merge from trunk

13 files changed, 325 insertions, 181 deletions

diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 3767b8e..8cf2ca7 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,89 @@
+2003-02-07  Vaclav Haisman  <V.Haisman@sh.cvut.cz>
+	    Christopher Faylor  <cgf@redhat.com>
+
+	* exceptions.cc (try_to_debug): Set priority of current thread rather
+	than the main thread.  Make busy waiting loop less busy.  Restore
+	priority when function returns.
+
+2003-02-07  Christopher Faylor  <cgf@redhat.com>
+
+	* malloc.cc (DEFAULT_MMAP_THRESHOLD): Set high to avoid mmaps.
+
+2003-02-07  Christopher Faylor  <cgf@redhat.com>
+
+	* pipe.cc (fhandler_pipe::close): Avoid extraneous this->.
+
+2003-02-06  Christopher Faylor  <cgf@redhat.com>
+
+	* heap.cc (heap_init): Remove debugging code.
+
+2003-02-06  Pierre Humblet  <pierre.humblet@ieee.org>
+
+	* security.h: Introduce names UNKNOWN_UID and UNKNOWN_GID and delete
+	declaration of is_grp_member.
+	* uinfo.cc (internal_getlogin): Use UNKNOWN_GID.
+	* passwd.cc (pwdgrp::read_passwd): Use UNKNOWN_UID.
+	* grp.cc (pwdgrp::read_group): Change group name to provide better
+	feedback.
+	(getgrgid): Use gid16togid32.
+	* sec_helper.cc (is_grp_member): Delete.
+
+2003-02-05  Christopher Faylor  <cgf@redhat.com>
+
+	* path.cc: Change 'to_posix_p' to 'to_posix' throughout.
+	(conv_path_list_buf_size): Accommodate relative paths.
+
+2003-02-05  Christopher Faylor  <cgf@redhat.com>
+
+	* path.cc (etc::dir_changed): Fix debug printf.
+
+2003-02-05  Corinna Vinschen  <corinna@vinschen.de>
+
+	* sec_acl.cc (setacl): Move all permission settings to beginning of
+	loop.  Set default rights to same values as in alloc_sd().  Set DELETE
+	for owner and default owner only if S_IWOTH is given.
+
+2003-02-05  Pierre Humblet  <pierre.humblet@ieee.org>
+
+	* sec_acl.cc: Change all  __aclent16_t to  __aclent32_t except in
+	wrapper function definitions. Replace call to the aclXYZ functions by
+	calls aclXYZ32.
+	(searchace): Change type of third argument to __uid32_t and use
+	ILLEGAL_UID instead of -1;
+	(setacl): Remove some initializations. Only give STANDARD_RIGHTS_WRITE
+	for S_IWOTH. Replace -1 by ILLEGAL_UID.
+	(getacl): Change type of owner_sid, group_sid and ace_sid to cygpsid.
+	In last else clause, suppress second call to ace_sid.get_id and use
+	TRUE in first call. Replace EqualSid by ==.
+	(acl_access): Call internal_getgroups in USER and GROUP cases.
+	(acecmp: Define static.
+	(acl32): Create from 16 bit type.
+	(facl32): Ditto.
+	(lacl32): Ditto.
+	(aclcheck32): Ditto.
+	(aclsort32): Ditto.
+	(acltomode32): Ditto.
+	(aclfrommode32): Ditto.
+	(acltopbits32): Ditto.
+	(aclfrompbits32): Ditto.
+	(acltotext32): Ditto.
+	(aclfromtext32): Ditto, and use strechr.
+	(acl16to32): Create.
+	(acl): Make it a wrapper function.
+	(facl): Ditto.
+	(lacl): Ditto.
+	(aclcheck): Ditto.
+	(aclsort): Ditto.
+	(acltomode): Ditto.
+	(aclfrommode): Ditto.
+	(acltopbits): Ditto.
+	(aclfrompbits): Ditto.
+	(acltotext): Ditto.
+	(aclfromtext): Ditto.
+	* security.cc (write_sd): Call set_process_privilege and check
+	ownership.
+	(alloc_sd): Remove call to set_process_privilege and the owner check.
+
 2003-02-05  Christopher Faylor  <cgf@redhat.com>
 
 	* include/sys/cygwin.h: Use C-style comments.
@@ -48,7 +134,7 @@
 	* pwdgrp.h: Change arguments of internal_getpwsid,
 	internal_getgrsid and internal_getgroups to cygpsid.
 	* passwd.cc (internal_getpwsid): Change argument from cygsid to cygpsid.
-	* grp.cc (internal_getgrsid): Ditto. 
+	* grp.cc (internal_getgrsid): Ditto.
 	(internal_getgroups): Ditto.
 
 2003-02-03  Christopher Faylor  <cgf@redhat.com>
diff --git a/winsup/cygwin/exceptions.cc b/winsup/cygwin/exceptions.cc
index 84b2f17..352cda0 100644
--- a/winsup/cygwin/exceptions.cc
+++ b/winsup/cygwin/exceptions.cc
@@ -343,7 +343,8 @@ try_to_debug (bool waitloop)
 
   __small_sprintf (strchr (debugger_command, '\0'), " %u", GetCurrentProcessId ());
 
-  SetThreadPriority (hMainThread, THREAD_PRIORITY_HIGHEST);
+  LONG prio = GetThreadPriority (GetCurrentThread ());
+  SetThreadPriority (GetCurrentThread (), THREAD_PRIORITY_HIGHEST);
   PROCESS_INFORMATION pi = {NULL, 0, 0, 0};
 
   STARTUPINFO si = {0, NULL, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL};
@@ -391,15 +392,17 @@ try_to_debug (bool waitloop)
     system_printf ("Failed to start debugger: %E");
   else
     {
-      SetThreadPriority (hMainThread, THREAD_PRIORITY_IDLE);
+      SetThreadPriority (GetCurrentThread (), THREAD_PRIORITY_IDLE);
       if (!waitloop)
 	return 1;
       while (!being_debugged ())
-	/* spin */;
-      Sleep (4000);
+	Sleep (0);
+      Sleep (2000);
       small_printf ("*** continuing from debugger call\n");
     }
 
+  SetThreadPriority (GetCurrentThread (), prio);
+
   /* FIXME: need to know handles of all running threads to
     resume_all_threads_except (current_thread_id);
   */
diff --git a/winsup/cygwin/grp.cc b/winsup/cygwin/grp.cc
index cee32a2..2d385c6 100644
--- a/winsup/cygwin/grp.cc
+++ b/winsup/cygwin/grp.cc
@@ -95,6 +95,8 @@ pwdgrp::read_group ()
 	  if ((gr = internal_getgrsid (cygheap->user.groups.pgsid)))
 	    strlcpy (group_name, gr->gr_name, sizeof (group_name));
 	}
+      if (myself->uid == UNKNOWN_UID)
+	strcpy (group_name, "mkpasswd"); /* Feedback... */
       snprintf (linebuf, sizeof (linebuf), "%s:%s:%lu:%s",
 		group_name, strbuf, myself->gid, cygheap->user.name ());
       debug_printf ("Completing /etc/group: %s", linebuf);
@@ -171,7 +173,7 @@ getgrgid (__gid16_t gid)
 {
   static struct __group16 g16;	/* FIXME: thread-safe? */
 
-  return grp32togrp16 (&g16, getgrgid32 ((__gid32_t) gid));
+  return grp32togrp16 (&g16, getgrgid32 (gid16togid32 (gid)));
 }
 
 extern "C" struct __group32 *
diff --git a/winsup/cygwin/heap.cc b/winsup/cygwin/heap.cc
index 19ce3f8..fb1e37c 100644
--- a/winsup/cygwin/heap.cc
+++ b/winsup/cygwin/heap.cc
@@ -69,8 +69,6 @@ heap_init ()
 
       /* Loop until we've managed to reserve an adequate amount of memory. */
       char *p;
-MEMORY_BASIC_INFORMATION m;
-(void) VirtualQuery (cygheap->user_heap.base, &m, sizeof (m));
       for (;;)
 	{
 	  p = (char *) VirtualAlloc (cygheap->user_heap.base, reserve_size,
@@ -80,18 +78,6 @@ MEMORY_BASIC_INFORMATION m;
 	  if ((reserve_size -= page_const) <= allocsize)
 	    break;
 	}
-      if (p == NULL)
-{
-system_printf ("unable to allocate heap %p, chunk %u, reserve %u, alloc %u, %E",
-cygheap->user_heap.base, cygheap->user_heap.chunk,
-reserve_size, allocsize);
-system_printf ("base %p mem alloc base %p, state %p, size %d, %E",
-cygheap->user_heap.base, m.AllocationBase, m.State, m.RegionSize);
-error_start_init ("h:/gdbtest/gdb.exe < con > con"); try_to_debug ();
-	api_fatal ("unable to allocate heap %p, chunk %u, reserve %u, alloc %u, %E",
-		   cygheap->user_heap.base, cygheap->user_heap.chunk,
-		   reserve_size, allocsize);
-}
       if (p != cygheap->user_heap.base)
 	api_fatal ("heap allocated but not at %p", cygheap->user_heap.base);
       if (!VirtualAlloc (cygheap->user_heap.base, allocsize, MEM_COMMIT, PAGE_READWRITE))
diff --git a/winsup/cygwin/malloc.cc b/winsup/cygwin/malloc.cc
index 2e0a5cc..85965c0 100644
--- a/winsup/cygwin/malloc.cc
+++ b/winsup/cygwin/malloc.cc
@@ -1455,6 +1455,8 @@ void     public_mSTATs();
 
 #define M_MMAP_THRESHOLD      -3
 
+#define DEFAULT_MMAP_THRESHOLD (128 * 1024 * 1024)
+
 #ifndef DEFAULT_MMAP_THRESHOLD
 #define DEFAULT_MMAP_THRESHOLD (256 * 1024)
 #endif
diff --git a/winsup/cygwin/passwd.cc b/winsup/cygwin/passwd.cc
index ad784ad..cdb73b0 100644
--- a/winsup/cygwin/passwd.cc
+++ b/winsup/cygwin/passwd.cc
@@ -87,7 +87,7 @@ pwdgrp::read_passwd ()
       (void) cygheap->user.ontherange (CH_HOME, NULL);
       snprintf (linebuf, sizeof (linebuf), "%s:*:%lu:%lu:,%s:%s:/bin/sh",
 		cygheap->user.name (),
-		myself->uid == ILLEGAL_UID ? DEFAULT_UID_NT : myself->uid,
+		myself->uid == ILLEGAL_UID ? UNKNOWN_UID : myself->uid,
 		myself->gid,
 		strbuf, getenv ("HOME") ?: "");
       debug_printf ("Completing /etc/passwd: %s", linebuf);
diff --git a/winsup/cygwin/path.cc b/winsup/cygwin/path.cc
index d058199..bcbae01 100644
--- a/winsup/cygwin/path.cc
+++ b/winsup/cygwin/path.cc
@@ -1070,13 +1070,13 @@ slash_unc_prefix_p (const char *path)
 /* conv_path_list: Convert a list of path names to/from Win32/POSIX. */
 
 static void
-conv_path_list (const char *src, char *dst, int to_posix_p)
+conv_path_list (const char *src, char *dst, int to_posix)
 {
   char *s;
   char *d = dst;
-  char src_delim = to_posix_p ? ';' : ':';
-  char dst_delim = to_posix_p ? ':' : ';';
-  int (*conv_fn) (const char *, char *) = (to_posix_p
+  char src_delim = to_posix ? ';' : ':';
+  char dst_delim = to_posix ? ':' : ';';
+  int (*conv_fn) (const char *, char *) = (to_posix
 					   ? cygwin_conv_to_posix_path
 					   : cygwin_conv_to_win32_path);
 
@@ -3315,23 +3315,29 @@ cygwin_posix_path_list_p (const char *path)
    allows the caller to use alloca if it wants.  */
 
 static int
-conv_path_list_buf_size (const char *path_list, int to_posix_p)
+conv_path_list_buf_size (const char *path_list, bool to_posix)
 {
   int i, num_elms, max_mount_path_len, size;
   const char *p;
 
+  path_conv pc(".", PC_FULL | PC_POSIX);
   /* The theory is that an upper bound is
      current_size + (num_elms * max_mount_path_len)  */
 
-  char delim = to_posix_p ? ';' : ':';
-  p = path_list;
-  for (num_elms = 1; (p = strchr (p, delim)) != NULL; ++num_elms)
-    ++p;
+  unsigned nrel;
+  char delim = to_posix ? ';' : ':';
+  for (p = path_list, num_elms = nrel = 0; p; num_elms++)
+    {
+      if (!isabspath (p))
+	nrel++;
+      p = strchr (++p, delim);
+    }
 
   /* 7: strlen ("//c") + slop, a conservative initial value */
-  for (max_mount_path_len = 7, i = 0; i < mount_table->nmounts; ++i)
+  for (max_mount_path_len = sizeof ("/cygdrive/X"), i = 0;
+       i < mount_table->nmounts; i++)
     {
-      int mount_len = (to_posix_p
+      int mount_len = (to_posix
 		       ? mount_table->mount[i].posix_pathlen
 		       : mount_table->mount[i].native_pathlen);
       if (max_mount_path_len < mount_len)
@@ -3339,20 +3345,23 @@ conv_path_list_buf_size (const char *path_list, int to_posix_p)
     }
 
   /* 100: slop */
-  size = strlen (path_list) + (num_elms * max_mount_path_len) + 100;
+  size = strlen (path_list)
+    + (num_elms * max_mount_path_len)
+    + (nrel * strlen (to_posix ? pc.get_win32 () : pc.normalized_path))
+    + 100;
   return size;
 }
 
 extern "C" int
 cygwin_win32_to_posix_path_list_buf_size (const char *path_list)
 {
-  return conv_path_list_buf_size (path_list, 1);
+  return conv_path_list_buf_size (path_list, true);
 }
 
 extern "C" int
 cygwin_posix_to_win32_path_list_buf_size (const char *path_list)
 {
-  return conv_path_list_buf_size (path_list, 0);
+  return conv_path_list_buf_size (path_list, false);
 }
 
 extern "C" int
@@ -3645,8 +3654,7 @@ etc::dir_changed (int n)
 						  | FILE_NOTIFY_CHANGE_FILE_NAME);
 #ifdef DEBUGGING
 	  if (changed_h == INVALID_HANDLE_VALUE)
-	    system_printf ("Can't open /etc for checking, %E", (char *) pwd,
-			   changed_h);
+	    system_printf ("Can't open %s for checking, %E", (char *) pwd);
 #endif
 	  memset (change_possible, true, sizeof (change_possible));
 	}
diff --git a/winsup/cygwin/pipe.cc b/winsup/cygwin/pipe.cc
index 51c74cf..75d3e98 100644
--- a/winsup/cygwin/pipe.cc
+++ b/winsup/cygwin/pipe.cc
@@ -86,6 +86,7 @@ fhandler_pipe::read (void *in_ptr, size_t& in_len)
 int
 fhandler_pipe::close ()
 {
+  int res = fhandler_base::close ();
   if (guard)
     CloseHandle (guard);
   if (writepipe_exists)
diff --git a/winsup/cygwin/sec_acl.cc b/winsup/cygwin/sec_acl.cc
index a7fc462..febda4f 100644
--- a/winsup/cygwin/sec_acl.cc
+++ b/winsup/cygwin/sec_acl.cc
@@ -32,23 +32,23 @@ details. */
 #include "cygheap.h"
 #include "pwdgrp.h"
 
-extern "C" int aclsort (int nentries, int, __aclent16_t *aclbufp);
-extern "C" int acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp);
+extern "C" int aclsort32 (int nentries, int, __aclent32_t *aclbufp);
+extern "C" int acl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp);
 
 static int
-searchace (__aclent16_t *aclp, int nentries, int type, int id = -1)
+searchace (__aclent32_t *aclp, int nentries, int type, __uid32_t id = ILLEGAL_UID)
 {
   int i;
 
   for (i = 0; i < nentries; ++i)
-    if ((aclp[i].a_type == type && (id == -1 || aclp[i].a_id == id))
+    if ((aclp[i].a_type == type && (id == ILLEGAL_UID || aclp[i].a_id == id))
 	|| !aclp[i].a_type)
       return i;
   return -1;
 }
 
 static int
-setacl (const char *file, int nentries, __aclent16_t *aclbufp)
+setacl (const char *file, int nentries, __aclent32_t *aclbufp)
 {
   DWORD sd_size = 4096;
   char sd_buf[4096];
@@ -63,7 +63,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
   BOOL dummy;
 
   /* Get owner SID. */
-  PSID owner_sid = NULL;
+  PSID owner_sid;
   if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy))
     {
       __seterrno ();
@@ -72,7 +72,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
   cygsid owner (owner_sid);
 
   /* Get group SID. */
-  PSID group_sid = NULL;
+  PSID group_sid;
   if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy))
     {
       __seterrno ();
@@ -92,8 +92,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
       __seterrno ();
       return -1;
     }
-  if (group
-      && !SetSecurityDescriptorGroup (&sd, group, FALSE))
+  if (!SetSecurityDescriptorGroup (&sd, group, FALSE))
     {
       __seterrno ();
       return -1;
@@ -117,12 +116,22 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
     }
   for (int i = 0; i < nentries; ++i)
     {
-      DWORD allow = STANDARD_RIGHTS_READ
-		    | FILE_READ_ATTRIBUTES | FILE_READ_EA;
+      DWORD allow;
+      /* Owner has more standard rights set. */
+      if ((aclbufp[i].a_type & ~ACL_DEFAULT) == USER_OBJ)
+	allow = (STANDARD_RIGHTS_ALL & ~DELETE)
+		| FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA;
+      else
+	allow = STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES | FILE_READ_EA;
       if (aclbufp[i].a_perm & S_IROTH)
 	allow |= FILE_GENERIC_READ;
       if (aclbufp[i].a_perm & S_IWOTH)
-	allow |= STANDARD_RIGHTS_ALL | FILE_GENERIC_WRITE;
+        {
+	  allow |= STANDARD_RIGHTS_WRITE | FILE_GENERIC_WRITE;
+	  /* Owner gets DELETE right, too. */
+	  if ((aclbufp[i].a_type & ~ACL_DEFAULT) == USER_OBJ)
+	    allow |= DELETE;
+	}
       if (aclbufp[i].a_perm & S_IXOTH)
 	allow |= FILE_GENERIC_EXECUTE;
       if ((aclbufp[i].a_perm & (S_IWOTH | S_IXOTH)) == (S_IWOTH | S_IXOTH))
@@ -141,7 +150,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
 	  && (pos = searchace (aclbufp + i + 1, nentries - i - 1,
 			       aclbufp[i].a_type | ACL_DEFAULT,
 			       (aclbufp[i].a_type & (USER|GROUP))
-			       ? aclbufp[i].a_id : -1)) >= 0
+			       ? aclbufp[i].a_id : ILLEGAL_UID)) >= 0
 	  && aclbufp[i].a_perm == aclbufp[pos].a_perm)
 	{
 	  inheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
@@ -151,13 +160,11 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
       switch (aclbufp[i].a_type)
 	{
 	case USER_OBJ:
-	  allow |= STANDARD_RIGHTS_ALL & ~DELETE;
 	  if (!add_access_allowed_ace (acl, ace_off++, allow,
 					owner, acl_len, inheritance))
 	    return -1;
 	  break;
 	case DEF_USER_OBJ:
-	  allow |= STANDARD_RIGHTS_ALL & ~DELETE;
 	  if (!add_access_allowed_ace (acl, ace_off++, allow,
 				       well_known_creator_owner_sid, acl_len, inheritance))
 	    return -1;
@@ -167,12 +174,12 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
 	  if (!(pw = internal_getpwuid (aclbufp[i].a_id))
 	      || !sid.getfrompw (pw)
 	      || !add_access_allowed_ace (acl, ace_off++, allow,
-					   sid, acl_len, inheritance))
+					  sid, acl_len, inheritance))
 	    return -1;
 	  break;
 	case GROUP_OBJ:
 	  if (!add_access_allowed_ace (acl, ace_off++, allow,
-					group, acl_len, inheritance))
+				       group, acl_len, inheritance))
 	    return -1;
 	  break;
 	case DEF_GROUP_OBJ:
@@ -185,7 +192,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
 	  if (!(gr = internal_getgrgid (aclbufp[i].a_id))
 	      || !sid.getfromgr (gr)
 	      || !add_access_allowed_ace (acl, ace_off++, allow,
-					   sid, acl_len, inheritance))
+					  sid, acl_len, inheritance))
 	    return -1;
 	  break;
 	case OTHER_OBJ:
@@ -229,7 +236,7 @@ setacl (const char *file, int nentries, __aclent16_t *aclbufp)
 #define DENY_X 010000
 
 static void
-getace (__aclent16_t &acl, int type, int id, DWORD win_ace_mask,
+getace (__aclent32_t &acl, int type, int id, DWORD win_ace_mask,
 	DWORD win_ace_type)
 {
   acl.a_type = type;
@@ -255,7 +262,7 @@ getace (__aclent16_t &acl, int type, int id, DWORD win_ace_mask,
 }
 
 static int
-getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
+getacl (const char *file, DWORD attr, int nentries, __aclent32_t *aclbufp)
 {
   DWORD sd_size = 4096;
   char sd_buf[4096];
@@ -268,30 +275,30 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
       return ret;
     }
 
-  PSID owner_sid;
-  PSID group_sid;
+  cygpsid owner_sid;
+  cygpsid group_sid;
   BOOL dummy;
   __uid32_t uid;
   __gid32_t gid;
 
-  if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy))
+  if (!GetSecurityDescriptorOwner (psd, (PSID *) &owner_sid, &dummy))
     {
       debug_printf ("GetSecurityDescriptorOwner %E");
       __seterrno ();
       return -1;
     }
-  uid = cygsid (owner_sid).get_uid ();
+  uid = owner_sid.get_uid ();
 
-  if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy))
+  if (!GetSecurityDescriptorGroup (psd, (PSID *) &group_sid, &dummy))
     {
       debug_printf ("GetSecurityDescriptorGroup %E");
       __seterrno ();
       return -1;
     }
-  gid = cygsid (group_sid).get_gid ();
+  gid = group_sid.get_gid ();
 
-  __aclent16_t lacl[MAX_ACL_ENTRIES];
-  memset (&lacl, 0, MAX_ACL_ENTRIES * sizeof (__aclent16_t));
+  __aclent32_t lacl[MAX_ACL_ENTRIES];
+  memset (&lacl, 0, MAX_ACL_ENTRIES * sizeof (__aclent32_t));
   lacl[0].a_type = USER_OBJ;
   lacl[0].a_id = uid;
   lacl[1].a_type = GROUP_OBJ;
@@ -326,7 +333,7 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
 	  if (!GetAce (acl, i, (PVOID *) &ace))
 	    continue;
 
-	  cygsid ace_sid ((PSID) &ace->SidStart);
+	  cygpsid ace_sid ((PSID) &ace->SidStart);
 	  int id;
 	  int type = 0;
 
@@ -356,19 +363,8 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
 	      id = ILLEGAL_GID;
 	    }
 	  else
-	    {
-	      id = ace_sid.get_id (FALSE, &type);
-	      if (type != GROUP)
-		{
-		  int type2 = 0;
-		  int id2 = ace_sid.get_id (TRUE, &type2);
-		  if (type2 == GROUP)
-		    {
-		      id = id2;
-		      type = GROUP;
-		    }
-		}
-	    }
+	    id = ace_sid.get_id (TRUE, &type);
+
 	  if (!type)
 	    continue;
 	  if (!(ace->Header.AceFlags & INHERIT_ONLY || type & ACL_DEFAULT))
@@ -401,17 +397,17 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
   if ((pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) < 0)
     pos = MAX_ACL_ENTRIES;
   if (aclbufp) {
-    if (EqualSid (owner_sid, group_sid))
+    if (owner_sid == group_sid)
       lacl[0].a_perm = lacl[1].a_perm;
     if (pos > nentries)
       {
 	set_errno (ENOSPC);
 	return -1;
       }
-    memcpy (aclbufp, lacl, pos * sizeof (__aclent16_t));
+    memcpy (aclbufp, lacl, pos * sizeof (__aclent32_t));
     for (i = 0; i < pos; ++i)
       aclbufp[i].a_perm &= ~(DENY_R | DENY_W | DENY_X);
-    aclsort (pos, 0, aclbufp);
+    aclsort32 (pos, 0, aclbufp);
   }
   syscall_printf ("%d = getacl (%s)", pos, file);
   return pos;
@@ -420,13 +416,13 @@ getacl (const char *file, DWORD attr, int nentries, __aclent16_t *aclbufp)
 int
 acl_access (const char *path, int flags)
 {
-  __aclent16_t acls[MAX_ACL_ENTRIES];
+  __aclent32_t acls[MAX_ACL_ENTRIES];
   int cnt;
 
-  if ((cnt = acl (path, GETACL, MAX_ACL_ENTRIES, acls)) < 1)
+  if ((cnt = acl32 (path, GETACL, MAX_ACL_ENTRIES, acls)) < 1)
     return -1;
 
-  /* Only check existance. */
+  /* Only check existence. */
   if (!(flags & (R_OK | W_OK | X_OK)))
     return 0;
 
@@ -440,25 +436,31 @@ acl_access (const char *path, int flags)
 	    {
 	      /*
 	       * Check if user is a NT group:
-	       * Take SID from passwd, search SID in group, check is_grp_member.
+	       * Take SID from passwd, search SID in token groups
 	       */
 	      cygsid owner;
 	      struct passwd *pw;
-	      struct __group32 *gr = NULL;
 
 	      if ((pw = internal_getpwuid (acls[i].a_id)) != NULL
 		  && owner.getfrompw (pw)
-		  && (gr = internal_getgrsid (owner))
-		  && is_grp_member (myself->uid, gr->gr_gid))
+		  && internal_getgroups (0, NULL, &owner) > 0)
 		break;
 	      continue;
 	    }
 	  break;
 	case GROUP_OBJ:
 	case GROUP:
-	  if (acls[i].a_id != myself->gid &&
-	      !is_grp_member (myself->uid, acls[i].a_id))
-	    continue;
+	  if (acls[i].a_id != myself->gid)
+            {
+	      cygsid group;
+	      struct __group32 *gr = NULL;
+
+	      if ((gr = internal_getgrgid (acls[i].a_id)) != NULL
+		  && group.getfromgr (gr)
+		  && internal_getgroups (0, NULL, &group) > 0)
+		break;
+	      continue;
+	    }
 	  break;
 	case OTHER_OBJ:
 	  break;
@@ -476,7 +478,7 @@ acl_access (const char *path, int flags)
 
 static
 int
-acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp,
+acl_worker (const char *path, int cmd, int nentries, __aclent32_t *aclbufp,
 	    int nofollow)
 {
   extern suffix_info stat_suffixes[];
@@ -530,7 +532,7 @@ acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp,
   switch (cmd)
     {
       case SETACL:
-	if (!aclsort (nentries, 0, aclbufp))
+	if (!aclsort32 (nentries, 0, aclbufp))
 	  return setacl (real_path.get_win32 (),
 			 nentries, aclbufp);
 	break;
@@ -556,21 +558,21 @@ acl_worker (const char *path, int cmd, int nentries, __aclent16_t *aclbufp,
 
 extern "C"
 int
-acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
+acl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp)
 {
   return acl_worker (path, cmd, nentries, aclbufp, 0);
 }
 
 extern "C"
 int
-lacl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
+lacl32 (const char *path, int cmd, int nentries, __aclent32_t *aclbufp)
 {
   return acl_worker (path, cmd, nentries, aclbufp, 1);
 }
 
 extern "C"
 int
-facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
+facl32 (int fd, int cmd, int nentries, __aclent32_t *aclbufp)
 {
   cygheap_fdget cfd (fd);
   if (cfd < 0)
@@ -591,7 +593,7 @@ facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
 
 extern "C"
 int
-aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
+aclcheck32 (__aclent32_t *aclbufp, int nentries, int *which)
 {
   BOOL has_user_obj = FALSE;
   BOOL has_group_obj = FALSE;
@@ -722,10 +724,10 @@ aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
   return 0;
 }
 
-extern "C"
+static
 int acecmp (const void *a1, const void *a2)
 {
-#define ace(i) ((const __aclent16_t *) a##i)
+#define ace(i) ((const __aclent32_t *) a##i)
   int ret = ace (1)->a_type - ace (2)->a_type;
   if (!ret)
     ret = ace (1)->a_id - ace (2)->a_id;
@@ -735,22 +737,22 @@ int acecmp (const void *a1, const void *a2)
 
 extern "C"
 int
-aclsort (int nentries, int, __aclent16_t *aclbufp)
+aclsort32 (int nentries, int, __aclent32_t *aclbufp)
 {
-  if (aclcheck (aclbufp, nentries, NULL))
+  if (aclcheck32 (aclbufp, nentries, NULL))
     return -1;
   if (!aclbufp || nentries < 1)
     {
       set_errno (EINVAL);
       return -1;
     }
-  qsort ((void *) aclbufp, nentries, sizeof (__aclent16_t), acecmp);
+  qsort ((void *) aclbufp, nentries, sizeof (__aclent32_t), acecmp);
   return 0;
 }
 
 extern "C"
 int
-acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
+acltomode32 (__aclent32_t *aclbufp, int nentries, mode_t *modep)
 {
   int pos;
 
@@ -790,7 +792,7 @@ acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
 
 extern "C"
 int
-aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
+aclfrommode32 (__aclent32_t *aclbufp, int nentries, mode_t *modep)
 {
   int pos;
 
@@ -828,16 +830,16 @@ aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
 
 extern "C"
 int
-acltopbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
+acltopbits32 (__aclent32_t *aclbufp, int nentries, mode_t *pbitsp)
 {
-  return acltomode (aclbufp, nentries, pbitsp);
+  return acltomode32 (aclbufp, nentries, pbitsp);
 }
 
 extern "C"
 int
-aclfrompbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
+aclfrompbits32 (__aclent32_t *aclbufp, int nentries, mode_t *pbitsp)
 {
-  return aclfrommode (aclbufp, nentries, pbitsp);
+  return aclfrommode32 (aclbufp, nentries, pbitsp);
 }
 
 static char *
@@ -854,10 +856,10 @@ permtostr (mode_t perm)
 
 extern "C"
 char *
-acltotext (__aclent16_t *aclbufp, int aclcnt)
+acltotext32 (__aclent32_t *aclbufp, int aclcnt)
 {
   if (!aclbufp || aclcnt < 1 || aclcnt > MAX_ACL_ENTRIES
-      || aclcheck (aclbufp, aclcnt, NULL))
+      || aclcheck32 (aclbufp, aclcnt, NULL))
     {
       set_errno (EINVAL);
       return NULL;
@@ -930,8 +932,8 @@ permfromstr (char *perm)
 }
 
 extern "C"
-__aclent16_t *
-aclfromtext (char *acltextp, int *)
+__aclent32_t *
+aclfromtext32 (char *acltextp, int *)
 {
   if (!acltextp)
     {
@@ -939,7 +941,7 @@ aclfromtext (char *acltextp, int *)
       return NULL;
     }
   char buf[strlen (acltextp) + 1];
-  __aclent16_t lacl[MAX_ACL_ENTRIES];
+  __aclent32_t lacl[MAX_ACL_ENTRIES];
   memset (lacl, 0, sizeof lacl);
   int pos = 0;
   strcpy (buf, acltextp);
@@ -970,11 +972,11 @@ aclfromtext (char *acltextp, int *)
 		      return NULL;
 		    }
 		  lacl[pos].a_id = pw->pw_uid;
-		  c = strchr (c, ':');
+		  c = strechr (c, ':');
 		}
 	      else if (isdigit (*c))
 		lacl[pos].a_id = strtol (c, &c, 10);
-	      if (!c || *c != ':')
+	      if (*c != ':')
 		{
 		  set_errno (EINVAL);
 		  return NULL;
@@ -998,11 +1000,11 @@ aclfromtext (char *acltextp, int *)
 		      return NULL;
 		    }
 		  lacl[pos].a_id = gr->gr_gid;
-		  c = strchr (c, ':');
+		  c = strechr (c, ':');
 		}
 	      else if (isdigit (*c))
 		lacl[pos].a_id = strtol (c, &c, 10);
-	      if (!c || *c != ':')
+	      if (*c != ':')
 		{
 		  set_errno (EINVAL);
 		  return NULL;
@@ -1036,9 +1038,97 @@ aclfromtext (char *acltextp, int *)
 	}
       ++pos;
     }
-  __aclent16_t *aclp = (__aclent16_t *) malloc (pos * sizeof (__aclent16_t));
+  __aclent32_t *aclp = (__aclent32_t *) malloc (pos * sizeof (__aclent32_t));
   if (aclp)
-    memcpy (aclp, lacl, pos * sizeof (__aclent16_t));
+    memcpy (aclp, lacl, pos * sizeof (__aclent32_t));
   return aclp;
 }
 
+/* __aclent16_t and __aclent32_t have same size and same member offsets */
+static __aclent32_t *
+acl16to32 (__aclent16_t *aclbufp, int nentries)
+{
+  __aclent32_t *aclbufp32 = (__aclent32_t *) aclbufp;
+  if (aclbufp32)
+    for (int i = 0; i < nentries; i++)
+      aclbufp32[i].a_id &= USHRT_MAX;
+  return aclbufp32;
+}
+
+extern "C"
+int
+acl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
+{
+  return acl32 (path, cmd, nentries, acl16to32 (aclbufp, nentries));
+}
+
+extern "C"
+int
+facl (int fd, int cmd, int nentries, __aclent16_t *aclbufp)
+{
+  return facl32 (fd, cmd, nentries, acl16to32 (aclbufp, nentries));
+}
+
+extern "C"
+int
+lacl (const char *path, int cmd, int nentries, __aclent16_t *aclbufp)
+{
+  return lacl32 (path, cmd, nentries, acl16to32 (aclbufp, nentries));
+}
+
+extern "C"
+int
+aclcheck (__aclent16_t *aclbufp, int nentries, int *which)
+{
+  return aclcheck32 (acl16to32 (aclbufp, nentries), nentries, which);
+}
+
+extern "C"
+int
+aclsort (int nentries, int i, __aclent16_t *aclbufp)
+{
+  return aclsort32 (nentries, i, acl16to32 (aclbufp, nentries));
+}
+
+
+extern "C"
+int
+acltomode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
+{
+  return acltomode32 (acl16to32 (aclbufp, nentries), nentries, modep);
+}
+
+extern "C"
+int
+aclfrommode (__aclent16_t *aclbufp, int nentries, mode_t *modep)
+{
+  return aclfrommode32 ((__aclent32_t *)aclbufp, nentries, modep);
+}
+
+extern "C"
+int
+acltopbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
+{
+  return acltopbits32 (acl16to32 (aclbufp, nentries), nentries, pbitsp);
+}
+
+extern "C"
+int
+aclfrompbits (__aclent16_t *aclbufp, int nentries, mode_t *pbitsp)
+{
+  return aclfrompbits32 ((__aclent32_t *)aclbufp, nentries, pbitsp);
+}
+
+extern "C"
+char *
+acltotext (__aclent16_t *aclbufp, int aclcnt)
+{
+  return acltotext32 (acl16to32 (aclbufp, aclcnt), aclcnt);
+}
+
+extern "C"
+__aclent16_t *
+aclfromtext (char *acltextp, int * aclcnt)
+{
+  return (__aclent16_t *) aclfromtext32 (acltextp, aclcnt);
+}
diff --git a/winsup/cygwin/sec_helper.cc b/winsup/cygwin/sec_helper.cc
index e4f7419..749596e 100644
--- a/winsup/cygwin/sec_helper.cc
+++ b/winsup/cygwin/sec_helper.cc
@@ -223,47 +223,6 @@ get_sids_info (cygpsid owner_sid, cygpsid group_sid, __uid32_t * uidret, __gid32
   return ret;
 }
 
-BOOL
-is_grp_member (__uid32_t uid, __gid32_t gid)
-{
-  struct passwd *pw;
-  struct __group32 *gr;
-  int idx;
-
-  /* Evaluate current user info by examining the info given in cygheap and
-     the current access token if ntsec is on. */
-  if (uid == myself->uid)
-    {
-      /* If gid == primary group of current user, return immediately. */
-      if (gid == myself->gid)
-	return TRUE;
-      /* Calling getgroups only makes sense when reading the access token. */
-      if (allow_ntsec)
-	{
-	  __gid32_t grps[NGROUPS_MAX];
-	  int cnt = internal_getgroups (NGROUPS_MAX, grps);
-	  for (idx = 0; idx < cnt; ++idx)
-	    if (grps[idx] == gid)
-	      return TRUE;
-	  return FALSE;
-	}
-    }
-
-  /* Otherwise try getting info from examining passwd and group files. */
-  if ((pw = internal_getpwuid (uid)))
-    {
-      /* If gid == primary group of uid, return immediately. */
-      if ((__gid32_t) pw->pw_gid == gid)
-	return TRUE;
-      /* Otherwise search for supplementary user list of this group. */
-      if ((gr = internal_getgrgid (gid)))
-	for (idx = 0; gr->gr_mem[idx]; ++idx)
-	  if (strcasematch (cygheap->user.name (), gr->gr_mem[idx]))
-	    return TRUE;
-    }
-  return FALSE;
-}
-
 #if 0 // unused
 #define SIDLEN	(sidlen = MAX_SID_LEN, &sidlen)
 #define DOMLEN	(domlen = INTERNET_MAX_HOST_NAME_LENGTH, &domlen)
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index 8c87270..33b529d 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -1140,6 +1140,30 @@ write_sd (const char *file, PSECURITY_DESCRIPTOR sd_buf, DWORD sd_size)
       return -1;
     }
 
+  BOOL dummy;
+  cygpsid owner;
+
+  if (!GetSecurityDescriptorOwner (sd_buf, (PSID *) &owner, &dummy))
+    {
+      __seterrno ();
+      return -1;
+    }
+  /* Try turning privilege on, may not have WRITE_OWNER or WRITE_DAC access.
+     Must have privilege to set different owner, else BackupWrite misbehaves */
+  static int NO_COPY saved_res; /* 0: never, 1: failed, 2 & 3: OK */
+  int res;
+  if (!saved_res || cygheap->user.issetuid ())
+    {
+      res = 2 + set_process_privilege (SE_RESTORE_NAME, true,
+				       cygheap->user.issetuid ());
+      if (!cygheap->user.issetuid ())
+	saved_res = res;
+    }
+  else
+    res = saved_res;
+  if (res == 1 && owner != cygheap->user.sid ())
+    return -1;
+
   HANDLE fh;
   fh = CreateFile (file,
 		   WRITE_OWNER | WRITE_DAC,
@@ -1561,22 +1585,6 @@ alloc_sd (__uid32_t uid, __gid32_t gid, int attribute,
     }
   owner_sid.debug_print ("alloc_sd: owner SID =");
 
-  /* Try turning privilege on, may not have WRITE_OWNER or WRITE_DAC access.
-     Must have privilege to set different owner, else BackupWrite misbehaves */
-  static int NO_COPY saved_res; /* 0: never, 1: failed, 2 & 3: OK */
-  int res;
-  if (!saved_res || cygheap->user.issetuid ())
-    {
-      res = 2 + set_process_privilege (SE_RESTORE_NAME, true,
-				       cygheap->user.issetuid ());
-      if (!cygheap->user.issetuid ())
-	saved_res = res;
-    }
-  else
-    res = saved_res;
-  if (res == 1 && owner_sid != cygheap->user.sid ())
-    return NULL;
-
   /* Get SID of new group. */
   cygsid group_sid;
   /* Check for current user first */
diff --git a/winsup/cygwin/security.h b/winsup/cygwin/security.h
index d789d18..a99ac0a 100644
--- a/winsup/cygwin/security.h
+++ b/winsup/cygwin/security.h
@@ -11,8 +11,8 @@ details. */
 #include <accctrl.h>
 
 #define DEFAULT_UID DOMAIN_USER_RID_ADMIN
-#define DEFAULT_UID_NT 400 /* Non conflicting number */
-#define DEFAULT_GID 401
+#define UNKNOWN_UID 400 /* Non conflicting number */
+#define UNKNOWN_GID 401
 
 #define MAX_SID_LEN 40
 #define MAX_DACL_LEN(n) (sizeof (ACL) \
@@ -244,7 +244,6 @@ void extract_nt_dom_user (const struct passwd *pw, char *domain, char *user);
 BOOL get_logon_server (const char * domain, char * server, WCHAR *wserver = NULL);
 
 /* sec_helper.cc: Security helper functions. */
-BOOL __stdcall is_grp_member (__uid32_t uid, __gid32_t gid);
 int set_process_privilege (const char *privilege, bool enable = true, bool use_thread = false);
 
 /* shared.cc: */
diff --git a/winsup/cygwin/uinfo.cc b/winsup/cygwin/uinfo.cc
index 784130f..cb620d8 100644
--- a/winsup/cygwin/uinfo.cc
+++ b/winsup/cygwin/uinfo.cc
@@ -37,7 +37,7 @@ internal_getlogin (cygheap_user &user)
   struct passwd *pw = NULL;
   HANDLE ptok = INVALID_HANDLE_VALUE;
 
-  myself->gid = DEFAULT_GID;
+  myself->gid = UNKNOWN_GID;
   if (wincap.has_security ())
     {
       DWORD siz;