range(0,15)] int8  num_auths;  /**< Number of sub-authorities */
 190                 uint8  id_auth[6];              /**< Identifier Authority */
 191                 uint32 sub_auths[num_auths];
 192         } dom_sid;
 193
 194         typedef [bitmap8bit] bitmap {
 195                 SEC_ACE_FLAG_OBJECT_INHERIT             = 0x01,
 196                 SEC_ACE_FLAG_CONTAINER_INHERIT          = 0x02,
 197                 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT       = 0x04,
 198                 SEC_ACE_FLAG_INHERIT_ONLY               = 0x08,
 199                 SEC_ACE_FLAG_INHERITED_ACE              = 0x10,
 200                 SEC_ACE_FLAG_VALID_INHERIT              = 0x0f,
 201                 SEC_ACE_FLAG_SUCCESSFUL_ACCESS          = 0x40,
 202                 SEC_ACE_FLAG_FAILED_ACCESS              = 0x80
 203         } security_ace_flags;
 204
 205         typedef [enum8bit] enum {
 206                 SEC_ACE_TYPE_ACCESS_ALLOWED             = 0,
 207                 SEC_ACE_TYPE_ACCESS_DENIED              = 1,
 208                 SEC_ACE_TYPE_SYSTEM_AUDIT               = 2,
 209                 SEC_ACE_TYPE_SYSTEM_ALARM               = 3,
 210                 SEC_ACE_TYPE_ALLOWED_COMPOUND           = 4,
 211                 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT      = 5,
 212                 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT       = 6,
 213                 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT        = 7,
 214                 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT        = 8
 215         } security_ace_type;
 216
 217         typedef bitmap {
 218                 SEC_ACE_OBJECT_TYPE_PRESENT             = 0x00000001,
 219                 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT   = 0x00000002
 220         } security_ace_object_flags;
 221
 222         typedef [nodiscriminant] union {
 223                 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
 224                 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
 225                 [default];
 226         } security_ace_object_type;
 227
 228         typedef [nodiscriminant] union {
 229                 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
 230                  * (of the parent container)
 231                  */
 232                 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
 233                 [default];
 234         } security_ace_object_inherited_type;
 235
 236         typedef struct {
 237                 security_ace_object_flags flags;
 238                 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
 239                 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
 240         } security_ace_object;
 241
 242         typedef [nodiscriminant] union {
 243                 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
 244                 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
 245                 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
 246                 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
 247                 [default];
 248         } security_ace_object_ctr;
 249
 250         typedef [public] struct {
 251                 security_ace_type type;  /* SEC_ACE_TYPE_* */
 252                 security_ace_flags flags; /* SEC_ACE_FLAG_* */
 253                 [value(ndr_size_security_ace(r))] uint16 size;
 254                 uint32 access_mask;
 255                 [switch_is(type)] security_ace_object_ctr object;
 256                 dom_sid trustee;
 257         } security_ace;
 258
 259         typedef enum {
 260                 SECURITY_ACL_REVISION_NT4       = 2,
 261                 SECURITY_ACL_REVISION_ADS       = 4
 262         } security_acl_revision;
 263
 264         const uint NT4_ACL_REVISION     = SECURITY_ACL_REVISION_NT4;
 265
 266         typedef [public] struct {
 267                 security_acl_revision revision;
 268                 [value(ndr_size_security_acl(r))] uint16 size;
 269                 [range(0,1000)] uint32 num_aces;
 270                 security_ace aces[num_aces];
 271         } security_acl;
 272
 273         /* default revision for new ACLs */
 274         typedef [enum8bit] enum {
 275                 SECURITY_DESCRIPTOR_REVISION_1 = 1
 276         } security_descriptor_revision;
 277
 278         const int SD_REVISION                    = SECURITY_DESCRIPTOR_REVISION_1;
 279
 280         /* security_descriptor->type bits */
 281         typedef [bitmap16bit] bitmap {
 282                 SEC_DESC_OWNER_DEFAULTED        = 0x0001,
 283                 SEC_DESC_GROUP_DEFAULTED        = 0x0002,
 284                 SEC_DESC_DACL_PRESENT           = 0x0004,
 285                 SEC_DESC_DACL_DEFAULTED         = 0x0008,
 286                 SEC_DESC_SACL_PRESENT           = 0x0010,
 287                 SEC_DESC_SACL_DEFAULTED         = 0x0020,
 288                 SEC_DESC_DACL_TRUSTED           = 0x0040,
 289                 SEC_DESC_SERVER_SECURITY        = 0x0080,
 290                 SEC_DESC_DACL_AUTO_INHERIT_REQ  = 0x0100,
 291                 SEC_DESC_SACL_AUTO_INHERIT_REQ  = 0x0200,
 292                 SEC_DESC_DACL_AUTO_INHERITED    = 0x0400,
 293                 SEC_DESC_SACL_AUTO_INHERITED    = 0x0800,
 294                 SEC_DESC_DACL_PROTECTED         = 0x1000,
 295                 SEC_DESC_SACL_PROTECTED         = 0x2000,
 296                 SEC_DESC_RM_CONTROL_VALID       = 0x4000,
 297                 SEC_DESC_SELF_RELATIVE          = 0x8000
 298         } security_descriptor_type;
 299
 300         /* bits that determine which parts of a security descriptor
 301            are being queried/set */
 302         const int SECINFO_OWNER                = 0x00000001;
 303         const int SECINFO_GROUP                = 0x00000002;
 304         const int SECINFO_DACL                 = 0x00000004;
 305         const int SECINFO_SACL                 = 0x00000008;
 306
 307         typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
 308                 security_descriptor_revision revision;
 309                 security_descriptor_type type;     /* SEC_DESC_xxxx flags */
 310                 [relative] dom_sid *owner_sid;
 311                 [relative] dom_sid *group_sid;
 312                 [relative] security_acl *sacl; /* system ACL */
 313                 [relative] security_acl *dacl; /* user (discretionary) ACL */
 314         } security_descriptor;
 315
 316         typedef [public] struct {
 317                 [range(0,0x40000),value(ndr_size_security_descriptor(sd))] uint32 sd_size;
 318                 [subcontext(4)] security_descriptor *sd;
 319         } sec_desc_buf;
 320
 321         typedef [public] struct {
 322                 dom_sid *user_sid;
 323                 dom_sid *group_sid;
 324                 uint32 num_sids;
 325                 [size_is(num_sids)] dom_sid *sids[*];
 326                 udlong privilege_mask;
 327         } security_token;
 328 }