ntaccess.h revision da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#ifndef _SMBSRV_NTACCESS_H
#define _SMBSRV_NTACCESS_H
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* This file defines the NT compatible access control masks and values.
* An access mask as a 32-bit value arranged as shown below.
*
* 31-28 Generic bits, interpreted per object type
* 27-26 Reserved, must-be-zero
* 25 Maximum allowed
* 24 System Security rights (SACL is SD)
* 23-16 Standard access rights, generic to all object types
* 15-0 Specific access rights, object specific
*
* 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
* 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
* +---------------+---------------+-------------------------------+
* |G|G|G|G|Res'd|A| StandardRights| SpecificRights |
* |R|W|E|A| |S| | |
* +-+-------------+---------------+-------------------------------+
*/
#ifdef __cplusplus
extern "C" {
#endif
/*
* Specific rights for files, pipes and directories.
*/
#define FILE_SPECIFIC_ALL (0x000001FFL)
#define SPECIFIC_RIGHTS_ALL (0x0000FFFFL)
/*
* Standard rights:
*
* DELETE The right to delete the object.
*
* READ_CONTROL The right to read the information in the object's security
* descriptor, not including the information in the SACL.
*
* WRITE_DAC The right to modify the DACL in the object's security
* descriptor.
*
* WRITE_OWNER The right to change the owner in the object's security
* descriptor.
*
* SYNCHRONIZE The right to use the object for synchronization. This enables
* a thread to wait until the object is in the signaled state.
*/
#define DELETE (0x00010000L)
#define READ_CONTROL (0x00020000L)
#define WRITE_DAC (0x00040000L)
#define SYNCHRONIZE (0x00100000L)
#define STANDARD_RIGHTS_REQUIRED (0x000F0000L)
#define STANDARD_RIGHTS_ALL (0x001F0000L)
#define STANDARD_RIGHTS_READ (READ_CONTROL)
#define STANDARD_RIGHTS_WRITE (READ_CONTROL)
#define STANDARD_RIGHTS_EXECUTE (READ_CONTROL)
#define FILE_METADATA_ALL (FILE_READ_EA |\
READ_CONTROL |\
WRITE_DAC |\
WRITE_OWNER |\
#define FILE_DATA_ALL (FILE_READ_DATA |\
FILE_EXECUTE |\
/*
* Miscellaneous bits: SACL access and maximum allowed access.
*/
#define ACCESS_SYSTEM_SECURITY (0x01000000L)
#define MAXIMUM_ALLOWED (0x02000000L)
/*
* Generic rights. These are shorthands that are interpreted as
* appropriate for the type of secured object being accessed.
*/
#define GENERIC_ALL (0x10000000UL)
#define GENERIC_EXECUTE (0x20000000UL)
#define GENERIC_WRITE (0x40000000UL)
#define GENERIC_READ (0x80000000UL)
#define FILE_GENERIC_READ (STANDARD_RIGHTS_READ | \
FILE_READ_DATA | \
FILE_READ_EA | \
#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE | \
FILE_WRITE_DATA | \
FILE_WRITE_EA | \
FILE_APPEND_DATA | \
#define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
FILE_EXECUTE | \
#define FILE_GENERIC_ALL (FILE_GENERIC_READ | \
/*
* LSA policy desired access masks.
*/
#define POLICY_VIEW_LOCAL_INFORMATION 0x00000001L
#define POLICY_VIEW_AUDIT_INFORMATION 0x00000002L
#define POLICY_GET_PRIVATE_INFORMATION 0x00000004L
#define POLICY_TRUST_ADMIN 0x00000008L
#define POLICY_CREATE_ACCOUNT 0x00000010L
#define POLICY_CREATE_SECRET 0x00000020L
#define POLICY_CREATE_PRIVILEGE 0x00000040L
#define POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080L
#define POLICY_SET_AUDIT_REQUIREMENTS 0x00000100L
#define POLICY_AUDIT_LOG_ADMIN 0x00000200L
#define POLICY_SERVER_ADMIN 0x00000400L
#define POLICY_LOOKUP_NAMES 0x00000800L
/*
* SAM specific rights desired access masks. These definitions are listed
* mostly as a convenience; they don't seem to be documented. Setting the
* desired access mask to GENERIC_EXECUTE and STANDARD_RIGHTS_EXECUTE
* seems to work when just looking up information.
*/
#define SAM_LOOKUP_INFORMATION (GENERIC_EXECUTE \
#define SAM_ACCESS_USER_READ 0x0000031BL
#define SAM_ACCESS_USER_UPDATE 0x0000031FL
#define SAM_ACCESS_USER_SETPWD 0x0000037FL
#define SAM_CONNECT_CREATE_ACCOUNT 0x00000020L
#define SAM_ENUM_LOCAL_DOMAIN 0x00000030L
#define SAM_DOMAIN_CREATE_ACCOUNT 0x00000211L
/*
* File attributes
*
* Note: 0x00000008 is reserved for use for the old DOS VOLID (volume ID)
* and is therefore not considered valid in NT.
*
* Note: 0x00000010 is reserved for use for the old DOS SUBDIRECTORY flag
* and is therefore not considered valid in NT. This flag has
* been disassociated with file attributes since the other flags are
* protected with READ_ and WRITE_ATTRIBUTES access to the file.
*
* Note: Note also that the order of these flags is set to allow both the
* FAT and the Pinball File Systems to directly set the attributes
* flags in attributes words without having to pick each flag out
* individually. The order of these flags should not be changed!
*
* The file attributes are defined in smbsrv/smb_vops.h
*/
/* Filesystem Attributes */
#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
#define FILE_CASE_PRESERVED_NAMES 0x00000002
#define FILE_UNICODE_ON_DISK 0x00000004
#define FILE_PERSISTENT_ACLS 0x00000008
#define FILE_FILE_COMPRESSION 0x00000010
#define FILE_VOLUME_QUOTAS 0x00000020
#define FILE_SUPPORTS_SPARSE_FILES 0x00000040
#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
#define FILE_VOLUME_IS_COMPRESSED 0x00008000
#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
#define FILE_SUPPORTS_ENCRYPTION 0x00020000
#define FILE_NAMED_STREAMS 0x00040000
#define FILE_READ_ONLY_VOLUME 0x00080000
#ifdef __cplusplus
}
#endif
#endif /* _SMBSRV_NTACCESS_H */