1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 *
25 * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
26 */
27
28 #ifndef _SMB_PRIVILEGE_H
29 #define _SMB_PRIVILEGE_H
30
31 #include <smb/wintypes.h>
32
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36
37 /*
38 * Privileges
39 *
40 * Privileges apply to all objects and over-ride the access controls
41 * in an object's security descriptor in a manner specific to each
42 * privilege. Privileges are still not full defined. Privileges are
43 * defined in a set structure (LUID = Locally Unique Identifier).
44 *
45 * The default LUID, name and display names defined on NT 4.0 are:
46 * LUID Privilege Name Display Name
47 * ---- -------------- ------------
48 * 0:2 SeCreateTokenPrivilege Create a token object
49 * 0:3 SeAssignPrimaryTokenPrivilege Replace a process level token
50 * 0:4 SeLockMemoryPrivilege Lock pages in memory
51 * 0:5 SeIncreaseQuotaPrivilege Increase quotas
52 * 0:6 SeMachineAccountPrivilege Add workstations to domain
53 * 0:7 SeTcbPrivilege Act as part of the operating system
54 * 0:8 SeSecurityPrivilege Manage auditing and security log
55 * 0:9 SeTakeOwnershipPrivilege Take ownership of files or other objects
56 * 0:10 SeLoadDriverPrivilege Load and unload device drivers
57 * 0:11 SeSystemProfilePrivilege Profile system performance
58 * 0:12 SeSystemtimePrivilege Change the system time
59 * 0:13 SeProfileSingleProcessPrivilege Profile single process
60 * 0:14 SeIncreaseBasePriorityPrivilege Increase scheduling priority
61 * 0:15 SeCreatePagefilePrivilege Create a pagefile
62 * 0:16 SeCreatePermanentPrivilege Create permanent shared objects
63 * 0:17 SeBackupPrivilege Back up files and directories
64 * 0:18 SeRestorePrivilege Restore files and directories
65 * 0:19 SeShutdownPrivilege Shut down the system
66 * 0:20 SeDebugPrivilege Debug programs
67 * 0:21 SeAuditPrivilege Generate security audits
68 * 0:22 SeSystemEnvironmentPrivilege Modify firmware environment values
69 * 0:23 SeChangeNotifyPrivilege Bypass traverse checking
70 * 0:24 SeRemoteShutdownPrivilege Force shutdown from a remote system
71 */
72
73 /*
74 * Privilege names
75 */
76 #define SE_CREATE_TOKEN_NAME "SeCreateTokenPrivilege"
77 #define SE_ASSIGNPRIMARYTOKEN_NAME "SeAssignPrimaryTokenPrivilege"
78 #define SE_LOCK_MEMORY_NAME "SeLockMemoryPrivilege"
79 #define SE_INCREASE_QUOTA_NAME "SeIncreaseQuotaPrivilege"
80 #define SE_UNSOLICITED_INPUT_NAME "SeUnsolicitedInputPrivilege"
81 #define SE_MACHINE_ACCOUNT_NAME "SeMachineAccountPrivilege"
82 #define SE_TCB_NAME "SeTcbPrivilege"
83 #define SE_SECURITY_NAME "SeSecurityPrivilege"
84 #define SE_TAKE_OWNERSHIP_NAME "SeTakeOwnershipPrivilege"
85 #define SE_LOAD_DRIVER_NAME "SeLoadDriverPrivilege"
86 #define SE_SYSTEM_PROFILE_NAME "SeSystemProfilePrivilege"
87 #define SE_SYSTEMTIME_NAME "SeSystemtimePrivilege"
88 #define SE_PROF_SINGLE_PROCESS_NAME "SeProfileSingleProcessPrivilege"
89 #define SE_INC_BASE_PRIORITY_NAME "SeIncreaseBasePriorityPrivilege"
90 #define SE_CREATE_PAGEFILE_NAME "SeCreatePagefilePrivilege"
91 #define SE_CREATE_PERMANENT_NAME "SeCreatePermanentPrivilege"
92 #define SE_BACKUP_NAME "SeBackupPrivilege"
93 #define SE_RESTORE_NAME "SeRestorePrivilege"
94 #define SE_SHUTDOWN_NAME "SeShutdownPrivilege"
95 #define SE_DEBUG_NAME "SeDebugPrivilege"
96 #define SE_AUDIT_NAME "SeAuditPrivilege"
97 #define SE_SYSTEM_ENVIRONMENT_NAME "SeSystemEnvironmentPrivilege"
98 #define SE_CHANGE_NOTIFY_NAME "SeChangeNotifyPrivilege"
99 #define SE_REMOTE_SHUTDOWN_NAME "SeRemoteShutdownPrivilege"
100
101 #define SE_MIN_LUID 2
102 #define SE_CREATE_TOKEN_LUID 2
103 #define SE_ASSIGNPRIMARYTOKEN_LUID 3
104 #define SE_LOCK_MEMORY_LUID 4
105 #define SE_INCREASE_QUOTA_LUID 5
106 #define SE_MACHINE_ACCOUNT_LUID 6
107 #define SE_TCB_LUID 7
108 #define SE_SECURITY_LUID 8
109 #define SE_TAKE_OWNERSHIP_LUID 9
110 #define SE_LOAD_DRIVER_LUID 10
111 #define SE_SYSTEM_PROFILE_LUID 11
112 #define SE_SYSTEMTIME_LUID 12
113 #define SE_PROF_SINGLE_PROCESS_LUID 13
114 #define SE_INC_BASE_PRIORITY_LUID 14
115 #define SE_CREATE_PAGEFILE_LUID 15
116 #define SE_CREATE_PERMANENT_LUID 16
117 #define SE_BACKUP_LUID 17
118 #define SE_RESTORE_LUID 18
119 #define SE_SHUTDOWN_LUID 19
120 #define SE_DEBUG_LUID 20
121 #define SE_AUDIT_LUID 21
122 #define SE_SYSTEM_ENVIRONMENT_LUID 22
123 #define SE_CHANGE_NOTIFY_LUID 23
124 #define SE_REMOTE_SHUTDOWN_LUID 24
125 #define SE_MAX_LUID 24
126
127 /*
128 * Privilege attributes
129 */
130 #define SE_PRIVILEGE_DISABLED 0x00000000
131 #define SE_PRIVILEGE_ENABLED_BY_DEFAULT 0x00000001
132 #define SE_PRIVILEGE_ENABLED 0x00000002
133 #define SE_PRIVILEGE_USED_FOR_ACCESS 0x80000000
134
135 /*
136 * Privilege Set Control flags
137 */
138 #define PRIVILEGE_SET_ALL_NECESSARY 1
139
140 /*
141 * Local User ID (an NT thing, not a Unix UID)
142 * See also: smb_luid_xdr()
143 */
144 typedef struct smb_luid {
145 uint32_t lo_part;
146 uint32_t hi_part;
147 } smb_luid_t;
148
149 /*
150 * Local User ID and attributes (again, an NT thing)
151 * See also: smb_luid_attrs_xdr()
152 */
153 typedef struct smb_luid_attrs {
154 smb_luid_t luid;
155 uint32_t attrs;
156 } smb_luid_attrs_t;
157
158 /*
159 * An (NT-style) collection of privileges.
160 * See also: smb_privset_xdr()
161 */
162 typedef struct smb_privset {
163 uint32_t priv_cnt;
164 uint32_t control;
165 smb_luid_attrs_t priv[ANY_SIZE_ARRAY];
166 } smb_privset_t;
167
168 /*
169 * These are possible value for smb_privinfo_t.flags
170 *
171 * PF_PRESENTABLE Privilege is user visible
172 */
173 #define PF_PRESENTABLE 0x1
174
175 /*
176 * Structure for passing privilege name and id information around within
177 * the system. Note that we are only storing the low uint32_t of the LUID;
178 * the high part is always zero here.
179 */
180 typedef struct smb_privinfo {
181 uint32_t id;
182 char *name;
183 char *display_name;
184 uint16_t flags;
185 } smb_privinfo_t;
186
187 smb_privinfo_t *smb_priv_getbyvalue(uint32_t id);
188 smb_privinfo_t *smb_priv_getbyname(char *name);
189 int smb_priv_presentable_num(void);
190 int smb_priv_presentable_ids(uint32_t *ids, int num);
191 smb_privset_t *smb_privset_new();
192 int smb_privset_size();
193 void smb_privset_init(smb_privset_t *privset);
194 void smb_privset_free(smb_privset_t *privset);
195 void smb_privset_copy(smb_privset_t *dst, smb_privset_t *src);
196 void smb_privset_merge(smb_privset_t *dst, smb_privset_t *src);
197 void smb_privset_enable(smb_privset_t *privset, uint32_t id);
198 int smb_privset_query(smb_privset_t *privset, uint32_t id);
199 void smb_privset_log(smb_privset_t *privset);
200
201 #ifdef __cplusplus
202 }
203 #endif
204
205 #endif /* _SMB_PRIVILEGE_H */