r3810: create a LIB_SECURITY subsystem

- move dom_sid, security_descriptor, security_* funtions to one place
  and rename some of them

metze
(This used to be commit b620bdd672cfdf0e009492e648b0709e6b6d8596)

9 files changed, 133 insertions, 116 deletions

diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index 2588590275..d527eabb2a 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -5,7 +5,6 @@ INIT_OBJ_FILES = \
 		librpc/ndr/ndr.o
 ADD_OBJ_FILES = \
 		librpc/ndr/ndr_basic.o \
-		librpc/ndr/ndr_sec.o \
 		librpc/ndr/ndr_spoolss_buf.o \
 		librpc/ndr/ndr_dcom.o 
 # End SUBSYSTEM LIBNDR_RAW
diff --git a/source4/librpc/idl/krb5pac.idl b/source4/librpc/idl/krb5pac.idl
index d3a28df27b..6efd8526b2 100644
--- a/source4/librpc/idl/krb5pac.idl
+++ b/source4/librpc/idl/krb5pac.idl
@@ -7,7 +7,8 @@
 [
   uuid("46746756-7567-7567-5677-756756756756"),
   version(0.0),
-  pointer_default(unique)
+  pointer_default(unique),
+  depends(security)
 ]
 interface krb5pac
 {
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 05da1bec8b..d3d3ad3da6 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -8,7 +8,8 @@
   version(0.0),
   endpoint("ncacn_np:[\\pipe\\lsarpc]","ncacn_np:[\\pipe\\lsass]", "ncacn_ip_tcp:"),
   pointer_default(unique),
-  helpstring("Local Server Authentication(?)")
+  helpstring("Local Server Authentication(?)"),
+  depends(security)
 ] interface lsarpc
 {
 	/******************/
diff --git a/source4/librpc/idl/misc.idl b/source4/librpc/idl/misc.idl
index dd31f0f54a..61adf04630 100644
--- a/source4/librpc/idl/misc.idl
+++ b/source4/librpc/idl/misc.idl
@@ -6,37 +6,6 @@
 
 interface misc
 {
-	/* a NULL sid */
-	const string SID_NULL = "S-1-0-0";
-
-	/* the world domain */
-	const string SID_WORLD_DOMAIN = "S-1-1";
-	const string SID_WORLD        = "S-1-1-0";
-
-	/* SECURITY_CREATOR_SID_AUTHORITY */
-	const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
-	const string SID_CREATOR_OWNER        = "S-1-3-0";
-	const string SID_CREATOR_GROUP        = "S-1-3-1";
-
-	/* SECURITY_NT_AUTHORITY */
-	const string SID_NT_AUTHORITY        = "S-1-5";
-	const string SID_NETWORK             = "S-1-5-2";
-	const string SID_ANONYMOUS           = "S-1-5-7";
-	const string SID_AUTHENTICATED_USERS = "S-1-5-11";
-	const string SID_SYSTEM              = "S-1-5-18";
-
-	/* SECURITY_BUILTIN_DOMAIN_RID */
-	const string SID_BUILTIN                   = "S-1-5-32";
-	const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
-	const string SID_BUILTIN_USERS             = "S-1-5-32-545";
-	const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
-	const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
-	const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
-	const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
-	const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
-	const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
-	const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
-
 	/* server roles */
 	typedef enum {
 		ROLE_STANDALONE    = 0,
@@ -54,70 +23,6 @@ interface misc
 		uint8  node[6];
 	} GUID;
 
-	/* a domain SID. Note that unlike Samba3 this contains a pointer,
-	   so you can't copy them using assignment */
-	typedef [public,noprint] struct {
-		uint8  sid_rev_num;             /**< SID revision number */
-		uint8  num_auths;               /**< Number of sub-authorities */
-		uint8  id_auth[6];              /**< Identifier Authority */
-		uint32 sub_auths[num_auths];
-	} dom_sid;
-
-	typedef [public] struct {
-		uint8 type;  /* xxxx_xxxx_ACE_TYPE - e.g allowed / denied etc */
-		uint8 flags; /* xxxx_INHERIT_xxxx - e.g OBJECT_INHERIT_ACE */
-		[value(ndr_size_security_ace(r))] uint16 size;
-		uint32 access_mask;
-
-#if 0
-		/* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
-		struct {
-			uint32 flags;
-			GUID object_guid;
-			GUID inherit_guid;
-		} *obj;
-#endif
-
-		dom_sid trustee;
-	} security_ace;
-
-	typedef [public] struct {
-		uint16 revision;
-		[value(ndr_size_security_acl(r))] uint16 size;
-		uint32 num_aces;
-		security_ace aces[num_aces];
-	} security_acl;
-
-	/* default revision for new ACLs */
-	const int SD_REVISION                    = 1;
-
-	/* security_descriptor->type bits */
-	const int SEC_DESC_OWNER_DEFAULTED	 = 0x0001;
-	const int SEC_DESC_GROUP_DEFAULTED	 = 0x0002;
-	const int SEC_DESC_DACL_PRESENT		 = 0x0004;
-	const int SEC_DESC_DACL_DEFAULTED	 = 0x0008;
-	const int SEC_DESC_SACL_PRESENT		 = 0x0010;
-	const int SEC_DESC_SACL_DEFAULTED	 = 0x0020;
-	const int SEC_DESC_DACL_TRUSTED		 = 0x0040;
-	const int SEC_DESC_SERVER_SECURITY	 = 0x0080;
-	const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
-	const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
-	const int SEC_DESC_DACL_AUTO_INHERITED	 = 0x0400;
-	const int SEC_DESC_SACL_AUTO_INHERITED	 = 0x0800;
-	const int SEC_DESC_DACL_PROTECTED	 = 0x1000;
-	const int SEC_DESC_SACL_PROTECTED	 = 0x2000;
-	const int SEC_DESC_RM_CONTROL_VALID	 = 0x4000;
-	const int SEC_DESC_SELF_RELATIVE	 = 0x8000;
-
-	typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
-		uint8 revision;
-		uint16 type;     /* SEC_DESC_xxxx flags */
-		[relative] dom_sid *owner_sid; 
-		[relative] dom_sid *group_sid;
-		[relative] security_acl *sacl; /* system ACL */
-		[relative] security_acl *dacl; /* user (discretionary) ACL */
-	} security_descriptor;
-
 	typedef [public] struct {
 		uint32 handle_type;
 		GUID   uuid;
diff --git a/source4/librpc/idl/samr.idl b/source4/librpc/idl/samr.idl
index a7bbe07b6a..358218c2a0 100644
--- a/source4/librpc/idl/samr.idl
+++ b/source4/librpc/idl/samr.idl
@@ -12,7 +12,7 @@
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\samr]","ncacn_ip_tcp:", "ncalrpc:"),
   pointer_default(unique),
-  depends(lsa)
+  depends(lsa,security)
 ] interface samr
 {
 	/* account control (acct_flags) bits */
diff --git a/source4/librpc/idl/security.idl b/source4/librpc/idl/security.idl
new file mode 100644
index 0000000000..ba75c0f54b
--- /dev/null
+++ b/source4/librpc/idl/security.idl
@@ -0,0 +1,123 @@
+#include "idl_types.h"
+
+/*
+  security IDL structures
+*/
+
+interface security
+{
+	/* a NULL sid */
+	const string SID_NULL = "S-1-0-0";
+
+	/* the world domain */
+	const string SID_WORLD_DOMAIN = "S-1-1";
+	const string SID_WORLD        = "S-1-1-0";
+
+	/* SECURITY_CREATOR_SID_AUTHORITY */
+	const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
+	const string SID_CREATOR_OWNER        = "S-1-3-0";
+	const string SID_CREATOR_GROUP        = "S-1-3-1";
+
+	/* SECURITY_NT_AUTHORITY */
+	const string SID_NT_AUTHORITY        = "S-1-5";
+	const string SID_NETWORK             = "S-1-5-2";
+	const string SID_ANONYMOUS           = "S-1-5-7";
+	const string SID_AUTHENTICATED_USERS = "S-1-5-11";
+	const string SID_SYSTEM              = "S-1-5-18";
+
+	/* SECURITY_BUILTIN_DOMAIN_RID */
+	const string SID_BUILTIN                   = "S-1-5-32";
+	const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
+	const string SID_BUILTIN_USERS             = "S-1-5-32-545";
+	const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
+	const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
+	const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
+	const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
+	const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
+	const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
+	const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";
+
+	/* a domain SID. Note that unlike Samba3 this contains a pointer,
+	   so you can't copy them using assignment */
+	typedef [public,noprint] struct {
+		uint8  sid_rev_num;             /**< SID revision number */
+		uint8  num_auths;               /**< Number of sub-authorities */
+		uint8  id_auth[6];              /**< Identifier Authority */
+		uint32 sub_auths[num_auths];
+	} dom_sid;
+
+	typedef [public] struct {
+		uint8 type;  /* xxxx_xxxx_ACE_TYPE - e.g allowed / denied etc */
+		uint8 flags; /* xxxx_INHERIT_xxxx - e.g OBJECT_INHERIT_ACE */
+		[value(ndr_size_security_ace(r))] uint16 size;
+		uint32 access_mask;
+
+#if 0
+		/* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
+		struct {
+			uint32 flags;
+			GUID object_guid;
+			GUID inherit_guid;
+		} *obj;
+#endif
+
+		dom_sid trustee;
+	} security_ace;
+
+	typedef [public] struct {
+		uint16 revision;
+		[value(ndr_size_security_acl(r))] uint16 size;
+		uint32 num_aces;
+		security_ace aces[num_aces];
+	} security_acl;
+
+	/* default revision for new ACLs */
+	const int SD_REVISION                    = 1;
+
+	/* security_descriptor->type bits */
+	const int SEC_DESC_OWNER_DEFAULTED	 = 0x0001;
+	const int SEC_DESC_GROUP_DEFAULTED	 = 0x0002;
+	const int SEC_DESC_DACL_PRESENT		 = 0x0004;
+	const int SEC_DESC_DACL_DEFAULTED	 = 0x0008;
+	const int SEC_DESC_SACL_PRESENT		 = 0x0010;
+	const int SEC_DESC_SACL_DEFAULTED	 = 0x0020;
+	const int SEC_DESC_DACL_TRUSTED		 = 0x0040;
+	const int SEC_DESC_SERVER_SECURITY	 = 0x0080;
+	const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
+	const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
+	const int SEC_DESC_DACL_AUTO_INHERITED	 = 0x0400;
+	const int SEC_DESC_SACL_AUTO_INHERITED	 = 0x0800;
+	const int SEC_DESC_DACL_PROTECTED	 = 0x1000;
+	const int SEC_DESC_SACL_PROTECTED	 = 0x2000;
+	const int SEC_DESC_RM_CONTROL_VALID	 = 0x4000;
+	const int SEC_DESC_SELF_RELATIVE	 = 0x8000;
+
+	typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
+		uint8 revision;
+		uint16 type;     /* SEC_DESC_xxxx flags */
+		[relative] dom_sid *owner_sid; 
+		[relative] dom_sid *group_sid;
+		[relative] security_acl *sacl; /* system ACL */
+		[relative] security_acl *dacl; /* user (discretionary) ACL */
+	} security_descriptor;
+
+	typedef [public,printonly] struct {
+		/* TODO */
+		uint32 flags;
+	} security_privilege;
+
+	typedef [public,printonly] struct {
+		uint32 flags;
+		dom_sid *user_sid;
+		dom_sid *group_sid;
+		dom_sid *logon_sid;
+		uint32 num_sids;
+		dom_sid sids[num_sids];
+		uint32 num_restricted_sids;
+		dom_sid restricted_sids[num_restricted_sids];
+		uint32 num_privileges;
+		security_privilege privileges[num_privileges];
+		security_acl *dacl;
+	} security_token;
+
+}
diff --git a/source4/librpc/idl/spoolss.idl b/source4/librpc/idl/spoolss.idl
index 91a7632422..41b992c5a2 100644
--- a/source4/librpc/idl/spoolss.idl
+++ b/source4/librpc/idl/spoolss.idl
@@ -8,7 +8,8 @@
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\spoolss]"),
   pointer_default(unique),
-  helpstring("Spooler SubSystem")
+  helpstring("Spooler SubSystem"),
+  depends(security)
 ] interface spoolss
 {
 	typedef struct {
diff --git a/source4/librpc/idl/srvsvc.idl b/source4/librpc/idl/srvsvc.idl
index 02e3dd6578..ee5b369534 100644
--- a/source4/librpc/idl/srvsvc.idl
+++ b/source4/librpc/idl/srvsvc.idl
@@ -7,7 +7,8 @@
 [ uuid("4b324fc8-1670-01d3-1278-5a47bf6ee188"),
   version(3.0),
   pointer_default(unique),
-  helpstring("Server Service")
+  helpstring("Server Service"),
+  depends(security)
 ] interface srvsvc
 {
 /**************************/
diff --git a/source4/librpc/ndr/ndr_sec.c b/source4/librpc/ndr/ndr_sec.c
index c91c2762c2..798d3a7cf1 100644
--- a/source4/librpc/ndr/ndr_sec.c
+++ b/source4/librpc/ndr/ndr_sec.c
@@ -23,6 +23,7 @@
 
 
 #include "includes.h"
+#include "librpc/gen_ndr/ndr_security.h"
 
 /*
   parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
@@ -112,18 +113,3 @@ size_t ndr_size_security_descriptor(struct security_descriptor *sd)
 	ret += ndr_size_security_acl(sd->sacl);
 	return ret;
 }
-
-/* 
-   talloc and copy a security descriptor
- */
-struct security_descriptor *copy_security_descriptor(TALLOC_CTX *mem_ctx, 
-							const struct security_descriptor *osd)
-{
-	struct security_descriptor *nsd;
-
-	/* FIXME */
-	DEBUG(1, ("copy_security_descriptor: sorry unimplemented yet\n"));
-	nsd = NULL;
-
-	return nsd;
-}