Cygwin API to atomically create a new file with an ACL?

[Thomas Wolff]

Am 16.11.2025 um 02:40 schrieb Thomas Wolff via Cygwin:
> Am 15.11.2025 um 19:05 schrieb Aurélien Couderc via Cygwin:
>> On Sat, Nov 15, 2025 at 3:43 PM Thomas Wolff via Cygwin
>> <cygwin@cygwin.com> wrote:
>>>
>>> Am 15.11.2025 um 13:58 schrieb Aurélien Couderc via Cygwin:
>>>> Does Cygwin have an API to atomically create a new file with an ACL?
>>>>
>>>> Aurélien
>>> I don't think there's such an API in POSIX. Instead it's the purpose of
>>> the directory default ACL entries to support this.
>>> While the manual pages of setfacl/getfacl are lousy, a fairly lucid
>>> description is in 7.6. POSIX Access Control Lists | Administration 
>>> Guide
>>> | Red Hat Gluster Storage | 3 | Red Hat Documentation
>>> <https://docs.redhat.com/en/documentation/red_hat_gluster_storage/3/html/administration_guide/sect-posix_access_control_lists>. 
>>>
>> That does not help. There are valid use cases, where this becomes
>> security relevant due race conditions between file creation and
>> setting of the ACLs.
>>
>> That's why all mainframe operating systems (and Windows WinNT as VMS
>> descendant) which support ACLs also support file creation with ACLs as
>> an argument.
>>
>> Aurélien
> The directory default ACL is like an implicit argument. I do not see a 
> race condition as my assumption is that the new file is equipped with 
> the inherited ACL in an atomic creation instance, although I do not 
> find this specified. Maybe someone has a more specific clue.
There is also manual page acl(5) but it's missing in cygwin:
acl(5): Access Control Lists - Linux man page 
<https://linux.die.net/man/5/acl>
Another good description is
Access control lists in Linux | Security and Hardening Guide | SLES 15 
SP7 
<https://documentation.suse.com/sles/15-SP7/html/SLES-all/cha-security-acls.html>