1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
use enumflags2::bitflags;
use serde::Serialize;
use strum::EnumString;
#[bitflags]
#[derive(Eq, PartialEq, Debug, Copy, Clone, Serialize, EnumString)]
#[repr(u32)]
#[allow(non_camel_case_types)]
pub enum AccessMaskFlag {
/// **When used in an Access Request operation:** When read access to an
/// object is requested, this bit is translated to a combination of
/// bits. These are most often set in the lower 16 bits of the
/// ACCESS_MASK. (Individual protocol specifications MAY specify a
/// different configuration.) The bits that are set are implementation
/// dependent. During this translation, the GR bit is cleared. The
/// resulting ACCESS_MASK bits are the actual permissions that are
/// checked against the ACE structures in the security descriptor that
/// attached to the object.
///
/// **When used to set the Security Descriptor on an object:** When the
/// GR bit is set in an ACE that is to be attached to an object, it is
/// translated into a combination of bits, which are usually set in the
/// lower 16 bits of the ACCESS_MASK. (Individual protocol
/// specifications MAY specify a different configuration.) The bits
/// that are set are implementation dependent. During this translation,
/// the GR bit is cleared. The resulting ACCESS_MASK bits are the actual
/// permissions that are granted by this ACE.
#[strum(serialize = "GR")]
GENERIC_READ = 0x80000000,
/// **When used in an Access Request operation:** When write access to
/// an object is requested, this bit is translated to a combination of
/// bits, which are usually set in the lower 16 bits of the ACCESS_MASK.
/// (Individual protocol specifications MAY specify a different
/// configuration.) The bits that are set are implementation dependent.
/// During this translation, the GW bit is cleared. The resulting
/// ACCESS_MASK bits are the actual permissions that are checked against
/// the ACE structures in the security descriptor that attached to the
/// object.
///
/// **When used to set the Security Descriptor on an object:** When the
/// GW bit is set in an ACE that is to be attached to an object, it is
/// translated into a combination of bits, which are usually set in the
/// lower 16 bits of the ACCESS_MASK. (Individual protocol
/// specifications MAY specify a different configuration.) The bits that
/// are set are implementation dependent. During this translation, the
/// GW bit is cleared. The resulting ACCESS_MASK bits are the actual
/// permissions that are granted by this ACE.
#[strum(serialize = "GW")]
GENERIC_WRITE = 0x40000000,
/// **When used in an Access Request operation:** When execute access to
/// an object is requested, this bit is translated to a combination of
/// bits, which are usually set in the lower 16 bits of the ACCESS_MASK.
/// (Individual protocol specifications MAY specify a different
/// configuration.) The bits that are set are implementation dependent.
/// During this translation, the GX bit is cleared. The resulting
/// ACCESS_MASK bits are the actual permissions that are checked against
/// the ACE structures in the security descriptor that attached to the
/// object.
///
/// **When used to set the Security Descriptor on an object:** When the
/// GX bit is set in an ACE that is to be attached to an object, it is
/// translated into a combination of bits, which are usually set in the
/// lower 16 bits of the ACCESS_MASK. (Individual protocol
/// specifications MAY specify a different configuration.) The bits that
/// are set are implementation AdsAccessMaskdependent. During this
/// translation, the GX bit is cleared. The resulting ACCESS_MASK bits
/// are the actual permissions that are granted by this ACE.
#[strum(serialize = "GX")]
GENERIC_EXECUTE = 0x20000000,
/// **When used in an Access Request operation:** When all access
/// permissions to an object are requested, this bit is translated to a
/// combination of bits, which are usually set in the lower 16 bits of
/// the ACCESS_MASK. (Individual protocol specifications MAY specify a
/// different configuration.) Objects are free to include bits from the
/// upper 16 bits in that translation as required by the objects
/// semantics. The bits that are set are implementation dependent.
/// During this translation, the GA bit is cleared. The resulting
/// ACCESS_MASK bits are the actual permissions that are checked against
/// the ACE structures in the security descriptor that attached to the
/// object.
///
/// **When used to set the Security Descriptor on an object:** When the
/// GA bit is set in an ACE that is to be attached to an object, it is
/// translated into a combination of bits, which are usually set in the
/// lower 16 bits of the ACCESS_MASK. (Individual protocol
/// specifications MAY specify a different configuration.) Objects are
/// free to include bits from the upper 16 bits in that translation, if
/// required by the objects semantics. The bits that are set are
/// implementation dependent. During this translation, the GA bit is
/// cleared. The resulting ACCESS_MASK bits are the actual permissions
/// that are granted by this ACE.
#[strum(serialize = "GA")]
GENERIC_ALL = 0x10000000,
/// **When used in an Access Request operation:** When requested, this
/// bit grants the requestor the maximum permissions allowed to the
/// object through the Access Check Algorithm. This bit can only be
/// requested; it cannot be set in an ACE.
///
/// **When used to set the Security Descriptor on an object:**
/// Specifying the Maximum Allowed bit in the SECURITY_DESCRIPTOR has no
/// meaning. The MA bit SHOULD NOT be set and SHOULD be ignored when
/// part of a SECURITY_DESCRIPTOR structure.
#[strum(serialize = "MA")]
MAXIMUM_ALLOWED = 0x02000000,
/// **When used in an Access Request operation:** When requested, this
/// bit grants the requestor the right to change the SACL of an object.
/// This bit MUST NOT be set in an ACE that is part of a DACL. When set
/// in an ACE that is part of a SACL, this bit controls auditing of
/// accesses to the SACL itself.
#[strum(serialize = "AS")]
ACCESS_SYSTEM_SECURITY = 0x01000000,
/// Specifies access to the object sufficient to synchronize or wait on
/// the object.
#[strum(serialize = "SY")]
#[allow(clippy::upper_case_acronyms)]
SYNCHRONIZE = 0x00100000,
/// Specifies access to change the owner of the object as listed in the
/// security descriptor.
#[strum(serialize = "WO")]
WRITE_OWNER = 0x00080000,
/// Specifies access to change the discretionary access control list of
/// the security descriptor of an object.
#[strum(serialize = "WD")]
WRITE_DACL = 0x00040000,
/// Specifies access to read the security descriptor of an object.
#[strum(serialize = "RC")]
READ_CONTROL = 0x00020000,
/// Specifies access to delete an object.
#[strum(serialize = "SD")]
STANDARD_DELETE = 0x00010000,
#[strum(serialize = "CR")]
CONTROL_ACCESS = 0x00000100,
#[strum(serialize = "LO")]
LIST_OBJECT = 0x00000080,
#[strum(serialize = "DT")]
DELETE_TREE = 0x00000040,
#[strum(serialize = "WP")]
WRITE_PROPERTY = 0x00000020,
#[strum(serialize = "RP")]
READ_PROPERTY = 0x00000010,
#[strum(serialize = "SW")]
SELF_WRITE = 0x00000008,
#[strum(serialize = "LC")]
LIST_CHILDREN = 0x00000004,
#[strum(serialize = "DC")]
DELETE_CHILD = 0x00000002,
#[strum(serialize = "CC")]
CREATE_CHILD = 0x00000001,
}