.. | .. |
---|
45 | 45 | */ |
---|
46 | 46 | #define DEFAULT_SEC_DESC_LEN (sizeof(struct cifs_ntsd) + \ |
---|
47 | 47 | sizeof(struct cifs_acl) + \ |
---|
48 | | - (sizeof(struct cifs_ace) * 3)) |
---|
| 48 | + (sizeof(struct cifs_ace) * 4)) |
---|
49 | 49 | |
---|
50 | 50 | /* |
---|
51 | 51 | * Maximum size of a string representation of a SID: |
---|
.. | .. |
---|
90 | 90 | __le32 num_aces; |
---|
91 | 91 | } __attribute__((packed)); |
---|
92 | 92 | |
---|
| 93 | +/* ACE types - see MS-DTYP 2.4.4.1 */ |
---|
| 94 | +#define ACCESS_ALLOWED_ACE_TYPE 0x00 |
---|
| 95 | +#define ACCESS_DENIED_ACE_TYPE 0x01 |
---|
| 96 | +#define SYSTEM_AUDIT_ACE_TYPE 0x02 |
---|
| 97 | +#define SYSTEM_ALARM_ACE_TYPE 0x03 |
---|
| 98 | +#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04 |
---|
| 99 | +#define ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05 |
---|
| 100 | +#define ACCESS_DENIED_OBJECT_ACE_TYPE 0x06 |
---|
| 101 | +#define SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07 |
---|
| 102 | +#define SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08 |
---|
| 103 | +#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09 |
---|
| 104 | +#define ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A |
---|
| 105 | +#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B |
---|
| 106 | +#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE 0x0C |
---|
| 107 | +#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE 0x0D |
---|
| 108 | +#define SYSTEM_ALARM_CALLBACK_ACE_TYPE 0x0E /* Reserved */ |
---|
| 109 | +#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F |
---|
| 110 | +#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10 /* reserved */ |
---|
| 111 | +#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x11 |
---|
| 112 | +#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x12 |
---|
| 113 | +#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x13 |
---|
| 114 | + |
---|
| 115 | +/* ACE flags */ |
---|
| 116 | +#define OBJECT_INHERIT_ACE 0x01 |
---|
| 117 | +#define CONTAINER_INHERIT_ACE 0x02 |
---|
| 118 | +#define NO_PROPAGATE_INHERIT_ACE 0x04 |
---|
| 119 | +#define INHERIT_ONLY_ACE 0x08 |
---|
| 120 | +#define INHERITED_ACE 0x10 |
---|
| 121 | +#define SUCCESSFUL_ACCESS_ACE_FLAG 0x40 |
---|
| 122 | +#define FAILED_ACCESS_ACE_FLAG 0x80 |
---|
| 123 | + |
---|
93 | 124 | struct cifs_ace { |
---|
94 | | - __u8 type; |
---|
| 125 | + __u8 type; /* see above and MS-DTYP 2.4.4.1 */ |
---|
95 | 126 | __u8 flags; |
---|
96 | 127 | __le16 size; |
---|
97 | 128 | __le32 access_req; |
---|
.. | .. |
---|
99 | 130 | } __attribute__((packed)); |
---|
100 | 131 | |
---|
101 | 132 | /* |
---|
| 133 | + * The current SMB3 form of security descriptor is similar to what was used for |
---|
| 134 | + * cifs (see above) but some fields are split, and fields in the struct below |
---|
| 135 | + * matches names of fields to the spec, MS-DTYP (see sections 2.4.5 and |
---|
| 136 | + * 2.4.6). Note that "CamelCase" fields are used in this struct in order to |
---|
| 137 | + * match the MS-DTYP and MS-SMB2 specs which define the wire format. |
---|
| 138 | + */ |
---|
| 139 | +struct smb3_sd { |
---|
| 140 | + __u8 Revision; /* revision level, MUST be one */ |
---|
| 141 | + __u8 Sbz1; /* only meaningful if 'RM' flag set below */ |
---|
| 142 | + __le16 Control; |
---|
| 143 | + __le32 OffsetOwner; |
---|
| 144 | + __le32 OffsetGroup; |
---|
| 145 | + __le32 OffsetSacl; |
---|
| 146 | + __le32 OffsetDacl; |
---|
| 147 | +} __packed; |
---|
| 148 | + |
---|
| 149 | +/* Meaning of 'Control' field flags */ |
---|
| 150 | +#define ACL_CONTROL_SR 0x8000 /* Self relative */ |
---|
| 151 | +#define ACL_CONTROL_RM 0x4000 /* Resource manager control bits */ |
---|
| 152 | +#define ACL_CONTROL_PS 0x2000 /* SACL protected from inherits */ |
---|
| 153 | +#define ACL_CONTROL_PD 0x1000 /* DACL protected from inherits */ |
---|
| 154 | +#define ACL_CONTROL_SI 0x0800 /* SACL Auto-Inherited */ |
---|
| 155 | +#define ACL_CONTROL_DI 0x0400 /* DACL Auto-Inherited */ |
---|
| 156 | +#define ACL_CONTROL_SC 0x0200 /* SACL computed through inheritance */ |
---|
| 157 | +#define ACL_CONTROL_DC 0x0100 /* DACL computed through inheritence */ |
---|
| 158 | +#define ACL_CONTROL_SS 0x0080 /* Create server ACL */ |
---|
| 159 | +#define ACL_CONTROL_DT 0x0040 /* DACL provided by trusted source */ |
---|
| 160 | +#define ACL_CONTROL_SD 0x0020 /* SACL defaulted */ |
---|
| 161 | +#define ACL_CONTROL_SP 0x0010 /* SACL is present on object */ |
---|
| 162 | +#define ACL_CONTROL_DD 0x0008 /* DACL defaulted */ |
---|
| 163 | +#define ACL_CONTROL_DP 0x0004 /* DACL is present on object */ |
---|
| 164 | +#define ACL_CONTROL_GD 0x0002 /* Group was defaulted */ |
---|
| 165 | +#define ACL_CONTROL_OD 0x0001 /* User was defaulted */ |
---|
| 166 | + |
---|
| 167 | +/* Meaning of AclRevision flags */ |
---|
| 168 | +#define ACL_REVISION 0x02 /* See section 2.4.4.1 of MS-DTYP */ |
---|
| 169 | +#define ACL_REVISION_DS 0x04 /* Additional AceTypes allowed */ |
---|
| 170 | + |
---|
| 171 | +struct smb3_acl { |
---|
| 172 | + u8 AclRevision; /* revision level */ |
---|
| 173 | + u8 Sbz1; /* MBZ */ |
---|
| 174 | + __le16 AclSize; |
---|
| 175 | + __le16 AceCount; |
---|
| 176 | + __le16 Sbz2; /* MBZ */ |
---|
| 177 | +} __packed; |
---|
| 178 | + |
---|
| 179 | +/* |
---|
| 180 | + * Used to store the special 'NFS SIDs' used to persist the POSIX uid and gid |
---|
| 181 | + * See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx |
---|
| 182 | + */ |
---|
| 183 | +struct owner_sid { |
---|
| 184 | + u8 Revision; |
---|
| 185 | + u8 NumAuth; |
---|
| 186 | + u8 Authority[6]; |
---|
| 187 | + __le32 SubAuthorities[3]; |
---|
| 188 | +} __packed; |
---|
| 189 | + |
---|
| 190 | +struct owner_group_sids { |
---|
| 191 | + struct owner_sid owner; |
---|
| 192 | + struct owner_sid group; |
---|
| 193 | +} __packed; |
---|
| 194 | + |
---|
| 195 | +/* |
---|
102 | 196 | * Minimum security identifier can be one for system defined Users |
---|
103 | 197 | * and Groups such as NULL SID and World or Built-in accounts such |
---|
104 | 198 | * as Administrator and Guest and consists of |
---|