* security.cc (get_file_sd): Add bool parameter justcreated. Use

	GetSecurityInfo only if justcreated is true, NtQuerySecurityObject
	otherwise.  Add comment to explain why.  Don't waste time to call
	NtQuerySecurityObject twice, just allocate big enough area.
	(get_file_attribute): Call get_file_sd with justcreated set to false.
	(set_file_attribute): Call get_file_sd with justcreated depending on
	S_JUSTCREATED pseudo file attribute.
	(check_file_access): Call get_file_sd with justcreated set to false.
	* sec_acl.cc (setacl): Ditto.
	(getacl): Ditto.
	* security.h: Convert many functions to regparm functions.
	(get_file_sd): Declare with extra bool parameter.

4 files changed, 100 insertions, 41 deletions

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 1b5da688d..eb15dd325 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,5 +1,20 @@
 2010-09-10  Corinna Vinschen  <corinna@vinschen.de>
 
+	* security.cc (get_file_sd): Add bool parameter justcreated.  Use
+	GetSecurityInfo only if justcreated is true, NtQuerySecurityObject
+	otherwise.  Add comment to explain why.  Don't waste time to call
+	NtQuerySecurityObject twice, just allocate big enough area.
+	(get_file_attribute): Call get_file_sd with justcreated set to false.
+	(set_file_attribute): Call get_file_sd with justcreated depending on
+	S_JUSTCREATED pseudo file attribute.
+	(check_file_access): Call get_file_sd with justcreated set to false.
+	* sec_acl.cc (setacl): Ditto.
+	(getacl): Ditto.
+	* security.h: Convert many functions to regparm functions.
+	(get_file_sd): Declare with extra bool parameter.
+
+2010-09-10  Corinna Vinschen  <corinna@vinschen.de>
+
 	* fhandler_procsys.cc (fhandler_procsys::exists): Rearrange to handle
 	dangling symlinks correctly.  Fix comments.
 	(fhandler_procsys::fill_filebuf): Remove useless comment.
diff --git a/winsup/cygwin/sec_acl.cc b/winsup/cygwin/sec_acl.cc
index 88abac46a..fbf2bffa7 100644
--- a/winsup/cygwin/sec_acl.cc
+++ b/winsup/cygwin/sec_acl.cc
@@ -41,7 +41,7 @@ setacl (HANDLE handle, path_conv &pc, int nentries, __aclent32_t *aclbufp,
 {
   security_descriptor sd_ret;
 
-  if (get_file_sd (handle, pc, sd_ret))
+  if (get_file_sd (handle, pc, sd_ret, false))
     return -1;
 
   BOOL dummy;
@@ -272,7 +272,7 @@ getacl (HANDLE handle, path_conv &pc, int nentries, __aclent32_t *aclbufp)
 {
   security_descriptor sd;
 
-  if (get_file_sd (handle, pc, sd))
+  if (get_file_sd (handle, pc, sd, false))
     return -1;
 
   cygpsid owner_sid;
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index d101623c7..e88fcf2fc 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -31,7 +31,8 @@ details. */
 				  | OWNER_SECURITY_INFORMATION)
 
 LONG
-get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd)
+get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
+	     bool justcreated)
 {
   DWORD error = ERROR_SUCCESS;
   int retry = 0;
@@ -41,19 +42,47 @@ get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd)
     {
       if (fh)
 	{
-	  /* Amazing but true.  If you want to know if an ACE is inherited
-	     from the parent object, you can't use the NtQuerySecurityObject
-	     function.  In the DACL returned by this functions, the
-	     INHERITED_ACE flag is never set.  Only by calling GetSecurityInfo
-	     you get this information.  Oh well. */
-	  PSECURITY_DESCRIPTOR psd;
-	  error = GetSecurityInfo (fh, SE_FILE_OBJECT, ALL_SECURITY_INFORMATION,
-				   NULL, NULL, NULL, NULL, &psd);
-	  if (error == ERROR_SUCCESS)
+	  if (justcreated)
 	    {
-	      sd = psd;
-	      res = 0;
-	      break;
+	      /* Amazing but true.  If you want to know if an ACE is inherited
+		 from the parent object, you can't use the NtQuerySecurityObject
+		 function.  In the DACL returned by this functions, the
+		 INHERITED_ACE flag is never set.  Only by calling
+		 GetSecurityInfo you get this information.
+		 
+		 This functionality is slow, and the extra information is only
+		 required when the file has been created and the permissions
+		 are about to be set to POSIX permissions.  Therefore we only
+		 use it in case the file just got created.  In all other cases
+		 we rather call NtQuerySecurityObject directly. */
+	      PSECURITY_DESCRIPTOR psd;
+	      error = GetSecurityInfo (fh, SE_FILE_OBJECT, ALL_SECURITY_INFORMATION,
+				       NULL, NULL, NULL, NULL, &psd);
+	      if (error == ERROR_SUCCESS)
+		{
+		  sd = psd;
+		  res = 0;
+		  break;
+		}
+	    }
+	  else
+	    {
+	      NTSTATUS status;
+	      ULONG len = 32768;
+
+	      if (!sd.malloc (len))
+		{
+		  set_errno (ENOMEM);
+		  break;
+		}
+	      status = NtQuerySecurityObject (fh, ALL_SECURITY_INFORMATION,
+					      sd, len, &len);
+	      if (NT_SUCCESS (status))
+		{
+		  res = 0;
+		  break;
+		}
+	      error = RtlNtStatusToDosError (status);
 	    }
 	}
       if (!retry)
@@ -323,7 +352,7 @@ get_file_attribute (HANDLE handle, path_conv &pc,
     {
       security_descriptor sd;
 
-      if (!get_file_sd (handle, pc, sd))
+      if (!get_file_sd (handle, pc, sd, false))
 	{
 	  get_info_from_sd (sd, attribute, uidret, gidret);
 	  return 0;
@@ -828,7 +857,7 @@ set_file_attribute (HANDLE handle, path_conv &pc,
     {
       security_descriptor sd;
 
-      if (!get_file_sd (handle, pc, sd)
+      if (!get_file_sd (handle, pc, sd, attribute & S_JUSTCREATED)
 	  && alloc_sd (pc, uid, gid, attribute, sd))
 	ret = set_file_sd (handle, pc, sd,
 			   uid != ILLEGAL_UID || gid != ILLEGAL_GID);
@@ -928,7 +957,7 @@ check_file_access (path_conv &pc, int flags, bool effective)
     desired |= FILE_WRITE_DATA;
   if (flags & X_OK)
     desired |= FILE_EXECUTE;
-  if (!get_file_sd (NULL, pc, sd))
+  if (!get_file_sd (NULL, pc, sd, false))
     ret = check_access (sd, mapping, desired, flags, effective);
   debug_printf ("flags %x, ret %d", flags, ret);
   return ret;
diff --git a/winsup/cygwin/security.h b/winsup/cygwin/security.h
index dde4d214e..d38edc16d 100644
--- a/winsup/cygwin/security.h
+++ b/winsup/cygwin/security.h
@@ -348,24 +348,37 @@ legal_sid_type (SID_NAME_USE type)
 class path_conv;
 /* File manipulation */
 int __stdcall get_file_attribute (HANDLE, path_conv &, mode_t *,
-				  __uid32_t *, __gid32_t *);
+				  __uid32_t *, __gid32_t *)
+		__attribute__ ((regparm (3)));
 int __stdcall set_file_attribute (HANDLE, path_conv &,
-				  __uid32_t, __gid32_t, mode_t);
-int __stdcall get_object_sd (HANDLE, security_descriptor &);
-int __stdcall get_object_attribute (HANDLE, __uid32_t *, __gid32_t *, mode_t *);
-int __stdcall set_object_attribute (HANDLE, __uid32_t, __gid32_t, mode_t);
+				  __uid32_t, __gid32_t, mode_t)
+		__attribute__ ((regparm (3)));
+int __stdcall get_object_sd (HANDLE, security_descriptor &)
+		__attribute__ ((regparm (2)));
+int __stdcall get_object_attribute (HANDLE, __uid32_t *, __gid32_t *, mode_t *)
+		__attribute__ ((regparm (3)));
+int __stdcall set_object_attribute (HANDLE, __uid32_t, __gid32_t, mode_t)
+		__attribute__ ((regparm (3)));
 int __stdcall create_object_sd_from_attribute (HANDLE, __uid32_t, __gid32_t,
-					       mode_t, security_descriptor &);
-int __stdcall set_object_sd (HANDLE, security_descriptor &, bool);
-
-int __stdcall get_reg_attribute (HKEY hkey, mode_t *, __uid32_t *, __gid32_t *);
-LONG __stdcall get_file_sd (HANDLE fh, path_conv &, security_descriptor &sd);
-LONG __stdcall set_file_sd (HANDLE fh, path_conv &, security_descriptor &sd,
-			    bool is_chown);
-bool __stdcall add_access_allowed_ace (PACL acl, int offset, DWORD attributes, PSID sid, size_t &len_add, DWORD inherit);
-bool __stdcall add_access_denied_ace (PACL acl, int offset, DWORD attributes, PSID sid, size_t &len_add, DWORD inherit);
-int __stdcall check_file_access (path_conv &, int, bool);
-int __stdcall check_registry_access (HANDLE, int, bool);
+					       mode_t, security_descriptor &)
+		__attribute__ ((regparm (3)));
+int __stdcall set_object_sd (HANDLE, security_descriptor &, bool)
+		__attribute__ ((regparm (3)));
+
+int __stdcall get_reg_attribute (HKEY hkey, mode_t *, __uid32_t *, __gid32_t *)
+		__attribute__ ((regparm (3)));
+LONG __stdcall get_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
+		__attribute__ ((regparm (3)));
+LONG __stdcall set_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
+		__attribute__ ((regparm (3)));
+bool __stdcall add_access_allowed_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
+		__attribute__ ((regparm (3)));
+bool __stdcall add_access_denied_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
+		__attribute__ ((regparm (3)));
+int __stdcall check_file_access (path_conv &, int, bool)
+		__attribute__ ((regparm (3)));
+int __stdcall check_registry_access (HANDLE, int, bool)
+		__attribute__ ((regparm (3)));
 
 void set_security_attribute (path_conv &pc, int attribute,
 			     PSECURITY_ATTRIBUTES psa,
@@ -437,9 +450,9 @@ void set_cygwin_privileges (HANDLE token);
 
 /* Various types of security attributes for use in Create* functions. */
 extern SECURITY_ATTRIBUTES sec_none, sec_none_nih, sec_all, sec_all_nih;
-extern SECURITY_ATTRIBUTES *__stdcall __sec_user (PVOID sa_buf, PSID sid1, PSID sid2,
-						  DWORD access2, BOOL inherit)
-  __attribute__ ((regparm (3)));
+extern SECURITY_ATTRIBUTES *__stdcall __sec_user (PVOID, PSID, PSID,
+						  DWORD, BOOL)
+		__attribute__ ((regparm (3)));
 extern PSECURITY_DESCRIPTOR _everyone_sd (void *buf, ACCESS_MASK access);
 #define everyone_sd(access)	(_everyone_sd (alloca (SD_MIN_SIZE), (access)))
 
@@ -448,10 +461,12 @@ extern PSECURITY_DESCRIPTOR _everyone_sd (void *buf, ACCESS_MASK access);
 extern bool sec_acl (PACL acl, bool original, bool admins, PSID sid1 = NO_SID,
 		     PSID sid2 = NO_SID, DWORD access2 = 0);
 
-ssize_t __stdcall read_ea (HANDLE hdl, path_conv &pc, const char *name,
-			   char *value, size_t size);
-int __stdcall write_ea (HANDLE hdl, path_conv &pc, const char *name,
-			const char *value, size_t size, int flags);
+ssize_t __stdcall read_ea (HANDLE, path_conv &, const char *,
+			   char *, size_t)
+		__attribute__ ((regparm (3)));
+int __stdcall write_ea (HANDLE, path_conv &, const char *, const char *,
+			size_t, int)
+		__attribute__ ((regparm (3)));
 
 /* Note: sid1 is usually (read: currently always) the current user's
    effective sid (cygheap->user.sid ()). */