reactos/include/xdk/setypes.h

   1 /******************************************************************************
   2  *                            Security Manager Types                          *
   3  ******************************************************************************/
   4 $if (_WDMDDK_)
   5
   6 /* Simple types */
   7 typedef PVOID PSECURITY_DESCRIPTOR;
   8 typedef ULONG SECURITY_INFORMATION, *PSECURITY_INFORMATION;
   9 typedef ULONG ACCESS_MASK, *PACCESS_MASK;
  10
  11 $endif (_WDMDDK_)
  12 $if (_WDMDDK_ || _WINNT_)
  13
  14 typedef PVOID PACCESS_TOKEN;
  15 typedef PVOID PSID;
  16
  17 $endif (_WDMDDK_ || _WINNT_)
  18 $if (_WDMDDK_)
  19
  20 #define DELETE                           0x00010000L
  21 #define READ_CONTROL                     0x00020000L
  22 #define WRITE_DAC                        0x00040000L
  23 #define WRITE_OWNER                      0x00080000L
  24 #define SYNCHRONIZE                      0x00100000L
  25 #define STANDARD_RIGHTS_REQUIRED         0x000F0000L
  26 #define STANDARD_RIGHTS_READ             READ_CONTROL
  27 #define STANDARD_RIGHTS_WRITE            READ_CONTROL
  28 #define STANDARD_RIGHTS_EXECUTE          READ_CONTROL
  29 #define STANDARD_RIGHTS_ALL              0x001F0000L
  30 #define SPECIFIC_RIGHTS_ALL              0x0000FFFFL
  31 #define ACCESS_SYSTEM_SECURITY           0x01000000L
  32 #define MAXIMUM_ALLOWED                  0x02000000L
  33 #define GENERIC_READ                     0x80000000L
  34 #define GENERIC_WRITE                    0x40000000L
  35 #define GENERIC_EXECUTE                  0x20000000L
  36 #define GENERIC_ALL                      0x10000000L
  37
  38 typedef struct _GENERIC_MAPPING {
  39   ACCESS_MASK GenericRead;
  40   ACCESS_MASK GenericWrite;
  41   ACCESS_MASK GenericExecute;
  42   ACCESS_MASK GenericAll;
  43 } GENERIC_MAPPING, *PGENERIC_MAPPING;
  44
  45 #define ACL_REVISION                      2
  46 #define ACL_REVISION_DS                   4
  47
  48 #define ACL_REVISION1                     1
  49 #define ACL_REVISION2                     2
  50 #define ACL_REVISION3                     3
  51 #define ACL_REVISION4                     4
  52 #define MIN_ACL_REVISION                  ACL_REVISION2
  53 #define MAX_ACL_REVISION                  ACL_REVISION4
  54
  55 typedef struct _ACL {
  56   UCHAR AclRevision;
  57   UCHAR Sbz1;
  58   USHORT AclSize;
  59   USHORT AceCount;
  60   USHORT Sbz2;
  61 } ACL, *PACL;
  62
  63 /* Current security descriptor revision value */
  64 #define SECURITY_DESCRIPTOR_REVISION     (1)
  65 #define SECURITY_DESCRIPTOR_REVISION1    (1)
  66
  67 /* Privilege attributes */
  68 #define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
  69 #define SE_PRIVILEGE_ENABLED            (0x00000002L)
  70 #define SE_PRIVILEGE_REMOVED            (0X00000004L)
  71 #define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)
  72
  73 #define SE_PRIVILEGE_VALID_ATTRIBUTES   (SE_PRIVILEGE_ENABLED_BY_DEFAULT | \
  74                                          SE_PRIVILEGE_ENABLED            | \
  75                                          SE_PRIVILEGE_REMOVED            | \
  76                                          SE_PRIVILEGE_USED_FOR_ACCESS)
  77
  78 #include <pshpack4.h>
  79 typedef struct _LUID_AND_ATTRIBUTES {
  80   LUID Luid;
  81   ULONG Attributes;
  82 } LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
  83 #include <poppack.h>
  84
  85 typedef LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
  86 typedef LUID_AND_ATTRIBUTES_ARRAY *PLUID_AND_ATTRIBUTES_ARRAY;
  87
  88 /* Privilege sets */
  89 #define PRIVILEGE_SET_ALL_NECESSARY (1)
  90
  91 typedef struct _PRIVILEGE_SET {
  92   ULONG PrivilegeCount;
  93   ULONG Control;
  94   LUID_AND_ATTRIBUTES Privilege[ANYSIZE_ARRAY];
  95 } PRIVILEGE_SET,*PPRIVILEGE_SET;
  96
  97 $endif(_WDMDDK_)
  98 $if(_WDMDDK_ || _WINNT_)
  99
 100 typedef enum _SECURITY_IMPERSONATION_LEVEL {
 101   SecurityAnonymous,
 102   SecurityIdentification,
 103   SecurityImpersonation,
 104   SecurityDelegation
 105 } SECURITY_IMPERSONATION_LEVEL, * PSECURITY_IMPERSONATION_LEVEL;
 106
 107 $endif (_WDMDDK_ || _WINNT_)
 108 $if (_WDMDDK_)
 109
 110 #define SECURITY_MAX_IMPERSONATION_LEVEL SecurityDelegation
 111 #define SECURITY_MIN_IMPERSONATION_LEVEL SecurityAnonymous
 112 #define DEFAULT_IMPERSONATION_LEVEL SecurityImpersonation
 113 #define VALID_IMPERSONATION_LEVEL(Level) (((Level) >= SECURITY_MIN_IMPERSONATION_LEVEL) && ((Level) <= SECURITY_MAX_IMPERSONATION_LEVEL))
 114
 115 #define SECURITY_DYNAMIC_TRACKING (TRUE)
 116 #define SECURITY_STATIC_TRACKING (FALSE)
 117
 118 $endif (_WDMDDK_)
 119 $if (_WDMDDK_ || _WINNT_)
 120
 121 typedef BOOLEAN SECURITY_CONTEXT_TRACKING_MODE, *PSECURITY_CONTEXT_TRACKING_MODE;
 122
 123 typedef struct _SECURITY_QUALITY_OF_SERVICE {
 124   $ULONG Length;
 125   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 126   SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode;
 127   BOOLEAN EffectiveOnly;
 128 } SECURITY_QUALITY_OF_SERVICE, *PSECURITY_QUALITY_OF_SERVICE;
 129
 130 typedef struct _SE_IMPERSONATION_STATE {
 131   PACCESS_TOKEN Token;
 132   BOOLEAN CopyOnOpen;
 133   BOOLEAN EffectiveOnly;
 134   SECURITY_IMPERSONATION_LEVEL Level;
 135 } SE_IMPERSONATION_STATE, *PSE_IMPERSONATION_STATE;
 136
 137 $endif (_WDMDDK_ || _WINNT_)
 138 $if (_WDMDDK_)
 139
 140 #define OWNER_SECURITY_INFORMATION       (0x00000001L)
 141 #define GROUP_SECURITY_INFORMATION       (0x00000002L)
 142 #define DACL_SECURITY_INFORMATION        (0x00000004L)
 143 #define SACL_SECURITY_INFORMATION        (0x00000008L)
 144 #define LABEL_SECURITY_INFORMATION       (0x00000010L)
 145
 146 #define PROTECTED_DACL_SECURITY_INFORMATION     (0x80000000L)
 147 #define PROTECTED_SACL_SECURITY_INFORMATION     (0x40000000L)
 148 #define UNPROTECTED_DACL_SECURITY_INFORMATION   (0x20000000L)
 149 #define UNPROTECTED_SACL_SECURITY_INFORMATION   (0x10000000L)
 150
 151 typedef enum _SECURITY_OPERATION_CODE {
 152   SetSecurityDescriptor,
 153   QuerySecurityDescriptor,
 154   DeleteSecurityDescriptor,
 155   AssignSecurityDescriptor
 156 } SECURITY_OPERATION_CODE, *PSECURITY_OPERATION_CODE;
 157
 158 #define INITIAL_PRIVILEGE_COUNT           3
 159
 160 typedef struct _INITIAL_PRIVILEGE_SET {
 161   ULONG PrivilegeCount;
 162   ULONG Control;
 163   LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
 164 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
 165
 166 #define SE_MIN_WELL_KNOWN_PRIVILEGE         2
 167 #define SE_CREATE_TOKEN_PRIVILEGE           2
 168 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE     3
 169 #define SE_LOCK_MEMORY_PRIVILEGE            4
 170 #define SE_INCREASE_QUOTA_PRIVILEGE         5
 171 #define SE_MACHINE_ACCOUNT_PRIVILEGE        6
 172 #define SE_TCB_PRIVILEGE                    7
 173 #define SE_SECURITY_PRIVILEGE               8
 174 #define SE_TAKE_OWNERSHIP_PRIVILEGE         9
 175 #define SE_LOAD_DRIVER_PRIVILEGE            10
 176 #define SE_SYSTEM_PROFILE_PRIVILEGE         11
 177 #define SE_SYSTEMTIME_PRIVILEGE             12
 178 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE    13
 179 #define SE_INC_BASE_PRIORITY_PRIVILEGE      14
 180 #define SE_CREATE_PAGEFILE_PRIVILEGE        15
 181 #define SE_CREATE_PERMANENT_PRIVILEGE       16
 182 #define SE_BACKUP_PRIVILEGE                 17
 183 #define SE_RESTORE_PRIVILEGE                18
 184 #define SE_SHUTDOWN_PRIVILEGE               19
 185 #define SE_DEBUG_PRIVILEGE                  20
 186 #define SE_AUDIT_PRIVILEGE                  21
 187 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE     22
 188 #define SE_CHANGE_NOTIFY_PRIVILEGE          23
 189 #define SE_REMOTE_SHUTDOWN_PRIVILEGE        24
 190 #define SE_UNDOCK_PRIVILEGE                 25
 191 #define SE_SYNC_AGENT_PRIVILEGE             26
 192 #define SE_ENABLE_DELEGATION_PRIVILEGE      27
 193 #define SE_MANAGE_VOLUME_PRIVILEGE          28
 194 #define SE_IMPERSONATE_PRIVILEGE            29
 195 #define SE_CREATE_GLOBAL_PRIVILEGE          30
 196 #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE 31
 197 #define SE_RELABEL_PRIVILEGE                32
 198 #define SE_INC_WORKING_SET_PRIVILEGE        33
 199 #define SE_TIME_ZONE_PRIVILEGE              34
 200 #define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE   35
 201 #define SE_MAX_WELL_KNOWN_PRIVILEGE         SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
 202
 203 typedef struct _SECURITY_SUBJECT_CONTEXT {
 204   PACCESS_TOKEN ClientToken;
 205   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 206   PACCESS_TOKEN PrimaryToken;
 207   PVOID ProcessAuditId;
 208 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
 209
 210 typedef struct _ACCESS_STATE {
 211   LUID OperationID;
 212   BOOLEAN SecurityEvaluated;
 213   BOOLEAN GenerateAudit;
 214   BOOLEAN GenerateOnClose;
 215   BOOLEAN PrivilegesAllocated;
 216   ULONG Flags;
 217   ACCESS_MASK RemainingDesiredAccess;
 218   ACCESS_MASK PreviouslyGrantedAccess;
 219   ACCESS_MASK OriginalDesiredAccess;
 220   SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
 221   PSECURITY_DESCRIPTOR SecurityDescriptor;
 222   PVOID AuxData;
 223   union {
 224     INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
 225     PRIVILEGE_SET PrivilegeSet;
 226   } Privileges;
 227   BOOLEAN AuditPrivileges;
 228   UNICODE_STRING ObjectName;
 229   UNICODE_STRING ObjectTypeName;
 230 } ACCESS_STATE, *PACCESS_STATE;
 231
 232 typedef VOID
 233 (NTAPI *PNTFS_DEREF_EXPORTED_SECURITY_DESCRIPTOR)(
 234   _In_ PVOID Vcb,
 235   _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);
 236
 237 #ifndef _NTLSA_IFS_
 238
 239 #ifndef _NTLSA_AUDIT_
 240 #define _NTLSA_AUDIT_
 241
 242 #define SE_MAX_AUDIT_PARAMETERS 32
 243 #define SE_MAX_GENERIC_AUDIT_PARAMETERS 28
 244
 245 #define SE_ADT_OBJECT_ONLY 0x1
 246
 247 #define SE_ADT_PARAMETERS_SELF_RELATIVE    0x00000001
 248 #define SE_ADT_PARAMETERS_SEND_TO_LSA      0x00000002
 249 #define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT  0x00000004
 250 #define SE_ADT_PARAMETER_GENERIC_AUDIT     0x00000008
 251 #define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010
 252
 253 #define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(Parameters) \
 254   ( sizeof(SE_ADT_PARAMETER_ARRAY) - sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \
 255     (SE_MAX_AUDIT_PARAMETERS - Parameters->ParameterCount) )
 256
 257 typedef enum _SE_ADT_PARAMETER_TYPE {
 258   SeAdtParmTypeNone = 0,
 259   SeAdtParmTypeString,
 260   SeAdtParmTypeFileSpec,
 261   SeAdtParmTypeUlong,
 262   SeAdtParmTypeSid,
 263   SeAdtParmTypeLogonId,
 264   SeAdtParmTypeNoLogonId,
 265   SeAdtParmTypeAccessMask,
 266   SeAdtParmTypePrivs,
 267   SeAdtParmTypeObjectTypes,
 268   SeAdtParmTypeHexUlong,
 269   SeAdtParmTypePtr,
 270   SeAdtParmTypeTime,
 271   SeAdtParmTypeGuid,
 272   SeAdtParmTypeLuid,
 273   SeAdtParmTypeHexInt64,
 274   SeAdtParmTypeStringList,
 275   SeAdtParmTypeSidList,
 276   SeAdtParmTypeDuration,
 277   SeAdtParmTypeUserAccountControl,
 278   SeAdtParmTypeNoUac,
 279   SeAdtParmTypeMessage,
 280   SeAdtParmTypeDateTime,
 281   SeAdtParmTypeSockAddr,
 282   SeAdtParmTypeSD,
 283   SeAdtParmTypeLogonHours,
 284   SeAdtParmTypeLogonIdNoSid,
 285   SeAdtParmTypeUlongNoConv,
 286   SeAdtParmTypeSockAddrNoPort,
 287   SeAdtParmTypeAccessReason
 288 } SE_ADT_PARAMETER_TYPE, *PSE_ADT_PARAMETER_TYPE;
 289
 290 typedef struct _SE_ADT_OBJECT_TYPE {
 291   GUID ObjectType;
 292   USHORT Flags;
 293   USHORT Level;
 294   ACCESS_MASK AccessMask;
 295 } SE_ADT_OBJECT_TYPE, *PSE_ADT_OBJECT_TYPE;
 296
 297 typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY {
 298   SE_ADT_PARAMETER_TYPE Type;
 299   ULONG Length;
 300   ULONG_PTR Data[2];
 301   PVOID Address;
 302 } SE_ADT_PARAMETER_ARRAY_ENTRY, *PSE_ADT_PARAMETER_ARRAY_ENTRY;
 303
 304 typedef struct _SE_ADT_ACCESS_REASON {
 305   ACCESS_MASK AccessMask;
 306   ULONG AccessReasons[32];
 307   ULONG ObjectTypeIndex;
 308   ULONG AccessGranted;
 309   PSECURITY_DESCRIPTOR SecurityDescriptor;
 310 } SE_ADT_ACCESS_REASON, *PSE_ADT_ACCESS_REASON;
 311
 312 typedef struct _SE_ADT_PARAMETER_ARRAY {
 313   ULONG CategoryId;
 314   ULONG AuditId;
 315   ULONG ParameterCount;
 316   ULONG Length;
 317   USHORT FlatSubCategoryId;
 318   USHORT Type;
 319   ULONG Flags;
 320   SE_ADT_PARAMETER_ARRAY_ENTRY Parameters[ SE_MAX_AUDIT_PARAMETERS ];
 321 } SE_ADT_PARAMETER_ARRAY, *PSE_ADT_PARAMETER_ARRAY;
 322
 323 #endif /* !_NTLSA_AUDIT_ */
 324 #endif /* !_NTLSA_IFS_ */
 325 $endif (_WDMDDK_)
 326 $if (_NTDDK_)
 327 #define SE_UNSOLICITED_INPUT_PRIVILEGE    6
 328
 329 typedef enum _WELL_KNOWN_SID_TYPE {
 330   WinNullSid = 0,
 331   WinWorldSid = 1,
 332   WinLocalSid = 2,
 333   WinCreatorOwnerSid = 3,
 334   WinCreatorGroupSid = 4,
 335   WinCreatorOwnerServerSid = 5,
 336   WinCreatorGroupServerSid = 6,
 337   WinNtAuthoritySid = 7,
 338   WinDialupSid = 8,
 339   WinNetworkSid = 9,
 340   WinBatchSid = 10,
 341   WinInteractiveSid = 11,
 342   WinServiceSid = 12,
 343   WinAnonymousSid = 13,
 344   WinProxySid = 14,
 345   WinEnterpriseControllersSid = 15,
 346   WinSelfSid = 16,
 347   WinAuthenticatedUserSid = 17,
 348   WinRestrictedCodeSid = 18,
 349   WinTerminalServerSid = 19,
 350   WinRemoteLogonIdSid = 20,
 351   WinLogonIdsSid = 21,
 352   WinLocalSystemSid = 22,
 353   WinLocalServiceSid = 23,
 354   WinNetworkServiceSid = 24,
 355   WinBuiltinDomainSid = 25,
 356   WinBuiltinAdministratorsSid = 26,
 357   WinBuiltinUsersSid = 27,
 358   WinBuiltinGuestsSid = 28,
 359   WinBuiltinPowerUsersSid = 29,
 360   WinBuiltinAccountOperatorsSid = 30,
 361   WinBuiltinSystemOperatorsSid = 31,
 362   WinBuiltinPrintOperatorsSid = 32,
 363   WinBuiltinBackupOperatorsSid = 33,
 364   WinBuiltinReplicatorSid = 34,
 365   WinBuiltinPreWindows2000CompatibleAccessSid = 35,
 366   WinBuiltinRemoteDesktopUsersSid = 36,
 367   WinBuiltinNetworkConfigurationOperatorsSid = 37,
 368   WinAccountAdministratorSid = 38,
 369   WinAccountGuestSid = 39,
 370   WinAccountKrbtgtSid = 40,
 371   WinAccountDomainAdminsSid = 41,
 372   WinAccountDomainUsersSid = 42,
 373   WinAccountDomainGuestsSid = 43,
 374   WinAccountComputersSid = 44,
 375   WinAccountControllersSid = 45,
 376   WinAccountCertAdminsSid = 46,
 377   WinAccountSchemaAdminsSid = 47,
 378   WinAccountEnterpriseAdminsSid = 48,
 379   WinAccountPolicyAdminsSid = 49,
 380   WinAccountRasAndIasServersSid = 50,
 381   WinNTLMAuthenticationSid = 51,
 382   WinDigestAuthenticationSid = 52,
 383   WinSChannelAuthenticationSid = 53,
 384   WinThisOrganizationSid = 54,
 385   WinOtherOrganizationSid = 55,
 386   WinBuiltinIncomingForestTrustBuildersSid = 56,
 387   WinBuiltinPerfMonitoringUsersSid = 57,
 388   WinBuiltinPerfLoggingUsersSid = 58,
 389   WinBuiltinAuthorizationAccessSid = 59,
 390   WinBuiltinTerminalServerLicenseServersSid = 60,
 391   WinBuiltinDCOMUsersSid = 61,
 392   WinBuiltinIUsersSid = 62,
 393   WinIUserSid = 63,
 394   WinBuiltinCryptoOperatorsSid = 64,
 395   WinUntrustedLabelSid = 65,
 396   WinLowLabelSid = 66,
 397   WinMediumLabelSid = 67,
 398   WinHighLabelSid = 68,
 399   WinSystemLabelSid = 69,
 400   WinWriteRestrictedCodeSid = 70,
 401   WinCreatorOwnerRightsSid = 71,
 402   WinCacheablePrincipalsGroupSid = 72,
 403   WinNonCacheablePrincipalsGroupSid = 73,
 404   WinEnterpriseReadonlyControllersSid = 74,
 405   WinAccountReadonlyControllersSid = 75,
 406   WinBuiltinEventLogReadersGroup = 76,
 407   WinNewEnterpriseReadonlyControllersSid = 77,
 408   WinBuiltinCertSvcDComAccessGroup = 78,
 409   WinMediumPlusLabelSid = 79,
 410   WinLocalLogonSid = 80,
 411   WinConsoleLogonSid = 81,
 412   WinThisOrganizationCertificateSid = 82,
 413 } WELL_KNOWN_SID_TYPE;
 414 $endif (_NTDDK_)
 415 $if (_NTIFS_ || _WINNT_)
 416
 417 #ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
 418 #define SID_IDENTIFIER_AUTHORITY_DEFINED
 419 typedef struct _SID_IDENTIFIER_AUTHORITY {
 420   $UCHAR Value[6];
 421 } SID_IDENTIFIER_AUTHORITY,*PSID_IDENTIFIER_AUTHORITY,*LPSID_IDENTIFIER_AUTHORITY;
 422 #endif
 423
 424 #ifndef SID_DEFINED
 425 #define SID_DEFINED
 426 typedef struct _SID {
 427   $UCHAR Revision;
 428   $UCHAR SubAuthorityCount;
 429   SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 430 #ifdef MIDL_PASS
 431   [size_is(SubAuthorityCount)] $ULONG SubAuthority[*];
 432 #else
 433   $ULONG SubAuthority[ANYSIZE_ARRAY];
 434 #endif
 435 } SID, *PISID;
 436 #endif
 437
 438 $endif (_NTIFS_ || _WINNT_)
 439 $if (_NTIFS_)
 440
 441 #define SID_REVISION                    1
 442 #define SID_MAX_SUB_AUTHORITIES         15
 443 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
 444
 445 #ifndef MIDL_PASS
 446 #define SECURITY_MAX_SID_SIZE (sizeof(SID) - sizeof(ULONG) + (SID_MAX_SUB_AUTHORITIES * sizeof(ULONG)))
 447 #endif
 448
 449 typedef enum _SID_NAME_USE {
 450   SidTypeUser = 1,
 451   SidTypeGroup,
 452   SidTypeDomain,
 453   SidTypeAlias,
 454   SidTypeWellKnownGroup,
 455   SidTypeDeletedAccount,
 456   SidTypeInvalid,
 457   SidTypeUnknown,
 458   SidTypeComputer,
 459   SidTypeLabel
 460 } SID_NAME_USE, *PSID_NAME_USE;
 461
 462 typedef struct _SID_AND_ATTRIBUTES {
 463 #ifdef MIDL_PASS
 464   PISID Sid;
 465 #else
 466   PSID Sid;
 467 #endif
 468   ULONG Attributes;
 469 } SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES;
 470 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
 471 typedef SID_AND_ATTRIBUTES_ARRAY *PSID_AND_ATTRIBUTES_ARRAY;
 472
 473 #define SID_HASH_SIZE 32
 474 typedef ULONG_PTR SID_HASH_ENTRY, *PSID_HASH_ENTRY;
 475
 476 typedef struct _SID_AND_ATTRIBUTES_HASH {
 477   ULONG SidCount;
 478   PSID_AND_ATTRIBUTES SidAttr;
 479   SID_HASH_ENTRY Hash[SID_HASH_SIZE];
 480 } SID_AND_ATTRIBUTES_HASH, *PSID_AND_ATTRIBUTES_HASH;
 481
 482 /* Universal well-known SIDs */
 483
 484 #define SECURITY_NULL_SID_AUTHORITY         {0,0,0,0,0,0}
 485 #define SECURITY_WORLD_SID_AUTHORITY        {0,0,0,0,0,1}
 486 #define SECURITY_LOCAL_SID_AUTHORITY        {0,0,0,0,0,2}
 487 #define SECURITY_CREATOR_SID_AUTHORITY      {0,0,0,0,0,3}
 488 #define SECURITY_NON_UNIQUE_AUTHORITY       {0,0,0,0,0,4}
 489 #define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
 490
 491 #define SECURITY_NULL_RID                 (0x00000000L)
 492 #define SECURITY_WORLD_RID                (0x00000000L)
 493 #define SECURITY_LOCAL_RID                (0x00000000L)
 494 #define SECURITY_LOCAL_LOGON_RID          (0x00000001L)
 495
 496 #define SECURITY_CREATOR_OWNER_RID        (0x00000000L)
 497 #define SECURITY_CREATOR_GROUP_RID        (0x00000001L)
 498 #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
 499 #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
 500 #define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
 501
 502 /* NT well-known SIDs */
 503
 504 #define SECURITY_NT_AUTHORITY           {0,0,0,0,0,5}
 505
 506 #define SECURITY_DIALUP_RID             (0x00000001L)
 507 #define SECURITY_NETWORK_RID            (0x00000002L)
 508 #define SECURITY_BATCH_RID              (0x00000003L)
 509 #define SECURITY_INTERACTIVE_RID        (0x00000004L)
 510 #define SECURITY_LOGON_IDS_RID          (0x00000005L)
 511 #define SECURITY_LOGON_IDS_RID_COUNT    (3L)
 512 #define SECURITY_SERVICE_RID            (0x00000006L)
 513 #define SECURITY_ANONYMOUS_LOGON_RID    (0x00000007L)
 514 #define SECURITY_PROXY_RID              (0x00000008L)
 515 #define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
 516 #define SECURITY_SERVER_LOGON_RID       SECURITY_ENTERPRISE_CONTROLLERS_RID
 517 #define SECURITY_PRINCIPAL_SELF_RID     (0x0000000AL)
 518 #define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
 519 #define SECURITY_RESTRICTED_CODE_RID    (0x0000000CL)
 520 #define SECURITY_TERMINAL_SERVER_RID    (0x0000000DL)
 521 #define SECURITY_REMOTE_LOGON_RID       (0x0000000EL)
 522 #define SECURITY_THIS_ORGANIZATION_RID  (0x0000000FL)
 523 #define SECURITY_IUSER_RID              (0x00000011L)
 524 #define SECURITY_LOCAL_SYSTEM_RID       (0x00000012L)
 525 #define SECURITY_LOCAL_SERVICE_RID      (0x00000013L)
 526 #define SECURITY_NETWORK_SERVICE_RID    (0x00000014L)
 527 #define SECURITY_NT_NON_UNIQUE          (0x00000015L)
 528 #define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT  (3L)
 529 #define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
 530
 531 #define SECURITY_BUILTIN_DOMAIN_RID     (0x00000020L)
 532 #define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
 533
 534
 535 #define SECURITY_PACKAGE_BASE_RID       (0x00000040L)
 536 #define SECURITY_PACKAGE_RID_COUNT      (2L)
 537 #define SECURITY_PACKAGE_NTLM_RID       (0x0000000AL)
 538 #define SECURITY_PACKAGE_SCHANNEL_RID   (0x0000000EL)
 539 #define SECURITY_PACKAGE_DIGEST_RID     (0x00000015L)
 540
 541 #define SECURITY_CRED_TYPE_BASE_RID             (0x00000041L)
 542 #define SECURITY_CRED_TYPE_RID_COUNT            (2L)
 543 #define SECURITY_CRED_TYPE_THIS_ORG_CERT_RID    (0x00000001L)
 544
 545 #define SECURITY_MIN_BASE_RID           (0x00000050L)
 546 #define SECURITY_SERVICE_ID_BASE_RID    (0x00000050L)
 547 #define SECURITY_SERVICE_ID_RID_COUNT   (6L)
 548 #define SECURITY_RESERVED_ID_BASE_RID   (0x00000051L)
 549 #define SECURITY_APPPOOL_ID_BASE_RID    (0x00000052L)
 550 #define SECURITY_APPPOOL_ID_RID_COUNT   (6L)
 551 #define SECURITY_VIRTUALSERVER_ID_BASE_RID    (0x00000053L)
 552 #define SECURITY_VIRTUALSERVER_ID_RID_COUNT   (6L)
 553 #define SECURITY_USERMODEDRIVERHOST_ID_BASE_RID  (0x00000054L)
 554 #define SECURITY_USERMODEDRIVERHOST_ID_RID_COUNT (6L)
 555 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_BASE_RID  (0x00000055L)
 556 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_RID_COUNT (6L)
 557 #define SECURITY_WMIHOST_ID_BASE_RID  (0x00000056L)
 558 #define SECURITY_WMIHOST_ID_RID_COUNT (6L)
 559 #define SECURITY_TASK_ID_BASE_RID                 (0x00000057L)
 560 #define SECURITY_NFS_ID_BASE_RID        (0x00000058L)
 561 #define SECURITY_COM_ID_BASE_RID        (0x00000059L)
 562 #define SECURITY_VIRTUALACCOUNT_ID_RID_COUNT   (6L)
 563
 564 #define SECURITY_MAX_BASE_RID           (0x0000006FL)
 565
 566 #define SECURITY_MAX_ALWAYS_FILTERED    (0x000003E7L)
 567 #define SECURITY_MIN_NEVER_FILTERED     (0x000003E8L)
 568
 569 #define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
 570
 571 #define SECURITY_WINDOWSMOBILE_ID_BASE_RID (0x00000070L)
 572
 573 /* Well-known domain relative sub-authority values (RIDs) */
 574
 575 #define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
 576
 577 #define FOREST_USER_RID_MAX            (0x000001F3L)
 578
 579 /* Well-known users */
 580
 581 #define DOMAIN_USER_RID_ADMIN          (0x000001F4L)
 582 #define DOMAIN_USER_RID_GUEST          (0x000001F5L)
 583 #define DOMAIN_USER_RID_KRBTGT         (0x000001F6L)
 584
 585 #define DOMAIN_USER_RID_MAX            (0x000003E7L)
 586
 587 /* Well-known groups */
 588
 589 #define DOMAIN_GROUP_RID_ADMINS               (0x00000200L)
 590 #define DOMAIN_GROUP_RID_USERS                (0x00000201L)
 591 #define DOMAIN_GROUP_RID_GUESTS               (0x00000202L)
 592 #define DOMAIN_GROUP_RID_COMPUTERS            (0x00000203L)
 593 #define DOMAIN_GROUP_RID_CONTROLLERS          (0x00000204L)
 594 #define DOMAIN_GROUP_RID_CERT_ADMINS          (0x00000205L)
 595 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS        (0x00000206L)
 596 #define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS    (0x00000207L)
 597 #define DOMAIN_GROUP_RID_POLICY_ADMINS        (0x00000208L)
 598 #define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
 599
 600 /* Well-known aliases */
 601
 602 #define DOMAIN_ALIAS_RID_ADMINS                         (0x00000220L)
 603 #define DOMAIN_ALIAS_RID_USERS                          (0x00000221L)
 604 #define DOMAIN_ALIAS_RID_GUESTS                         (0x00000222L)
 605 #define DOMAIN_ALIAS_RID_POWER_USERS                    (0x00000223L)
 606
 607 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS                    (0x00000224L)
 608 #define DOMAIN_ALIAS_RID_SYSTEM_OPS                     (0x00000225L)
 609 #define DOMAIN_ALIAS_RID_PRINT_OPS                      (0x00000226L)
 610 #define DOMAIN_ALIAS_RID_BACKUP_OPS                     (0x00000227L)
 611
 612 #define DOMAIN_ALIAS_RID_REPLICATOR                     (0x00000228L)
 613 #define DOMAIN_ALIAS_RID_RAS_SERVERS                    (0x00000229L)
 614 #define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS               (0x0000022AL)
 615 #define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS           (0x0000022BL)
 616 #define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS      (0x0000022CL)
 617 #define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
 618
 619 #define DOMAIN_ALIAS_RID_MONITORING_USERS               (0x0000022EL)
 620 #define DOMAIN_ALIAS_RID_LOGGING_USERS                  (0x0000022FL)
 621 #define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS            (0x00000230L)
 622 #define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS             (0x00000231L)
 623 #define DOMAIN_ALIAS_RID_DCOM_USERS                     (0x00000232L)
 624 #define DOMAIN_ALIAS_RID_IUSERS                         (0x00000238L)
 625 #define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS               (0x00000239L)
 626 #define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP     (0x0000023BL)
 627 #define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
 628 #define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP        (0x0000023DL)
 629 #define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP      (0x0000023EL)
 630
 631 #define SECURITY_MANDATORY_LABEL_AUTHORITY          {0,0,0,0,0,16}
 632 #define SECURITY_MANDATORY_UNTRUSTED_RID            (0x00000000L)
 633 #define SECURITY_MANDATORY_LOW_RID                  (0x00001000L)
 634 #define SECURITY_MANDATORY_MEDIUM_RID               (0x00002000L)
 635 #define SECURITY_MANDATORY_HIGH_RID                 (0x00003000L)
 636 #define SECURITY_MANDATORY_SYSTEM_RID               (0x00004000L)
 637 #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID    (0x00005000L)
 638
 639 /* SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
 640    can be set by a usermode caller.*/
 641
 642 #define SECURITY_MANDATORY_MAXIMUM_USER_RID   SECURITY_MANDATORY_SYSTEM_RID
 643
 644 #define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
 645
 646 /* Allocate the System Luid.  The first 1000 LUIDs are reserved.
 647    Use #999 here (0x3e7 = 999) */
 648
 649 #define SYSTEM_LUID                     {0x3e7, 0x0}
 650 #define ANONYMOUS_LOGON_LUID            {0x3e6, 0x0}
 651 #define LOCALSERVICE_LUID               {0x3e5, 0x0}
 652 #define NETWORKSERVICE_LUID             {0x3e4, 0x0}
 653 #define IUSER_LUID                      {0x3e3, 0x0}
 654
 655 typedef struct _ACE_HEADER {
 656   UCHAR AceType;
 657   UCHAR AceFlags;
 658   USHORT AceSize;
 659 } ACE_HEADER, *PACE_HEADER;
 660
 661 /* also in winnt.h */
 662 #define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
 663 #define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
 664 #define ACCESS_DENIED_ACE_TYPE                  (0x1)
 665 #define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
 666 #define SYSTEM_ALARM_ACE_TYPE                   (0x3)
 667 #define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
 668 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
 669 #define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
 670 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
 671 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
 672 #define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
 673 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
 674 #define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
 675 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
 676 #define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
 677 #define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
 678 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
 679 #define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
 680 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
 681 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
 682 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
 683 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
 684 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
 685 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
 686 #define ACCESS_MAX_MS_V5_ACE_TYPE               (0x11)
 687 #define SYSTEM_MANDATORY_LABEL_ACE_TYPE         (0x11)
 688
 689 /* The following are the inherit flags that go into the AceFlags field
 690    of an Ace header. */
 691
 692 #define OBJECT_INHERIT_ACE                (0x1)
 693 #define CONTAINER_INHERIT_ACE             (0x2)
 694 #define NO_PROPAGATE_INHERIT_ACE          (0x4)
 695 #define INHERIT_ONLY_ACE                  (0x8)
 696 #define INHERITED_ACE                     (0x10)
 697 #define VALID_INHERIT_FLAGS               (0x1F)
 698
 699 #define SUCCESSFUL_ACCESS_ACE_FLAG        (0x40)
 700 #define FAILED_ACCESS_ACE_FLAG            (0x80)
 701
 702 typedef struct _ACCESS_ALLOWED_ACE {
 703   ACE_HEADER Header;
 704   ACCESS_MASK Mask;
 705   ULONG SidStart;
 706 } ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
 707
 708 typedef struct _ACCESS_DENIED_ACE {
 709   ACE_HEADER Header;
 710   ACCESS_MASK Mask;
 711   ULONG SidStart;
 712 } ACCESS_DENIED_ACE, *PACCESS_DENIED_ACE;
 713
 714 typedef struct _SYSTEM_AUDIT_ACE {
 715   ACE_HEADER Header;
 716   ACCESS_MASK Mask;
 717   ULONG SidStart;
 718 } SYSTEM_AUDIT_ACE, *PSYSTEM_AUDIT_ACE;
 719
 720 typedef struct _SYSTEM_ALARM_ACE {
 721   ACE_HEADER Header;
 722   ACCESS_MASK Mask;
 723   ULONG SidStart;
 724 } SYSTEM_ALARM_ACE, *PSYSTEM_ALARM_ACE;
 725
 726 typedef struct _SYSTEM_MANDATORY_LABEL_ACE {
 727   ACE_HEADER Header;
 728   ACCESS_MASK Mask;
 729   ULONG SidStart;
 730 } SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
 731
 732 #define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP         0x1
 733 #define SYSTEM_MANDATORY_LABEL_NO_READ_UP          0x2
 734 #define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP       0x4
 735 #define SYSTEM_MANDATORY_LABEL_VALID_MASK (SYSTEM_MANDATORY_LABEL_NO_WRITE_UP   | \
 736                                            SYSTEM_MANDATORY_LABEL_NO_READ_UP    | \
 737                                            SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
 738
 739 #define SECURITY_DESCRIPTOR_MIN_LENGTH   (sizeof(SECURITY_DESCRIPTOR))
 740
 741 typedef USHORT SECURITY_DESCRIPTOR_CONTROL,*PSECURITY_DESCRIPTOR_CONTROL;
 742
 743 #define SE_OWNER_DEFAULTED              0x0001
 744 #define SE_GROUP_DEFAULTED              0x0002
 745 #define SE_DACL_PRESENT                 0x0004
 746 #define SE_DACL_DEFAULTED               0x0008
 747 #define SE_SACL_PRESENT                 0x0010
 748 #define SE_SACL_DEFAULTED               0x0020
 749 #define SE_DACL_UNTRUSTED               0x0040
 750 #define SE_SERVER_SECURITY              0x0080
 751 #define SE_DACL_AUTO_INHERIT_REQ        0x0100
 752 #define SE_SACL_AUTO_INHERIT_REQ        0x0200
 753 #define SE_DACL_AUTO_INHERITED          0x0400
 754 #define SE_SACL_AUTO_INHERITED          0x0800
 755 #define SE_DACL_PROTECTED               0x1000
 756 #define SE_SACL_PROTECTED               0x2000
 757 #define SE_RM_CONTROL_VALID             0x4000
 758 #define SE_SELF_RELATIVE                0x8000
 759
 760 typedef struct _SECURITY_DESCRIPTOR_RELATIVE {
 761   UCHAR Revision;
 762   UCHAR Sbz1;
 763   SECURITY_DESCRIPTOR_CONTROL Control;
 764   ULONG Owner;
 765   ULONG Group;
 766   ULONG Sacl;
 767   ULONG Dacl;
 768 } SECURITY_DESCRIPTOR_RELATIVE, *PISECURITY_DESCRIPTOR_RELATIVE;
 769
 770 typedef struct _SECURITY_DESCRIPTOR {
 771   UCHAR Revision;
 772   UCHAR Sbz1;
 773   SECURITY_DESCRIPTOR_CONTROL Control;
 774   PSID Owner;
 775   PSID Group;
 776   PACL Sacl;
 777   PACL Dacl;
 778 } SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
 779
 780 typedef struct _OBJECT_TYPE_LIST {
 781   USHORT Level;
 782   USHORT Sbz;
 783   GUID *ObjectType;
 784 } OBJECT_TYPE_LIST, *POBJECT_TYPE_LIST;
 785
 786 #define ACCESS_OBJECT_GUID       0
 787 #define ACCESS_PROPERTY_SET_GUID 1
 788 #define ACCESS_PROPERTY_GUID     2
 789 #define ACCESS_MAX_LEVEL         4
 790
 791 typedef enum _AUDIT_EVENT_TYPE {
 792   AuditEventObjectAccess,
 793   AuditEventDirectoryServiceAccess
 794 } AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;
 795
 796 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
 797
 798 #define ACCESS_DS_SOURCE_A "DS"
 799 #define ACCESS_DS_SOURCE_W L"DS"
 800 #define ACCESS_DS_OBJECT_TYPE_NAME_A "Directory Service Object"
 801 #define ACCESS_DS_OBJECT_TYPE_NAME_W L"Directory Service Object"
 802
 803 #define ACCESS_REASON_TYPE_MASK 0xffff0000
 804 #define ACCESS_REASON_DATA_MASK 0x0000ffff
 805
 806 typedef enum _ACCESS_REASON_TYPE {
 807   AccessReasonNone = 0x00000000,
 808   AccessReasonAllowedAce = 0x00010000,
 809   AccessReasonDeniedAce = 0x00020000,
 810   AccessReasonAllowedParentAce = 0x00030000,
 811   AccessReasonDeniedParentAce = 0x00040000,
 812   AccessReasonMissingPrivilege = 0x00100000,
 813   AccessReasonFromPrivilege = 0x00200000,
 814   AccessReasonIntegrityLevel = 0x00300000,
 815   AccessReasonOwnership = 0x00400000,
 816   AccessReasonNullDacl = 0x00500000,
 817   AccessReasonEmptyDacl = 0x00600000,
 818   AccessReasonNoSD = 0x00700000,
 819   AccessReasonNoGrant = 0x00800000
 820 } ACCESS_REASON_TYPE;
 821
 822 typedef ULONG ACCESS_REASON;
 823
 824 typedef struct _ACCESS_REASONS {
 825   ACCESS_REASON Data[32];
 826 } ACCESS_REASONS, *PACCESS_REASONS;
 827
 828 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_OWNER_ACE    0x00000001
 829 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_LABEL_ACE    0x00000002
 830 #define SE_SECURITY_DESCRIPTOR_VALID_FLAGS          0x00000003
 831
 832 typedef struct _SE_SECURITY_DESCRIPTOR {
 833   ULONG Size;
 834   ULONG Flags;
 835   PSECURITY_DESCRIPTOR SecurityDescriptor;
 836 } SE_SECURITY_DESCRIPTOR, *PSE_SECURITY_DESCRIPTOR;
 837
 838 typedef struct _SE_ACCESS_REQUEST {
 839   ULONG Size;
 840   PSE_SECURITY_DESCRIPTOR SeSecurityDescriptor;
 841   ACCESS_MASK DesiredAccess;
 842   ACCESS_MASK PreviouslyGrantedAccess;
 843   PSID PrincipalSelfSid;
 844   PGENERIC_MAPPING GenericMapping;
 845   ULONG ObjectTypeListCount;
 846   POBJECT_TYPE_LIST ObjectTypeList;
 847 } SE_ACCESS_REQUEST, *PSE_ACCESS_REQUEST;
 848
 849 typedef struct _SE_ACCESS_REPLY {
 850   ULONG Size;
 851   ULONG ResultListCount;
 852   PACCESS_MASK GrantedAccess;
 853   PNTSTATUS AccessStatus;
 854   PACCESS_REASONS AccessReason;
 855   PPRIVILEGE_SET* Privileges;
 856 } SE_ACCESS_REPLY, *PSE_ACCESS_REPLY;
 857
 858 typedef enum _SE_AUDIT_OPERATION {
 859   AuditPrivilegeObject,
 860   AuditPrivilegeService,
 861   AuditAccessCheck,
 862   AuditOpenObject,
 863   AuditOpenObjectWithTransaction,
 864   AuditCloseObject,
 865   AuditDeleteObject,
 866   AuditOpenObjectForDelete,
 867   AuditOpenObjectForDeleteWithTransaction,
 868   AuditCloseNonObject,
 869   AuditOpenNonObject,
 870   AuditObjectReference,
 871   AuditHandleCreation,
 872 } SE_AUDIT_OPERATION, *PSE_AUDIT_OPERATION;
 873
 874 typedef struct _SE_AUDIT_INFO {
 875   ULONG Size;
 876   AUDIT_EVENT_TYPE AuditType;
 877   SE_AUDIT_OPERATION AuditOperation;
 878   ULONG AuditFlags;
 879   UNICODE_STRING SubsystemName;
 880   UNICODE_STRING ObjectTypeName;
 881   UNICODE_STRING ObjectName;
 882   PVOID HandleId;
 883   GUID* TransactionId;
 884   LUID* OperationId;
 885   BOOLEAN ObjectCreation;
 886   BOOLEAN GenerateOnClose;
 887 } SE_AUDIT_INFO, *PSE_AUDIT_INFO;
 888
 889 #define TOKEN_ASSIGN_PRIMARY            (0x0001)
 890 #define TOKEN_DUPLICATE                 (0x0002)
 891 #define TOKEN_IMPERSONATE               (0x0004)
 892 #define TOKEN_QUERY                     (0x0008)
 893 #define TOKEN_QUERY_SOURCE              (0x0010)
 894 #define TOKEN_ADJUST_PRIVILEGES         (0x0020)
 895 #define TOKEN_ADJUST_GROUPS             (0x0040)
 896 #define TOKEN_ADJUST_DEFAULT            (0x0080)
 897 #define TOKEN_ADJUST_SESSIONID          (0x0100)
 898
 899 #define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED  |\
 900                             TOKEN_ASSIGN_PRIMARY      |\
 901                             TOKEN_DUPLICATE           |\
 902                             TOKEN_IMPERSONATE         |\
 903                             TOKEN_QUERY               |\
 904                             TOKEN_QUERY_SOURCE        |\
 905                             TOKEN_ADJUST_PRIVILEGES   |\
 906                             TOKEN_ADJUST_GROUPS       |\
 907                             TOKEN_ADJUST_DEFAULT )
 908
 909 #if ((defined(_WIN32_WINNT) && (_WIN32_WINNT > 0x0400)) || (!defined(_WIN32_WINNT)))
 910 #define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P |\
 911                            TOKEN_ADJUST_SESSIONID )
 912 #else
 913 #define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P)
 914 #endif
 915
 916 #define TOKEN_READ       (STANDARD_RIGHTS_READ     |\
 917                           TOKEN_QUERY)
 918
 919 #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE    |\
 920                           TOKEN_ADJUST_PRIVILEGES  |\
 921                           TOKEN_ADJUST_GROUPS      |\
 922                           TOKEN_ADJUST_DEFAULT)
 923
 924 #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
 925
 926 typedef enum _TOKEN_TYPE {
 927   TokenPrimary = 1,
 928   TokenImpersonation
 929 } TOKEN_TYPE,*PTOKEN_TYPE;
 930
 931 typedef enum _TOKEN_INFORMATION_CLASS {
 932   TokenUser = 1,
 933   TokenGroups,
 934   TokenPrivileges,
 935   TokenOwner,
 936   TokenPrimaryGroup,
 937   TokenDefaultDacl,
 938   TokenSource,
 939   TokenType,
 940   TokenImpersonationLevel,
 941   TokenStatistics,
 942   TokenRestrictedSids,
 943   TokenSessionId,
 944   TokenGroupsAndPrivileges,
 945   TokenSessionReference,
 946   TokenSandBoxInert,
 947   TokenAuditPolicy,
 948   TokenOrigin,
 949   TokenElevationType,
 950   TokenLinkedToken,
 951   TokenElevation,
 952   TokenHasRestrictions,
 953   TokenAccessInformation,
 954   TokenVirtualizationAllowed,
 955   TokenVirtualizationEnabled,
 956   TokenIntegrityLevel,
 957   TokenUIAccess,
 958   TokenMandatoryPolicy,
 959   TokenLogonSid,
 960   MaxTokenInfoClass
 961 } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
 962
 963 typedef struct _TOKEN_USER {
 964   SID_AND_ATTRIBUTES User;
 965 } TOKEN_USER, *PTOKEN_USER;
 966
 967 typedef struct _TOKEN_GROUPS {
 968   ULONG GroupCount;
 969 #ifdef MIDL_PASS
 970   [size_is(GroupCount)] SID_AND_ATTRIBUTES Groups[*];
 971 #else
 972   SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
 973 #endif
 974 } TOKEN_GROUPS,*PTOKEN_GROUPS,*LPTOKEN_GROUPS;
 975
 976 typedef struct _TOKEN_PRIVILEGES {
 977   ULONG PrivilegeCount;
 978   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
 979 } TOKEN_PRIVILEGES,*PTOKEN_PRIVILEGES,*LPTOKEN_PRIVILEGES;
 980
 981 typedef struct _TOKEN_OWNER {
 982   PSID Owner;
 983 } TOKEN_OWNER,*PTOKEN_OWNER;
 984
 985 typedef struct _TOKEN_PRIMARY_GROUP {
 986   PSID PrimaryGroup;
 987 } TOKEN_PRIMARY_GROUP,*PTOKEN_PRIMARY_GROUP;
 988
 989 typedef struct _TOKEN_DEFAULT_DACL {
 990   PACL DefaultDacl;
 991 } TOKEN_DEFAULT_DACL,*PTOKEN_DEFAULT_DACL;
 992
 993 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES {
 994   ULONG SidCount;
 995   ULONG SidLength;
 996   PSID_AND_ATTRIBUTES Sids;
 997   ULONG RestrictedSidCount;
 998   ULONG RestrictedSidLength;
 999   PSID_AND_ATTRIBUTES RestrictedSids;
1000   ULONG PrivilegeCount;
1001   ULONG PrivilegeLength;
1002   PLUID_AND_ATTRIBUTES Privileges;
1003   LUID AuthenticationId;
1004 } TOKEN_GROUPS_AND_PRIVILEGES, *PTOKEN_GROUPS_AND_PRIVILEGES;
1005
1006 typedef struct _TOKEN_LINKED_TOKEN {
1007   HANDLE LinkedToken;
1008 } TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN;
1009
1010 typedef struct _TOKEN_ELEVATION {
1011   ULONG TokenIsElevated;
1012 } TOKEN_ELEVATION, *PTOKEN_ELEVATION;
1013
1014 typedef struct _TOKEN_MANDATORY_LABEL {
1015   SID_AND_ATTRIBUTES Label;
1016 } TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;
1017
1018 #define TOKEN_MANDATORY_POLICY_OFF             0x0
1019 #define TOKEN_MANDATORY_POLICY_NO_WRITE_UP     0x1
1020 #define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
1021
1022 #define TOKEN_MANDATORY_POLICY_VALID_MASK    (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
1023                                               TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
1024
1025 typedef struct _TOKEN_MANDATORY_POLICY {
1026   ULONG Policy;
1027 } TOKEN_MANDATORY_POLICY, *PTOKEN_MANDATORY_POLICY;
1028
1029 typedef struct _TOKEN_ACCESS_INFORMATION {
1030   PSID_AND_ATTRIBUTES_HASH SidHash;
1031   PSID_AND_ATTRIBUTES_HASH RestrictedSidHash;
1032   PTOKEN_PRIVILEGES Privileges;
1033   LUID AuthenticationId;
1034   TOKEN_TYPE TokenType;
1035   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1036   TOKEN_MANDATORY_POLICY MandatoryPolicy;
1037   ULONG Flags;
1038 } TOKEN_ACCESS_INFORMATION, *PTOKEN_ACCESS_INFORMATION;
1039
1040 #define POLICY_AUDIT_SUBCATEGORY_COUNT (53)
1041
1042 typedef struct _TOKEN_AUDIT_POLICY {
1043   UCHAR PerUserPolicy[((POLICY_AUDIT_SUBCATEGORY_COUNT) >> 1) + 1];
1044 } TOKEN_AUDIT_POLICY, *PTOKEN_AUDIT_POLICY;
1045
1046 #define TOKEN_SOURCE_LENGTH 8
1047
1048 typedef struct _TOKEN_SOURCE {
1049   CHAR SourceName[TOKEN_SOURCE_LENGTH];
1050   LUID SourceIdentifier;
1051 } TOKEN_SOURCE,*PTOKEN_SOURCE;
1052
1053 typedef struct _TOKEN_STATISTICS {
1054   LUID TokenId;
1055   LUID AuthenticationId;
1056   LARGE_INTEGER ExpirationTime;
1057   TOKEN_TYPE TokenType;
1058   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1059   ULONG DynamicCharged;
1060   ULONG DynamicAvailable;
1061   ULONG GroupCount;
1062   ULONG PrivilegeCount;
1063   LUID ModifiedId;
1064 } TOKEN_STATISTICS, *PTOKEN_STATISTICS;
1065
1066 typedef struct _TOKEN_CONTROL {
1067   LUID TokenId;
1068   LUID AuthenticationId;
1069   LUID ModifiedId;
1070   TOKEN_SOURCE TokenSource;
1071 } TOKEN_CONTROL,*PTOKEN_CONTROL;
1072
1073 typedef struct _TOKEN_ORIGIN {
1074   LUID OriginatingLogonSession;
1075 } TOKEN_ORIGIN, *PTOKEN_ORIGIN;
1076
1077 typedef enum _MANDATORY_LEVEL {
1078   MandatoryLevelUntrusted = 0,
1079   MandatoryLevelLow,
1080   MandatoryLevelMedium,
1081   MandatoryLevelHigh,
1082   MandatoryLevelSystem,
1083   MandatoryLevelSecureProcess,
1084   MandatoryLevelCount
1085 } MANDATORY_LEVEL, *PMANDATORY_LEVEL;
1086
1087 #define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x0001
1088 #define TOKEN_HAS_BACKUP_PRIVILEGE      0x0002
1089 #define TOKEN_HAS_RESTORE_PRIVILEGE     0x0004
1090 #define TOKEN_WRITE_RESTRICTED          0x0008
1091 #define TOKEN_IS_RESTRICTED             0x0010
1092 #define TOKEN_SESSION_NOT_REFERENCED    0x0020
1093 #define TOKEN_SANDBOX_INERT             0x0040
1094 #define TOKEN_HAS_IMPERSONATE_PRIVILEGE 0x0080
1095 #define SE_BACKUP_PRIVILEGES_CHECKED    0x0100
1096 #define TOKEN_VIRTUALIZE_ALLOWED        0x0200
1097 #define TOKEN_VIRTUALIZE_ENABLED        0x0400
1098 #define TOKEN_IS_FILTERED               0x0800
1099 #define TOKEN_UIACCESS                  0x1000
1100 #define TOKEN_NOT_LOW                   0x2000
1101
1102 typedef struct _SE_EXPORTS {
1103   LUID SeCreateTokenPrivilege;
1104   LUID SeAssignPrimaryTokenPrivilege;
1105   LUID SeLockMemoryPrivilege;
1106   LUID SeIncreaseQuotaPrivilege;
1107   LUID SeUnsolicitedInputPrivilege;
1108   LUID SeTcbPrivilege;
1109   LUID SeSecurityPrivilege;
1110   LUID SeTakeOwnershipPrivilege;
1111   LUID SeLoadDriverPrivilege;
1112   LUID SeCreatePagefilePrivilege;
1113   LUID SeIncreaseBasePriorityPrivilege;
1114   LUID SeSystemProfilePrivilege;
1115   LUID SeSystemtimePrivilege;
1116   LUID SeProfileSingleProcessPrivilege;
1117   LUID SeCreatePermanentPrivilege;
1118   LUID SeBackupPrivilege;
1119   LUID SeRestorePrivilege;
1120   LUID SeShutdownPrivilege;
1121   LUID SeDebugPrivilege;
1122   LUID SeAuditPrivilege;
1123   LUID SeSystemEnvironmentPrivilege;
1124   LUID SeChangeNotifyPrivilege;
1125   LUID SeRemoteShutdownPrivilege;
1126   PSID SeNullSid;
1127   PSID SeWorldSid;
1128   PSID SeLocalSid;
1129   PSID SeCreatorOwnerSid;
1130   PSID SeCreatorGroupSid;
1131   PSID SeNtAuthoritySid;
1132   PSID SeDialupSid;
1133   PSID SeNetworkSid;
1134   PSID SeBatchSid;
1135   PSID SeInteractiveSid;
1136   PSID SeLocalSystemSid;
1137   PSID SeAliasAdminsSid;
1138   PSID SeAliasUsersSid;
1139   PSID SeAliasGuestsSid;
1140   PSID SeAliasPowerUsersSid;
1141   PSID SeAliasAccountOpsSid;
1142   PSID SeAliasSystemOpsSid;
1143   PSID SeAliasPrintOpsSid;
1144   PSID SeAliasBackupOpsSid;
1145   PSID SeAuthenticatedUsersSid;
1146   PSID SeRestrictedSid;
1147   PSID SeAnonymousLogonSid;
1148   LUID SeUndockPrivilege;
1149   LUID SeSyncAgentPrivilege;
1150   LUID SeEnableDelegationPrivilege;
1151   PSID SeLocalServiceSid;
1152   PSID SeNetworkServiceSid;
1153   LUID SeManageVolumePrivilege;
1154   LUID SeImpersonatePrivilege;
1155   LUID SeCreateGlobalPrivilege;
1156   LUID SeTrustedCredManAccessPrivilege;
1157   LUID SeRelabelPrivilege;
1158   LUID SeIncreaseWorkingSetPrivilege;
1159   LUID SeTimeZonePrivilege;
1160   LUID SeCreateSymbolicLinkPrivilege;
1161   PSID SeIUserSid;
1162   PSID SeUntrustedMandatorySid;
1163   PSID SeLowMandatorySid;
1164   PSID SeMediumMandatorySid;
1165   PSID SeHighMandatorySid;
1166   PSID SeSystemMandatorySid;
1167   PSID SeOwnerRightsSid;
1168 } SE_EXPORTS, *PSE_EXPORTS;
1169
1170 typedef NTSTATUS
1171 (NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
1172   IN PLUID LogonId);
1173
1174 typedef struct _SECURITY_CLIENT_CONTEXT {
1175   SECURITY_QUALITY_OF_SERVICE SecurityQos;
1176   PACCESS_TOKEN ClientToken;
1177   BOOLEAN DirectlyAccessClientToken;
1178   BOOLEAN DirectAccessEffectiveOnly;
1179   BOOLEAN ServerIsRemote;
1180   TOKEN_CONTROL ClientTokenControl;
1181 } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
1182
1183 $endif (_NTIFS_)