DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 5AG9kSwr1415076
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 6ACB93858D20
Message-ID: <1fb9eb10-983a-43da-b523-06f6ede14436@towo.net>
Date: Sun, 16 Nov 2025 10:45:57 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Cygwin API to atomically create a new file with an ACL?
To: cygwin AT cygwin DOT com
References: <CA+1jF5q8VmGAiUyrQQ1dLa_0KLByfsFLtic86kr61HTTFAm9oA AT mail DOT gmail DOT com>
 <0a1391ac-adba-4420-b581-ccdb3842109a AT towo DOT net>
 <CA+1jF5r47SbFZHk4rp0z8K0ezGhrZpaVUu6pKMb=4VJnYQ0vcg AT mail DOT gmail DOT com>
 <d21b4aa3-3915-439e-9a07-2cb169ddf2ab AT towo DOT net>
Autocrypt: addr=towo AT towo DOT net; keydata=
 xsDNBGNaf3QBDACVevqudcTSevLThXKQPU1QpaDxtGuYjtwmr7i9wXxVGih4Y4oxOJN4PYlu
 KBX9IVAI4651dA+xYtXuyIkWOPZWyyzkGKavQOn3Q7dk09oj7bh2IwOndpxXXde337D408EQ
 bQEGbMHr9lOWhSAideowzgCeFIvGTf2AovbPh97HpexJn1/HCRiRAhTNlrkS1DByUgCAeEMK
 fEr6aGM/Ou29MT+eTnQwOIZTnl9Z9LxM2FtqqMH3MycC7I2OoW3XXhuL8BPQdyJUjWa0/J11
 Oo5jFkRXtWenIns6jGn18oW72jnDmo9jXwwS+iZWAV6Y51nhD7jSC+3xs9ORmPCdtHUSpTr1
 zh67UueUJ3DUUNVuA25Hn/9EJMJ2L60BGUEr88NEB6pcZhmcwdkurAQeYT6t+frzBz2ctsoN
 BoxP/Xc02yd+z7hXWRRMrJWh9WHlQHA3Z4FfmyNhyPhs3MgKTJ1E9QfzGquigAmF3/k/Dc1m
 7cSOKhGYhpEJdSpdXccJFKkAEQEAAc0cVGhvbWFzIFdvbGZmIDx0b3dvQHRvd28ubmV0PsLB
 BwQTAQgAMRYhBHUiRKsHn5d8BpWdP8bz0e72Bp0CBQJjWn93AhsDBAsJCAcFFQgJCgsFFgID
 AQAACgkQxvPR7vYGnQKSMAv8Di+8MXB2mcfsemRdShfLLKcLOv+d0CXAtPVaY3XKxbKpRvC9
 +AAT5wIHYjQft77/b2y87vGIh+nQ5hKLtNtQPSDtqG/Igkb5jAXpLi28fSUzgM96DvARmwve
 5wSnAU3prxH+Y63YpOpslEcGMRoEtYCDy1ANMYPcEZT/YvDd4CplyyEai4VYrw3/LsESDYlY
 GK6uMQzZ1jl2cNOUFu6BwLUeZIcwaqGto8n4R4nbf4jxUEpa21bWBPqE+Jf49uipjPr/iJ72
 5HbdWuuCfyTTJEJjfNEBigWP2RXM9iNDcO61V3aEjh76tThfBK2MMlLWfZkQaQziu24x8R4B
 I0efJYWBX2Sv2qnsH/EWj7FUIZjRqGG7LnWHLShfG6yjSOTOWYi8BbsvoftpaLWgZX28aGX4
 uzuSZ5L0caXh/pr/gSgqoH/YbuFIgqtQH4seOBgTybd22Vpe78rnc+8450pN8qwchHAZaJka
 UxS0SpYxXzXmHUKILA4C43s0U/z2Mez9zsDNBGNaf3cBDADeJ7paMrb6f1+k8wM7tyk0/Ded
 KX/pOejt/D20Ceerw2iL/4tUmBL+A3ic2yjiSFUSsEfHwgCVwKrn4MwZtkesdiphm2lk6xWc
 k1ENCQy44QwQT6UZ/mHWYWcj5LS6ua183x1zdn9iF3lv150nm/ssw56D7USz/ap1Vh0lf5te
 D+CIheGLocVDqxWiu7rHP8jKRWFgq/+OU6HKX8p2Yv1oYsykh9qF2bFzawLDS+S1VbfRicfD
 G0RtceL/BAf7b6UE5u9TGdfrFEa2TKZeS/FS/ViKUfwsXQIki1sWt2FQENbuDY28vxyR46ZZ
 0gixDCFUoBw5pkmOGVQa+1RQYrRqlN4X0CAgp7mFVeEHl5NTgiL1bemkQVmHOUDG+CzNg+Lk
 UGoedAtT672l3JjrnSs4j8zNshpgV2OfAhAC+V9XvqCjMnxzVfXkVlbuWpPfUWQeFclLGg8P
 agpQUE0Ux+VV4DoeQCxYEnRCf/n7n+IRfILj5+2l6Zw4M7zSu6ii0tUAEQEAAcLA9gQYAQgA
 IBYhBHUiRKsHn5d8BpWdP8bz0e72Bp0CBQJjWn97AhsMAAoJEMbz0e72Bp0CQr4L/REdT0SF
 mbapnZIe92THCdtAUgwEv8VdNiNFBJelz8P/fuXuNPtisYvQQD4e64zpWe2UC4Cxo9DUk/pW
 6Qci1xaXRKEiSPjHdSGGVB1PFIcqiS75GCf/ga/Dnfsy0Y4Uh6OGTQnkvZLBCe3vvcVLDQ7F
 PuV79zA9/eOeOW6aGoO6bq/wH+z96f9LyTITkQDy07fm6JYTGuzAoJE2AEboU1mgbtlx+tAa
 QFkpAQkp2g1Vhc3A7k4vntlHOrjMC+uVFh7QTGFfIlLRF6izUjSe6EZ06LErzlIiE05RP3yF
 FSRWidW0wze26peYlxYVgH1+T9wMTW2oiTBybfAMHBAxUP7Gr1WUo/oJEr0srWhatz8AwydP
 y7NwFbdpYn0NcFBaIlLW/JL11Eovwlivow+oGpzGFuuzSuflp2q9s2JWtn4EhW0kEs93D0LP
 iuJWvRaCZ6aD3uF3FMW8wyVWZYsLrzune2jH8w/uKMprDEOGOm+BcyhEFedTyY1ygbZKl+0G kQ==
In-Reply-To: <d21b4aa3-3915-439e-9a07-2cb169ddf2ab@towo.net>
UI-OutboundReport: notjunk:1;M01:P0:Iz1/ox6ljCQ=;VnILxmCiDCniG7WruEQtNdk/DXd
 TC8YwjDNpH2FKydlkcVUptQSpdNleVboznWizu6WyLfGLoWoqp0CXnTSuu5aOMrMNGqBnJ84a
 htW1tcwHG0ve7PjY0VK0CCrpxozCgpv31Ga7858+07S/dV2Run+JNGtRC+rp5nVjJleJohjr2
 3KTddsOubq2mz+oGinf3WYYugKSd7oe1z72CVCPur3BRb4zpCFD+7QDqPQjhNgxVxWw4GmYdI
 jBqTS32lZ1zY1A9IrzdnMXnaAnFgKaskbXsSwrNXUz3u+McAo6zfUkga2MzJxj55aBPemZd8t
 /Qk9A5yPNrr8+IxjE/VDpOTS+TZJYj2ywhzYH+Lw/Dxx8rY89TGGOyQqLms0lGwnYSu/ES9SB
 nogRRdd4Q4XqZcHHLfb1ur5ula+FsXO0lP5qk1YWv0QH83RXP8utZOPfrOy/1o3WakK7ZD8Cc
 FWMeIfchewQGvxbIQ19yetZou8wUFHYzCNWJh3DCb7z9s2ocxV5Npd4CxmjSopurMaVejN4Ud
 U/oU1Fqq6EKk3MFjwmYoVlSNo40k/hHFCCgcGkloQ38F0SwO3G52qYD8Kjm/70Cf1HM21zgb7
 j9378KKU31LLay7xftUs7kb/DPEqcKqKE2bnCTENfqrYssNFbAfbBfgp5jvPUsADEoYI/VCzw
 bNxiLwGd1NqppWmiZQ2q40EmBqoo02hBCxyDC8ovqM4C+BEX1e1T50O5LMBrBz08j+W0uYtaT
 tevXmEHoOtusb+BizHuOZ7jLkOmjaTs02gMvgqOsLz0KT7XaXNfqQPVCq2T06+mMo93yQcMGh
 DLikTQ4d++myQyK+/gMyTWrruZehMXaAN8gp2hs3EcmDdC/3CcpJFVBtdfHTnfEFnr7tsFamn
 RcOqwU92TfvQtlfDk9tw+oYhm5LTkknxeU3HhpsABO2NDTcsw5B8reGtAjZTFx9sP2G++itIx
 DV2GRprG0jQvke3uPWR07D5bdsRej0jETXHjlzq1Vo1bof1k2J4N0Z0NqpkbS0lOTnZxs4yoK
 4zzMrHqCbijFHMmQjw8gxi+sNHcFfwTY26Gdz7YLxQUYpsqtPy9Vmv5rjweHxeH0hoss6SybH
 Dkb0jBQXq6DiJxg4XxQsFBkydS+zOm+zUMyc6/XznFHY9qw6UQvT1hYqW7CF3jZ3kBNVy6sbW
 je+jD7wawnmfpmwYxZvFqJD+8VAppvj9J1vTNp0dBzMnJjvMeXeNXm6qIpHNxsLqB8k23idM2
 HpMrgGYWiTypfov5ancnzDELE3V0Mmlr7P9fQNca1dGLXQEbe4JicHKvSz8DD6stfQexEDOXS
 mdiGR20muMXEt1BBBQyefAVELsYpGPvLjGSoaMNmpxYheu19Urd8YW95YjkZj6ehBpFIqcVQ/
 d5VMJN1sUJKrMJLO/N/c5yp4giHpUsRgXoxvNrlBE7BPnUM1CFkMqYdrRuy3mbgByOTpMMXF+
 j+sGvMaOXRdVS491JTIz5LX5MYTPbbGWtR93os5TJAaE8XLu9KIhLK0bfxz2Cse59uFJvnzsc
 h/DJe786OY0zMppyZCGJfOO2U/TxRyeeMujuULjoouSrarRRAEeKrkmFOrRKpPdayV1crTm1G
 9DhRzkbkOHAY6S7Hi+Djje8t5o6FzVEJqC2ysLqZnZ5lUyK0GDAmUzECDQI12kuM1/44BeS5d
 q89RvqhNQA70A/TGU3zdZCOFedh2WO/OeIQnbGZejx7xx0S+5ZS5irUgBbAp42rZfkybo7354
 zTUghRUKeYCfq
Precedence: list
From: Thomas Wolff via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Thomas Wolff <towo AT towo DOT net>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit


Am 16.11.2025 um 02:40 schrieb Thomas Wolff via Cygwin:
> Am 15.11.2025 um 19:05 schrieb Aurélien Couderc via Cygwin:
>> On Sat, Nov 15, 2025 at 3:43 PM Thomas Wolff via Cygwin
>> <cygwin AT cygwin DOT com> wrote:
>>>
>>> Am 15.11.2025 um 13:58 schrieb Aurélien Couderc via Cygwin:
>>>> Does Cygwin have an API to atomically create a new file with an ACL?
>>>>
>>>> Aurélien
>>> I don't think there's such an API in POSIX. Instead it's the purpose of
>>> the directory default ACL entries to support this.
>>> While the manual pages of setfacl/getfacl are lousy, a fairly lucid
>>> description is in 7.6. POSIX Access Control Lists | Administration 
>>> Guide
>>> | Red Hat Gluster Storage | 3 | Red Hat Documentation
>>> <https://docs.redhat.com/en/documentation/red_hat_gluster_storage/3/html/administration_guide/sect-posix_access_control_lists>. 
>>>
>> That does not help. There are valid use cases, where this becomes
>> security relevant due race conditions between file creation and
>> setting of the ACLs.
>>
>> That's why all mainframe operating systems (and Windows WinNT as VMS
>> descendant) which support ACLs also support file creation with ACLs as
>> an argument.
>>
>> Aurélien
> The directory default ACL is like an implicit argument. I do not see a 
> race condition as my assumption is that the new file is equipped with 
> the inherited ACL in an atomic creation instance, although I do not 
> find this specified. Maybe someone has a more specific clue.
There is also manual page acl(5) but it's missing in cygwin:
acl(5): Access Control Lists - Linux man page 
<https://linux.die.net/man/5/acl>
Another good description is
Access control lists in Linux | Security and Hardening Guide | SLES 15 
SP7 
<https://documentation.suse.com/sles/15-SP7/html/SLES-all/cha-security-acls.html> 

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple