4 security IDL structures
8 pointer_default(unique)
13 access masks are divided up like this:
16 a = generic rights bits SEC_GENERIC_
18 c = standard rights bits SEC_STD_
19 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
21 common combinations of bits are prefixed with SEC_RIGHTS_
23 const int SEC_MASK_GENERIC = 0xF0000000;
24 const int SEC_MASK_FLAGS = 0x0F000000;
25 const int SEC_MASK_STANDARD = 0x00FF0000;
26 const int SEC_MASK_SPECIFIC = 0x0000FFFF;
29 const int SEC_GENERIC_ALL = 0x10000000;
30 const int SEC_GENERIC_EXECUTE = 0x20000000;
31 const int SEC_GENERIC_WRITE = 0x40000000;
32 const int SEC_GENERIC_READ = 0x80000000;
35 const int SEC_FLAG_SYSTEM_SECURITY = 0x01000000;
36 const int SEC_FLAG_MAXIMUM_ALLOWED = 0x02000000;
39 const int SEC_STD_DELETE = 0x00010000;
40 const int SEC_STD_READ_CONTROL = 0x00020000;
41 const int SEC_STD_WRITE_DAC = 0x00040000;
42 const int SEC_STD_WRITE_OWNER = 0x00080000;
43 const int SEC_STD_SYNCHRONIZE = 0x00100000;
44 const int SEC_STD_REQUIRED = 0x000F0000;
45 const int SEC_STD_ALL = 0x001F0000;
47 /* file specific bits */
48 const int SEC_FILE_READ_DATA = 0x00000001;
49 const int SEC_FILE_WRITE_DATA = 0x00000002;
50 const int SEC_FILE_APPEND_DATA = 0x00000004;
51 const int SEC_FILE_READ_EA = 0x00000008;
52 const int SEC_FILE_WRITE_EA = 0x00000010;
53 const int SEC_FILE_EXECUTE = 0x00000020;
54 const int SEC_FILE_READ_ATTRIBUTE = 0x00000080;
55 const int SEC_FILE_WRITE_ATTRIBUTE = 0x00000100;
56 const int SEC_FILE_ALL = 0x000001ff;
58 /* directory specific bits */
59 const int SEC_DIR_LIST = 0x00000001;
60 const int SEC_DIR_ADD_FILE = 0x00000002;
61 const int SEC_DIR_ADD_SUBDIR = 0x00000004;
62 const int SEC_DIR_READ_EA = 0x00000008;
63 const int SEC_DIR_WRITE_EA = 0x00000010;
64 const int SEC_DIR_TRAVERSE = 0x00000020;
65 const int SEC_DIR_DELETE_CHILD = 0x00000040;
66 const int SEC_DIR_READ_ATTRIBUTE = 0x00000080;
67 const int SEC_DIR_WRITE_ATTRIBUTE = 0x00000100;
69 /* registry entry specific bits */
70 const int SEC_REG_QUERY_VALUE = 0x00000001;
71 const int SEC_REG_SET_VALUE = 0x00000002;
72 const int SEC_REG_CREATE_SUBKEY = 0x00000004;
73 const int SEC_REG_ENUM_SUBKEYS = 0x00000008;
74 const int SEC_REG_NOTIFY = 0x00000010;
75 const int SEC_REG_CREATE_LINK = 0x00000020;
77 /* ldap specific access bits */
78 const int SEC_ADS_CREATE_CHILD = 0x00000001;
79 const int SEC_ADS_DELETE_CHILD = 0x00000002;
80 const int SEC_ADS_LIST = 0x00000004;
81 const int SEC_ADS_SELF_WRITE = 0x00000008;
82 const int SEC_ADS_READ_PROP = 0x00000010;
83 const int SEC_ADS_WRITE_PROP = 0x00000020;
84 const int SEC_ADS_DELETE_TREE = 0x00000040;
85 const int SEC_ADS_LIST_OBJECT = 0x00000080;
86 const int SEC_ADS_CONTROL_ACCESS = 0x00000100;
88 /* generic->specific mappings for files */
89 const int SEC_RIGHTS_FILE_READ = SEC_STD_READ_CONTROL |
92 SEC_FILE_READ_ATTRIBUTE |
95 const int SEC_RIGHTS_FILE_WRITE = SEC_STD_READ_CONTROL |
98 SEC_FILE_WRITE_ATTRIBUTE |
100 SEC_FILE_APPEND_DATA;
102 const int SEC_RIGHTS_FILE_EXECUTE = SEC_STD_SYNCHRONIZE |
103 SEC_STD_READ_CONTROL |
104 SEC_FILE_READ_ATTRIBUTE |
107 const int SEC_RIGHTS_FILE_ALL = SEC_STD_ALL | SEC_FILE_ALL;
109 /* generic->specific mappings for directories (same as files) */
110 const int SEC_RIGHTS_DIR_READ = SEC_RIGHTS_FILE_READ;
111 const int SEC_RIGHTS_DIR_WRITE = SEC_RIGHTS_FILE_WRITE;
112 const int SEC_RIGHTS_DIR_EXECUTE = SEC_RIGHTS_FILE_EXECUTE;
113 const int SEC_RIGHTS_DIR_ALL = SEC_RIGHTS_FILE_ALL;
116 /***************************************************************/
117 /* WELL KNOWN SIDS */
120 const string SID_NULL = "S-1-0-0";
122 /* the world domain */
123 const string SID_WORLD_DOMAIN = "S-1-1";
124 const string SID_WORLD = "S-1-1-0";
126 /* SECURITY_CREATOR_SID_AUTHORITY */
127 const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
128 const string SID_CREATOR_OWNER = "S-1-3-0";
129 const string SID_CREATOR_GROUP = "S-1-3-1";
131 /* SECURITY_NT_AUTHORITY */
132 const string SID_NT_AUTHORITY = "S-1-5";
133 const string SID_NT_DIALUP = "S-1-5-1";
134 const string SID_NT_NETWORK = "S-1-5-2";
135 const string SID_NT_BATCH = "S-1-5-3";
136 const string SID_NT_INTERACTIVE = "S-1-5-4";
137 const string SID_NT_SERVICE = "S-1-5-6";
138 const string SID_NT_ANONYMOUS = "S-1-5-7";
139 const string SID_NT_PROXY = "S-1-5-8";
140 const string SID_NT_ENTERPRISE_DCS = "S-1-5-9";
141 const string SID_NT_SELF = "S-1-5-10";
142 const string SID_NT_AUTHENTICATED_USERS = "S-1-5-11";
143 const string SID_NT_RESTRICTED = "S-1-5-12";
144 const string SID_NT_TERMINAL_SERVER_USERS = "S-1-5-13";
145 const string SID_NT_REMOTE_INTERACTIVE = "S-1-5-14";
146 const string SID_NT_THIS_ORGANISATION = "S-1-5-15";
147 const string SID_NT_SYSTEM = "S-1-5-18";
148 const string SID_NT_LOCAL_SERVICE = "S-1-5-19";
149 const string SID_NT_NETWORK_SERVICE = "S-1-5-20";
151 /* SECURITY_BUILTIN_DOMAIN_RID */
152 const string SID_BUILTIN = "S-1-5-32";
153 const string SID_BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
154 const string SID_BUILTIN_USERS = "S-1-5-32-545";
155 const string SID_BUILTIN_GUESTS = "S-1-5-32-546";
156 const string SID_BUILTIN_POWER_USERS = "S-1-5-32-547";
157 const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
158 const string SID_BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
159 const string SID_BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
160 const string SID_BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
161 const string SID_BUILTIN_REPLICATOR = "S-1-5-32-552";
165 privilege IDs. Please keep the IDs below 64. If we get more
166 than 64 then we need to change security_token
169 SEC_PRIV_SECURITY = 1,
171 SEC_PRIV_RESTORE = 3,
172 SEC_PRIV_SYSTEMTIME = 4,
173 SEC_PRIV_SHUTDOWN = 5,
174 SEC_PRIV_REMOTE_SHUTDOWN = 6,
175 SEC_PRIV_TAKE_OWNERSHIP = 7,
177 SEC_PRIV_SYSTEM_ENVIRONMENT = 9,
178 SEC_PRIV_SYSTEM_PROFILE = 10,
179 SEC_PRIV_PROFILE_SINGLE_PROCESS = 11,
180 SEC_PRIV_INCREASE_BASE_PRIORITY = 12,
181 SEC_PRIV_LOAD_DRIVER = 13,
182 SEC_PRIV_CREATE_PAGEFILE = 14,
183 SEC_PRIV_INCREASE_QUOTA = 15,
184 SEC_PRIV_CHANGE_NOTIFY = 16,
185 SEC_PRIV_UNDOCK = 17,
186 SEC_PRIV_MANAGE_VOLUME = 18,
187 SEC_PRIV_IMPERSONATE = 19,
188 SEC_PRIV_CREATE_GLOBAL = 20,
189 SEC_PRIV_ENABLE_DELEGATION = 21,
190 SEC_PRIV_INTERACTIVE_LOGON = 22,
191 SEC_PRIV_NETWORK_LOGON = 23,
192 SEC_PRIV_REMOTE_INTERACTIVE_LOGON = 24
196 /* a domain SID. Note that unlike Samba3 this contains a pointer,
197 so you can't copy them using assignment */
198 typedef [public,noprint,noejs] struct {
199 uint8 sid_rev_num; /**< SID revision number */
200 [range(0,15)] int8 num_auths; /**< Number of sub-authorities */
201 uint8 id_auth[6]; /**< Identifier Authority */
202 uint32 sub_auths[num_auths];
205 typedef [bitmap8bit] bitmap {
206 SEC_ACE_FLAG_OBJECT_INHERIT = 0x01,
207 SEC_ACE_FLAG_CONTAINER_INHERIT = 0x02,
208 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT = 0x04,
209 SEC_ACE_FLAG_INHERIT_ONLY = 0x08,
210 SEC_ACE_FLAG_INHERITED_ACE = 0x10,
211 SEC_ACE_FLAG_VALID_INHERIT = 0x0f,
212 SEC_ACE_FLAG_SUCCESSFUL_ACCESS = 0x40,
213 SEC_ACE_FLAG_FAILED_ACCESS = 0x80
214 } security_ace_flags;
216 typedef [enum8bit] enum {
217 SEC_ACE_TYPE_ACCESS_ALLOWED = 0,
218 SEC_ACE_TYPE_ACCESS_DENIED = 1,
219 SEC_ACE_TYPE_SYSTEM_AUDIT = 2,
220 SEC_ACE_TYPE_SYSTEM_ALARM = 3,
221 SEC_ACE_TYPE_ALLOWED_COMPOUND = 4,
222 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT = 5,
223 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT = 6,
224 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT = 7,
225 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT = 8
229 SEC_ACE_OBJECT_TYPE_PRESENT = 0x00000001,
230 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x00000002
231 } security_ace_object_flags;
233 typedef [nodiscriminant] union {
234 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
235 [case(SEC_ACE_OBJECT_TYPE_PRESENT)] GUID type;
237 } security_ace_object_type;
239 typedef [nodiscriminant] union {
240 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
241 * (of the parent container)
243 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] GUID inherited_type;
245 } security_ace_object_inherited_type;
248 security_ace_object_flags flags;
249 [switch_is(flags & SEC_ACE_OBJECT_TYPE_PRESENT)] security_ace_object_type type;
250 [switch_is(flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)] security_ace_object_inherited_type inherited_type;
251 } security_ace_object;
253 typedef [nodiscriminant] union {
254 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT)] security_ace_object object;
255 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT)] security_ace_object object;
256 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT)] security_ace_object object;
257 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT)] security_ace_object object;
259 } security_ace_object_ctr;
261 typedef [public] struct {
262 security_ace_type type; /* SEC_ACE_TYPE_* */
263 security_ace_flags flags; /* SEC_ACE_FLAG_* */
264 [value(ndr_size_security_ace(r))] uint16 size;
266 [switch_is(type)] security_ace_object_ctr object;
271 SECURITY_ACL_REVISION_NT4 = 2,
272 SECURITY_ACL_REVISION_ADS = 4
273 } security_acl_revision;
275 const uint NT4_ACL_REVISION = SECURITY_ACL_REVISION_NT4;
277 typedef [public] struct {
278 security_acl_revision revision;
279 [value(ndr_size_security_acl(r))] uint16 size;
280 [range(0,1000)] uint32 num_aces;
281 security_ace aces[num_aces];
284 /* default revision for new ACLs */
285 typedef [enum8bit] enum {
286 SECURITY_DESCRIPTOR_REVISION_1 = 1
287 } security_descriptor_revision;
289 const int SD_REVISION = SECURITY_DESCRIPTOR_REVISION_1;
291 /* security_descriptor->type bits */
292 typedef [bitmap16bit] bitmap {
293 SEC_DESC_OWNER_DEFAULTED = 0x0001,
294 SEC_DESC_GROUP_DEFAULTED = 0x0002,
295 SEC_DESC_DACL_PRESENT = 0x0004,
296 SEC_DESC_DACL_DEFAULTED = 0x0008,
297 SEC_DESC_SACL_PRESENT = 0x0010,
298 SEC_DESC_SACL_DEFAULTED = 0x0020,
299 SEC_DESC_DACL_TRUSTED = 0x0040,
300 SEC_DESC_SERVER_SECURITY = 0x0080,
301 SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100,
302 SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200,
303 SEC_DESC_DACL_AUTO_INHERITED = 0x0400,
304 SEC_DESC_SACL_AUTO_INHERITED = 0x0800,
305 SEC_DESC_DACL_PROTECTED = 0x1000,
306 SEC_DESC_SACL_PROTECTED = 0x2000,
307 SEC_DESC_RM_CONTROL_VALID = 0x4000,
308 SEC_DESC_SELF_RELATIVE = 0x8000
309 } security_descriptor_type;
311 typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
312 security_descriptor_revision revision;
313 security_descriptor_type type; /* SEC_DESC_xxxx flags */
314 [relative] dom_sid *owner_sid;
315 [relative] dom_sid *group_sid;
316 [relative] security_acl *sacl; /* system ACL */
317 [relative] security_acl *dacl; /* user (discretionary) ACL */
318 } security_descriptor;
320 typedef [public] struct {
321 [range(0,0x40000),value(ndr_size_security_descriptor(sd))] uint32 sd_size;
322 [subcontext(4)] security_descriptor *sd;
325 typedef [public] struct {
329 [size_is(num_sids)] dom_sid *sids[*];
330 udlong privilege_mask;
333 /* bits that determine which parts of a security descriptor
334 are being queried/set */
335 typedef [public,bitmap32bit] bitmap {
336 SECINFO_OWNER = 0x00000001,
337 SECINFO_GROUP = 0x00000002,
338 SECINFO_DACL = 0x00000004,
339 SECINFO_SACL = 0x00000008