xref: /titanic_41/usr/src/uts/common/smbsrv/ntifs.h (revision 9fb67ea305c66b6a297583b9b0db6796b0dfe497)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _SMBSRV_NTIFS_H
27 #define	_SMBSRV_NTIFS_H
28 
29 /*
30  * This file provides definitions compatible with the NT Installable
31  * File System (IFS) interface. This header file also defines the Security
32  * Descriptor module from Windows.
33  */
34 
35 #ifdef __cplusplus
36 extern "C" {
37 #endif
38 
39 #include <sys/acl.h>
40 #include <sys/list.h>
41 #include <smbsrv/smb_sid.h>
42 
43 /*
44  * The Volume and Directory bits are for SMB rather than NT.
45  * NT has an explicit Normal bit; this bit is implied in SMB
46  * when the Hidden, System and Directory bits are not set.
47  *
48  * File attributes and creation flags share the same 32-bit
49  * space.
50  */
51 #define	FILE_ATTRIBUTE_READONLY			0x00000001
52 #define	FILE_ATTRIBUTE_HIDDEN			0x00000002
53 #define	FILE_ATTRIBUTE_SYSTEM			0x00000004
54 #define	FILE_ATTRIBUTE_VOLUME			0x00000008
55 #define	FILE_ATTRIBUTE_DIRECTORY		0x00000010
56 #define	FILE_ATTRIBUTE_ARCHIVE			0x00000020
57 #define	FILE_ATTRIBUTE_DEVICE			0x00000040
58 #define	FILE_ATTRIBUTE_NORMAL			0x00000080
59 #define	FILE_ATTRIBUTE_TEMPORARY		0x00000100
60 #define	FILE_ATTRIBUTE_SPARSE_FILE		0x00000200
61 #define	FILE_ATTRIBUTE_REPARSE_POINT		0x00000400
62 #define	FILE_ATTRIBUTE_COMPRESSED		0x00000800
63 #define	FILE_ATTRIBUTE_OFFLINE			0x00001000
64 #define	FILE_ATTRIBUTE_NOT_CONTENT_INDEXED	0x00002000
65 #define	FILE_ATTRIBUTE_ENCRYPTED		0x00004000
66 #define	FILE_ATTRIBUTE_VIRTUAL			0x00010000
67 #define	FILE_FLAG_OPEN_NO_RECALL		0x00100000
68 #define	FILE_FLAG_OPEN_REPARSE_POINT		0x00200000
69 #define	FILE_FLAG_POSIX_SEMANTICS		0x01000000
70 #define	FILE_FLAG_BACKUP_SEMANTICS		0x02000000
71 #define	FILE_FLAG_DELETE_ON_CLOSE		0x04000000
72 #define	FILE_FLAG_SEQUENTIAL_SCAN		0x08000000
73 #define	FILE_FLAG_RANDOM_ACCESS			0x10000000
74 #define	FILE_FLAG_NO_BUFFERING			0x20000000
75 #define	FILE_FLAG_OVERLAPPED			0x40000000
76 #define	FILE_FLAG_WRITE_THROUGH			0x80000000
77 
78 #define	FILE_ATTRIBUTE_VALID_FLAGS		0x00001fb7
79 #define	FILE_ATTRIBUTE_VALID_SET_FLAGS		0x00001fa7
80 #define	FILE_ATTRIBUTE_MASK			0x00003FFF
81 
82 /*
83  * The create/open option flags: used in NtCreateAndx and NtTransactCreate
84  * SMB requests.
85  *
86  * The CreateOptions specify the options to be applied when creating or
87  * opening the file, as a compatible combination of the following flags:
88  *
89  * FILE_DIRECTORY_FILE
90  *	The file being created or opened is a directory file. With this
91  *	flag, the Disposition parameter must be set to one of FILE_CREATE,
92  *	FILE_OPEN, or FILE_OPEN_IF. With this flag, other compatible
93  *	CreateOptions flags include only the following:
94  *			FILE_SYNCHRONOUS_IO_ALERT
95  *			FILE_SYNCHRONOUS_IO_NONALERT
96  *			FILE_WRITE_THROUGH
97  *			FILE_OPEN_FOR_BACKUP_INTENT
98  *			FILE_OPEN_BY_FILE_ID
99  *
100  * FILE_NON_DIRECTORY_FILE
101  *	The file being opened must not be a directory file or this call
102  *	will fail. The file object being opened can represent a data file,
103  *	a logical, virtual, or physical device, or a volume.
104  *
105  * FILE_WRITE_THROUGH
106  *	System services, FSDs, and drivers that write data to the file must
107  *	actually transfer the data into the file before any requested write
108  *	operation is considered complete. This flag is automatically set if
109  *	the CreateOptions flag FILE_NO_INTERMEDIATE _BUFFERING is set.
110  *
111  * FILE_SEQUENTIAL_ONLY
112  *	All accesses to the file will be sequential.
113  *
114  * FILE_RANDOM_ACCESS
115  *	Accesses to the file can be random, so no sequential read-ahead
116  *	operations should be performed on the file by FSDs or the system.
117  *	FILE_NO_INTERMEDIATE _BUFFERING	The file cannot be cached or
118  *	buffered in a driver's internal buffers. This flag is incompatible
119  *	with the DesiredAccess FILE_APPEND_DATA flag.
120  *
121  * FILE_SYNCHRONOUS_IO_ALERT
122  *	All operations on the file are performed synchronously. Any wait
123  *	on behalf of the caller is subject to premature termination from
124  *	alerts. This flag also causes the I/O system to maintain the file
125  *	position context. If this flag is set, the DesiredAccess
126  *	SYNCHRONIZE flag also must be set.
127  *
128  * FILE_SYNCHRONOUS_IO _NONALERT
129  *	All operations on the file are performed synchronously. Waits in
130  *	the system to synchronize I/O queuing and completion are not subject
131  *	to alerts. This flag also causes the I/O system to maintain the file
132  *	position context. If this flag is set, the DesiredAccess SYNCHRONIZE
133  *	flag also must be set.
134  *
135  * FILE_CREATE_TREE _CONNECTION
136  *	Create a tree connection for this file in order to open it over the
137  *	network. This flag is irrelevant to device and intermediate drivers.
138  *
139  * FILE_COMPLETE_IF_OPLOCKED
140  *	Complete this operation immediately with an alternate success code
141  *	if the target file is oplocked, rather than blocking the caller's
142  *	thread. If the file is oplocked, another caller already has access
143  *	to the file over the network. This flag is irrelevant to device and
144  *	intermediate drivers.
145  *
146  * FILE_NO_EA_KNOWLEDGE
147  *	If the extended attributes on an existing file being opened indicate
148  *	that the caller must understand EAs to properly interpret the file,
149  *	fail this request because the caller does not understand how to deal
150  *	with EAs. Device and intermediate drivers can ignore this flag.
151  *
152  * FILE_DELETE_ON_CLOSE
153  *	Delete the file when the last reference to it is passed to close.
154  *
155  * FILE_OPEN_BY_FILE_ID
156  *	The file name contains the name of a device and a 64-bit ID to
157  *	be used to open the file. This flag is irrelevant to device and
158  *	intermediate drivers.
159  *
160  * FILE_OPEN_FOR_BACKUP _INTENT
161  *	The file is being opened for backup intent, hence, the system should
162  *	check for certain access rights and grant the caller the appropriate
163  *	accesses to the file before checking the input DesiredAccess against
164  *	the file's security descriptor. This flag is irrelevant to device
165  *	and intermediate drivers.
166  */
167 #define	FILE_DIRECTORY_FILE			0x00000001
168 #define	FILE_WRITE_THROUGH			0x00000002
169 #define	FILE_SEQUENTIAL_ONLY			0x00000004
170 #define	FILE_NO_INTERMEDIATE_BUFFERING		0x00000008
171 
172 #define	FILE_SYNCHRONOUS_IO_ALERT		0x00000010
173 #define	FILE_SYNCHRONOUS_IO_NONALERT		0x00000020
174 #define	FILE_NON_DIRECTORY_FILE			0x00000040
175 #define	FILE_CREATE_TREE_CONNECTION		0x00000080
176 
177 #define	FILE_COMPLETE_IF_OPLOCKED		0x00000100
178 #define	FILE_NO_EA_KNOWLEDGE			0x00000200
179 /* UNUSED					0x00000400 */
180 #define	FILE_RANDOM_ACCESS			0x00000800
181 
182 #define	FILE_DELETE_ON_CLOSE			0x00001000
183 #define	FILE_OPEN_BY_FILE_ID			0x00002000
184 #define	FILE_OPEN_FOR_BACKUP_INTENT		0x00004000
185 #define	FILE_NO_COMPRESSION			0x00008000
186 
187 #define	FILE_RESERVE_OPFILTER			0x00100000
188 #define	FILE_RESERVED0				0x00200000
189 #define	FILE_RESERVED1				0x00400000
190 #define	FILE_RESERVED2				0x00800000
191 
192 #define	FILE_VALID_OPTION_FLAGS			0x007fffff
193 #define	FILE_VALID_PIPE_OPTION_FLAGS		0x00000032
194 #define	FILE_VALID_MAILSLOT_OPTION_FLAGS	0x00000032
195 #define	FILE_VALID_SET_FLAGS			0x00000036
196 
197 /*
198  * Define the file information class values used by the NT DDK and HAL.
199  */
200 typedef enum _FILE_INFORMATION_CLASS {
201 	FileDirectoryInformation		= 1,
202 	FileFullDirectoryInformation,		/* 2 */
203 	FileBothDirectoryInformation,		/* 3 */
204 	FileBasicInformation,			/* 4 */
205 	FileStandardInformation,		/* 5 */
206 	FileInternalInformation,		/* 6 */
207 	FileEaInformation,			/* 7 */
208 	FileAccessInformation,			/* 8 */
209 	FileNameInformation,			/* 9 */
210 	FileRenameInformation,			/* 10 */
211 	FileLinkInformation,			/* 11 */
212 	FileNamesInformation,			/* 12 */
213 	FileDispositionInformation,		/* 13 */
214 	FilePositionInformation,		/* 14 */
215 	FileFullEaInformation,			/* 15 */
216 	FileModeInformation,			/* 16 */
217 	FileAlignmentInformation,		/* 17 */
218 	FileAllInformation,			/* 18 */
219 	FileAllocationInformation,		/* 19 */
220 	FileEndOfFileInformation,		/* 20 */
221 	FileAlternateNameInformation,		/* 21 */
222 	FileStreamInformation,			/* 22 */
223 	FilePipeInformation,			/* 23 */
224 	FilePipeLocalInformation,		/* 24 */
225 	FilePipeRemoteInformation,		/* 25 */
226 	FileMailslotQueryInformation,		/* 26 */
227 	FileMailslotSetInformation,		/* 27 */
228 	FileCompressionInformation,		/* 28 */
229 	FileObjectIdInformation,		/* 29 */
230 	FileCompletionInformation,		/* 30 */
231 	FileMoveClusterInformation,		/* 31 */
232 	FileQuotaInformation,			/* 32 */
233 	FileReparsePointInformation,		/* 33 */
234 	FileNetworkOpenInformation,		/* 34 */
235 	FileAttributeTagInformation,		/* 35 */
236 	FileTrackingInformation,		/* 36 */
237 	FileIdBothDirectoryInformation,		/* 37 */
238 	FileIdFullDirectoryInformation,		/* 38 */
239 	FileValidDataLengthInformation,		/* 39 */
240 	FileShortNameInformation,		/* 40 */
241 	FileInformationReserved41,		/* 41 */
242 	FileInformationReserved42,		/* 42 */
243 	FileInformationReserved43,		/* 43 */
244 	FileSfioReserveInformation,		/* 44 */
245 	FileSfioVolumeInformation,		/* 45 */
246 	FileHardLinkInformation,		/* 46 */
247 	FileInformationReserved47,		/* 47 */
248 	FileNormalizedNameInformation,		/* 48 */
249 	FileInformationReserved49,		/* 49 */
250 	FileIdGlobalTxDirectoryInformation,	/* 50 */
251 	FileInformationReserved51,		/* 51 */
252 	FileInformationReserved52,		/* 52 */
253 	FileInformationReserved53,		/* 53 */
254 	FileStandardLinkInformation,		/* 54 */
255 	FileMaximumInformation
256 } FILE_INFORMATION_CLASS;
257 
258 /*
259  * Define the file system information class values.
260  */
261 typedef enum _FILE_FS_INFORMATION_CLASS {
262 	FileFsVolumeInformation		= 1,
263 	FileFsLabelInformation,		/* 2 */
264 	FileFsSizeInformation,		/* 3 */
265 	FileFsDeviceInformation,	/* 4 */
266 	FileFsAttributeInformation,	/* 5 */
267 	FileFsControlInformation,	/* 6 */
268 	FileFsFullSizeInformation,	/* 7 */
269 	FileFsObjectIdInformation,	/* 8 */
270 	FileFsDriverPathInformation	/* 9 */
271 } FILE_FS_INFORMATION_CLASS;
272 
273 /*
274  * Discretionary Access Control List (DACL)
275  *
276  * A Discretionary Access Control List (DACL), often abbreviated to
277  * ACL, is a list of access controls which either allow or deny access
278  * for users or groups to a resource. There is a list header followed
279  * by a list of access control entries (ACE). Each ACE specifies the
280  * access allowed or denied to a single user or group (identified by
281  * a SID).
282  *
283  * There is another access control list object called a System Access
284  * Control List (SACL), which is used to control auditing, but no
285  * support is provideed for SACLs at this time.
286  *
287  * ACL header format:
288  *
289  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
290  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
291  *   +-------------------------------+---------------+---------------+
292  *   |            AclSize            |      Sbz1     |  AclRevision  |
293  *   +-------------------------------+---------------+---------------+
294  *   |              Sbz2             |           AceCount            |
295  *   +-------------------------------+-------------------------------+
296  *
297  * AclRevision specifies the revision level of the ACL. This value should
298  * be ACL_REVISION, unless the ACL contains an object-specific ACE, in which
299  * case this value must be ACL_REVISION_DS. All ACEs in an ACL must be at the
300  * same revision level.
301  *
302  * ACE header format:
303  *
304  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
305  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
306  *   +---------------+-------+-------+---------------+---------------+
307  *   |            AceSize            |    AceFlags   |     AceType   |
308  *   +---------------+-------+-------+---------------+---------------+
309  *
310  * Access mask format:
311  *
312  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
313  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
314  *   +---------------+---------------+-------------------------------+
315  *   |G|G|G|G|Res'd|A| StandardRights|         SpecificRights        |
316  *   |R|W|E|A|     |S|               |                               |
317  *   +-+-------------+---------------+-------------------------------+
318  *
319  *   typedef struct ACCESS_MASK {
320  *       WORD SpecificRights;
321  *       BYTE StandardRights;
322  *       BYTE AccessSystemAcl : 1;
323  *       BYTE Reserved : 3;
324  *       BYTE GenericAll : 1;
325  *       BYTE GenericExecute : 1;
326  *       BYTE GenericWrite : 1;
327  *       BYTE GenericRead : 1;
328  *   } ACCESS_MASK;
329  *
330  */
331 
332 #define	ACL_REVISION1			1
333 #define	ACL_REVISION2			2
334 #define	MIN_ACL_REVISION2		ACL_REVISION2
335 #define	ACL_REVISION3			3
336 #define	ACL_REVISION4			4
337 #define	MAX_ACL_REVISION		ACL_REVISION4
338 
339 /*
340  * Current ACE and ACL revision Levels
341  */
342 #define	ACE_REVISION			1
343 #define	ACL_REVISION			ACL_REVISION2
344 #define	ACL_REVISION_DS			ACL_REVISION4
345 
346 
347 #define	ACCESS_ALLOWED_ACE_TYPE		0
348 #define	ACCESS_DENIED_ACE_TYPE		1
349 #define	SYSTEM_AUDIT_ACE_TYPE		2
350 #define	SYSTEM_ALARM_ACE_TYPE		3
351 
352 /*
353  *  se_flags
354  * ----------
355  * Specifies a set of ACE type-specific control flags. This member can be a
356  * combination of the following values.
357  *
358  * CONTAINER_INHERIT_ACE: Child objects that are containers, such as
359  *		directories, inherit the ACE as an effective ACE. The inherited
360  *		ACE is inheritable unless the NO_PROPAGATE_INHERIT_ACE bit flag
361  *		is also set.
362  *
363  * INHERIT_ONLY_ACE: Indicates an inherit-only ACE which does not control
364  *		access to the object to which it is attached.
365  *		If this flag is not set,
366  *		the ACE is an effective ACE which controls access to the object
367  *		to which it is attached.
368  * 		Both effective and inherit-only ACEs can be inherited
369  *		depending on the state of the other inheritance flags.
370  *
371  * INHERITED_ACE: Windows 2000/XP: Indicates that the ACE was inherited.
372  *		The system sets this bit when it propagates an
373  *		inherited ACE to a child object.
374  *
375  * NO_PROPAGATE_INHERIT_ACE: If the ACE is inherited by a child object, the
376  *		system clears the OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE
377  *		flags in the inherited ACE.
378  *		This prevents the ACE from being inherited by
379  *		subsequent generations of objects.
380  *
381  * OBJECT_INHERIT_ACE: Noncontainer child objects inherit the ACE as an
382  *		effective ACE.  For child objects that are containers,
383  *		the ACE is inherited as an inherit-only ACE unless the
384  *		NO_PROPAGATE_INHERIT_ACE bit flag is also set.
385  */
386 #define	OBJECT_INHERIT_ACE		0x01
387 #define	CONTAINER_INHERIT_ACE		0x02
388 #define	NO_PROPOGATE_INHERIT_ACE	0x04
389 #define	INHERIT_ONLY_ACE		0x08
390 #define	INHERITED_ACE			0x10
391 #define	INHERIT_MASK_ACE		0x1F
392 
393 
394 /*
395  * These flags are only used in system audit or alarm ACEs to
396  * indicate when an audit message should be generated, i.e.
397  * on successful access or on unsuccessful access.
398  */
399 #define	SUCCESSFUL_ACCESS_ACE_FLAG	0x40
400 #define	FAILED_ACCESS_ACE_FLAG		0x80
401 
402 /*
403  * se_bsize is the size, in bytes, of ACE as it appears on the wire.
404  * se_sln is used to sort the ACL when it's required.
405  */
406 typedef struct smb_acehdr {
407 	uint8_t		se_type;
408 	uint8_t		se_flags;
409 	uint16_t	se_bsize;
410 } smb_acehdr_t;
411 
412 typedef struct smb_ace {
413 	smb_acehdr_t	se_hdr;
414 	uint32_t	se_mask;
415 	list_node_t	se_sln;
416 	smb_sid_t	*se_sid;
417 } smb_ace_t;
418 
419 /*
420  * sl_bsize is the size of ACL in bytes as it appears on the wire.
421  */
422 typedef struct smb_acl {
423 	uint8_t		sl_revision;
424 	uint16_t	sl_bsize;
425 	uint16_t	sl_acecnt;
426 	smb_ace_t	*sl_aces;
427 	list_t		sl_sorted;
428 } smb_acl_t;
429 
430 /*
431  * ACE/ACL header size, in byte, as it appears on the wire
432  */
433 #define	SMB_ACE_HDRSIZE		4
434 #define	SMB_ACL_HDRSIZE		8
435 
436 /*
437  * Security Descriptor (SD)
438  *
439  * Security descriptors provide protection for objects, for example
440  * files and directories. It identifies the owner and primary group
441  * (SIDs) and contains an access control list. When a user tries to
442  * access an object his SID is compared to the permissions in the
443  * DACL to determine if access should be allowed or denied. Note that
444  * this is a simplification because there are other factors, such as
445  * default behavior and privileges to be taken into account (see also
446  * access tokens).
447  *
448  * The boolean flags have the following meanings when set:
449  *
450  * SE_OWNER_DEFAULTED indicates that the SID pointed to by the Owner
451  * field was provided by a defaulting mechanism rather than explicitly
452  * provided by the original provider of the security descriptor. This
453  * may affect the treatment of the SID with respect to inheritance of
454  * an owner.
455  *
456  * SE_GROUP_DEFAULTED indicates that the SID in the Group field was
457  * provided by a defaulting mechanism rather than explicitly provided
458  * by the original provider of the security descriptor.  This may
459  * affect the treatment of the SID with respect to inheritance of a
460  * primary group.
461  *
462  * SE_DACL_PRESENT indicates that the security descriptor contains a
463  * discretionary ACL. If this flag is set and the Dacl field of the
464  * SECURITY_DESCRIPTOR is null, then a null ACL is explicitly being
465  * specified.
466  *
467  * SE_DACL_DEFAULTED indicates that the ACL pointed to by the Dacl
468  * field was provided by a defaulting mechanism rather than explicitly
469  * provided by the original provider of the security descriptor. This
470  * may affect the treatment of the ACL with respect to inheritance of
471  * an ACL. This flag is ignored if the DaclPresent flag is not set.
472  *
473  * SE_SACL_PRESENT indicates that the security descriptor contains a
474  * system ACL pointed to by the Sacl field. If this flag is set and
475  * the Sacl field of the SECURITY_DESCRIPTOR is null, then an empty
476  * (but present) ACL is being specified.
477  *
478  * SE_SACL_DEFAULTED indicates that the ACL pointed to by the Sacl
479  * field was provided by a defaulting mechanism rather than explicitly
480  * provided by the original provider of the security descriptor. This
481  * may affect the treatment of the ACL with respect to inheritance of
482  * an ACL. This flag is ignored if the SaclPresent flag is not set.
483  *
484  * SE_DACL_PROTECTED Prevents ACEs set on the DACL of the parent container
485  * (and any objects above the parent container in the directory hierarchy)
486  * from being applied to the object's DACL.
487  *
488  * SE_SACL_PROTECTED Prevents ACEs set on the SACL of the parent container
489  * (and any objects above the parent container in the directory hierarchy)
490  * from being applied to the object's SACL.
491  *
492  * Note that the SE_DACL_PRESENT flag needs to be present to set
493  * SE_DACL_PROTECTED and SE_SACL_PRESENT needs to be present to set
494  * SE_SACL_PROTECTED.
495  *
496  * SE_SELF_RELATIVE indicates that the security descriptor is in self-
497  * relative form. In this form, all fields of the security descriptor
498  * are contiguous in memory and all pointer fields are expressed as
499  * offsets from the beginning of the security descriptor.
500  *
501  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
502  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
503  *   +---------------------------------------------------------------+
504  *   |            Control            |Reserved1 (SBZ)|   Revision    |
505  *   +---------------------------------------------------------------+
506  *   |                            Owner                              |
507  *   +---------------------------------------------------------------+
508  *   |                            Group                              |
509  *   +---------------------------------------------------------------+
510  *   |                            Sacl                               |
511  *   +---------------------------------------------------------------+
512  *   |                            Dacl                               |
513  *   +---------------------------------------------------------------+
514  *
515  */
516 
517 #define	SMB_OWNER_SECINFO	0x0001
518 #define	SMB_GROUP_SECINFO	0x0002
519 #define	SMB_DACL_SECINFO	0x0004
520 #define	SMB_SACL_SECINFO	0x0008
521 #define	SMB_ALL_SECINFO		0x000F
522 #define	SMB_ACL_SECINFO		(SMB_DACL_SECINFO | SMB_SACL_SECINFO)
523 
524 #define	SECURITY_DESCRIPTOR_REVISION	1
525 
526 
527 #define	SE_OWNER_DEFAULTED		0x0001
528 #define	SE_GROUP_DEFAULTED		0x0002
529 #define	SE_DACL_PRESENT			0x0004
530 #define	SE_DACL_DEFAULTED		0x0008
531 #define	SE_SACL_PRESENT			0x0010
532 #define	SE_SACL_DEFAULTED		0x0020
533 #define	SE_DACL_AUTO_INHERIT_REQ	0x0100
534 #define	SE_SACL_AUTO_INHERIT_REQ	0x0200
535 #define	SE_DACL_AUTO_INHERITED		0x0400
536 #define	SE_SACL_AUTO_INHERITED		0x0800
537 #define	SE_DACL_PROTECTED		0x1000
538 #define	SE_SACL_PROTECTED		0x2000
539 #define	SE_SELF_RELATIVE		0x8000
540 
541 #define	SE_DACL_INHERITANCE_MASK	0x1500
542 #define	SE_SACL_INHERITANCE_MASK	0x2A00
543 
544 /*
545  * Security descriptor structures:
546  *
547  * smb_sd_t     SD in SMB pointer form
548  * smb_fssd_t   SD in filesystem form
549  *
550  * Filesystems (e.g. ZFS/UFS) don't have something equivalent
551  * to SD. The items comprising a SMB SD are kept separately in
552  * filesystem. smb_fssd_t is introduced as a helper to provide
553  * the required abstraction for CIFS code.
554  */
555 
556 typedef struct smb_sd {
557 	uint8_t		sd_revision;
558 	uint16_t	sd_control;
559 	smb_sid_t 	*sd_owner;	/* SID file owner */
560 	smb_sid_t 	*sd_group;	/* SID group (for POSIX) */
561 	smb_acl_t 	*sd_sacl;	/* ACL System (audits) */
562 	smb_acl_t 	*sd_dacl;	/* ACL Discretionary (perm) */
563 } smb_sd_t;
564 
565 /*
566  * SD header size as it appears on the wire
567  */
568 #define	SMB_SD_HDRSIZE	20
569 
570 /*
571  * values for smb_fssd.sd_flags
572  */
573 #define	SMB_FSSD_FLAGS_DIR	0x01
574 
575 typedef struct smb_fssd {
576 	uint32_t	sd_secinfo;
577 	uint32_t	sd_flags;
578 	uid_t		sd_uid;
579 	gid_t		sd_gid;
580 	acl_t		*sd_zdacl;
581 	acl_t		*sd_zsacl;
582 } smb_fssd_t;
583 
584 void smb_sd_init(smb_sd_t *, uint8_t);
585 void smb_sd_term(smb_sd_t *);
586 uint32_t smb_sd_get_secinfo(smb_sd_t *);
587 uint32_t smb_sd_len(smb_sd_t *, uint32_t);
588 uint32_t smb_sd_tofs(smb_sd_t *, smb_fssd_t *);
589 
590 void smb_fssd_init(smb_fssd_t *, uint32_t, uint32_t);
591 void smb_fssd_term(smb_fssd_t *);
592 
593 void smb_acl_sort(smb_acl_t *);
594 void smb_acl_free(smb_acl_t *);
595 smb_acl_t *smb_acl_alloc(uint8_t, uint16_t, uint16_t);
596 smb_acl_t *smb_acl_from_zfs(acl_t *);
597 uint32_t smb_acl_to_zfs(smb_acl_t *, uint32_t, int, acl_t **);
598 uint16_t smb_acl_len(smb_acl_t *);
599 boolean_t smb_acl_isvalid(smb_acl_t *, int);
600 
601 void smb_fsacl_free(acl_t *);
602 acl_t *smb_fsacl_alloc(int, int);
603 
604 #ifdef __cplusplus
605 }
606 #endif
607 
608 #endif /* _SMBSRV_NTIFS_H */
609