Reapply POSIX ACL changes.

  - New, unified implementation of POSIX permission and ACL handling.  The
    new ACLs now store the POSIX ACL MASK/CLASS_OBJ permission mask, and
    they allow to inherit the S_ISGID bit.  ACL inheritance now really
    works as desired, in a limited, but theoretically equivalent fashion
    even for non-Cygwin processes.

    To accommodate Windows default ACLs, the new code ignores SYSTEM and
    Administrators group permissions when computing the MASK/CLASS_OBJ
    permission mask on old ACLs, and it doesn't deny access to SYSTEM and
    Administrators group based on the value of MASK/CLASS_OBJ when
    creating the new ACLs.

    The new code now handles the S_ISGID bit on directories as on Linux:
    Setting S_ISGID on a directory causes new files and subdirs created
    within to inherit its group, rather than the primary group of the user
    who created the file.  This only works for files and directories
    created by Cygwin processes.

2015-05-29  Corinna Vinschen  <corinna@vinschen.de>

	Reapply POSIX ACL changes.

	* utils.xml (setfacl): Show new option output.
	(getfacl): Show new option output.

	* sec_acl.cc (get_posix_access): Check for Cygwin "standard" ACL.
	Apply umask, if so.  Align comments.
	* security.cc (set_created_file_access): Fix permission masking by
	incoming requested file mode.

	* sec_acl.cc (set_posix_access): Apply mask only in terms of execute bit
	for SYSTEM and Admins group.

	* sec_acl.cc (set_posix_access): Don't create DENY ACEs for USER and
	GROUP entries if they are the same as USER_OBJ or GROUP_OBJ.

	* fhandler.h (fhandler_pty_slave::facl): Add prototype.
	* fhandler_tty.cc (fhandler_pty_slave::facl): New method.
	(fhandler_pty_slave::fchown): Fix uid/gid handling.
	* sec_acl.cc (set_posix_access): Drop superfluous class_idx variable.
	Simplify and move around code in a few places.  To improve ACL
	readability, add r/w permissions to Admins ACE appended to pty ACL.
	Add comment to explain Windows ACE Mask filtering being in the way of
	creating a real CLASS_OBJ.
	(get_posix_access): Fake CLASS_OBJ for ptys.  Explain why.
	* security.cc (get_object_attribute): Add S_IFCHR flag to attributes
	when calling get_posix_access.

	* sec_acl.cc (set_posix_access): Move merging group perms into owner
	perms in case of owner == group after mask has been computed.  Take
	mask into account when doing so to avoid unnecessary ACCESS_DENIED_ACE.

	* sec_acl.cc (get_posix_access): Only set saw_group_obj flag if we saw
	the ACCESS_ALLOWED_ACE.

	* fhandler_disk_file.cc (fhandler_disk_file::fchmod): Deliberatly
	set GROUP_OBJ and CLASS_OBJ perms to new group perms.  Add comment
	to explain why.
	* security.cc (set_created_file_access): Ditto.

	* sec_acl.cc (set_posix_access): Replace previous patch.  Return
	EINVAL if uid and/or guid is invalid and not backed by an actual
	Windows account.

	* sec_acl.cc (set_posix_access): Workaround owner/group SIDs being NULL.

	* sec_acl.cc (set_posix_access): Handle files with owner == group.
	Rephrase switch statement checking against unfiltered a_type value.
	(get_posix_access): Handle files with owner == group.

	* sec_acl.cc (get_posix_access): Don't use GROUP_OBJ access to fix up
	CLASS_OBJ mask on old-style ACLs.  Fix a comment.

	* sec_acl.cc (set_posix_access): Always make sure Admins have
	WRITE_DAC and WRITE_OWNER permissions.
	* security.h (create_object_sd_from_attribute): Drop handle parameter
	from prototype.
	* security.cc (create_object_sd_from_attribute): Drop handle parameter.
	Just create the standard POSIXy security descriptor.
	(set_object_attribute): Accommodate dropped paramter in call to
	create_object_sd_from_attribute.
	* fhandler_tty.cc: Ditto, throughout.

	* fhandler_disk_file.cc (fhandler_disk_file::fchmod): Fix typo in
	mask computation.

	* fhandler.cc (fhandler_base::open_with_arch): Call open with mode
	not umasked.
	(fhandler_base::open): Explicitely umask mode on NFS here.  Call new
	set_created_file_access rather than set_file_attribute.
	* fhandler_disk_file.cc (fhandler_disk_file::fchmod): Reimplement
	setting permissions on filesystems supporting ACLs using the new
	set_posix_access call.
	(fhandler_disk_file::fchown): Ditto.
	(fhandler_disk_file::mkdir): Call new set_created_file_access rather
	than set_file_attribute.
	* fhandler_socket.cc (fhandler_socket::bind): Don't umask here.  Add
	WRITE_OWNER access to allow writing group in case of SGID bit set.
	Call new set_created_file_access rather than set_file_attribute.
	* path.cc (symlink_worker): Call new set_created_file_access rather
	than set_file_attribute.
	* sec_acl.cc (searchace): Un-staticize.
	(set_posix_access): New, complementary functionality to
	get_posix_access.
	(setacl): Implement in terms of get_posix_access/set_posix_access.
	(get_posix_access): Add handling for just created files requiring
	their first Cygwin ACL.  Fix new_style recognition.  Handle SGID
	bit.  For old-style ACLs, ignore SYSTEM and Administrators when
	computing the {DEF_}CLASS_OBJ perms.
	* security.cc (get_file_sd): Revamp comment.  Change and (hopefully)
	speed up inheritance processing for just created files.
	(alloc_sd): Remove.
	(set_security_attribute): Call set_posix_access instead of alloc_sd.
	(get_object_attribute): Fix return value.
	(create_object_sd_from_attribute): Call set_posix_access instead of
	alloc_sd.
	(set_file_attribute): Remove.
	(set_created_file_access): New function implemented in terms of
	get_posix_access/set_posix_access.
	* security.h (set_file_attribute): Remove prototype.
	(set_created_file_access): Add prototype.
	(searchace): Ditto.
	(set_posix_access): Ditto.
	* syscalls.cc (open): Call open_with_arch with mode not umasked.

	* sec_acl.cc: Change preceeding comment explaining new-style ACLs.
	Describe how to generate deny ACEs in more detail.  Accommodate the
	fact that a NULL deny ACE is used for {DEF_}CLASS_OBJ, rather than
	a special Cygwin ACE.  Improve further comments.
	(CYG_ACE_NEW_STYLE): Define.
	(get_posix_access): Change from Cygwin ACE to NULL deny ACE.  Fix
	CLASS_OBJ handling to generate CLASS_OBJ and DEF_CLASS_OBJ from a single
	NULL deny ACE if the inheritance flags say so.
	* sec_helper.cc (well_known_cygwin_sid): Remove.
	* security.h (well_known_cygwin_sid): Drop declaration.

	* sec_acl.cc (CYG_ACE_ISBITS_TO_WIN): Fix typo.
	(get_posix_access): Rename index variable from i to idx.  Define only
	once at top level.

	* security.cc (add_access_allowed_ace): Drop unused parameter "offset".
	Accommodate throughout.
	(add_access_denied_ace): Ditto.
	* sec_acl.cc: Accommodate above change throughout.
	* security.h (add_access_allowed_ace): Adjust prototype to above change.
	(add_access_denied_ace): Ditto.

	* sec_acl.cc (get_posix_access): Handle multiple ACEs for the
	owner and primary group of the file.  Handle the default primary
	group ACE as DEF_GROUP_OBJ entry if the directory has the S_ISGID bit
	set.  Add comments.  Minor code rearrangements.

	Preliminary read side implementation of new permission handling.
	* acl.h (MAX_ACL_ENTRIES): Raise to 2730.  Add comment to explain.
	* sec_acl.cc:  Add leading comment to explain new ACL style.
	Add definitions and macros to use for bits in new Cygwin ACL.
	(DENY_RWX): New mask value for all temporary deny bits.
	(getace): Add bool parameter to decide when leaving all bits intact,
	rather than filtering them per the already set bits.
	(get_posix_access): New function, taking over functionality to read
	POSIX ACL from SECURITY_DESCRIPTOR.
	(getacl): Just call get_posix_access.
	* sec_helper.cc (well_known_cygwin_sid): Define.
	* security.cc (get_attribute_from_acl): Remove.
	(get_info_from_sd): Remove.
	(get_reg_sd): Call get_posix_access instead of get_info_from_sd.
	(get_file_attribute): Ditto.
	(get_object_attribute): Ditto.
	* security.h (well_known_cygwin_sid): Declare.
	(get_posix_access): Add prototype.

	* Throughout, use simpler ACE macros from Windows' accctrl.h.

	* getfacl.c (main): Special-case SYSTEM and Admins group.  Add comments.

	* setfacl.c: Align more to Linux tool.
	(delacl): New function to delete acl entries only.
	(modacl): Drop delete functionality.  Add handling of recomputing the
	mask and default mask values.
	(delallacl): Rename from delacl.
	(setfacl): Call delacl in Delete case.  Call delallacl in DeleteAll
	and DeleteDef case.
	(usage): Accommodate new options.  Rearrange and rephrase slightly.
	(longopts): Emit 'x' in --delete case.  Add --no-mask and --mask
	options.
	(opts): Add -x and -n options.
	(main): Handle -d and -x the same.  Handle -n and --mask options.
	Drop handling for -r option.

	* getfacl.c (usage): Align more closely to Linux version.  Add new
	options -c, -e, -E.  Change formatting to accommodate longer options.
	(longopts): Rename --noname to --numeric.  Keep --noname for backward
	compatibility.  Add --omit-header, --all-effective and --no-effective
	options.
	(opts): Add -c, -e and -E option.
	(main): Handle new -c, -e, and -E options.

Signed-off-by: Corinna Vinschen <corinna@vinschen.de>

1 files changed, 163 insertions, 650 deletions

diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index 9a94c53d1..ac25d71c4 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -15,6 +15,7 @@ details. */
 #include "winsup.h"
 #include <unistd.h>
 #include <stdlib.h>
+#include <sys/acl.h>
 #include "cygerrno.h"
 #include "security.h"
 #include "path.h"
@@ -34,7 +35,6 @@ static GENERIC_MAPPING NO_COPY_RO file_mapping = { FILE_GENERIC_READ,
 						   FILE_GENERIC_WRITE,
 						   FILE_GENERIC_EXECUTE,
 						   FILE_ALL_ACCESS };
-
 LONG
 get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
 	     bool justcreated)
@@ -85,62 +85,46 @@ get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
 	  return -1;
 	}
     }
-  /* Ok, so we have a security descriptor now.  Unfortunately, if you want
-     to know if an ACE is inherited from the parent object, you can't just
-     call NtQuerySecurityObject once.  The problem is this:
+  /* We have a security descriptor now.  Unfortunately, if you want to know
+     if an ACE is inherited from the parent object, this isn't sufficient.
 
      In the simple case, the SDs control word contains one of the
      SE_DACL_AUTO_INHERITED or SE_DACL_PROTECTED flags, or at least one of
-     the ACEs has the INHERITED_ACE flag set.  In all of these cases the
-     GetSecurityInfo function calls NtQuerySecurityObject only once, too,
-     apparently because it figures that the DACL is self-sufficient, which
-     it usually is.  Windows Explorer, for instance, takes great care to
-     set these flags in a security descriptor if you change the ACL in the
-     GUI property dialog.
-
-     The tricky case is if none of these flags is set in the SD.  That means
-     the information whether or not an ACE has been inherited is not available
-     in the DACL of the object.  In this case GetSecurityInfo also fetches the
-     SD from the parent directory and tests if the object's SD contains
-     inherited ACEs from the parent.  The below code is closly emulating the
-     behaviour of GetSecurityInfo so we can get rid of this advapi32 dependency.
-
-     However, this functionality is slow, and the extra information is only
-     required when the file has been created and the permissions are about
-     to be set to POSIX permissions.  Therefore we only use it in case the
-     file just got created.
-
-     Note that GetSecurityInfo has a problem on 5.1 and 5.2 kernels.  Sometimes
-     it returns ERROR_INVALID_ADDRESS if a former request for the parent
-     directories' SD used NtQuerySecurityObject, rather than GetSecurityInfo
-     as well.  See http://cygwin.com/ml/cygwin-developers/2011-03/msg00027.html
-     for the solution.  This problem does not occur with the below code, so
-     the workaround has been removed. */
+     the ACEs has the INHERITED_ACE flag set.  In all of these cases we
+     know the DACL has been inherited.
+
+     If none of these flags is set in the SD, the information whether
+     or not an ACE has been inherited is not available in the DACL of the
+     object.  In this case GetSecurityInfo fetches the SD from the parent
+     directory and tests if the object's SD contains inherited ACEs from the
+     parent.
+
+     Note that we're not testing the SE_DACL_AUTO_INHERITED and
+     SE_DACL_PROTECTED flags here because we know the state the file's SD
+     is in.  Since we're creating all files with a NULL descriptor, the DACL
+     is either inherited from the parent, or it's the default DACL.  In
+     neither case, one of these flags is set.
+
+     For speed, we're not calling RtlConvertToAutoInheritSecurityObject
+     anymore (but keep the code here for reference).  Rather we just test
+     if one of the parent's ACEs is inheritable.  If so, we know we inherited
+     it and set the SE_DACL_AUTO_INHERITED flag.  If not, we may assume our
+     object's DACL is the default DACL.
+
+     This functionality is slow and the extra information is only required
+     when the file has been created and the permissions are about to be set
+     to POSIX permissions.  Therefore we only use it in case the file just
+     got created. */
   if (justcreated)
     {
-      SECURITY_DESCRIPTOR_CONTROL ctrl;
-      ULONG dummy;
       PACL dacl;
       BOOLEAN exists, def;
       ACCESS_ALLOWED_ACE *ace;
       UNICODE_STRING dirname;
-      PSECURITY_DESCRIPTOR psd, nsd;
+      PSECURITY_DESCRIPTOR psd;
       tmp_pathbuf tp;
 
-      /* Check SDs control flags.  If SE_DACL_AUTO_INHERITED or
-	 SE_DACL_PROTECTED is set we're done. */
-      RtlGetControlSecurityDescriptor (sd, &ctrl, &dummy);
-      if (ctrl & (SE_DACL_AUTO_INHERITED | SE_DACL_PROTECTED))
-	return 0;
-      /* Otherwise iterate over the ACEs and see if any one of them has the
-	 INHERITED_ACE flag set.  If so, we're done. */
-      if (NT_SUCCESS (RtlGetDaclSecurityDescriptor (sd, &exists, &dacl, &def))
-	  && exists && dacl)
-	for (ULONG idx = 0; idx < dacl->AceCount; ++idx)
-	  if (NT_SUCCESS (RtlGetAce (dacl, idx, (PVOID *) &ace))
-	      && (ace->Header.AceFlags & INHERITED_ACE))
-	    return 0;
-      /* Otherwise, open the parent directory with READ_CONTROL... */
+      /* Open the parent directory with READ_CONTROL... */
       RtlSplitUnicodePath (pc.get_nt_native_path (), &dirname, NULL);
       InitializeObjectAttributes (&attr, &dirname, pc.objcaseinsensitive (),
 				  NULL, NULL);
@@ -164,12 +148,14 @@ get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
 			&dirname, status);
 	  return 0;
 	}
+#if 0
       /* ... and create a new security descriptor in which all inherited ACEs
 	 are marked with the INHERITED_ACE flag.  For a description of the
 	 undocumented RtlConvertToAutoInheritSecurityObject function from
 	 ntdll.dll see the MSDN man page for the advapi32 function
 	 ConvertToAutoInheritPrivateObjectSecurity.  Fortunately the latter
 	 is just a shim. */
+      PSECURITY_DESCRIPTOR nsd;
       status = RtlConvertToAutoInheritSecurityObject (psd, sd, &nsd, NULL,
 						      pc.isdir (),
 						      &file_mapping);
@@ -185,6 +171,36 @@ get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
       len = RtlLengthSecurityDescriptor (nsd);
       memcpy ((PSECURITY_DESCRIPTOR) sd, nsd, len);
       RtlDeleteSecurityObject (&nsd);
+#else
+      /* ... and check the parent descriptor for inheritable ACEs matching
+	 our current object type (file/dir).  The simple truth in our case
+	 is, either the parent dir had inheritable ACEs and all our ACEs are
+	 inherited, or the parent dir didn't have inheritable ACEs and all
+	 our ACEs are taken from the default DACL. */
+      bool inherited = false;
+      BYTE search_flags = pc.isdir () ? SUB_CONTAINERS_AND_OBJECTS_INHERIT
+				      : SUB_OBJECTS_ONLY_INHERIT;
+      if (NT_SUCCESS (RtlGetDaclSecurityDescriptor (psd, &exists, &dacl, &def))
+	  && exists && dacl)
+	for (ULONG idx = 0; idx < dacl->AceCount; ++idx)
+	  if (NT_SUCCESS (RtlGetAce (dacl, idx, (PVOID *) &ace))
+	      && (ace->Header.AceFlags & search_flags))
+	    {
+	      inherited = true;
+	      break;
+	    }
+      /* Then, if the parent descriptor contained inheritable ACEs, we mark
+	 the SD as SE_DACL_AUTO_INHERITED.  Note that this requires the
+	 matching check in get_posix_access.  If we ever revert to
+	 RtlConvertToAutoInheritSecurityObject, the check in get_posix_access
+	 has to test every single ACE for the INHERITED_ACE flag again. */
+      if (inherited
+	  && NT_SUCCESS (RtlGetDaclSecurityDescriptor (sd, &exists, &dacl,
+						       &def))
+	  && exists && dacl)
+	RtlSetControlSecurityDescriptor (sd, SE_DACL_AUTO_INHERITED,
+					     SE_DACL_AUTO_INHERITED);
+#endif
     }
   return 0;
 }
@@ -234,213 +250,6 @@ set_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd, bool is_chown)
   return res;
 }
 
-static void
-get_attribute_from_acl (mode_t *attribute, PACL acl, PSID owner_sid,
-			PSID group_sid, bool grp_member)
-{
-  ACCESS_ALLOWED_ACE *ace;
-  mode_t allow = 0;
-  mode_t deny = 0;
-  mode_t *flags, *anti;
-  bool isownergroup = RtlEqualSid (owner_sid, group_sid);
-  bool userisowner  = RtlEqualSid (owner_sid, cygheap->user.sid ());
-
-  for (DWORD i = 0; i < acl->AceCount; ++i)
-    {
-      if (!NT_SUCCESS (RtlGetAce (acl, i, (PVOID *) &ace)))
-	continue;
-      if (ace->Header.AceFlags & INHERIT_ONLY_ACE)
-	continue;
-      switch (ace->Header.AceType)
-	{
-	case ACCESS_ALLOWED_ACE_TYPE:
-	  flags = &allow;
-	  anti = &deny;
-	  break;
-	case ACCESS_DENIED_ACE_TYPE:
-	  flags = &deny;
-	  anti = &allow;
-	  break;
-	default:
-	  continue;
-	}
-
-      cygpsid ace_sid ((PSID) &ace->SidStart);
-      if (ace_sid == well_known_world_sid)
-	{
-	  if (ace->Mask & FILE_READ_BITS)
-	    *flags |= ((!(*anti & S_IROTH)) ? S_IROTH : 0)
-		      | ((!isownergroup && !(*anti & S_IRGRP)) ? S_IRGRP : 0)
-		      | ((!(*anti & S_IRUSR)) ? S_IRUSR : 0);
-	  if (ace->Mask & FILE_WRITE_BITS)
-	    *flags |= ((!(*anti & S_IWOTH)) ? S_IWOTH : 0)
-		      | ((!isownergroup && !(*anti & S_IWGRP)) ? S_IWGRP : 0)
-		      | ((!(*anti & S_IWUSR)) ? S_IWUSR : 0);
-	  if (ace->Mask & FILE_EXEC_BITS)
-	    *flags |= ((!(*anti & S_IXOTH)) ? S_IXOTH : 0)
-		      | ((!isownergroup && !(*anti & S_IXGRP)) ? S_IXGRP : 0)
-		      | ((!(*anti & S_IXUSR)) ? S_IXUSR : 0);
-	  if ((S_ISDIR (*attribute)) &&
-	      (ace->Mask & (FILE_WRITE_DATA | FILE_EXECUTE | FILE_DELETE_CHILD))
-	      == (FILE_WRITE_DATA | FILE_EXECUTE))
-	    *flags |= S_ISVTX;
-	}
-      else if (ace_sid == well_known_null_sid)
-	{
-	  /* Read SUID, SGID and VTX bits from NULL ACE. */
-	  if (ace->Mask & FILE_READ_DATA)
-	    *flags |= S_ISVTX;
-	  if (ace->Mask & FILE_WRITE_DATA)
-	    *flags |= S_ISGID;
-	  if (ace->Mask & FILE_APPEND_DATA)
-	    *flags |= S_ISUID;
-	}
-      else if (ace_sid == owner_sid)
-	{
-	  if (ace->Mask & FILE_READ_BITS)
-	    *flags |= ((!(*anti & S_IRUSR)) ? S_IRUSR : 0);
-	  if (ace->Mask & FILE_WRITE_BITS)
-	    *flags |= ((!(*anti & S_IWUSR)) ? S_IWUSR : 0);
-	  if (ace->Mask & FILE_EXEC_BITS)
-	    *flags |= ((!(*anti & S_IXUSR)) ? S_IXUSR : 0);
-	  /* Apply deny mask to group if group SID == owner SID. */
-	  if (group_sid && isownergroup
-	      && ace->Header.AceType == ACCESS_DENIED_ACE_TYPE)
-	    {
-	      if (ace->Mask & FILE_READ_BITS)
-		*flags |= ((!(*anti & S_IRUSR)) ? S_IRGRP : 0);
-	      if (ace->Mask & FILE_WRITE_BITS)
-		*flags |= ((!(*anti & S_IWUSR)) ? S_IWGRP : 0);
-	      if (ace->Mask & FILE_EXEC_BITS)
-		*flags |= ((!(*anti & S_IXUSR)) ? S_IXGRP : 0);
-	    }
-	}
-      else if (ace_sid == group_sid)
-	{
-	  if (ace->Mask & FILE_READ_BITS)
-	    *flags |= ((!(*anti & S_IRGRP)) ? S_IRGRP : 0)
-		      | ((grp_member && !(*anti & S_IRUSR)) ? S_IRUSR : 0);
-	  if (ace->Mask & FILE_WRITE_BITS)
-	    *flags |= ((!(*anti & S_IWGRP)) ? S_IWGRP : 0)
-		      | ((grp_member && !(*anti & S_IWUSR)) ? S_IWUSR : 0);
-	  if (ace->Mask & FILE_EXEC_BITS)
-	    *flags |= ((!(*anti & S_IXGRP)) ? S_IXGRP : 0)
-		      | ((grp_member && !(*anti & S_IXUSR)) ? S_IXUSR : 0);
-	}
-      else if (flags == &allow)
-	{
-	  /* Simplified computation of additional group permissions based on
-	     the CLASS_OBJ value.  CLASS_OBJ represents the or'ed value of
-	     the primary group permissions and all secondary user and group
-	     permissions.  FIXME: This only takes ACCESS_ALLOWED_ACEs into
-	     account.  The computation with additional ACCESS_DENIED_ACE
-	     handling is much more complicated. */
-	  if (ace->Mask & FILE_READ_BITS)
-	    *flags |= S_IRGRP;
-	  if (ace->Mask & FILE_WRITE_BITS)
-	    *flags |= S_IWGRP;
-	  if (ace->Mask & FILE_EXEC_BITS)
-	    *flags |= S_IXGRP;
-	  /* If the current user is the owner of the file, check if the
-	     additional SIDs are in the user's token.  Note that this is
-	     some ugly hack, but a full-fledged solution requires to
-	     create tokens or perhaps using AUTHZ. */
-	  BOOL ret;
-	  if (userisowner
-	      && CheckTokenMembership (cygheap->user.issetuid ()
-				       ? cygheap->user.imp_token () : NULL,
-				       ace_sid, &ret)
-	      && ret)
-	    {
-	      if (ace->Mask & FILE_READ_BITS)
-		*flags |= (!(*anti & S_IRUSR)) ? S_IRUSR : 0;
-	      if (ace->Mask & FILE_WRITE_BITS)
-		*flags |= (!(*anti & S_IWUSR)) ? S_IWUSR : 0;
-	      if (ace->Mask & FILE_EXEC_BITS)
-		*flags |= (!(*anti & S_IXUSR)) ? S_IXUSR : 0;
-	    }
-	}
-    }
-  *attribute &= ~(S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX | S_ISGID | S_ISUID);
-#if 0
-  /* Disable owner/group permissions equivalence if owner SID == group SID.
-     It's technically not quite correct, but it helps in case a security
-     conscious application checks if a file has too open permissions.  In
-     fact, since owner == group, there's no security issue here. */
-  if (owner_sid && group_sid && RtlEqualSid (owner_sid, group_sid)
-      /* FIXME: temporary exception for /var/empty */
-      && well_known_system_sid != group_sid)
-    {
-      allow &= ~(S_IRGRP | S_IWGRP | S_IXGRP);
-      allow |= (((allow & S_IRUSR) ? S_IRGRP : 0)
-		| ((allow & S_IWUSR) ? S_IWGRP : 0)
-		| ((allow & S_IXUSR) ? S_IXGRP : 0));
-    }
-#endif
-  *attribute |= allow;
-}
-
-static void
-get_info_from_sd (PSECURITY_DESCRIPTOR psd, mode_t *attribute,
-		  uid_t *uidret, gid_t *gidret)
-{
-  if (!psd)
-    {
-      /* If reading the security descriptor failed, treat the object
-	 as unreadable. */
-      if (attribute)
-	*attribute &= ~(S_IRWXU | S_IRWXG | S_IRWXO);
-      if (uidret)
-	*uidret = ILLEGAL_UID;
-      if (gidret)
-	*gidret = ILLEGAL_GID;
-      return;
-    }
-
-  cygpsid owner_sid;
-  cygpsid group_sid;
-  NTSTATUS status;
-  BOOLEAN dummy;
-
-  status = RtlGetOwnerSecurityDescriptor (psd, (PSID *) &owner_sid, &dummy);
-  if (!NT_SUCCESS (status))
-    debug_printf ("RtlGetOwnerSecurityDescriptor: %y", status);
-  status = RtlGetGroupSecurityDescriptor (psd, (PSID *) &group_sid, &dummy);
-  if (!NT_SUCCESS (status))
-    debug_printf ("RtlGetGroupSecurityDescriptor: %y", status);
-
-  uid_t uid;
-  gid_t gid;
-  bool grp_member = get_sids_info (owner_sid, group_sid, &uid, &gid);
-  if (uidret)
-    *uidret = uid;
-  if (gidret)
-    *gidret = gid;
-
-  if (!attribute)
-    {
-      syscall_printf ("uid %u, gid %u", uid, gid);
-      return;
-    }
-
-  PACL acl;
-  BOOLEAN acl_exists;
-
-  status = RtlGetDaclSecurityDescriptor (psd, &acl_exists, &acl, &dummy);
-  if (!NT_SUCCESS (status))
-    {
-      __seterrno_from_nt_status (status);
-      *attribute &= ~(S_IRWXU | S_IRWXG | S_IRWXO);
-    }
-  else if (!acl_exists || !acl)
-    *attribute |= S_IRWXU | S_IRWXG | S_IRWXO;
-  else
-    get_attribute_from_acl (attribute, acl, owner_sid, group_sid, grp_member);
-
-  syscall_printf ("%sACL %y, uid %u, gid %u",
-		  (!acl_exists || !acl)?"NO ":"", *attribute, uid, gid);
-}
-
 static int
 get_reg_sd (HANDLE handle, security_descriptor &sd_ret)
 {
@@ -473,7 +282,7 @@ get_reg_attribute (HKEY hkey, mode_t *attribute, uid_t *uidret,
 
   if (!get_reg_sd (hkey, sd))
     {
-      get_info_from_sd (sd, attribute, uidret, gidret);
+      get_posix_access (sd, attribute, uidret, gidret, NULL, 0);
       return 0;
     }
   /* The entries are already set to default values */
@@ -490,7 +299,7 @@ get_file_attribute (HANDLE handle, path_conv &pc,
 
       if (!get_file_sd (handle, pc, sd, false))
 	{
-	  get_info_from_sd (sd, attribute, uidret, gidret);
+	  get_posix_access (sd, attribute, uidret, gidret, NULL, 0);
 	  return 0;
 	}
       /* ENOSYS is returned by get_file_sd if fetching the DACL from a remote
@@ -518,8 +327,8 @@ get_file_attribute (HANDLE handle, path_conv &pc,
 }
 
 bool
-add_access_allowed_ace (PACL acl, int offset, DWORD attributes,
-			PSID sid, size_t &len_add, DWORD inherit)
+add_access_allowed_ace (PACL acl, DWORD attributes, PSID sid, size_t &len_add,
+			DWORD inherit)
 {
   NTSTATUS status = RtlAddAccessAllowedAceEx (acl, ACL_REVISION, inherit,
 					      attributes, sid);
@@ -533,8 +342,8 @@ add_access_allowed_ace (PACL acl, int offset, DWORD attributes,
 }
 
 bool
-add_access_denied_ace (PACL acl, int offset, DWORD attributes,
-		       PSID sid, size_t &len_add, DWORD inherit)
+add_access_denied_ace (PACL acl, DWORD attributes, PSID sid, size_t &len_add,
+		       DWORD inherit)
 {
   NTSTATUS status = RtlAddAccessDeniedAceEx (acl, ACL_REVISION, inherit,
 					     attributes, sid);
@@ -547,367 +356,6 @@ add_access_denied_ace (PACL acl, int offset, DWORD attributes,
   return true;
 }
 
-static PSECURITY_DESCRIPTOR
-alloc_sd (path_conv &pc, uid_t uid, gid_t gid, int attribute,
-	  security_descriptor &sd_ret)
-{
-  NTSTATUS status;
-  BOOLEAN dummy;
-  tmp_pathbuf tp;
-
-  /* NOTE: If the high bit of attribute is set, we have just created
-     a file or directory.  See below for an explanation. */
-
-  debug_printf("uid %u, gid %u, attribute 0%o", uid, gid, attribute);
-
-  /* Get owner and group from current security descriptor. */
-  PSID cur_owner_sid = NULL;
-  PSID cur_group_sid = NULL;
-  status = RtlGetOwnerSecurityDescriptor (sd_ret, &cur_owner_sid, &dummy);
-  if (!NT_SUCCESS (status))
-    debug_printf ("RtlGetOwnerSecurityDescriptor: %y", status);
-  status = RtlGetGroupSecurityDescriptor (sd_ret, &cur_group_sid, &dummy);
-  if (!NT_SUCCESS (status))
-    debug_printf ("RtlGetGroupSecurityDescriptor: %y", status);
-
-  /* Get SID of owner. */
-  cygsid owner_sid;
-  /* Check for current user first */
-  if (uid == myself->uid)
-    owner_sid = cygheap->user.sid ();
-  else if (uid == ILLEGAL_UID)
-    owner_sid = cur_owner_sid;
-  else if (!owner_sid.getfrompw (internal_getpwuid (uid)))
-    {
-      set_errno (EINVAL);
-      return NULL;
-    }
-  owner_sid.debug_print ("alloc_sd: owner SID =");
-
-  /* Get SID of new group. */
-  cygsid group_sid;
-  /* Check for current user first */
-  if (gid == myself->gid)
-    group_sid = cygheap->user.groups.pgsid;
-  else if (gid == ILLEGAL_GID)
-    group_sid = cur_group_sid;
-  else if (!group_sid.getfromgr (internal_getgrgid (gid)))
-    {
-      set_errno (EINVAL);
-      return NULL;
-    }
-  group_sid.debug_print ("alloc_sd: group SID =");
-
-  /* Initialize local security descriptor. */
-  SECURITY_DESCRIPTOR sd;
-  RtlCreateSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION);
-
-  /* We set the SE_DACL_PROTECTED flag here to prevent the DACL from being
-     modified by inheritable ACEs. */
-  RtlSetControlSecurityDescriptor (&sd, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
-
-  /* Create owner for local security descriptor. */
-  status = RtlSetOwnerSecurityDescriptor (&sd, owner_sid, FALSE);
-  if (!NT_SUCCESS (status))
-    {
-      __seterrno_from_nt_status (status);
-      return NULL;
-    }
-
-  /* Create group for local security descriptor. */
-  status = RtlSetGroupSecurityDescriptor (&sd, group_sid, FALSE);
-  if (!NT_SUCCESS (status))
-    {
-      __seterrno_from_nt_status (status);
-      return NULL;
-    }
-
-  /* Initialize local access control list. */
-  PACL acl = (PACL) tp.w_get ();
-  RtlCreateAcl (acl, ACL_MAXIMUM_SIZE, ACL_REVISION);
-
-  /* From here fill ACL. */
-  size_t acl_len = sizeof (ACL);
-  int ace_off = 0;
-  /* Only used for sync objects (for ttys).  The admins group should
-     always have the right to manipulate the ACL, so we have to make sure
-     that the ACL gives the admins group STANDARD_RIGHTS_ALL access. */
-  bool saw_admins = false;
-
-  /* Construct allow attribute for owner.
-     Don't set FILE_READ/WRITE_ATTRIBUTES unconditionally on Samba, otherwise
-     it enforces read permissions.  Same for other's below. */
-  DWORD owner_allow = STANDARD_RIGHTS_ALL
-		      | (pc.fs_is_samba ()
-			 ? 0 : (FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES));
-  if (attribute & S_IRUSR)
-    owner_allow |= FILE_GENERIC_READ;
-  if (attribute & S_IWUSR)
-    owner_allow |= FILE_GENERIC_WRITE;
-  if (attribute & S_IXUSR)
-    owner_allow |= FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES;
-  if (S_ISDIR (attribute)
-      && (attribute & (S_IWUSR | S_IXUSR)) == (S_IWUSR | S_IXUSR))
-    owner_allow |= FILE_DELETE_CHILD;
-  /* For sync objects note that the owner is admin. */
-  if (S_ISCHR (attribute) && owner_sid == well_known_admins_sid)
-    saw_admins = true;
-
-  /* Construct allow attribute for group. */
-  DWORD group_allow = STANDARD_RIGHTS_READ | SYNCHRONIZE
-		      | (pc.fs_is_samba () ? 0 : FILE_READ_ATTRIBUTES);
-  if (attribute & S_IRGRP)
-    group_allow |= FILE_GENERIC_READ;
-  if (attribute & S_IWGRP)
-    group_allow |= FILE_GENERIC_WRITE;
-  if (attribute & S_IXGRP)
-    group_allow |= FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES;
-  if (S_ISDIR (attribute)
-      && (attribute & (S_IWGRP | S_IXGRP)) == (S_IWGRP | S_IXGRP)
-      && !(attribute & S_ISVTX))
-    group_allow |= FILE_DELETE_CHILD;
-  /* For sync objects, add STANDARD_RIGHTS_ALL for admins group. */
-  if (S_ISCHR (attribute) && group_sid == well_known_admins_sid)
-    {
-      group_allow |= STANDARD_RIGHTS_ALL;
-      saw_admins = true;
-    }
-
-  /* Construct allow attribute for everyone. */
-  DWORD other_allow = STANDARD_RIGHTS_READ | SYNCHRONIZE
-		      | (pc.fs_is_samba () ? 0 : FILE_READ_ATTRIBUTES);
-  if (attribute & S_IROTH)
-    other_allow |= FILE_GENERIC_READ;
-  if (attribute & S_IWOTH)
-    other_allow |= FILE_GENERIC_WRITE;
-  if (attribute & S_IXOTH)
-    other_allow |= FILE_GENERIC_EXECUTE & ~FILE_READ_ATTRIBUTES;
-  if (S_ISDIR (attribute)
-      && (attribute & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH)
-      && !(attribute & S_ISVTX))
-    other_allow |= FILE_DELETE_CHILD;
-
-  /* Construct SUID, SGID and VTX bits in NULL ACE. */
-  DWORD null_allow = 0L;
-  if (attribute & (S_ISUID | S_ISGID | S_ISVTX))
-    {
-      if (attribute & S_ISUID)
-	null_allow |= FILE_APPEND_DATA;
-      if (attribute & S_ISGID)
-	null_allow |= FILE_WRITE_DATA;
-      if (attribute & S_ISVTX)
-	null_allow |= FILE_READ_DATA;
-    }
-
-  /* Add owner and group permissions if SIDs are equal
-     and construct deny attributes for group and owner. */
-  bool isownergroup;
-  if ((isownergroup = (owner_sid == group_sid)))
-    owner_allow |= group_allow;
-
-  DWORD owner_deny = ~owner_allow & (group_allow | other_allow);
-  owner_deny &= ~(STANDARD_RIGHTS_READ
-		  | FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES);
-
-  DWORD group_deny = ~group_allow & other_allow;
-  group_deny &= ~(STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES);
-
-  /* Set deny ACE for owner. */
-  if (owner_deny
-      && !add_access_denied_ace (acl, ace_off++, owner_deny,
-				 owner_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-  /* Set deny ACE for group here to respect the canonical order,
-     if this does not impact owner */
-  if (group_deny && !(group_deny & owner_allow) && !isownergroup
-      && !add_access_denied_ace (acl, ace_off++, group_deny,
-				 group_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-  /* Set allow ACE for owner. */
-  if (!add_access_allowed_ace (acl, ace_off++, owner_allow,
-			       owner_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-  /* Set deny ACE for group, if still needed. */
-  if ((group_deny & owner_allow) && !isownergroup
-      && !add_access_denied_ace (acl, ace_off++, group_deny,
-				 group_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-  /* Set allow ACE for group. */
-  if (!isownergroup
-      && !add_access_allowed_ace (acl, ace_off++, group_allow,
-				  group_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-
-  /* For sync objects, if we didn't see the admins group so far, add entry
-     with STANDARD_RIGHTS_ALL access. */
-  if (S_ISCHR (attribute) && !saw_admins)
-    {
-      if (!add_access_allowed_ace (acl, ace_off++, STANDARD_RIGHTS_ALL,
-				   well_known_admins_sid, acl_len,
-				   NO_INHERITANCE))
-	return NULL;
-      saw_admins = true;
-    }
-
-  /* Set allow ACE for everyone. */
-  if (!add_access_allowed_ace (acl, ace_off++, other_allow,
-			       well_known_world_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-  /* Set null ACE for special bits. */
-  if (null_allow
-      && !add_access_allowed_ace (acl, ace_off++, null_allow,
-				  well_known_null_sid, acl_len, NO_INHERITANCE))
-    return NULL;
-
-  /* Fill ACL with unrelated ACEs from current security descriptor. */
-  PACL oacl;
-  BOOLEAN acl_exists = FALSE;
-  ACCESS_ALLOWED_ACE *ace;
-
-  status = RtlGetDaclSecurityDescriptor (sd_ret, &acl_exists, &oacl, &dummy);
-  if (NT_SUCCESS (status) && acl_exists && oacl)
-    for (DWORD i = 0; i < oacl->AceCount; ++i)
-      if (NT_SUCCESS (RtlGetAce (oacl, i, (PVOID *) &ace)))
-	{
-	  cygpsid ace_sid ((PSID) &ace->SidStart);
-
-	  /* Always skip NULL SID as well as admins SID on virtual device files
-	     in /proc/sys. */
-	  if (ace_sid == well_known_null_sid
-	      || (S_ISCHR (attribute) && ace_sid == well_known_admins_sid))
-	    continue;
-	  /* Check for ACEs which are always created in the preceding code
-	     and check for the default inheritence ACEs which will be created
-	     for just created directories.  Skip them for just created
-	     directories or if they are not inherited.  If they are inherited,
-	     make sure they are *only* inherited, so they don't collide with
-	     the permissions set in this function. */
-	  if ((ace_sid == cur_owner_sid)
-	      || (ace_sid == owner_sid)
-	      || (ace_sid == cur_group_sid)
-	      || (ace_sid == group_sid)
-	      || (ace_sid == well_known_creator_owner_sid)
-	      || (ace_sid == well_known_creator_group_sid)
-	      || (ace_sid == well_known_world_sid))
-	    {
-	      if ((S_ISDIR (attribute) && (attribute & S_JUSTCREATED))
-		  || (ace->Header.AceFlags
-		      & (CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE)) == 0)
-		continue;
-	      else
-		ace->Header.AceFlags |= INHERIT_ONLY_ACE;
-	    }
-	  if (attribute & S_JUSTCREATED)
-	    {
-	      /* Since files and dirs are created with a NULL descriptor,
-		 inheritence rules kick in.  If no inheritable entries exist
-		 in the parent object, Windows will create entries from the
-		 user token's default DACL in the file DACL.  These entries
-		 are not desired and we drop them silently. */
-	      if (!(ace->Header.AceFlags & INHERITED_ACE))
-		continue;
-	      /* Remove the INHERITED_ACE flag since on POSIX systems
-		 inheritance is settled when the file has been created.
-		 This also avoids error messages in Windows Explorer when
-		 opening a file's security tab.  Explorer complains if
-		 inheritable ACEs are preceding non-inheritable ACEs. */
-	      ace->Header.AceFlags &= ~INHERITED_ACE;
-	      /* However, if the newly created object is a directory,
-	         it inherits the default ACL from its parent, so mark
-		 all unrelated, inherited ACEs inheritable. */
-	      if (S_ISDIR (attribute))
-		ace->Header.AceFlags |= CONTAINER_INHERIT_ACE
-					| OBJECT_INHERIT_ACE;
-	    }
-	  else if (uid == ILLEGAL_UID && gid == ILLEGAL_UID
-		   && ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE
-		   && ace_sid != well_known_creator_group_sid
-		   && ace_sid != well_known_creator_owner_sid
-		   && ace_sid != well_known_world_sid)
-	    {
-	      /* FIXME: Temporary workaround for the problem that chmod does
-		 not affect the group permissions if other users and groups
-		 in the ACL have more permissions than the primary group due
-		 to the CLASS_OBJ emulation.  The temporary workaround is to
-		 disallow any secondary ACE in the ACL more permissions than
-		 the primary group when writing a new ACL via chmod. */
-	      ace->Mask &= group_allow;
-	    }
-	  /* Add unrelated ACCESS_DENIED_ACE to the beginning but behind
-	     the owner_deny, ACCESS_ALLOWED_ACE to the end.  FIXME: this
-	     would break the order of the inherit-only ACEs. */
-	  status = RtlAddAce (acl, ACL_REVISION,
-			      ace->Header.AceType == ACCESS_DENIED_ACE_TYPE
-			      ?  (owner_deny ? 1 : 0) : MAXDWORD,
-			      (LPVOID) ace, ace->Header.AceSize);
-	  if (!NT_SUCCESS (status))
-	    {
-	      __seterrno_from_nt_status (status);
-	      return NULL;
-	    }
-	  ace_off++;
-	  acl_len += ace->Header.AceSize;
-	}
-
-  /* Construct appropriate inherit attribute for new directories.  Keep in
-     mind that we do this only for the sake of non-Cygwin applications.
-     Cygwin applications don't need this. */
-  if (S_ISDIR (attribute) && (attribute & S_JUSTCREATED))
-    {
-      const DWORD inherit = CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE
-			    | INHERIT_ONLY_ACE;
-      /* Set allow ACE for owner. */
-      if (!add_access_allowed_ace (acl, ace_off++, owner_allow,
-				   well_known_creator_owner_sid, acl_len,
-				   inherit))
-	return NULL;
-      /* Set allow ACE for group. */
-      if (!add_access_allowed_ace (acl, ace_off++, group_allow,
-				   well_known_creator_group_sid, acl_len,
-				   inherit))
-	return NULL;
-      /* Set allow ACE for everyone. */
-      if (!add_access_allowed_ace (acl, ace_off++, other_allow,
-				   well_known_world_sid, acl_len, inherit))
-	return NULL;
-    }
-
-  /* Set AclSize to computed value. */
-  acl->AclSize = acl_len;
-  debug_printf ("ACL-Size: %d", acl_len);
-
-  /* Create DACL for local security descriptor. */
-  status = RtlSetDaclSecurityDescriptor (&sd, TRUE, acl, FALSE);
-  if (!NT_SUCCESS (status))
-    {
-      __seterrno_from_nt_status (status);
-      return NULL;
-    }
-
-  /* Make self relative security descriptor. */
-  DWORD sd_size = 0;
-  RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
-  if (sd_size <= 0)
-    {
-      __seterrno ();
-      return NULL;
-    }
-  if (!sd_ret.malloc (sd_size))
-    {
-      set_errno (ENOMEM);
-      return NULL;
-    }
-  status = RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
-  if (!NT_SUCCESS (status))
-    {
-      __seterrno_from_nt_status (status);
-      return NULL;
-    }
-  debug_printf ("Created SD-Size: %u", sd_ret.size ());
-
-  return sd_ret;
-}
-
 void
 set_security_attribute (path_conv &pc, int attribute, PSECURITY_ATTRIBUTES psa,
 			security_descriptor &sd)
@@ -915,8 +363,9 @@ set_security_attribute (path_conv &pc, int attribute, PSECURITY_ATTRIBUTES psa,
   psa->lpSecurityDescriptor = sd.malloc (SECURITY_DESCRIPTOR_MIN_LENGTH);
   RtlCreateSecurityDescriptor ((PSECURITY_DESCRIPTOR) psa->lpSecurityDescriptor,
 				SECURITY_DESCRIPTOR_REVISION);
-  psa->lpSecurityDescriptor = alloc_sd (pc, geteuid32 (), getegid32 (),
-					attribute, sd);
+  psa->lpSecurityDescriptor = set_posix_access (attribute, geteuid32 (),
+						getegid32 (), NULL, 0,
+						sd, false);
 }
 
 int
@@ -952,22 +401,24 @@ get_object_attribute (HANDLE handle, uid_t *uidret, gid_t *gidret,
 		      mode_t *attribute)
 {
   security_descriptor sd;
+  mode_t attr = S_IFCHR;
 
   if (get_object_sd (handle, sd))
     return -1;
-  get_info_from_sd (sd, attribute, uidret, gidret);
-  return 0;
+  if (attribute)
+    *attribute |= S_IFCHR;
+  else
+    attribute = &attr;
+  return get_posix_access (sd, attribute, uidret, gidret, NULL, 0)
+	 >= 0 ? 0 : -1;
 }
 
 int
-create_object_sd_from_attribute (HANDLE handle, uid_t uid, gid_t gid,
-				 mode_t attribute, security_descriptor &sd)
+create_object_sd_from_attribute (uid_t uid, gid_t gid, mode_t attribute,
+				 security_descriptor &sd)
 {
-  path_conv pc;
-  if ((handle && get_object_sd (handle, sd))
-      || !alloc_sd (pc, uid, gid, attribute, sd))
-    return -1;
-  return 0;
+  return set_posix_access (S_IFCHR | attribute, uid, gid, NULL, 0, sd, false)
+  	 ? 0 : -1;
 }
 
 int
@@ -985,36 +436,98 @@ set_object_sd (HANDLE handle, security_descriptor &sd, bool chown)
 }
 
 int
-set_object_attribute (HANDLE handle, uid_t uid, gid_t gid,
-		      mode_t attribute)
+set_object_attribute (HANDLE handle, uid_t uid, gid_t gid, mode_t attribute)
 {
   security_descriptor sd;
 
-  if (create_object_sd_from_attribute (handle, uid, gid, attribute, sd)
+  if (create_object_sd_from_attribute (uid, gid, attribute, sd)
       || set_object_sd (handle, sd, uid != ILLEGAL_UID || gid != ILLEGAL_GID))
     return -1;
   return 0;
 }
 
 int
-set_file_attribute (HANDLE handle, path_conv &pc,
-		    uid_t uid, gid_t gid, mode_t attribute)
+set_created_file_access (HANDLE handle, path_conv &pc, mode_t attr)
 {
   int ret = -1;
-
-  if (pc.has_acls ())
-    {
-      security_descriptor sd;
-
-      if (!get_file_sd (handle, pc, sd, (bool)(attribute & S_JUSTCREATED))
-	  && alloc_sd (pc, uid, gid, attribute, sd))
-	ret = set_file_sd (handle, pc, sd,
-			   uid != ILLEGAL_UID || gid != ILLEGAL_GID);
+  security_descriptor sd, sd_ret;
+  mode_t attr_rd;
+  uid_t uid;
+  gid_t gid;
+  tmp_pathbuf tp;
+  aclent_t *aclp;
+  int nentries, idx;
+
+  if (!get_file_sd (handle, pc, sd, true))
+    {
+      attr |= S_JUSTCREATED;
+      if (pc.isdir ())
+	attr |= S_IFDIR;
+      attr_rd = attr;
+      aclp = (aclent_t *) tp.c_get ();
+      if ((nentries = get_posix_access (sd, &attr_rd, &uid, &gid,
+					aclp, MAX_ACL_ENTRIES)) >= 0)
+	{
+	  if (S_ISLNK (attr))
+	    {
+	      /* Symlinks always get the request POSIX perms. */
+	      aclp[0].a_perm = (attr >> 6) & S_IRWXO;
+	      if ((idx = searchace (aclp, nentries, GROUP_OBJ)) >= 0)
+		aclp[idx].a_perm = (attr >> 3) & S_IRWXO;
+	      if (nentries > MIN_ACL_ENTRIES
+		  && (idx = searchace (aclp, nentries, CLASS_OBJ)) >= 0)
+		aclp[idx].a_perm = (attr >> 3) & S_IRWXO;
+	      if ((idx = searchace (aclp, nentries, OTHER_OBJ)) >= 0)
+		aclp[idx].a_perm = attr & S_IRWXO;
+	    }
+	  else
+	    {
+	      /* Overwrite ACL permissions as required by POSIX 1003.1e
+		 draft 17. */
+	      aclp[0].a_perm &= (attr >> 6) & S_IRWXO;
+	      /* Deliberate deviation from POSIX 1003.1e here.  We're not
+		 writing CLASS_OBJ *or* GROUP_OBJ, but both.  Otherwise we're
+		 going to be in constant trouble with user expectations. */
+	      if ((idx = searchace (aclp, nentries, GROUP_OBJ)) >= 0)
+		aclp[idx].a_perm &= (attr >> 3) & S_IRWXO;
+	      if (nentries > MIN_ACL_ENTRIES
+		  && (idx = searchace (aclp, nentries, CLASS_OBJ)) >= 0)
+		aclp[idx].a_perm &= (attr >> 3) & S_IRWXO;
+	      if ((idx = searchace (aclp, nentries, OTHER_OBJ)) >= 0)
+		aclp[idx].a_perm &= attr & S_IRWXO;
+	    }
+	  /* Construct appropriate inherit attribute for new directories.
+	     Basically we do this only for the sake of non-Cygwin applications.
+	     Cygwin applications don't need these.  Additionally, if the
+	     S_ISGID bit is set, propagate it. */
+	  if (S_ISDIR (attr))
+	    {
+	      if (searchace (aclp, nentries, DEF_USER_OBJ) < 0)
+		{
+		  aclp[nentries].a_type = DEF_USER_OBJ;
+		  aclp[nentries].a_id = ILLEGAL_UID;
+		  aclp[nentries++].a_perm = (attr >> 6) & S_IRWXO;
+		}
+	      if (searchace (aclp, nentries, DEF_GROUP_OBJ) < 0)
+		{
+		  aclp[nentries].a_type = DEF_GROUP_OBJ;
+		  aclp[nentries].a_id = ILLEGAL_GID;
+		  aclp[nentries++].a_perm = (attr >> 3) & S_IRWXO;
+		}
+	      if (searchace (aclp, nentries, DEF_OTHER_OBJ) < 0)
+		{
+		  aclp[nentries].a_type = DEF_OTHER_OBJ;
+		  aclp[nentries].a_id = ILLEGAL_UID;
+		  aclp[nentries++].a_perm = attr & S_IRWXO;
+		}
+	      if (attr_rd & S_ISGID)
+		attr |= S_ISGID;
+	    }
+	  if (set_posix_access (attr, uid, gid, aclp, nentries, sd_ret,
+				pc.fs_is_samba ()))
+	    ret = set_file_sd (handle, pc, sd_ret, attr_rd & S_ISGID);
+	}
     }
-  else
-    ret = 0;
-  syscall_printf ("%d = set_file_attribute(%S, %d, %d, 0%o)",
-		  ret, pc.get_nt_native_path (), uid, gid, attribute);
   return ret;
 }
 
@@ -1165,7 +678,7 @@ convert_samba_sd (security_descriptor &sd_ret)
 		  ace_sid.getfromgr (grp);
 	      }
 	  }
-	if (!add_access_allowed_ace (acl, i, ace->Mask, ace_sid, acl_len,
+	if (!add_access_allowed_ace (acl, ace->Mask, ace_sid, acl_len,
 				     ace->Header.AceFlags))
 	  return;
       }