1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright (c) 2016 by Delphix. All rights reserved.
25 */
26
27 #ifndef _SMBSRV_NTIFS_H
28 #define _SMBSRV_NTIFS_H
29
30 /*
31 * This file provides definitions compatible with the NT Installable
32 * File System (IFS) interface. This header file also defines the Security
33 * Descriptor module from Windows.
34 */
35
36 #ifdef __cplusplus
37 extern "C" {
38 #endif
39
40 #include <sys/acl.h>
41 #include <sys/list.h>
42 #include <smbsrv/smb_sid.h>
43
44 /*
45 * The Volume and Directory bits are for SMB rather than NT.
46 * NT has an explicit Normal bit; this bit is implied in SMB
47 * when the Hidden, System and Directory bits are not set.
48 *
49 * File attributes and creation flags share the same 32-bit
50 * space.
51 */
52 #define FILE_ATTRIBUTE_READONLY 0x00000001
53 #define FILE_ATTRIBUTE_HIDDEN 0x00000002
54 #define FILE_ATTRIBUTE_SYSTEM 0x00000004
55 #define FILE_ATTRIBUTE_VOLUME 0x00000008
56 #define FILE_ATTRIBUTE_DIRECTORY 0x00000010
57 #define FILE_ATTRIBUTE_ARCHIVE 0x00000020
58 #define FILE_ATTRIBUTE_DEVICE 0x00000040
59 #define FILE_ATTRIBUTE_NORMAL 0x00000080
60 #define FILE_ATTRIBUTE_TEMPORARY 0x00000100
61 #define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
62 #define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
63 #define FILE_ATTRIBUTE_COMPRESSED 0x00000800
64 #define FILE_ATTRIBUTE_OFFLINE 0x00001000
65 #define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
66 #define FILE_ATTRIBUTE_ENCRYPTED 0x00004000
67 #define FILE_ATTRIBUTE_VIRTUAL 0x00010000
68 #define FILE_FLAG_OPEN_NO_RECALL 0x00100000
69 #define FILE_FLAG_OPEN_REPARSE_POINT 0x00200000
70 #define FILE_FLAG_POSIX_SEMANTICS 0x01000000
71 #define FILE_FLAG_BACKUP_SEMANTICS 0x02000000
72 #define FILE_FLAG_DELETE_ON_CLOSE 0x04000000
73 #define FILE_FLAG_SEQUENTIAL_SCAN 0x08000000
74 #define FILE_FLAG_RANDOM_ACCESS 0x10000000
75 #define FILE_FLAG_NO_BUFFERING 0x20000000
76 #define FILE_FLAG_OVERLAPPED 0x40000000
77 #define FILE_FLAG_WRITE_THROUGH 0x80000000
78
79 #define FILE_ATTRIBUTE_VALID_FLAGS 0x00001fb7
80 #define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x00001fa7
81 #define FILE_ATTRIBUTE_MASK 0x00003FFF
82
83 /*
84 * The create/open option flags: used in NtCreateAndx and NtTransactCreate
85 * SMB requests.
86 *
87 * The CreateOptions specify the options to be applied when creating or
88 * opening the file, as a compatible combination of the following flags:
89 *
90 * FILE_DIRECTORY_FILE
91 * The file being created or opened is a directory file. With this
92 * flag, the Disposition parameter must be set to one of FILE_CREATE,
93 * FILE_OPEN, or FILE_OPEN_IF. With this flag, other compatible
94 * CreateOptions flags include only the following:
95 * FILE_SYNCHRONOUS_IO_ALERT
96 * FILE_SYNCHRONOUS_IO_NONALERT
97 * FILE_WRITE_THROUGH
98 * FILE_OPEN_FOR_BACKUP_INTENT
99 * FILE_OPEN_BY_FILE_ID
100 *
101 * FILE_NON_DIRECTORY_FILE
102 * The file being opened must not be a directory file or this call
103 * will fail. The file object being opened can represent a data file,
104 * a logical, virtual, or physical device, or a volume.
105 *
106 * FILE_WRITE_THROUGH
107 * System services, FSDs, and drivers that write data to the file must
108 * actually transfer the data into the file before any requested write
109 * operation is considered complete. This flag is automatically set if
110 * the CreateOptions flag FILE_NO_INTERMEDIATE _BUFFERING is set.
111 *
112 * FILE_SEQUENTIAL_ONLY
113 * All accesses to the file will be sequential.
114 *
115 * FILE_RANDOM_ACCESS
116 * Accesses to the file can be random, so no sequential read-ahead
117 * operations should be performed on the file by FSDs or the system.
118 * FILE_NO_INTERMEDIATE _BUFFERING The file cannot be cached or
119 * buffered in a driver's internal buffers. This flag is incompatible
120 * with the DesiredAccess FILE_APPEND_DATA flag.
121 *
122 * FILE_SYNCHRONOUS_IO_ALERT
123 * All operations on the file are performed synchronously. Any wait
124 * on behalf of the caller is subject to premature termination from
125 * alerts. This flag also causes the I/O system to maintain the file
126 * position context. If this flag is set, the DesiredAccess
127 * SYNCHRONIZE flag also must be set.
128 *
129 * FILE_SYNCHRONOUS_IO _NONALERT
130 * All operations on the file are performed synchronously. Waits in
131 * the system to synchronize I/O queuing and completion are not subject
132 * to alerts. This flag also causes the I/O system to maintain the file
133 * position context. If this flag is set, the DesiredAccess SYNCHRONIZE
134 * flag also must be set.
135 *
136 * FILE_CREATE_TREE _CONNECTION
137 * Create a tree connection for this file in order to open it over the
138 * network. This flag is irrelevant to device and intermediate drivers.
139 *
140 * FILE_COMPLETE_IF_OPLOCKED
141 * Complete this operation immediately with an alternate success code
142 * if the target file is oplocked, rather than blocking the caller's
143 * thread. If the file is oplocked, another caller already has access
144 * to the file over the network. This flag is irrelevant to device and
145 * intermediate drivers.
146 *
147 * FILE_NO_EA_KNOWLEDGE
148 * If the extended attributes on an existing file being opened indicate
149 * that the caller must understand EAs to properly interpret the file,
150 * fail this request because the caller does not understand how to deal
151 * with EAs. Device and intermediate drivers can ignore this flag.
152 *
153 * FILE_DELETE_ON_CLOSE
154 * Delete the file when the last reference to it is passed to close.
155 *
156 * FILE_OPEN_BY_FILE_ID
157 * The file name contains the name of a device and a 64-bit ID to
158 * be used to open the file. This flag is irrelevant to device and
159 * intermediate drivers.
160 *
161 * FILE_OPEN_FOR_BACKUP _INTENT
162 * The file is being opened for backup intent, hence, the system should
163 * check for certain access rights and grant the caller the appropriate
164 * accesses to the file before checking the input DesiredAccess against
165 * the file's security descriptor. This flag is irrelevant to device
166 * and intermediate drivers.
167 */
168 #define FILE_DIRECTORY_FILE 0x00000001
169 #define FILE_WRITE_THROUGH 0x00000002
170 #define FILE_SEQUENTIAL_ONLY 0x00000004
171 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
172
173 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
174 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
175 #define FILE_NON_DIRECTORY_FILE 0x00000040
176 #define FILE_CREATE_TREE_CONNECTION 0x00000080
177
178 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
179 #define FILE_NO_EA_KNOWLEDGE 0x00000200
180 /* UNUSED 0x00000400 */
181 #define FILE_RANDOM_ACCESS 0x00000800
182
183 #define FILE_DELETE_ON_CLOSE 0x00001000
184 #define FILE_OPEN_BY_FILE_ID 0x00002000
185 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
186 #define FILE_NO_COMPRESSION 0x00008000
187
188 #define FILE_RESERVE_OPFILTER 0x00100000
189 #define FILE_RESERVED0 0x00200000
190 #define FILE_RESERVED1 0x00400000
191 #define FILE_RESERVED2 0x00800000
192
193 #define FILE_VALID_OPTION_FLAGS 0x007fffff
194 #define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
195 #define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
196 #define FILE_VALID_SET_FLAGS 0x00000036
197
198 /*
199 * Define the file information class values used by the NT DDK and HAL.
200 */
201 typedef enum _FILE_INFORMATION_CLASS {
202 FileDirectoryInformation = 1,
203 FileFullDirectoryInformation, /* 2 */
204 FileBothDirectoryInformation, /* 3 */
205 FileBasicInformation, /* 4 */
206 FileStandardInformation, /* 5 */
207 FileInternalInformation, /* 6 */
208 FileEaInformation, /* 7 */
209 FileAccessInformation, /* 8 */
210 FileNameInformation, /* 9 */
211 FileRenameInformation, /* 10 */
212 FileLinkInformation, /* 11 */
213 FileNamesInformation, /* 12 */
214 FileDispositionInformation, /* 13 */
215 FilePositionInformation, /* 14 */
216 FileFullEaInformation, /* 15 */
217 FileModeInformation, /* 16 */
218 FileAlignmentInformation, /* 17 */
219 FileAllInformation, /* 18 */
220 FileAllocationInformation, /* 19 */
221 FileEndOfFileInformation, /* 20 */
222 FileAlternateNameInformation, /* 21 */
223 FileStreamInformation, /* 22 */
224 FilePipeInformation, /* 23 */
225 FilePipeLocalInformation, /* 24 */
226 FilePipeRemoteInformation, /* 25 */
227 FileMailslotQueryInformation, /* 26 */
228 FileMailslotSetInformation, /* 27 */
229 FileCompressionInformation, /* 28 */
230 FileObjectIdInformation, /* 29 */
231 FileCompletionInformation, /* 30 */
232 FileMoveClusterInformation, /* 31 */
233 FileQuotaInformation, /* 32 */
234 FileReparsePointInformation, /* 33 */
235 FileNetworkOpenInformation, /* 34 */
236 FileAttributeTagInformation, /* 35 */
237 FileTrackingInformation, /* 36 */
238 FileIdBothDirectoryInformation, /* 37 */
239 FileIdFullDirectoryInformation, /* 38 */
240 FileValidDataLengthInformation, /* 39 */
241 FileShortNameInformation, /* 40 */
242 FileInformationReserved41, /* 41 */
243 FileInformationReserved42, /* 42 */
244 FileInformationReserved43, /* 43 */
245 FileSfioReserveInformation, /* 44 */
246 FileSfioVolumeInformation, /* 45 */
247 FileHardLinkInformation, /* 46 */
248 FileInformationReserved47, /* 47 */
249 FileNormalizedNameInformation, /* 48 */
250 FileInformationReserved49, /* 49 */
251 FileIdGlobalTxDirectoryInformation, /* 50 */
252 FileInformationReserved51, /* 51 */
253 FileInformationReserved52, /* 52 */
254 FileInformationReserved53, /* 53 */
255 FileStandardLinkInformation, /* 54 */
256 FileMaximumInformation
257 } FILE_INFORMATION_CLASS;
258
259 /*
260 * Define the file system information class values.
261 */
262 typedef enum _FILE_FS_INFORMATION_CLASS {
263 FileFsVolumeInformation = 1,
264 FileFsLabelInformation, /* 2 */
265 FileFsSizeInformation, /* 3 */
266 FileFsDeviceInformation, /* 4 */
267 FileFsAttributeInformation, /* 5 */
268 FileFsControlInformation, /* 6 */
269 FileFsFullSizeInformation, /* 7 */
270 FileFsObjectIdInformation, /* 8 */
271 FileFsDriverPathInformation /* 9 */
272 } FILE_FS_INFORMATION_CLASS;
273
274 /*
275 * Discretionary Access Control List (DACL)
276 *
277 * A Discretionary Access Control List (DACL), often abbreviated to
278 * ACL, is a list of access controls which either allow or deny access
279 * for users or groups to a resource. There is a list header followed
280 * by a list of access control entries (ACE). Each ACE specifies the
281 * access allowed or denied to a single user or group (identified by
282 * a SID).
283 *
284 * There is another access control list object called a System Access
285 * Control List (SACL), which is used to control auditing, but no
286 * support is provideed for SACLs at this time.
287 *
288 * ACL header format:
289 *
290 * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
291 * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
292 * +-------------------------------+---------------+---------------+
293 * | AclSize | Sbz1 | AclRevision |
294 * +-------------------------------+---------------+---------------+
295 * | Sbz2 | AceCount |
296 * +-------------------------------+-------------------------------+
297 *
298 * AclRevision specifies the revision level of the ACL. This value should
299 * be ACL_REVISION, unless the ACL contains an object-specific ACE, in which
300 * case this value must be ACL_REVISION_DS. All ACEs in an ACL must be at the
301 * same revision level.
302 *
303 * ACE header format:
304 *
305 * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
306 * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
307 * +---------------+-------+-------+---------------+---------------+
308 * | AceSize | AceFlags | AceType |
309 * +---------------+-------+-------+---------------+---------------+
310 *
311 * Access mask format:
312 *
313 * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
314 * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
315 * +---------------+---------------+-------------------------------+
316 * |G|G|G|G|Res'd|A| StandardRights| SpecificRights |
317 * |R|W|E|A| |S| | |
318 * +-+-------------+---------------+-------------------------------+
319 *
320 * typedef struct ACCESS_MASK {
321 * WORD SpecificRights;
322 * BYTE StandardRights;
323 * BYTE AccessSystemAcl : 1;
324 * BYTE Reserved : 3;
325 * BYTE GenericAll : 1;
326 * BYTE GenericExecute : 1;
327 * BYTE GenericWrite : 1;
328 * BYTE GenericRead : 1;
329 * } ACCESS_MASK;
330 *
331 */
332
333 #define ACL_REVISION1 1
334 #define ACL_REVISION2 2
335 #define MIN_ACL_REVISION2 ACL_REVISION2
336 #define ACL_REVISION3 3
337 #define ACL_REVISION4 4
338 #define MAX_ACL_REVISION ACL_REVISION4
339
340 /*
341 * Current ACE and ACL revision Levels
342 */
343 #define ACE_REVISION 1
344 #define ACL_REVISION ACL_REVISION2
345 #define ACL_REVISION_DS ACL_REVISION4
346
347
348 #define ACCESS_ALLOWED_ACE_TYPE 0
349 #define ACCESS_DENIED_ACE_TYPE 1
350 #define SYSTEM_AUDIT_ACE_TYPE 2
351 #define SYSTEM_ALARM_ACE_TYPE 3
352
353 /*
354 * se_flags
355 * ----------
356 * Specifies a set of ACE type-specific control flags. This member can be a
357 * combination of the following values.
358 *
359 * CONTAINER_INHERIT_ACE: Child objects that are containers, such as
360 * directories, inherit the ACE as an effective ACE. The inherited
361 * ACE is inheritable unless the NO_PROPAGATE_INHERIT_ACE bit flag
362 * is also set.
363 *
364 * INHERIT_ONLY_ACE: Indicates an inherit-only ACE which does not control
365 * access to the object to which it is attached.
366 * If this flag is not set,
367 * the ACE is an effective ACE which controls access to the object
368 * to which it is attached.
369 * Both effective and inherit-only ACEs can be inherited
370 * depending on the state of the other inheritance flags.
371 *
372 * INHERITED_ACE: Windows 2000/XP: Indicates that the ACE was inherited.
373 * The system sets this bit when it propagates an
374 * inherited ACE to a child object.
375 *
376 * NO_PROPAGATE_INHERIT_ACE: If the ACE is inherited by a child object, the
377 * system clears the OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE
378 * flags in the inherited ACE.
379 * This prevents the ACE from being inherited by
380 * subsequent generations of objects.
381 *
382 * OBJECT_INHERIT_ACE: Noncontainer child objects inherit the ACE as an
383 * effective ACE. For child objects that are containers,
384 * the ACE is inherited as an inherit-only ACE unless the
385 * NO_PROPAGATE_INHERIT_ACE bit flag is also set.
386 */
387 #define OBJECT_INHERIT_ACE 0x01
388 #define CONTAINER_INHERIT_ACE 0x02
389 #define NO_PROPOGATE_INHERIT_ACE 0x04
390 #define INHERIT_ONLY_ACE 0x08
391 #define INHERITED_ACE 0x10
392 #define INHERIT_MASK_ACE 0x1F
393
394
395 /*
396 * These flags are only used in system audit or alarm ACEs to
397 * indicate when an audit message should be generated, i.e.
398 * on successful access or on unsuccessful access.
399 */
400 #define SUCCESSFUL_ACCESS_ACE_FLAG 0x40
401 #define FAILED_ACCESS_ACE_FLAG 0x80
402
403 /*
404 * se_bsize is the size, in bytes, of ACE as it appears on the wire.
405 * se_sln is used to sort the ACL when it's required.
406 */
407 typedef struct smb_acehdr {
408 uint8_t se_type;
409 uint8_t se_flags;
410 uint16_t se_bsize;
411 } smb_acehdr_t;
412
413 typedef struct smb_ace {
414 smb_acehdr_t se_hdr;
415 uint32_t se_mask;
416 list_node_t se_sln;
417 smb_sid_t *se_sid;
418 } smb_ace_t;
419
420 /*
421 * sl_bsize is the size of ACL in bytes as it appears on the wire.
422 */
423 typedef struct smb_acl {
424 uint8_t sl_revision;
425 uint16_t sl_bsize;
426 uint16_t sl_acecnt;
427 smb_ace_t *sl_aces;
428 list_t sl_sorted;
429 } smb_acl_t;
430
431 /*
432 * ACE/ACL header size, in byte, as it appears on the wire
433 */
434 #define SMB_ACE_HDRSIZE 4
435 #define SMB_ACL_HDRSIZE 8
436
437 /*
438 * Security Descriptor (SD)
439 *
440 * Security descriptors provide protection for objects, for example
441 * files and directories. It identifies the owner and primary group
442 * (SIDs) and contains an access control list. When a user tries to
443 * access an object their SID is compared to the permissions in the
444 * DACL to determine if access should be allowed or denied. Note that
445 * this is a simplification because there are other factors, such as
446 * default behavior and privileges to be taken into account (see also
447 * access tokens).
448 *
449 * The boolean flags have the following meanings when set:
450 *
451 * SE_OWNER_DEFAULTED indicates that the SID pointed to by the Owner
452 * field was provided by a defaulting mechanism rather than explicitly
453 * provided by the original provider of the security descriptor. This
454 * may affect the treatment of the SID with respect to inheritance of
455 * an owner.
456 *
457 * SE_GROUP_DEFAULTED indicates that the SID in the Group field was
458 * provided by a defaulting mechanism rather than explicitly provided
459 * by the original provider of the security descriptor. This may
460 * affect the treatment of the SID with respect to inheritance of a
461 * primary group.
462 *
463 * SE_DACL_PRESENT indicates that the security descriptor contains a
464 * discretionary ACL. If this flag is set and the Dacl field of the
465 * SECURITY_DESCRIPTOR is null, then a null ACL is explicitly being
466 * specified.
467 *
468 * SE_DACL_DEFAULTED indicates that the ACL pointed to by the Dacl
469 * field was provided by a defaulting mechanism rather than explicitly
470 * provided by the original provider of the security descriptor. This
471 * may affect the treatment of the ACL with respect to inheritance of
472 * an ACL. This flag is ignored if the DaclPresent flag is not set.
473 *
474 * SE_SACL_PRESENT indicates that the security descriptor contains a
475 * system ACL pointed to by the Sacl field. If this flag is set and
476 * the Sacl field of the SECURITY_DESCRIPTOR is null, then an empty
477 * (but present) ACL is being specified.
478 *
479 * SE_SACL_DEFAULTED indicates that the ACL pointed to by the Sacl
480 * field was provided by a defaulting mechanism rather than explicitly
481 * provided by the original provider of the security descriptor. This
482 * may affect the treatment of the ACL with respect to inheritance of
483 * an ACL. This flag is ignored if the SaclPresent flag is not set.
484 *
485 * SE_DACL_PROTECTED Prevents ACEs set on the DACL of the parent container
486 * (and any objects above the parent container in the directory hierarchy)
487 * from being applied to the object's DACL.
488 *
489 * SE_SACL_PROTECTED Prevents ACEs set on the SACL of the parent container
490 * (and any objects above the parent container in the directory hierarchy)
491 * from being applied to the object's SACL.
492 *
493 * Note that the SE_DACL_PRESENT flag needs to be present to set
494 * SE_DACL_PROTECTED and SE_SACL_PRESENT needs to be present to set
495 * SE_SACL_PROTECTED.
496 *
497 * SE_SELF_RELATIVE indicates that the security descriptor is in self-
498 * relative form. In this form, all fields of the security descriptor
499 * are contiguous in memory and all pointer fields are expressed as
500 * offsets from the beginning of the security descriptor.
501 *
502 * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
503 * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
504 * +---------------------------------------------------------------+
505 * | Control |Reserved1 (SBZ)| Revision |
506 * +---------------------------------------------------------------+
507 * | Owner |
508 * +---------------------------------------------------------------+
509 * | Group |
510 * +---------------------------------------------------------------+
511 * | Sacl |
512 * +---------------------------------------------------------------+
513 * | Dacl |
514 * +---------------------------------------------------------------+
515 *
516 */
517
518 #define SMB_OWNER_SECINFO 0x0001
519 #define SMB_GROUP_SECINFO 0x0002
520 #define SMB_DACL_SECINFO 0x0004
521 #define SMB_SACL_SECINFO 0x0008
522 #define SMB_ALL_SECINFO 0x000F
523 #define SMB_ACL_SECINFO (SMB_DACL_SECINFO | SMB_SACL_SECINFO)
524
525 #define SECURITY_DESCRIPTOR_REVISION 1
526
527
528 #define SE_OWNER_DEFAULTED 0x0001
529 #define SE_GROUP_DEFAULTED 0x0002
530 #define SE_DACL_PRESENT 0x0004
531 #define SE_DACL_DEFAULTED 0x0008
532 #define SE_SACL_PRESENT 0x0010
533 #define SE_SACL_DEFAULTED 0x0020
534 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
535 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
536 #define SE_DACL_AUTO_INHERITED 0x0400
537 #define SE_SACL_AUTO_INHERITED 0x0800
538 #define SE_DACL_PROTECTED 0x1000
539 #define SE_SACL_PROTECTED 0x2000
540 #define SE_SELF_RELATIVE 0x8000
541
542 #define SE_DACL_INHERITANCE_MASK 0x1500
543 #define SE_SACL_INHERITANCE_MASK 0x2A00
544
545 /*
546 * Security descriptor structures:
547 *
548 * smb_sd_t SD in SMB pointer form
549 * smb_fssd_t SD in filesystem form
550 *
551 * Filesystems (e.g. ZFS/UFS) don't have something equivalent
552 * to SD. The items comprising a SMB SD are kept separately in
553 * filesystem. smb_fssd_t is introduced as a helper to provide
554 * the required abstraction for CIFS code.
555 */
556
557 typedef struct smb_sd {
558 uint8_t sd_revision;
559 uint16_t sd_control;
560 smb_sid_t *sd_owner; /* SID file owner */
561 smb_sid_t *sd_group; /* SID group (for POSIX) */
562 smb_acl_t *sd_sacl; /* ACL System (audits) */
563 smb_acl_t *sd_dacl; /* ACL Discretionary (perm) */
564 } smb_sd_t;
565
566 /*
567 * SD header size as it appears on the wire
568 */
569 #define SMB_SD_HDRSIZE 20
570
571 /*
572 * values for smb_fssd.sd_flags
573 */
574 #define SMB_FSSD_FLAGS_DIR 0x01
575
576 typedef struct smb_fssd {
577 uint32_t sd_secinfo;
578 uint32_t sd_flags;
579 uid_t sd_uid;
580 gid_t sd_gid;
581 acl_t *sd_zdacl;
582 acl_t *sd_zsacl;
583 } smb_fssd_t;
584
585 void smb_sd_init(smb_sd_t *, uint8_t);
586 void smb_sd_term(smb_sd_t *);
587 uint32_t smb_sd_get_secinfo(smb_sd_t *);
588 uint32_t smb_sd_len(smb_sd_t *, uint32_t);
589 uint32_t smb_sd_tofs(smb_sd_t *, smb_fssd_t *);
590
591 void smb_fssd_init(smb_fssd_t *, uint32_t, uint32_t);
592 void smb_fssd_term(smb_fssd_t *);
593
594 void smb_acl_sort(smb_acl_t *);
595 void smb_acl_free(smb_acl_t *);
596 smb_acl_t *smb_acl_alloc(uint8_t, uint16_t, uint16_t);
597 smb_acl_t *smb_acl_from_zfs(acl_t *);
598 uint32_t smb_acl_to_zfs(smb_acl_t *, uint32_t, int, acl_t **);
599 uint16_t smb_acl_len(smb_acl_t *);
600 boolean_t smb_acl_isvalid(smb_acl_t *, int);
601
602 void smb_fsacl_free(acl_t *);
603 acl_t *smb_fsacl_alloc(int, int);
604
605 #ifdef __cplusplus
606 }
607 #endif
608
609 #endif /* _SMBSRV_NTIFS_H */