Home | History | Annotate | Download | only in smbsrv
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef _SMBSRV_NTACCESS_H
     27 #define	_SMBSRV_NTACCESS_H
     28 
     29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     30 
     31 /*
     32  * This file defines the NT compatible access control masks and values.
     33  * An access mask as a 32-bit value arranged as shown below.
     34  *
     35  *   31-28    Generic bits, interpreted per object type
     36  *   27-26    Reserved, must-be-zero
     37  *   25       Maximum allowed
     38  *   24       System Security rights (SACL is SD)
     39  *   23-16    Standard access rights, generic to all object types
     40  *   15-0     Specific access rights, object specific
     41  *
     42  *   3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
     43  *   1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
     44  *   +---------------+---------------+-------------------------------+
     45  *   |G|G|G|G|Res'd|A| StandardRights|         SpecificRights        |
     46  *   |R|W|E|A|     |S|               |                               |
     47  *   +-+-------------+---------------+-------------------------------+
     48  */
     49 
     50 #ifdef __cplusplus
     51 extern "C" {
     52 #endif
     53 
     54 /*
     55  * Specific rights for files, pipes and directories.
     56  */
     57 #define	FILE_READ_DATA			(0x0001) /* file & pipe */
     58 #define	FILE_LIST_DIRECTORY		(0x0001) /* directory */
     59 #define	FILE_WRITE_DATA			(0x0002) /* file & pipe */
     60 #define	FILE_ADD_FILE			(0x0002) /* directory */
     61 #define	FILE_APPEND_DATA		(0x0004) /* file */
     62 #define	FILE_ADD_SUBDIRECTORY		(0x0004) /* directory */
     63 #define	FILE_CREATE_PIPE_INSTANCE	(0x0004) /* named pipe */
     64 #define	FILE_READ_EA			(0x0008) /* file & directory */
     65 #define	FILE_READ_PROPERTIES		(0x0008) /* pipe */
     66 #define	FILE_WRITE_EA			(0x0010) /* file & directory */
     67 #define	FILE_WRITE_PROPERTIES		(0x0010) /* pipe */
     68 #define	FILE_EXECUTE			(0x0020) /* file */
     69 #define	FILE_TRAVERSE			(0x0020) /* directory */
     70 #define	FILE_DELETE_CHILD		(0x0040) /* directory */
     71 #define	FILE_READ_ATTRIBUTES		(0x0080) /* all */
     72 #define	FILE_WRITE_ATTRIBUTES		(0x0100) /* all */
     73 #define	FILE_SPECIFIC_ALL		(0x000001FFL)
     74 #define	SPECIFIC_RIGHTS_ALL		(0x0000FFFFL)
     75 
     76 
     77 /*
     78  * Standard rights:
     79  *
     80  * DELETE	The right to delete the object.
     81  *
     82  * READ_CONTROL The right to read the information in the object's security
     83  *              descriptor, not including the information in the SACL.
     84  *
     85  * WRITE_DAC    The right to modify the DACL in the object's security
     86  *	        descriptor.
     87  *
     88  * WRITE_OWNER  The right to change the owner in the object's security
     89  *	        descriptor.
     90  *
     91  * SYNCHRONIZE  The right to use the object for synchronization. This enables
     92  *              a thread to wait until the object is in the signaled state.
     93  */
     94 #define	DELETE				(0x00010000L)
     95 #define	READ_CONTROL			(0x00020000L)
     96 #define	WRITE_DAC			(0x00040000L)
     97 #define	WRITE_OWNER			(0x00080000L) /* take ownership */
     98 #define	SYNCHRONIZE			(0x00100000L)
     99 #define	STANDARD_RIGHTS_REQUIRED	(0x000F0000L)
    100 #define	STANDARD_RIGHTS_ALL		(0x001F0000L)
    101 
    102 
    103 #define	STANDARD_RIGHTS_READ		(READ_CONTROL)
    104 #define	STANDARD_RIGHTS_WRITE		(READ_CONTROL)
    105 #define	STANDARD_RIGHTS_EXECUTE		(READ_CONTROL)
    106 
    107 #define	FILE_METADATA_ALL		(FILE_READ_EA		|\
    108 					FILE_READ_ATTRIBUTES	|\
    109 					READ_CONTROL		|\
    110 					FILE_WRITE_EA		|\
    111 					FILE_WRITE_ATTRIBUTES	|\
    112 					WRITE_DAC		|\
    113 					WRITE_OWNER		|\
    114 					SYNCHRONIZE)
    115 
    116 #define	FILE_DATA_ALL			(FILE_READ_DATA		|\
    117 					FILE_WRITE_DATA		|\
    118 					FILE_APPEND_DATA	|\
    119 					FILE_EXECUTE		|\
    120 					DELETE)
    121 
    122 #define	FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
    123 
    124 
    125 /*
    126  * Miscellaneous bits: SACL access and maximum allowed access.
    127  */
    128 #define	ACCESS_SYSTEM_SECURITY		(0x01000000L)
    129 #define	MAXIMUM_ALLOWED			(0x02000000L)
    130 
    131 
    132 /*
    133  * Generic rights. These are shorthands that are interpreted as
    134  * appropriate for the type of secured object being accessed.
    135  */
    136 #define	GENERIC_ALL			(0x10000000UL)
    137 #define	GENERIC_EXECUTE			(0x20000000UL)
    138 #define	GENERIC_WRITE			(0x40000000UL)
    139 #define	GENERIC_READ			(0x80000000UL)
    140 
    141 #define	FILE_GENERIC_READ (STANDARD_RIGHTS_READ |		\
    142 	    FILE_READ_DATA		|			\
    143 	    FILE_READ_ATTRIBUTES	|			\
    144 	    FILE_READ_EA		|			\
    145 	    SYNCHRONIZE)
    146 
    147 #define	FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE |		\
    148 	    FILE_WRITE_DATA		|			\
    149 	    FILE_WRITE_ATTRIBUTES	|			\
    150 	    FILE_WRITE_EA		|			\
    151 	    FILE_APPEND_DATA		|			\
    152 	    SYNCHRONIZE)
    153 
    154 #define	FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE |		\
    155 	    FILE_READ_ATTRIBUTES	|			\
    156 	    FILE_EXECUTE		|			\
    157 	    SYNCHRONIZE)
    158 
    159 #define	FILE_GENERIC_ALL (FILE_GENERIC_READ |			\
    160 	    FILE_GENERIC_WRITE		|			\
    161 	    FILE_GENERIC_EXECUTE)
    162 
    163 
    164 /*
    165  * LSA policy desired access masks.
    166  */
    167 #define	POLICY_VIEW_LOCAL_INFORMATION		0x00000001L
    168 #define	POLICY_VIEW_AUDIT_INFORMATION		0x00000002L
    169 #define	POLICY_GET_PRIVATE_INFORMATION		0x00000004L
    170 #define	POLICY_TRUST_ADMIN			0x00000008L
    171 #define	POLICY_CREATE_ACCOUNT			0x00000010L
    172 #define	POLICY_CREATE_SECRET			0x00000020L
    173 #define	POLICY_CREATE_PRIVILEGE			0x00000040L
    174 #define	POLICY_SET_DEFAULT_QUOTA_LIMITS		0x00000080L
    175 #define	POLICY_SET_AUDIT_REQUIREMENTS		0x00000100L
    176 #define	POLICY_AUDIT_LOG_ADMIN			0x00000200L
    177 #define	POLICY_SERVER_ADMIN			0x00000400L
    178 #define	POLICY_LOOKUP_NAMES			0x00000800L
    179 
    180 
    181 /*
    182  * SAM specific rights desired access masks. These definitions are listed
    183  * mostly as a convenience; they don't seem to be documented. Setting the
    184  * desired access mask to GENERIC_EXECUTE and STANDARD_RIGHTS_EXECUTE
    185  * seems to work when just looking up information.
    186  */
    187 #define	SAM_LOOKUP_INFORMATION (GENERIC_EXECUTE		\
    188 	    | STANDARD_RIGHTS_EXECUTE)
    189 
    190 #define	SAM_ACCESS_USER_READ		0x0000031BL
    191 #define	SAM_ACCESS_USER_UPDATE		0x0000031FL
    192 #define	SAM_ACCESS_USER_SETPWD		0x0000037FL
    193 #define	SAM_CONNECT_CREATE_ACCOUNT	0x00000020L
    194 #define	SAM_ENUM_LOCAL_DOMAIN		0x00000030L
    195 #define	SAM_DOMAIN_CREATE_ACCOUNT	0x00000211L
    196 
    197 
    198 /*
    199  * File attributes
    200  *
    201  * Note:  0x00000008 is reserved for use for the old DOS VOLID (volume ID)
    202  *        and is therefore not considered valid in NT.
    203  *
    204  * Note:  0x00000010 is reserved for use for the old DOS SUBDIRECTORY flag
    205  *        and is therefore not considered valid in NT.  This flag has
    206  *        been disassociated with file attributes since the other flags are
    207  *        protected with READ_ and WRITE_ATTRIBUTES access to the file.
    208  *
    209  * Note:  Note also that the order of these flags is set to allow both the
    210  *        FAT and the Pinball File Systems to directly set the attributes
    211  *        flags in attributes words without having to pick each flag out
    212  *        individually.  The order of these flags should not be changed!
    213  *
    214  * The file attributes are defined in smbsrv/smb_vops.h
    215  */
    216 
    217 /* Filesystem Attributes */
    218 #define	FILE_CASE_SENSITIVE_SEARCH	0x00000001
    219 #define	FILE_CASE_PRESERVED_NAMES	0x00000002
    220 #define	FILE_UNICODE_ON_DISK		0x00000004
    221 #define	FILE_PERSISTENT_ACLS		0x00000008
    222 #define	FILE_FILE_COMPRESSION		0x00000010
    223 #define	FILE_VOLUME_QUOTAS		0x00000020
    224 #define	FILE_SUPPORTS_SPARSE_FILES	0x00000040
    225 #define	FILE_SUPPORTS_REPARSE_POINTS	0x00000080
    226 #define	FILE_SUPPORTS_REMOTE_STORAGE	0x00000100
    227 #define	FILE_VOLUME_IS_COMPRESSED	0x00008000
    228 #define	FILE_SUPPORTS_OBJECT_IDS	0x00010000
    229 #define	FILE_SUPPORTS_ENCRYPTION	0x00020000
    230 #define	FILE_NAMED_STREAMS		0x00040000
    231 #define	FILE_READ_ONLY_VOLUME		0x00080000
    232 
    233 #ifdef __cplusplus
    234 }
    235 #endif
    236 
    237 #endif /* _SMBSRV_NTACCESS_H */
    238