samba.git/libcli/security/secace.h, branch talloc-2.4.4

librpc:ndr: Introduce ‘libndr_flags’ type

2023-11-01T20:10:45+00:00

The LIBNDR_FLAG_ namespace is getting dangerously full, with only a
single flag value (1 << 9) remaining for use. After that flag is put
into use, we won’t be able to add any new flags without increasing the
flag width to 64‐bit.

Up to now we’ve used a haphazard mix of int, unsigned, and uint32_t to
store these flags. Introduce a new type, ‘libndr_flags’, to be used
consistently to hold LIBNDR flags. If in the future we find we need to
move to 64‐bit flags, this type gives us an opportunity to do that.

Bump the NDR version to 4.0.0 — an major version increment, for we’re
changing the function ABI and adding the new symbol
ndr_print_libndr_flags.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

libcli/security: helper to find ACEs with meaningful codas

2023-09-26T23:45:35+00:00

Only Resource Attribute ACEs and Conditional ACEs are expected to have
trailing data. Others sometimes might, but we don't care what it is.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: helper to find resource attribute ACEs

2023-09-26T23:45:35+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: helper to find callback/conditional aces

2023-09-26T23:45:35+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: rm unused sec_ace_copy()

2023-08-24T02:53:31+00:00

Unused since 2014.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

librpc/security.idl: adjust size calculations for upcoming ace types

2023-08-24T02:53:31+00:00

Soon we will get Conditional ACEs and Resource Attribute ACES, each of
which have trailing bytes at the end of the ACE. Here's a diagram:

              ____      The ACE size field may indicate a size bigger
  .type      /    |     than the known parts, even when you take
  .flags    /     |     rounding to a multiple of four into account.
  .size  --'      |     This extra data is meaningful in some ACEs.
  .access_mask    |
  .trustee (sid) _|  <- known data ends here.
                  :
   "coda"      ___:  <- the trailing part, Zero size unless the size
                        field points beyond the end of the known data.
			Probably empty for ordinary ACE types.

Until now we have thrown away these extra bytes, because they have no
meaning in the ACE types we recognise. But with conditional and
resource attribute ACEs we need to catch and process these bytes, so
we add an extra field for that.

Thus we can drop the manually written ndr_pull_security_ace() that
discarded the trailing bytes, because we just allow it to be pulled
into an unused blob. In the very common case, the blob will be empty.

Microsoft does not use a common name across different ACE types to
describe this end-data -- "coda" is a Samba term.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

lib: Remove some unused code

2015-08-14T05:46:12+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Martin Schwenke

libcli/security: remove sec_ace_equal

2014-05-29T01:34:38+00:00

This function is a duplicate of security_ace_equal(), and is no longer
used.

Signed-off-by: David Disseldorp 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu May 29 03:34:38 CEST 2014 on sn-devel-104

libcli/security: remove unused sec_ace_del_sid()

2014-05-28T23:08:25+00:00

With sec_desc_del_sid() now gone, this can also be removed.

Signed-off-by: David Disseldorp 
Reviewed-by: Andrew Bartlett

libcli/sd: remove redundant sec_ace_add_sid()

2014-05-28T15:52:13+00:00

This function adds a new allow-type ACE to an existing ACE list. With
the removal of sec_desc_add_sid(), this is no longer used internally.

The same behaviour can be achieved via the much cleaner
security_ace_create() function.

Signed-off-by: David Disseldorp 
Reviewed-by: Jeremy Allison 
Reviewed-by: Volker Lendecke