Cygwin API to atomically create a new file with an ACL?

[Thomas Wolff]

Am 15.11.2025 um 19:05 schrieb Aurélien Couderc via Cygwin:
> On Sat, Nov 15, 2025 at 3:43 PM Thomas Wolff via Cygwin
> <cygwin@cygwin.com> wrote:
>>
>> Am 15.11.2025 um 13:58 schrieb Aurélien Couderc via Cygwin:
>>> Does Cygwin have an API to atomically create a new file with an ACL?
>>>
>>> Aurélien
>> I don't think there's such an API in POSIX. Instead it's the purpose of
>> the directory default ACL entries to support this.
>> While the manual pages of setfacl/getfacl are lousy, a fairly lucid
>> description is in 7.6. POSIX Access Control Lists | Administration Guide
>> | Red Hat Gluster Storage | 3 | Red Hat Documentation
>> <https://docs.redhat.com/en/documentation/red_hat_gluster_storage/3/html/administration_guide/sect-posix_access_control_lists>.
> That does not help. There are valid use cases, where this becomes
> security relevant due race conditions between file creation and
> setting of the ACLs.
>
> That's why all mainframe operating systems (and Windows WinNT as VMS
> descendant) which support ACLs also support file creation with ACLs as
> an argument.
>
> Aurélien
The directory default ACL is like an implicit argument. I do not see a 
race condition as my assumption is that the new file is equipped with 
the inherited ACL in an atomic creation instance, although I do not find 
this specified. Maybe someone has a more specific clue.