122 lines · c
1/* SPDX-License-Identifier: LGPL-2.1+ */2/*3 * Copyright (c) International Business Machines Corp., 20074 * Author(s): Steve French (sfrench@us.ibm.com)5 * Modified by Namjae Jeon (linkinjeon@kernel.org)6 */7 8#ifndef _COMMON_SMBACL_H9#define _COMMON_SMBACL_H10 11#define NUM_AUTHS (6) /* number of authority fields */12#define SID_MAX_SUB_AUTHORITIES (15) /* max number of sub authority fields */13 14/* ACE types - see MS-DTYP 2.4.4.1 */15#define ACCESS_ALLOWED_ACE_TYPE 0x0016#define ACCESS_DENIED_ACE_TYPE 0x0117#define SYSTEM_AUDIT_ACE_TYPE 0x0218#define SYSTEM_ALARM_ACE_TYPE 0x0319#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x0420#define ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x0521#define ACCESS_DENIED_OBJECT_ACE_TYPE 0x0622#define SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x0723#define SYSTEM_ALARM_OBJECT_ACE_TYPE 0x0824#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x0925#define ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A26#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B27#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE 0x0C28#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE 0x0D29#define SYSTEM_ALARM_CALLBACK_ACE_TYPE 0x0E /* Reserved */30#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F31#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10 /* reserved */32#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x1133#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x1234#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x1335 36/* ACE flags */37#define OBJECT_INHERIT_ACE 0x0138#define CONTAINER_INHERIT_ACE 0x0239#define NO_PROPAGATE_INHERIT_ACE 0x0440#define INHERIT_ONLY_ACE 0x0841#define INHERITED_ACE 0x1042#define SUCCESSFUL_ACCESS_ACE_FLAG 0x4043#define FAILED_ACCESS_ACE_FLAG 0x8044 45/*46 * Maximum size of a string representation of a SID:47 *48 * The fields are unsigned values in decimal. So:49 *50 * u8: max 3 bytes in decimal51 * u32: max 10 bytes in decimal52 *53 * "S-" + 3 bytes for version field + 15 for authority field + NULL terminator54 *55 * For authority field, max is when all 6 values are non-zero and it must be56 * represented in hex. So "-0x" + 12 hex digits.57 *58 * Add 11 bytes for each subauthority field (10 bytes each + 1 for '-')59 */60#define SID_STRING_BASE_SIZE (2 + 3 + 15 + 1)61#define SID_STRING_SUBAUTH_SIZE (11) /* size of a single subauth string */62 63#define DOMAIN_USER_RID_LE cpu_to_le32(513)64 65/*66 * ACE types - see MS-DTYP 2.4.4.167 */68enum {69 ACCESS_ALLOWED,70 ACCESS_DENIED,71};72 73/*74 * Security ID types75 */76enum {77 SIDOWNER = 1,78 SIDGROUP,79 SIDCREATOR_OWNER,80 SIDCREATOR_GROUP,81 SIDUNIX_USER,82 SIDUNIX_GROUP,83 SIDNFS_USER,84 SIDNFS_GROUP,85 SIDNFS_MODE,86};87 88struct smb_ntsd {89 __le16 revision; /* revision level */90 __le16 type;91 __le32 osidoffset;92 __le32 gsidoffset;93 __le32 sacloffset;94 __le32 dacloffset;95} __attribute__((packed));96 97struct smb_sid {98 __u8 revision; /* revision level */99 __u8 num_subauth;100 __u8 authority[NUM_AUTHS];101 __le32 sub_auth[SID_MAX_SUB_AUTHORITIES]; /* sub_auth[num_subauth] */102} __attribute__((packed));103 104/* size of a struct smb_sid, sans sub_auth array */105#define CIFS_SID_BASE_SIZE (1 + 1 + NUM_AUTHS)106 107struct smb_acl {108 __le16 revision; /* revision level */109 __le16 size;110 __le32 num_aces;111} __attribute__((packed));112 113struct smb_ace {114 __u8 type; /* see above and MS-DTYP 2.4.4.1 */115 __u8 flags;116 __le16 size;117 __le32 access_req;118 struct smb_sid sid; /* ie UUID of user or group who gets these perms */119} __attribute__((packed));120 121#endif /* _COMMON_SMBACL_H */122