/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*
* Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
*/
#ifndef _SMB_PRIVILEGE_H
#define _SMB_PRIVILEGE_H
#include <smb/wintypes.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
* Privileges
*
* Privileges apply to all objects and over-ride the access controls
* in an object's security descriptor in a manner specific to each
* privilege. Privileges are still not full defined. Privileges are
* defined in a set structure (LUID = Locally Unique Identifier).
*
* The default LUID, name and display names defined on NT 4.0 are:
* LUID Privilege Name Display Name
* ---- -------------- ------------
* 0:2 SeCreateTokenPrivilege Create a token object
* 0:3 SeAssignPrimaryTokenPrivilege Replace a process level token
* 0:4 SeLockMemoryPrivilege Lock pages in memory
* 0:5 SeIncreaseQuotaPrivilege Increase quotas
* 0:6 SeMachineAccountPrivilege Add workstations to domain
* 0:7 SeTcbPrivilege Act as part of the operating system
* 0:8 SeSecurityPrivilege Manage auditing and security log
* 0:9 SeTakeOwnershipPrivilege Take ownership of files or other objects
* 0:10 SeLoadDriverPrivilege Load and unload device drivers
* 0:11 SeSystemProfilePrivilege Profile system performance
* 0:12 SeSystemtimePrivilege Change the system time
* 0:13 SeProfileSingleProcessPrivilege Profile single process
* 0:14 SeIncreaseBasePriorityPrivilege Increase scheduling priority
* 0:15 SeCreatePagefilePrivilege Create a pagefile
* 0:16 SeCreatePermanentPrivilege Create permanent shared objects
* 0:17 SeBackupPrivilege Back up files and directories
* 0:18 SeRestorePrivilege Restore files and directories
* 0:19 SeShutdownPrivilege Shut down the system
* 0:20 SeDebugPrivilege Debug programs
* 0:21 SeAuditPrivilege Generate security audits
* 0:22 SeSystemEnvironmentPrivilege Modify firmware environment values
* 0:23 SeChangeNotifyPrivilege Bypass traverse checking
* 0:24 SeRemoteShutdownPrivilege Force shutdown from a remote system
*/
/*
* Privilege names
*/
#define SE_CREATE_TOKEN_NAME "SeCreateTokenPrivilege"
#define SE_ASSIGNPRIMARYTOKEN_NAME "SeAssignPrimaryTokenPrivilege"
#define SE_LOCK_MEMORY_NAME "SeLockMemoryPrivilege"
#define SE_INCREASE_QUOTA_NAME "SeIncreaseQuotaPrivilege"
#define SE_UNSOLICITED_INPUT_NAME "SeUnsolicitedInputPrivilege"
#define SE_MACHINE_ACCOUNT_NAME "SeMachineAccountPrivilege"
#define SE_TCB_NAME "SeTcbPrivilege"
#define SE_SECURITY_NAME "SeSecurityPrivilege"
#define SE_TAKE_OWNERSHIP_NAME "SeTakeOwnershipPrivilege"
#define SE_LOAD_DRIVER_NAME "SeLoadDriverPrivilege"
#define SE_SYSTEM_PROFILE_NAME "SeSystemProfilePrivilege"
#define SE_SYSTEMTIME_NAME "SeSystemtimePrivilege"
#define SE_PROF_SINGLE_PROCESS_NAME "SeProfileSingleProcessPrivilege"
#define SE_INC_BASE_PRIORITY_NAME "SeIncreaseBasePriorityPrivilege"
#define SE_CREATE_PAGEFILE_NAME "SeCreatePagefilePrivilege"
#define SE_CREATE_PERMANENT_NAME "SeCreatePermanentPrivilege"
#define SE_BACKUP_NAME "SeBackupPrivilege"
#define SE_RESTORE_NAME "SeRestorePrivilege"
#define SE_SHUTDOWN_NAME "SeShutdownPrivilege"
#define SE_DEBUG_NAME "SeDebugPrivilege"
#define SE_AUDIT_NAME "SeAuditPrivilege"
#define SE_SYSTEM_ENVIRONMENT_NAME "SeSystemEnvironmentPrivilege"
#define SE_CHANGE_NOTIFY_NAME "SeChangeNotifyPrivilege"
#define SE_REMOTE_SHUTDOWN_NAME "SeRemoteShutdownPrivilege"
#define SE_READ_FILE_NAME "BypassAclRead"
#define SE_WRITE_FILE_NAME "BypassAclWrite"
#define SE_MIN_LUID 2
#define SE_CREATE_TOKEN_LUID 2
#define SE_ASSIGNPRIMARYTOKEN_LUID 3
#define SE_LOCK_MEMORY_LUID 4
#define SE_INCREASE_QUOTA_LUID 5
#define SE_MACHINE_ACCOUNT_LUID 6
#define SE_TCB_LUID 7
#define SE_SECURITY_LUID 8
#define SE_TAKE_OWNERSHIP_LUID 9
#define SE_LOAD_DRIVER_LUID 10
#define SE_SYSTEM_PROFILE_LUID 11
#define SE_SYSTEMTIME_LUID 12
#define SE_PROF_SINGLE_PROCESS_LUID 13
#define SE_INC_BASE_PRIORITY_LUID 14
#define SE_CREATE_PAGEFILE_LUID 15
#define SE_CREATE_PERMANENT_LUID 16
#define SE_BACKUP_LUID 17
#define SE_RESTORE_LUID 18
#define SE_SHUTDOWN_LUID 19
#define SE_DEBUG_LUID 20
#define SE_AUDIT_LUID 21
#define SE_SYSTEM_ENVIRONMENT_LUID 22
#define SE_CHANGE_NOTIFY_LUID 23
#define SE_REMOTE_SHUTDOWN_LUID 24
#define SE_READ_FILE_LUID 25
#define SE_WRITE_FILE_LUID 26
#define SE_MAX_LUID 26
/*
* Privilege attributes
*/
#define SE_PRIVILEGE_DISABLED 0x00000000
#define SE_PRIVILEGE_ENABLED_BY_DEFAULT 0x00000001
#define SE_PRIVILEGE_ENABLED 0x00000002
#define SE_PRIVILEGE_USED_FOR_ACCESS 0x80000000
/*
* Privilege Set Control flags
*/
#define PRIVILEGE_SET_ALL_NECESSARY 1
/*
* Local User ID (an NT thing, not a Unix UID)
* See also: smb_luid_xdr()
*/
typedef struct smb_luid {
uint32_t lo_part;
uint32_t hi_part;
} smb_luid_t;
/*
* Local User ID and attributes (again, an NT thing)
* See also: smb_luid_attrs_xdr()
*/
typedef struct smb_luid_attrs {
smb_luid_t luid;
uint32_t attrs;
} smb_luid_attrs_t;
/*
* An (NT-style) collection of privileges.
* See also: smb_privset_xdr()
*/
typedef struct smb_privset {
uint32_t priv_cnt;
uint32_t control;
smb_luid_attrs_t priv[ANY_SIZE_ARRAY];
} smb_privset_t;
/*
* These are possible value for smb_privinfo_t.flags
*
* PF_PRESENTABLE Privilege is user visible
*/
#define PF_PRESENTABLE 0x1
/*
* Structure for passing privilege name and id information around within
* the system. Note that we are only storing the low uint32_t of the LUID;
* the high part is always zero here.
*/
typedef struct smb_privinfo {
uint32_t id;
char *name;
char *display_name;
uint16_t flags;
} smb_privinfo_t;
smb_privinfo_t *smb_priv_getbyvalue(uint32_t id);
smb_privinfo_t *smb_priv_getbyname(char *name);
int smb_priv_presentable_num(void);
int smb_priv_presentable_ids(uint32_t *ids, int num);
smb_privset_t *smb_privset_new();
int smb_privset_size();
void smb_privset_init(smb_privset_t *privset);
void smb_privset_free(smb_privset_t *privset);
void smb_privset_copy(smb_privset_t *dst, smb_privset_t *src);
void smb_privset_merge(smb_privset_t *dst, smb_privset_t *src);
void smb_privset_enable(smb_privset_t *privset, uint32_t id);
int smb_privset_query(smb_privset_t *privset, uint32_t id);
void smb_privset_log(smb_privset_t *privset);
#ifdef __cplusplus
}
#endif
#endif /* _SMB_PRIVILEGE_H */