2005-02-03 18:14:54 +03:00
2010-08-27 02:56:15 +04:00
/*
2003-05-06 17:10:10 +04:00
Unix SMB / CIFS implementation .
SMB parameters and setup
Copyright ( C ) Andrew Tridgell 1992 - 1997
Copyright ( C ) Luke Kenneth Casson Leighton 1996 - 1997
Copyright ( C ) Paul Ashton 1997
2005-01-13 21:20:37 +03:00
Copyright ( C ) Simo Sorce 2003
2005-03-10 21:50:47 +03:00
Copyright ( C ) Gerald ( Jerry ) Carter 2005
2010-08-26 12:38:16 +04:00
Copyright ( C ) Andrew Bartlett 2010
2010-08-27 02:56:15 +04:00
2003-05-06 17:10:10 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
the Free Software Foundation ; either version 3 of the License , or
2003-05-06 17:10:10 +04:00
( at your option ) any later version .
2010-08-27 02:56:15 +04:00
2003-05-06 17:10:10 +04:00
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
2010-08-27 02:56:15 +04:00
2003-05-06 17:10:10 +04:00
You should have received a copy of the GNU General Public License
2007-07-10 04:52:41 +04:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
2003-05-06 17:10:10 +04:00
*/
# ifndef PRIVILEGES_H
# define PRIVILEGES_H
2010-06-05 04:39:11 +04:00
# include "../librpc/gen_ndr/lsa.h"
2010-08-27 06:44:35 +04:00
# include "../librpc/gen_ndr/security.h"
2010-06-05 04:39:11 +04:00
2005-01-19 19:52:19 +03:00
/* privilege bitmask */
2005-01-13 21:20:37 +03:00
/* common privilege defines */
2003-06-18 19:24:10 +04:00
2010-08-24 08:47:26 +04:00
# define SE_END 0x0
# define SE_NONE 0x0
2010-08-26 08:37:00 +04:00
# define SE_ALL_PRIVS (uint64_t)-1
2003-06-18 19:24:10 +04:00
2005-01-13 21:20:37 +03:00
2007-06-14 15:29:35 +04:00
/* defined in lib/privilegs_basic.c */
2010-08-26 08:37:00 +04:00
extern const uint64_t se_priv_all ;
2005-01-19 19:52:19 +03:00
2010-08-26 08:37:00 +04:00
extern const uint64_t se_priv_none ;
extern const uint64_t se_machine_account ;
extern const uint64_t se_print_operator ;
extern const uint64_t se_add_users ;
extern const uint64_t se_disk_operators ;
extern const uint64_t se_remote_shutdown ;
extern const uint64_t se_restore ;
extern const uint64_t se_take_ownership ;
2005-01-19 19:52:19 +03:00
2005-01-13 21:20:37 +03:00
/*
* These are used in Lsa replies ( srv_lsa_nt . c )
*/
2005-06-29 20:35:32 +04:00
typedef struct {
2003-10-06 05:38:46 +04:00
TALLOC_CTX * mem_ctx ;
2007-10-19 04:40:25 +04:00
bool ext_ctx ;
2003-05-06 17:10:10 +04:00
uint32 count ;
uint32 control ;
2010-06-05 04:39:11 +04:00
struct lsa_LUIDAttribute * set ;
2003-05-06 17:10:10 +04:00
} PRIVILEGE_SET ;
2005-06-29 20:35:32 +04:00
typedef struct {
2010-08-26 16:49:27 +04:00
uint64_t privilege_mask ;
2005-01-13 21:20:37 +03:00
const char * name ;
2003-06-18 19:24:10 +04:00
const char * description ;
2010-08-26 16:49:27 +04:00
enum sec_privilege luid ;
2003-06-18 19:24:10 +04:00
} PRIVS ;
2010-08-27 03:22:31 +04:00
/***************************************************************************
copy an uint64_t structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool se_priv_copy ( uint64_t * dst , const uint64_t * src ) ;
/***************************************************************************
put all privileges into a mask
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool se_priv_put_all_privileges ( uint64_t * privilege_mask ) ;
/***************************************************************************
combine 2 uint64_t structures and store the resulting set in mew_mask
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void se_priv_add ( uint64_t * privilege_mask , const uint64_t * addpriv ) ;
/***************************************************************************
remove one uint64_t sytucture from another and store the resulting set
in mew_mask
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void se_priv_remove ( uint64_t * privilege_mask , const uint64_t * removepriv ) ;
/***************************************************************************
check if 2 uint64_t structure are equal
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool se_priv_equal ( const uint64_t * privilege_mask1 , const uint64_t * privilege_mask2 ) ;
/*********************************************************************
Lookup the uint64_t value for a privilege name
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool se_priv_from_name ( const char * name , uint64_t * privilege_mask ) ;
/***************************************************************************
dump an uint64_t structure to the log files
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void dump_se_priv ( int dbg_cl , int dbg_lvl , const uint64_t * privilege_mask ) ;
/****************************************************************************
check if the privilege is in the privilege list
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool is_privilege_assigned ( const uint64_t * privileges ,
const uint64_t * check ) ;
const char * get_privilege_dispname ( const char * name ) ;
/****************************************************************************
Does the user have the specified privilege ? We only deal with one privilege
at a time here .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool user_has_privileges ( const struct security_token * token , const uint64_t * privilege_bit ) ;
/****************************************************************************
Does the user have any of the specified privileges ? We only deal with one privilege
at a time here .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
bool user_has_any_privilege ( struct security_token * token , const uint64_t * privilege_mask ) ;
/*******************************************************************
return the number of elements in the privlege array
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
int count_all_privileges ( void ) ;
/*********************************************************************
Generate the struct lsa_LUIDAttribute structure based on a bitmask
The assumption here is that the privilege has already been validated
so we are guaranteed to find it in the list .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct lsa_LUIDAttribute get_privilege_luid ( uint64_t * privilege_mask ) ;
/****************************************************************************
Convert a LUID to a named string
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
const char * luid_to_privilege_name ( const struct lsa_LUID * set ) ;
bool se_priv_to_privilege_set ( PRIVILEGE_SET * set , uint64_t * privilege_mask ) ;
bool privilege_set_to_se_priv ( uint64_t * privilege_mask , struct lsa_PrivilegeSet * privset ) ;
2003-06-18 19:24:10 +04:00
# endif /* PRIVILEGES_H */
