r12004: added some SEC_ADS_* security flags. Needed for a SDDL parser.
[kai/samba.git] / source4 / librpc / idl / security.idl
1 #include "idl_types.h"
2
3 /*
4   security IDL structures
5 */
6
7 [
8         pointer_default(unique)
9 ]
10 interface security
11 {
12         /*
13           access masks are divided up like this:
14                 0xabccdddd
15                 where 
16                    a = generic rights bits        SEC_GENERIC_
17                    b = flags                      SEC_FLAG_
18                    c = standard rights bits       SEC_STD_
19                    d = object type specific bits  SEC_{FILE,DIR,REG,xxx}_
20                    
21           common combinations of bits are prefixed with SEC_RIGHTS_
22         */
23         const int SEC_MASK_GENERIC         = 0xF0000000;
24         const int SEC_MASK_FLAGS           = 0x0F000000;
25         const int SEC_MASK_STANDARD        = 0x00FF0000;
26         const int SEC_MASK_SPECIFIC        = 0x0000FFFF;
27
28         /* generic bits */
29         const int SEC_GENERIC_ALL          = 0x10000000;
30         const int SEC_GENERIC_EXECUTE      = 0x20000000;
31         const int SEC_GENERIC_WRITE        = 0x40000000;
32         const int SEC_GENERIC_READ         = 0x80000000;
33
34         /* flag bits */
35         const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
36         const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
37
38         /* standard bits */
39         const int SEC_STD_DELETE           = 0x00010000;
40         const int SEC_STD_READ_CONTROL     = 0x00020000;
41         const int SEC_STD_WRITE_DAC        = 0x00040000;
42         const int SEC_STD_WRITE_OWNER      = 0x00080000;
43         const int SEC_STD_SYNCHRONIZE      = 0x00100000;
44         const int SEC_STD_REQUIRED         = 0x000F0000;
45         const int SEC_STD_ALL              = 0x001F0000;
46
47         /* file specific bits */
48         const int SEC_FILE_READ_DATA       = 0x00000001;
49         const int SEC_FILE_WRITE_DATA      = 0x00000002;
50         const int SEC_FILE_APPEND_DATA     = 0x00000004;
51         const int SEC_FILE_READ_EA         = 0x00000008;
52         const int SEC_FILE_WRITE_EA        = 0x00000010;
53         const int SEC_FILE_EXECUTE         = 0x00000020;
54         const int SEC_FILE_READ_ATTRIBUTE  = 0x00000080;
55         const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
56         const int SEC_FILE_ALL             = 0x000001ff;
57
58         /* directory specific bits */
59         const int SEC_DIR_LIST             = 0x00000001;
60         const int SEC_DIR_ADD_FILE         = 0x00000002;
61         const int SEC_DIR_ADD_SUBDIR       = 0x00000004;
62         const int SEC_DIR_READ_EA          = 0x00000008;
63         const int SEC_DIR_WRITE_EA         = 0x00000010;
64         const int SEC_DIR_TRAVERSE         = 0x00000020;
65         const int SEC_DIR_DELETE_CHILD     = 0x00000040;
66         const int SEC_DIR_READ_ATTRIBUTE   = 0x00000080;
67         const int SEC_DIR_WRITE_ATTRIBUTE  = 0x00000100;
68
69         /* registry entry specific bits */
70         const int SEC_REG_QUERY_VALUE      = 0x00000001;
71         const int SEC_REG_SET_VALUE        = 0x00000002;
72         const int SEC_REG_CREATE_SUBKEY    = 0x00000004;
73         const int SEC_REG_ENUM_SUBKEYS     = 0x00000008;
74         const int SEC_REG_NOTIFY           = 0x00000010;
75         const int SEC_REG_CREATE_LINK      = 0x00000020;
76
77         /* ldap specific access bits */
78         const int SEC_ADS_CREATE_CHILD     = 0x00000001;
79         const int SEC_ADS_DELETE_CHILD     = 0x00000002;
80         const int SEC_ADS_LIST             = 0x00000004;
81         const int SEC_ADS_SELF_WRITE       = 0x00000008;
82         const int SEC_ADS_READ_PROP        = 0x00000010;
83         const int SEC_ADS_WRITE_PROP       = 0x00000020;
84         const int SEC_ADS_DELETE_TREE      = 0x00000040;
85         const int SEC_ADS_LIST_OBJECT      = 0x00000080;
86         const int SEC_ADS_CONTROL_ACCESS   = 0x00000100;
87
88         /* generic->specific mappings for files */
89         const int SEC_RIGHTS_FILE_READ    = SEC_STD_READ_CONTROL | 
90                                             SEC_STD_SYNCHRONIZE | 
91                                             SEC_FILE_READ_DATA | 
92                                             SEC_FILE_READ_ATTRIBUTE | 
93                                             SEC_FILE_READ_EA;
94
95         const int SEC_RIGHTS_FILE_WRITE   = SEC_STD_READ_CONTROL | 
96                                             SEC_STD_SYNCHRONIZE | 
97                                             SEC_FILE_WRITE_DATA | 
98                                             SEC_FILE_WRITE_ATTRIBUTE | 
99                                             SEC_FILE_WRITE_EA |
100                                             SEC_FILE_APPEND_DATA;
101         
102         const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE | 
103                                             SEC_STD_READ_CONTROL | 
104                                             SEC_FILE_READ_ATTRIBUTE | 
105                                             SEC_FILE_EXECUTE;
106
107         const int SEC_RIGHTS_FILE_ALL     = SEC_STD_ALL | SEC_FILE_ALL;
108
109         /* generic->specific mappings for directories (same as files) */
110         const int SEC_RIGHTS_DIR_READ     = SEC_RIGHTS_FILE_READ;
111         const int SEC_RIGHTS_DIR_WRITE    = SEC_RIGHTS_FILE_WRITE;
112         const int SEC_RIGHTS_DIR_EXECUTE  = SEC_RIGHTS_FILE_EXECUTE;
113         const int SEC_RIGHTS_DIR_ALL      = SEC_RIGHTS_FILE_ALL;
114
115
116         /***************************************************************/
117         /* WELL KNOWN SIDS */
118
119         /* a NULL sid */
120         const string SID_NULL = "S-1-0-0";
121
122         /* the world domain */
123         const string SID_WORLD_DOMAIN = "S-1-1";
124         const string SID_WORLD        = "S-1-1-0";
125
126         /* SECURITY_CREATOR_SID_AUTHORITY */
127         const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
128         const string SID_CREATOR_OWNER        = "S-1-3-0";
129         const string SID_CREATOR_GROUP        = "S-1-3-1";
130
131         /* SECURITY_NT_AUTHORITY */
132         const string SID_NT_AUTHORITY             = "S-1-5";
133         const string SID_NT_DIALUP                = "S-1-5-1";
134         const string SID_NT_NETWORK               = "S-1-5-2";
135         const string SID_NT_BATCH                 = "S-1-5-3";
136         const string SID_NT_INTERACTIVE           = "S-1-5-4";
137         const string SID_NT_SERVICE               = "S-1-5-6";
138         const string SID_NT_ANONYMOUS             = "S-1-5-7";
139         const string SID_NT_PROXY                 = "S-1-5-8";
140         const string SID_NT_ENTERPRISE_DCS        = "S-1-5-9";
141         const string SID_NT_SELF                  = "S-1-5-10";
142         const string SID_NT_AUTHENTICATED_USERS   = "S-1-5-11";
143         const string SID_NT_RESTRICTED            = "S-1-5-12";
144         const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
145         const string SID_NT_REMOTE_INTERACTIVE    = "S-1-5-14";
146         const string SID_NT_THIS_ORGANISATION     = "S-1-5-15";
147         const string SID_NT_SYSTEM                = "S-1-5-18";
148         const string SID_NT_LOCAL_SERVICE         = "S-1-5-19";
149         const string SID_NT_NETWORK_SERVICE       = "S-1-5-20";
150
151         /* SECURITY_BUILTIN_DOMAIN_RID */
152         const string SID_BUILTIN                   = "S-1-5-32";
153         const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
154         const string SID_BUILTIN_USERS             = "S-1-5-32-545";
155         const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
156         const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
157         const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
158         const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
159         const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
160         const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
161         const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
162
163
164         /*
165           privilege IDs. Please keep the IDs below 64. If we get more
166           than 64 then we need to change security_token
167         */
168         typedef enum {
169                 SEC_PRIV_SECURITY                  = 1,
170                 SEC_PRIV_BACKUP                    = 2,
171                 SEC_PRIV_RESTORE                   = 3,
172                 SEC_PRIV_SYSTEMTIME                = 4,
173                 SEC_PRIV_SHUTDOWN                  = 5,
174                 SEC_PRIV_REMOTE_SHUTDOWN           = 6,
175                 SEC_PRIV_TAKE_OWNERSHIP            = 7,
176                 SEC_PRIV_DEBUG                     = 8,
177                 SEC_PRIV_SYSTEM_ENVIRONMENT        = 9,
178                 SEC_PRIV_SYSTEM_PROFILE            = 10,
179                 SEC_PRIV_PROFILE_SINGLE_PROCESS    = 11,
180                 SEC_PRIV_INCREASE_BASE_PRIORITY    = 12,
181                 SEC_PRIV_LOAD_DRIVER               = 13,
182                 SEC_PRIV_CREATE_PAGEFILE           = 14,
183                 SEC_PRIV_INCREASE_QUOTA            = 15,
184                 SEC_PRIV_CHANGE_NOTIFY             = 16,
185                 SEC_PRIV_UNDOCK                    = 17,
186                 SEC_PRIV_MANAGE_VOLUME             = 18,
187                 SEC_PRIV_IMPERSONATE               = 19,
188                 SEC_PRIV_CREATE_GLOBAL             = 20,
189                 SEC_PRIV_ENABLE_DELEGATION         = 21,
190                 SEC_PRIV_INTERACTIVE_LOGON         = 22,
191                 SEC_PRIV_NETWORK_LOGON             = 23,
192                 SEC_PRIV_REMOTE_INTERACTIVE_LOGON  = 24
193         } sec_privilege;
194
195
196         /* a domain SID. Note that unlike Samba3 this contains a pointer,
197            so you can't copy them using assignment */
198         typedef [public,noprint,noejs] struct {
199                 uint8  sid_rev_num;             /**< SID revision number */
200                 [range(0,15)] int8  num_auths;  /**< Number of sub-authorities */
201                 uint8  id_auth[6];              /**< Identifier Authority */
202                 uint32 sub_auths[num_auths];
203         } dom_sid;
204
205         typedef [bitmap8bit] bitmap {
206                 SEC_ACE_FLAG_OBJECT_INHERIT             = 0x01,
207                 SEC_ACE_FLAG_CONTAINER_INHERIT          = 0x02,
208                 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT       = 0x04,
209                 SEC_ACE_FLAG_INHERIT_ONLY               = 0x08,
210                 SEC_ACE_FLAG_INHERITED_ACE              = 0x10,
211                 SEC_ACE_FLAG_VALID_INHERIT              = 0x0f,
212                 SEC_ACE_FLAG_SUCCESSFUL_ACCESS          = 0x40,
213                 SEC_ACE_FLAG_FAILED_ACCESS              = 0x80
214         } security_ace_flags;
215
216         typedef [enum8bit] enum {
217                 SEC_ACE_TYPE_ACCESS_ALLOWED             = 0,
218                 SEC_ACE_TYPE_ACCESS_DENIED              = 1,
219                 SEC_ACE_TYPE_SYSTEM_AUDIT               = 2,
220                 SEC_ACE_TYPE_SYSTEM_ALARM               = 3,
221                 SEC_ACE_TYPE_ALLOWED_COMPOUND           = 4,
222                 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT      = 5,
223                 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT       = 6,
224                 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT        = 7,
225                 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT        = 8
226         } security_ace_type;
227
228         typedef bitmap {
229                 SEC_ACE_OBJECT_TYPE_PRESENT             = 0x00000001,
230                 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT   = 0x00000002
231         } security_ace_object_flags;
232
233         typedef [nodiscriminant] union {
234                 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
235                 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
236                 [default];
237         } security_ace_object_type;
238
239         typedef [nodiscriminant] union {
240                 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
241                  * (of the parent container)
242                  */
243                 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
244                 [default];
245         } security_ace_object_inherited_type;
246
247         typedef struct {
248                 security_ace_object_flags flags;
249                 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
250                 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
251         } security_ace_object;
252
253         typedef [nodiscriminant] union {
254                 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
255                 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
256                 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
257                 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
258                 [default];
259         } security_ace_object_ctr;
260
261         typedef [public] struct {
262                 security_ace_type type;  /* SEC_ACE_TYPE_* */
263                 security_ace_flags flags; /* SEC_ACE_FLAG_* */
264                 [value(ndr_size_security_ace(r))] uint16 size;
265                 uint32 access_mask;
266                 [switch_is(type)] security_ace_object_ctr object;
267                 dom_sid trustee;
268         } security_ace;
269
270         typedef enum {
271                 SECURITY_ACL_REVISION_NT4       = 2,
272                 SECURITY_ACL_REVISION_ADS       = 4
273         } security_acl_revision;
274
275         const uint NT4_ACL_REVISION     = SECURITY_ACL_REVISION_NT4;
276
277         typedef [public] struct {
278                 security_acl_revision revision;
279                 [value(ndr_size_security_acl(r))] uint16 size;
280                 [range(0,1000)] uint32 num_aces;
281                 security_ace aces[num_aces];
282         } security_acl;
283
284         /* default revision for new ACLs */
285         typedef [enum8bit] enum {
286                 SECURITY_DESCRIPTOR_REVISION_1 = 1
287         } security_descriptor_revision;
288
289         const int SD_REVISION                    = SECURITY_DESCRIPTOR_REVISION_1;
290
291         /* security_descriptor->type bits */
292         typedef [bitmap16bit] bitmap {
293                 SEC_DESC_OWNER_DEFAULTED        = 0x0001,
294                 SEC_DESC_GROUP_DEFAULTED        = 0x0002,
295                 SEC_DESC_DACL_PRESENT           = 0x0004,
296                 SEC_DESC_DACL_DEFAULTED         = 0x0008,
297                 SEC_DESC_SACL_PRESENT           = 0x0010,
298                 SEC_DESC_SACL_DEFAULTED         = 0x0020,
299                 SEC_DESC_DACL_TRUSTED           = 0x0040,
300                 SEC_DESC_SERVER_SECURITY        = 0x0080,
301                 SEC_DESC_DACL_AUTO_INHERIT_REQ  = 0x0100,
302                 SEC_DESC_SACL_AUTO_INHERIT_REQ  = 0x0200,
303                 SEC_DESC_DACL_AUTO_INHERITED    = 0x0400,
304                 SEC_DESC_SACL_AUTO_INHERITED    = 0x0800,
305                 SEC_DESC_DACL_PROTECTED         = 0x1000,
306                 SEC_DESC_SACL_PROTECTED         = 0x2000,
307                 SEC_DESC_RM_CONTROL_VALID       = 0x4000,
308                 SEC_DESC_SELF_RELATIVE          = 0x8000
309         } security_descriptor_type;
310
311         typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
312                 security_descriptor_revision revision;
313                 security_descriptor_type type;     /* SEC_DESC_xxxx flags */
314                 [relative] dom_sid *owner_sid; 
315                 [relative] dom_sid *group_sid;
316                 [relative] security_acl *sacl; /* system ACL */
317                 [relative] security_acl *dacl; /* user (discretionary) ACL */
318         } security_descriptor;
319
320         typedef [public] struct {
321                 [range(0,0x40000),value(ndr_size_security_descriptor(sd))] uint32 sd_size;
322                 [subcontext(4)] security_descriptor *sd;
323         } sec_desc_buf;
324
325         typedef [public] struct {
326                 dom_sid *user_sid;
327                 dom_sid *group_sid;
328                 uint32 num_sids;
329                 [size_is(num_sids)] dom_sid *sids[*];
330                 udlong privilege_mask;
331         } security_token;
332
333         /* bits that determine which parts of a security descriptor
334            are being queried/set */
335         typedef [public,bitmap32bit] bitmap {
336                 SECINFO_OWNER                = 0x00000001,
337                 SECINFO_GROUP                = 0x00000002,
338                 SECINFO_DACL                 = 0x00000004,
339                 SECINFO_SACL                 = 0x00000008
340         } security_secinfo;
341 }