summaryrefslogtreecommitdiff
path: root/source4/librpc
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2004-11-17 14:35:29 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:05:56 -0500
commit856ee665374071c89f5ecf540dcc3d68ccf2ff16 (patch)
tree34c2193631b6f965d85724f05c67e57a8508d997 /source4/librpc
parent04a47a26ce3cdc9de5a98ede499be6e693896824 (diff)
downloadsamba-856ee665374071c89f5ecf540dcc3d68ccf2ff16.tar.gz
samba-856ee665374071c89f5ecf540dcc3d68ccf2ff16.tar.bz2
samba-856ee665374071c89f5ecf540dcc3d68ccf2ff16.zip
r3810: create a LIB_SECURITY subsystem
- move dom_sid, security_descriptor, security_* funtions to one place and rename some of them metze (This used to be commit b620bdd672cfdf0e009492e648b0709e6b6d8596)
Diffstat (limited to 'source4/librpc')
-rw-r--r--source4/librpc/config.mk1
-rw-r--r--source4/librpc/idl/krb5pac.idl3
-rw-r--r--source4/librpc/idl/lsa.idl3
-rw-r--r--source4/librpc/idl/misc.idl95
-rw-r--r--source4/librpc/idl/samr.idl2
-rw-r--r--source4/librpc/idl/security.idl123
-rw-r--r--source4/librpc/idl/spoolss.idl3
-rw-r--r--source4/librpc/idl/srvsvc.idl3
-rw-r--r--source4/librpc/ndr/ndr_sec.c16
9 files changed, 133 insertions, 116 deletions
diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index 2588590275..d527eabb2a 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -5,7 +5,6 @@ INIT_OBJ_FILES = \
librpc/ndr/ndr.o
ADD_OBJ_FILES = \
librpc/ndr/ndr_basic.o \
- librpc/ndr/ndr_sec.o \
librpc/ndr/ndr_spoolss_buf.o \
librpc/ndr/ndr_dcom.o
# End SUBSYSTEM LIBNDR_RAW
diff --git a/source4/librpc/idl/krb5pac.idl b/source4/librpc/idl/krb5pac.idl
index d3a28df27b..6efd8526b2 100644
--- a/source4/librpc/idl/krb5pac.idl
+++ b/source4/librpc/idl/krb5pac.idl
@@ -7,7 +7,8 @@
[
uuid("46746756-7567-7567-5677-756756756756"),
version(0.0),
- pointer_default(unique)
+ pointer_default(unique),
+ depends(security)
]
interface krb5pac
{
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 05da1bec8b..d3d3ad3da6 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -8,7 +8,8 @@
version(0.0),
endpoint("ncacn_np:[\\pipe\\lsarpc]","ncacn_np:[\\pipe\\lsass]", "ncacn_ip_tcp:"),
pointer_default(unique),
- helpstring("Local Server Authentication(?)")
+ helpstring("Local Server Authentication(?)"),
+ depends(security)
] interface lsarpc
{
/******************/
diff --git a/source4/librpc/idl/misc.idl b/source4/librpc/idl/misc.idl
index dd31f0f54a..61adf04630 100644
--- a/source4/librpc/idl/misc.idl
+++ b/source4/librpc/idl/misc.idl
@@ -6,37 +6,6 @@
interface misc
{
- /* a NULL sid */
- const string SID_NULL = "S-1-0-0";
-
- /* the world domain */
- const string SID_WORLD_DOMAIN = "S-1-1";
- const string SID_WORLD = "S-1-1-0";
-
- /* SECURITY_CREATOR_SID_AUTHORITY */
- const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
- const string SID_CREATOR_OWNER = "S-1-3-0";
- const string SID_CREATOR_GROUP = "S-1-3-1";
-
- /* SECURITY_NT_AUTHORITY */
- const string SID_NT_AUTHORITY = "S-1-5";
- const string SID_NETWORK = "S-1-5-2";
- const string SID_ANONYMOUS = "S-1-5-7";
- const string SID_AUTHENTICATED_USERS = "S-1-5-11";
- const string SID_SYSTEM = "S-1-5-18";
-
- /* SECURITY_BUILTIN_DOMAIN_RID */
- const string SID_BUILTIN = "S-1-5-32";
- const string SID_BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
- const string SID_BUILTIN_USERS = "S-1-5-32-545";
- const string SID_BUILTIN_GUESTS = "S-1-5-32-546";
- const string SID_BUILTIN_POWER_USERS = "S-1-5-32-547";
- const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
- const string SID_BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
- const string SID_BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
- const string SID_BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
- const string SID_BUILTIN_REPLICATOR = "S-1-5-32-552";
-
/* server roles */
typedef enum {
ROLE_STANDALONE = 0,
@@ -54,70 +23,6 @@ interface misc
uint8 node[6];
} GUID;
- /* a domain SID. Note that unlike Samba3 this contains a pointer,
- so you can't copy them using assignment */
- typedef [public,noprint] struct {
- uint8 sid_rev_num; /**< SID revision number */
- uint8 num_auths; /**< Number of sub-authorities */
- uint8 id_auth[6]; /**< Identifier Authority */
- uint32 sub_auths[num_auths];
- } dom_sid;
-
- typedef [public] struct {
- uint8 type; /* xxxx_xxxx_ACE_TYPE - e.g allowed / denied etc */
- uint8 flags; /* xxxx_INHERIT_xxxx - e.g OBJECT_INHERIT_ACE */
- [value(ndr_size_security_ace(r))] uint16 size;
- uint32 access_mask;
-
-#if 0
- /* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
- struct {
- uint32 flags;
- GUID object_guid;
- GUID inherit_guid;
- } *obj;
-#endif
-
- dom_sid trustee;
- } security_ace;
-
- typedef [public] struct {
- uint16 revision;
- [value(ndr_size_security_acl(r))] uint16 size;
- uint32 num_aces;
- security_ace aces[num_aces];
- } security_acl;
-
- /* default revision for new ACLs */
- const int SD_REVISION = 1;
-
- /* security_descriptor->type bits */
- const int SEC_DESC_OWNER_DEFAULTED = 0x0001;
- const int SEC_DESC_GROUP_DEFAULTED = 0x0002;
- const int SEC_DESC_DACL_PRESENT = 0x0004;
- const int SEC_DESC_DACL_DEFAULTED = 0x0008;
- const int SEC_DESC_SACL_PRESENT = 0x0010;
- const int SEC_DESC_SACL_DEFAULTED = 0x0020;
- const int SEC_DESC_DACL_TRUSTED = 0x0040;
- const int SEC_DESC_SERVER_SECURITY = 0x0080;
- const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
- const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
- const int SEC_DESC_DACL_AUTO_INHERITED = 0x0400;
- const int SEC_DESC_SACL_AUTO_INHERITED = 0x0800;
- const int SEC_DESC_DACL_PROTECTED = 0x1000;
- const int SEC_DESC_SACL_PROTECTED = 0x2000;
- const int SEC_DESC_RM_CONTROL_VALID = 0x4000;
- const int SEC_DESC_SELF_RELATIVE = 0x8000;
-
- typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
- uint8 revision;
- uint16 type; /* SEC_DESC_xxxx flags */
- [relative] dom_sid *owner_sid;
- [relative] dom_sid *group_sid;
- [relative] security_acl *sacl; /* system ACL */
- [relative] security_acl *dacl; /* user (discretionary) ACL */
- } security_descriptor;
-
typedef [public] struct {
uint32 handle_type;
GUID uuid;
diff --git a/source4/librpc/idl/samr.idl b/source4/librpc/idl/samr.idl
index a7bbe07b6a..358218c2a0 100644
--- a/source4/librpc/idl/samr.idl
+++ b/source4/librpc/idl/samr.idl
@@ -12,7 +12,7 @@
version(1.0),
endpoint("ncacn_np:[\\pipe\\samr]","ncacn_ip_tcp:", "ncalrpc:"),
pointer_default(unique),
- depends(lsa)
+ depends(lsa,security)
] interface samr
{
/* account control (acct_flags) bits */
diff --git a/source4/librpc/idl/security.idl b/source4/librpc/idl/security.idl
new file mode 100644
index 0000000000..ba75c0f54b
--- /dev/null
+++ b/source4/librpc/idl/security.idl
@@ -0,0 +1,123 @@
+#include "idl_types.h"
+
+/*
+ security IDL structures
+*/
+
+interface security
+{
+ /* a NULL sid */
+ const string SID_NULL = "S-1-0-0";
+
+ /* the world domain */
+ const string SID_WORLD_DOMAIN = "S-1-1";
+ const string SID_WORLD = "S-1-1-0";
+
+ /* SECURITY_CREATOR_SID_AUTHORITY */
+ const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
+ const string SID_CREATOR_OWNER = "S-1-3-0";
+ const string SID_CREATOR_GROUP = "S-1-3-1";
+
+ /* SECURITY_NT_AUTHORITY */
+ const string SID_NT_AUTHORITY = "S-1-5";
+ const string SID_NETWORK = "S-1-5-2";
+ const string SID_ANONYMOUS = "S-1-5-7";
+ const string SID_AUTHENTICATED_USERS = "S-1-5-11";
+ const string SID_SYSTEM = "S-1-5-18";
+
+ /* SECURITY_BUILTIN_DOMAIN_RID */
+ const string SID_BUILTIN = "S-1-5-32";
+ const string SID_BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
+ const string SID_BUILTIN_USERS = "S-1-5-32-545";
+ const string SID_BUILTIN_GUESTS = "S-1-5-32-546";
+ const string SID_BUILTIN_POWER_USERS = "S-1-5-32-547";
+ const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
+ const string SID_BUILTIN_SERVER_OPERATORS = "S-1-5-32-549";
+ const string SID_BUILTIN_PRINT_OPERATORS = "S-1-5-32-550";
+ const string SID_BUILTIN_BACKUP_OPERATORS = "S-1-5-32-551";
+ const string SID_BUILTIN_REPLICATOR = "S-1-5-32-552";
+
+ /* a domain SID. Note that unlike Samba3 this contains a pointer,
+ so you can't copy them using assignment */
+ typedef [public,noprint] struct {
+ uint8 sid_rev_num; /**< SID revision number */
+ uint8 num_auths; /**< Number of sub-authorities */
+ uint8 id_auth[6]; /**< Identifier Authority */
+ uint32 sub_auths[num_auths];
+ } dom_sid;
+
+ typedef [public] struct {
+ uint8 type; /* xxxx_xxxx_ACE_TYPE - e.g allowed / denied etc */
+ uint8 flags; /* xxxx_INHERIT_xxxx - e.g OBJECT_INHERIT_ACE */
+ [value(ndr_size_security_ace(r))] uint16 size;
+ uint32 access_mask;
+
+#if 0
+ /* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
+ struct {
+ uint32 flags;
+ GUID object_guid;
+ GUID inherit_guid;
+ } *obj;
+#endif
+
+ dom_sid trustee;
+ } security_ace;
+
+ typedef [public] struct {
+ uint16 revision;
+ [value(ndr_size_security_acl(r))] uint16 size;
+ uint32 num_aces;
+ security_ace aces[num_aces];
+ } security_acl;
+
+ /* default revision for new ACLs */
+ const int SD_REVISION = 1;
+
+ /* security_descriptor->type bits */
+ const int SEC_DESC_OWNER_DEFAULTED = 0x0001;
+ const int SEC_DESC_GROUP_DEFAULTED = 0x0002;
+ const int SEC_DESC_DACL_PRESENT = 0x0004;
+ const int SEC_DESC_DACL_DEFAULTED = 0x0008;
+ const int SEC_DESC_SACL_PRESENT = 0x0010;
+ const int SEC_DESC_SACL_DEFAULTED = 0x0020;
+ const int SEC_DESC_DACL_TRUSTED = 0x0040;
+ const int SEC_DESC_SERVER_SECURITY = 0x0080;
+ const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
+ const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
+ const int SEC_DESC_DACL_AUTO_INHERITED = 0x0400;
+ const int SEC_DESC_SACL_AUTO_INHERITED = 0x0800;
+ const int SEC_DESC_DACL_PROTECTED = 0x1000;
+ const int SEC_DESC_SACL_PROTECTED = 0x2000;
+ const int SEC_DESC_RM_CONTROL_VALID = 0x4000;
+ const int SEC_DESC_SELF_RELATIVE = 0x8000;
+
+ typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
+ uint8 revision;
+ uint16 type; /* SEC_DESC_xxxx flags */
+ [relative] dom_sid *owner_sid;
+ [relative] dom_sid *group_sid;
+ [relative] security_acl *sacl; /* system ACL */
+ [relative] security_acl *dacl; /* user (discretionary) ACL */
+ } security_descriptor;
+
+ typedef [public,printonly] struct {
+ /* TODO */
+ uint32 flags;
+ } security_privilege;
+
+ typedef [public,printonly] struct {
+ uint32 flags;
+ dom_sid *user_sid;
+ dom_sid *group_sid;
+ dom_sid *logon_sid;
+ uint32 num_sids;
+ dom_sid sids[num_sids];
+ uint32 num_restricted_sids;
+ dom_sid restricted_sids[num_restricted_sids];
+ uint32 num_privileges;
+ security_privilege privileges[num_privileges];
+ security_acl *dacl;
+ } security_token;
+
+}
diff --git a/source4/librpc/idl/spoolss.idl b/source4/librpc/idl/spoolss.idl
index 91a7632422..41b992c5a2 100644
--- a/source4/librpc/idl/spoolss.idl
+++ b/source4/librpc/idl/spoolss.idl
@@ -8,7 +8,8 @@
version(1.0),
endpoint("ncacn_np:[\\pipe\\spoolss]"),
pointer_default(unique),
- helpstring("Spooler SubSystem")
+ helpstring("Spooler SubSystem"),
+ depends(security)
] interface spoolss
{
typedef struct {
diff --git a/source4/librpc/idl/srvsvc.idl b/source4/librpc/idl/srvsvc.idl
index 02e3dd6578..ee5b369534 100644
--- a/source4/librpc/idl/srvsvc.idl
+++ b/source4/librpc/idl/srvsvc.idl
@@ -7,7 +7,8 @@
[ uuid("4b324fc8-1670-01d3-1278-5a47bf6ee188"),
version(3.0),
pointer_default(unique),
- helpstring("Server Service")
+ helpstring("Server Service"),
+ depends(security)
] interface srvsvc
{
/**************************/
diff --git a/source4/librpc/ndr/ndr_sec.c b/source4/librpc/ndr/ndr_sec.c
index c91c2762c2..798d3a7cf1 100644
--- a/source4/librpc/ndr/ndr_sec.c
+++ b/source4/librpc/ndr/ndr_sec.c
@@ -23,6 +23,7 @@
#include "includes.h"
+#include "librpc/gen_ndr/ndr_security.h"
/*
parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
@@ -112,18 +113,3 @@ size_t ndr_size_security_descriptor(struct security_descriptor *sd)
ret += ndr_size_security_acl(sd->sacl);
return ret;
}
-
-/*
- talloc and copy a security descriptor
- */
-struct security_descriptor *copy_security_descriptor(TALLOC_CTX *mem_ctx,
- const struct security_descriptor *osd)
-{
- struct security_descriptor *nsd;
-
- /* FIXME */
- DEBUG(1, ("copy_security_descriptor: sorry unimplemented yet\n"));
- nsd = NULL;
-
- return nsd;
-}