usbloadergx/source/libntfs/security.c

/**
 * security.c - Handling security/ACLs in NTFS.  Originated from the Linux-NTFS project.
 *
 * Copyright (c) 2004 Anton Altaparmakov
 * Copyright (c) 2005-2006 Szabolcs Szakacsits
 * Copyright (c) 2006 Yura Pakhuchiy
 * Copyright (c) 2007-2009 Jean-Pierre Andre
 *
 * This program/include file is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as published
 * by the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program/include file is distributed in the hope that it will be
 * useful, but WITHOUT ANY WARRANTY; without even the implied warranty
 * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program (in the main directory of the NTFS-3G
 * distribution in the file COPYING); if not, write to the Free Software
 * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#ifdef HAVE_STDIO_H
#include <stdio.h>
#endif
#ifdef HAVE_STDLIB_H
#include <stdlib.h>
#endif
#ifdef HAVE_STRING_H
#include <string.h>
#endif
#ifdef HAVE_ERRNO_H
#include <errno.h>
#endif
#ifdef HAVE_FCNTL_H
#include <fcntl.h>
#endif
#ifdef HAVE_SETXATTR
#include <sys/xattr.h>
#endif
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif

#include <unistd.h>
#include <pwd.h>
#include <grp.h>

#include "param.h"
#include "types.h"
#include "layout.h"
#include "attrib.h"
#include "index.h"
#include "dir.h"
#include "bitmap.h"
#include "security.h"
#include "acls.h"
#include "cache.h"
#include "misc.h"

/*
 *  JPA NTFS constants or structs
 *  should be moved to layout.h
 */

#define ALIGN_SDS_BLOCK 0x40000 /* Alignment for a $SDS block */
#define ALIGN_SDS_ENTRY 16 /* Alignment for a $SDS entry */
#define STUFFSZ 0x4000 /* unitary stuffing size for $SDS */
#define FIRST_SECURITY_ID 0x100 /* Lowest security id */

/* Mask for attributes which can be forced */
#define FILE_ATTR_SETTABLE ( FILE_ATTR_READONLY     \
                | FILE_ATTR_HIDDEN  \
                | FILE_ATTR_SYSTEM  \
                | FILE_ATTR_ARCHIVE \
                | FILE_ATTR_TEMPORARY   \
                | FILE_ATTR_OFFLINE \
                | FILE_ATTR_NOT_CONTENT_INDEXED )

struct SII          /* this is an image of an $SII index entry */
{
    le16 offs;
    le16 size;
    le32 fill1;
    le16 indexsz;
    le16 indexksz;
    le16 flags;
    le16 fill2;
    le32 keysecurid;

    /* did not find official description for the following */
    le32 hash;
    le32 securid;
    le32 dataoffsl; /* documented as badly aligned */
    le32 dataoffsh;
    le32 datasize;
} ;

struct SDH          /* this is an image of an $SDH index entry */
{
    le16 offs;
    le16 size;
    le32 fill1;
    le16 indexsz;
    le16 indexksz;
    le16 flags;
    le16 fill2;
    le32 keyhash;
    le32 keysecurid;

    /* did not find official description for the following */
    le32 hash;
    le32 securid;
    le32 dataoffsl;
    le32 dataoffsh;
    le32 datasize;
    le32 fill3;
} ;

/*
 *  A few useful constants
 */

static ntfschar sii_stream[] = { const_cpu_to_le16( '$' ),
                                 const_cpu_to_le16( 'S' ),
                                 const_cpu_to_le16( 'I' ),
                                 const_cpu_to_le16( 'I' ),
                                 const_cpu_to_le16( 0 )
                               };
static ntfschar sdh_stream[] = { const_cpu_to_le16( '$' ),
                                 const_cpu_to_le16( 'S' ),
                                 const_cpu_to_le16( 'D' ),
                                 const_cpu_to_le16( 'H' ),
                                 const_cpu_to_le16( 0 )
                               };

/*
 *      null SID (S-1-0-0)
 */

extern const SID *nullsid;

/*
 * The zero GUID.
 */

static const GUID __zero_guid = { const_cpu_to_le32( 0 ), const_cpu_to_le16( 0 ),
                                  const_cpu_to_le16( 0 ), { 0, 0, 0, 0, 0, 0, 0, 0 }
                                };
static const GUID *const zero_guid = &__zero_guid;

/**
 * ntfs_guid_is_zero - check if a GUID is zero
 * @guid:   [IN] guid to check
 *
 * Return TRUE if @guid is a valid pointer to a GUID and it is the zero GUID
 * and FALSE otherwise.
 */
BOOL ntfs_guid_is_zero( const GUID *guid )
{
    return ( memcmp( guid, zero_guid, sizeof( *zero_guid ) ) );
}

/**
 * ntfs_guid_to_mbs - convert a GUID to a multi byte string
 * @guid:   [IN]  guid to convert
 * @guid_str:   [OUT] string in which to return the GUID (optional)
 *
 * Convert the GUID pointed to by @guid to a multi byte string of the form
 * "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX".  Therefore, @guid_str (if not NULL)
 * needs to be able to store at least 37 bytes.
 *
 * If @guid_str is not NULL it will contain the converted GUID on return.  If
 * it is NULL a string will be allocated and this will be returned.  The caller
 * is responsible for free()ing the string in that case.
 *
 * On success return the converted string and on failure return NULL with errno
 * set to the error code.
 */
char *ntfs_guid_to_mbs( const GUID *guid, char *guid_str )
{
    char *_guid_str;
    int res;

    if ( !guid )
    {
        errno = EINVAL;
        return NULL;
    }
    _guid_str = guid_str;
    if ( !_guid_str )
    {
        _guid_str = ( char* )ntfs_malloc( 37 );
        if ( !_guid_str )
            return _guid_str;
    }
    res = snprintf( _guid_str, 37,
                    "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
                    ( unsigned int )le32_to_cpu( guid->data1 ),
                    le16_to_cpu( guid->data2 ), le16_to_cpu( guid->data3 ),
                    guid->data4[0], guid->data4[1],
                    guid->data4[2], guid->data4[3], guid->data4[4],
                    guid->data4[5], guid->data4[6], guid->data4[7] );
    if ( res == 36 )
        return _guid_str;
    if ( !guid_str )
        free( _guid_str );
    errno = EINVAL;
    return NULL;
}

/**
 * ntfs_sid_to_mbs_size - determine maximum size for the string of a SID
 * @sid:    [IN]  SID for which to determine the maximum string size
 *
 * Determine the maximum multi byte string size in bytes which is needed to
 * store the standard textual representation of the SID pointed to by @sid.
 * See ntfs_sid_to_mbs(), below.
 *
 * On success return the maximum number of bytes needed to store the multi byte
 * string and on failure return -1 with errno set to the error code.
 */
int ntfs_sid_to_mbs_size( const SID *sid )
{
    int size, i;

    if ( !ntfs_sid_is_valid( sid ) )
    {
        errno = EINVAL;
        return -1;
    }
    /* Start with "S-". */
    size = 2;
    /*
     * Add the SID_REVISION.  Hopefully the compiler will optimize this
     * away as SID_REVISION is a constant.
     */
    for ( i = SID_REVISION; i > 0; i /= 10 )
        size++;
    /* Add the "-". */
    size++;
    /*
     * Add the identifier authority.  If it needs to be in decimal, the
     * maximum is 2^32-1 = 4294967295 = 10 characters.  If it needs to be
     * in hexadecimal, then maximum is 0x665544332211 = 14 characters.
     */
    if ( !sid->identifier_authority.high_part )
        size += 10;
    else
        size += 14;
    /*
     * Finally, add the sub authorities.  For each we have a "-" followed
     * by a decimal which can be up to 2^32-1 = 4294967295 = 10 characters.
     */
    size += ( 1 + 10 ) * sid->sub_authority_count;
    /* We need the zero byte at the end, too. */
    size++;
    return size * sizeof( char );
}

/**
 * ntfs_sid_to_mbs - convert a SID to a multi byte string
 * @sid:        [IN]  SID to convert
 * @sid_str:        [OUT] string in which to return the SID (optional)
 * @sid_str_size:   [IN]  size in bytes of @sid_str
 *
 * Convert the SID pointed to by @sid to its standard textual representation.
 * @sid_str (if not NULL) needs to be able to store at least
 * ntfs_sid_to_mbs_size() bytes.  @sid_str_size is the size in bytes of
 * @sid_str if @sid_str is not NULL.
 *
 * The standard textual representation of the SID is of the form:
 *  S-R-I-S-S...
 * Where:
 *    - The first "S" is the literal character 'S' identifying the following
 *  digits as a SID.
 *    - R is the revision level of the SID expressed as a sequence of digits
 *  in decimal.
 *    - I is the 48-bit identifier_authority, expressed as digits in decimal,
 *  if I < 2^32, or hexadecimal prefixed by "0x", if I >= 2^32.
 *    - S... is one or more sub_authority values, expressed as digits in
 *  decimal.
 *
 * If @sid_str is not NULL it will contain the converted SUID on return.  If it
 * is NULL a string will be allocated and this will be returned.  The caller is
 * responsible for free()ing the string in that case.
 *
 * On success return the converted string and on failure return NULL with errno
 * set to the error code.
 */
char *ntfs_sid_to_mbs( const SID *sid, char *sid_str, size_t sid_str_size )
{
    u64 u;
    le32 leauth;
    char *s;
    int i, j, cnt;

    /*
     * No need to check @sid if !@sid_str since ntfs_sid_to_mbs_size() will
     * check @sid, too.  8 is the minimum SID string size.
     */
    if ( sid_str && ( sid_str_size < 8 || !ntfs_sid_is_valid( sid ) ) )
    {
        errno = EINVAL;
        return NULL;
    }
    /* Allocate string if not provided. */
    if ( !sid_str )
    {
        cnt = ntfs_sid_to_mbs_size( sid );
        if ( cnt < 0 )
            return NULL;
        s = ( char* )ntfs_malloc( cnt );
        if ( !s )
            return s;
        sid_str = s;
        /* So we know we allocated it. */
        sid_str_size = 0;
    }
    else
    {
        s = sid_str;
        cnt = sid_str_size;
    }
    /* Start with "S-R-". */
    i = snprintf( s, cnt, "S-%hhu-", ( unsigned char )sid->revision );
    if ( i < 0 || i >= cnt )
        goto err_out;
    s += i;
    cnt -= i;
    /* Add the identifier authority. */
    for ( u = i = 0, j = 40; i < 6; i++, j -= 8 )
        u += ( u64 )sid->identifier_authority.value[i] << j;
    if ( !sid->identifier_authority.high_part )
        i = snprintf( s, cnt, "%lu", ( unsigned long )u );
    else
        i = snprintf( s, cnt, "0x%llx", ( unsigned long long )u );
    if ( i < 0 || i >= cnt )
        goto err_out;
    s += i;
    cnt -= i;
    /* Finally, add the sub authorities. */
    for ( j = 0; j < sid->sub_authority_count; j++ )
    {
        leauth = sid->sub_authority[j];
        i = snprintf( s, cnt, "-%u", ( unsigned int )
                      le32_to_cpu( leauth ) );
        if ( i < 0 || i >= cnt )
            goto err_out;
        s += i;
        cnt -= i;
    }
    return sid_str;
err_out:
    if ( i >= cnt )
        i = EMSGSIZE;
    else
        i = errno;
    if ( !sid_str_size )
        free( sid_str );
    errno = i;
    return NULL;
}

/**
 * ntfs_generate_guid - generatates a random current guid.
 * @guid:   [OUT]   pointer to a GUID struct to hold the generated guid.
 *
 * perhaps not a very good random number generator though...
 */
void ntfs_generate_guid( GUID *guid )
{
    unsigned int i;
    u8 *p = ( u8 * )guid;

    for ( i = 0; i < sizeof( GUID ); i++ )
    {
        p[i] = ( u8 )( random() & 0xFF );
        if ( i == 7 )
            p[7] = ( p[7] & 0x0F ) | 0x40;
        if ( i == 8 )
            p[8] = ( p[8] & 0x3F ) | 0x80;
    }
}

/**
 * ntfs_security_hash - calculate the hash of a security descriptor
 * @sd:         self-relative security descriptor whose hash to calculate
 * @length:     size in bytes of the security descritor @sd
 *
 * Calculate the hash of the self-relative security descriptor @sd of length
 * @length bytes.
 *
 * This hash is used in the $Secure system file as the primary key for the $SDH
 * index and is also stored in the header of each security descriptor in the
 * $SDS data stream as well as in the index data of both the $SII and $SDH
 * indexes.  In all three cases it forms part of the SDS_ENTRY_HEADER
 * structure.
 *
 * Return the calculated security hash in little endian.
 */
le32 ntfs_security_hash( const SECURITY_DESCRIPTOR_RELATIVE *sd, const u32 len )
{
    const le32 *pos = ( const le32* )sd;
    const le32 *end = pos + ( len >> 2 );
    u32 hash = 0;

    while ( pos < end )
    {
        hash = le32_to_cpup( pos ) + ntfs_rol32( hash, 3 );
        pos++;
    }
    return cpu_to_le32( hash );
}

/*
 *      Internal read
 *  copied and pasted from ntfs_fuse_read() and made independent
 *  of fuse context
 */

static int ntfs_local_read( ntfs_inode *ni,
                            ntfschar *stream_name, int stream_name_len,
                            char *buf, size_t size, off_t offset )
{
    ntfs_attr *na = NULL;
    int res, total = 0;

    na = ntfs_attr_open( ni, AT_DATA, stream_name, stream_name_len );
    if ( !na )
    {
        res = -errno;
        goto exit;
    }
    if ( ( size_t )offset < ( size_t )na->data_size )
    {
        if ( offset + size > ( size_t )na->data_size )
            size = na->data_size - offset;
        while ( size )
        {
            res = ntfs_attr_pread( na, offset, size, buf );
            if ( ( off_t )res < ( off_t )size )
                ntfs_log_perror( "ntfs_attr_pread partial read "
                                 "(%lld : %lld <> %d)",
                                 ( long long )offset,
                                 ( long long )size, res );
            if ( res <= 0 )
            {
                res = -errno;
                goto exit;
            }
            size -= res;
            offset += res;
            total += res;
        }
    }
    res = total;
exit:
    if ( na )
        ntfs_attr_close( na );
    return res;
}


/*
 *      Internal write
 *  copied and pasted from ntfs_fuse_write() and made independent
 *  of fuse context
 */

static int ntfs_local_write( ntfs_inode *ni,
                             ntfschar *stream_name, int stream_name_len,
                             char *buf, size_t size, off_t offset )
{
    ntfs_attr *na = NULL;
    int res, total = 0;

    na = ntfs_attr_open( ni, AT_DATA, stream_name, stream_name_len );
    if ( !na )
    {
        res = -errno;
        goto exit;
    }
    while ( size )
    {
        res = ntfs_attr_pwrite( na, offset, size, buf );
        if ( res < ( s64 )size )
            ntfs_log_perror( "ntfs_attr_pwrite partial write (%lld: "
                             "%lld <> %d)", ( long long )offset,
                             ( long long )size, res );
        if ( res <= 0 )
        {
            res = -errno;
            goto exit;
        }
        size -= res;
        offset += res;
        total += res;
    }
    res = total;
exit:
    if ( na )
        ntfs_attr_close( na );
    return res;
}


/*
 *  Get the first entry of current index block
 *  cut and pasted form ntfs_ie_get_first() in index.c
 */

static INDEX_ENTRY *ntfs_ie_get_first( INDEX_HEADER *ih )
{
    return ( INDEX_ENTRY* )( ( u8* )ih + le32_to_cpu( ih->entries_offset ) );
}

/*
 *      Stuff a 256KB block into $SDS before writing descriptors
 *  into the block.
 *
 *  This prevents $SDS from being automatically declared as sparse
 *  when the second copy of the first security descriptor is written
 *  256KB further ahead.
 *
 *  Having $SDS declared as a sparse file is not wrong by itself
 *  and chkdsk leaves it as a sparse file. It does however complain
 *  and add a sparse flag (0x0200) into field file_attributes of
 *  STANDARD_INFORMATION of $Secure. This probably means that a
 *  sparse attribute (ATTR_IS_SPARSE) is only allowed in sparse
 *  files (FILE_ATTR_SPARSE_FILE).
 *
 *  Windows normally does not convert to sparse attribute or sparse
 *  file. Stuffing is just a way to get to the same result.
 */

static int entersecurity_stuff( ntfs_volume *vol, off_t offs )
{
    int res;
    int written;
    unsigned long total;
    char *stuff;

    res = 0;
    total = 0;
    stuff = ( char* )ntfs_malloc( STUFFSZ );
    if ( stuff )
    {
        memset( stuff, 0, STUFFSZ );
        do
        {
            written = ntfs_local_write( vol->secure_ni,
                                        STREAM_SDS, 4, stuff, STUFFSZ, offs );
            if ( written == STUFFSZ )
            {
                total += STUFFSZ;
                offs += STUFFSZ;
            }
            else
            {
                errno = ENOSPC;
                res = -1;
            }
        }
        while ( !res && ( total < ALIGN_SDS_BLOCK ) );
        free( stuff );
    }
    else
    {
        errno = ENOMEM;
        res = -1;
    }
    return ( res );
}

/*
 *      Enter a new security descriptor into $Secure (data only)
 *      it has to be written twice with an offset of 256KB
 *
 *  Should only be called by entersecurityattr() to ensure consistency
 *
 *  Returns zero if sucessful
 */

static int entersecurity_data( ntfs_volume *vol,
                               const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz,
                               le32 hash, le32 keyid, off_t offs, int gap )
{
    int res;
    int written1;
    int written2;
    char *fullattr;
    int fullsz;
    SECURITY_DESCRIPTOR_HEADER *phsds;

    res = -1;
    fullsz = attrsz + gap + sizeof( SECURITY_DESCRIPTOR_HEADER );
    fullattr = ( char* )ntfs_malloc( fullsz );
    if ( fullattr )
    {
        /*
         * Clear the gap from previous descriptor
         * this could be useful for appending the second
         * copy to the end of file. When creating a new
         * 256K block, the gap is cleared while writing
         * the first copy
         */
        if ( gap )
            memset( fullattr, 0, gap );
        memcpy( &fullattr[gap + sizeof( SECURITY_DESCRIPTOR_HEADER )],
                attr, attrsz );
        phsds = ( SECURITY_DESCRIPTOR_HEADER* ) & fullattr[gap];
        phsds->hash = hash;
        phsds->security_id = keyid;
        phsds->offset = cpu_to_le64( offs );
        phsds->length = cpu_to_le32( fullsz - gap );
        written1 = ntfs_local_write( vol->secure_ni,
                                     STREAM_SDS, 4, fullattr, fullsz,
                                     offs - gap );
        written2 = ntfs_local_write( vol->secure_ni,
                                     STREAM_SDS, 4, fullattr, fullsz,
                                     offs - gap + ALIGN_SDS_BLOCK );
        if ( ( written1 == fullsz )
                && ( written2 == written1 ) )
            res = 0;
        else
            errno = ENOSPC;
        free( fullattr );
    }
    else
        errno = ENOMEM;
    return ( res );
}

/*
 *  Enter a new security descriptor in $Secure (indexes only)
 *
 *  Should only be called by entersecurityattr() to ensure consistency
 *
 *  Returns zero if sucessful
 */

static int entersecurity_indexes( ntfs_volume *vol, s64 attrsz,
                                  le32 hash, le32 keyid, off_t offs )
{
    union
    {
        struct
        {
            le32 dataoffsl;
            le32 dataoffsh;
        } parts;
        le64 all;
    } realign;
    int res;
    ntfs_index_context *xsii;
    ntfs_index_context *xsdh;
    struct SII newsii;
    struct SDH newsdh;

    res = -1;
    /* enter a new $SII record */

    xsii = vol->secure_xsii;
    ntfs_index_ctx_reinit( xsii );
    newsii.offs = const_cpu_to_le16( 20 );
    newsii.size = const_cpu_to_le16( sizeof( struct SII ) - 20 );
    newsii.fill1 = const_cpu_to_le32( 0 );
    newsii.indexsz = const_cpu_to_le16( sizeof( struct SII ) );
    newsii.indexksz = const_cpu_to_le16( sizeof( SII_INDEX_KEY ) );
    newsii.flags = const_cpu_to_le16( 0 );
    newsii.fill2 = const_cpu_to_le16( 0 );
    newsii.keysecurid = keyid;
    newsii.hash = hash;
    newsii.securid = keyid;
    realign.all = cpu_to_le64( offs );
    newsii.dataoffsh = realign.parts.dataoffsh;
    newsii.dataoffsl = realign.parts.dataoffsl;
    newsii.datasize = cpu_to_le32( attrsz
                                   + sizeof( SECURITY_DESCRIPTOR_HEADER ) );
    if ( !ntfs_ie_add( xsii, ( INDEX_ENTRY* )&newsii ) )
    {

        /* enter a new $SDH record */

        xsdh = vol->secure_xsdh;
        ntfs_index_ctx_reinit( xsdh );
        newsdh.offs = const_cpu_to_le16( 24 );
        newsdh.size = const_cpu_to_le16(
                          sizeof( SECURITY_DESCRIPTOR_HEADER ) );
        newsdh.fill1 = const_cpu_to_le32( 0 );
        newsdh.indexsz = const_cpu_to_le16(
                             sizeof( struct SDH ) );
        newsdh.indexksz = const_cpu_to_le16(
                              sizeof( SDH_INDEX_KEY ) );
        newsdh.flags = const_cpu_to_le16( 0 );
        newsdh.fill2 = const_cpu_to_le16( 0 );
        newsdh.keyhash = hash;
        newsdh.keysecurid = keyid;
        newsdh.hash = hash;
        newsdh.securid = keyid;
        newsdh.dataoffsh = realign.parts.dataoffsh;
        newsdh.dataoffsl = realign.parts.dataoffsl;
        newsdh.datasize = cpu_to_le32( attrsz
                                       + sizeof( SECURITY_DESCRIPTOR_HEADER ) );
        /* special filler value, Windows generally */
        /* fills with 0x00490049, sometimes with zero */
        newsdh.fill3 = const_cpu_to_le32( 0x00490049 );
        if ( !ntfs_ie_add( xsdh, ( INDEX_ENTRY* )&newsdh ) )
            res = 0;
    }
    return ( res );
}

/*
 *  Enter a new security descriptor in $Secure (data and indexes)
 *  Returns id of entry, or zero if there is a problem.
 *  (should not be called for NTFS version < 3.0)
 *
 *  important : calls have to be serialized, however no locking is
 *  needed while fuse is not multithreaded
 */

static le32 entersecurityattr( ntfs_volume *vol,
                               const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz,
                               le32 hash )
{
    union
    {
        struct
        {
            le32 dataoffsl;
            le32 dataoffsh;
        } parts;
        le64 all;
    } realign;
    le32 securid;
    le32 keyid;
    u32 newkey;
    off_t offs;
    int gap;
    int size;
    BOOL found;
    struct SII *psii;
    INDEX_ENTRY *entry;
    INDEX_ENTRY *next;
    ntfs_index_context *xsii;
    int retries;
    ntfs_attr *na;
    int olderrno;

    /* find the first available securid beyond the last key */
    /* in $Secure:$SII. This also determines the first */
    /* available location in $Secure:$SDS, as this stream */
    /* is always appended to and the id's are allocated */
    /* in sequence */

    securid = const_cpu_to_le32( 0 );
    xsii = vol->secure_xsii;
    ntfs_index_ctx_reinit( xsii );
    offs = size = 0;
    keyid = const_cpu_to_le32( -1 );
    olderrno = errno;
    found = !ntfs_index_lookup( ( char* ) & keyid,
                                sizeof( SII_INDEX_KEY ), xsii );
    if ( !found && ( errno != ENOENT ) )
    {
        ntfs_log_perror( "Inconsistency in index $SII" );
        psii = ( struct SII* )NULL;
    }
    else
    {
        /* restore errno to avoid misinterpretation */
        errno = olderrno;
        entry = xsii->entry;
        psii = ( struct SII* )xsii->entry;
    }
    if ( psii )
    {
        /*
         * Get last entry in block, but must get first one
         * one first, as we should already be beyond the
         * last one. For some reason the search for the last
         * entry sometimes does not return the last block...
         * we assume this can only happen in root block
         */
        if ( xsii->is_in_root )
            entry = ntfs_ie_get_first
                    ( ( INDEX_HEADER* ) & xsii->ir->index );
        else
            entry = ntfs_ie_get_first
                    ( ( INDEX_HEADER* ) & xsii->ib->index );
        /*
         * All index blocks should be at least half full
         * so there always is a last entry but one,
         * except when creating the first entry in index root.
         * This was however found not to be true : chkdsk
         * sometimes deletes all the (unused) keys in the last
         * index block without rebalancing the tree.
         * When this happens, a new search is restarted from
         * the smallest key.
         */
        keyid = const_cpu_to_le32( 0 );
        retries = 0;
        while ( entry )
        {
            next = ntfs_index_next( entry, xsii );
            if ( next )
            {
                psii = ( struct SII* )next;
                /* save last key and */
                /* available position */
                keyid = psii->keysecurid;
                realign.parts.dataoffsh
                = psii->dataoffsh;
                realign.parts.dataoffsl
                = psii->dataoffsl;
                offs = le64_to_cpu( realign.all );
                size = le32_to_cpu( psii->datasize );
            }
            entry = next;
            if ( !entry && !keyid && !retries )
            {
                /* search failed, retry from smallest key */
                ntfs_index_ctx_reinit( xsii );
                found = !ntfs_index_lookup( ( char* ) & keyid,
                                            sizeof( SII_INDEX_KEY ), xsii );
                if ( !found && ( errno != ENOENT ) )
                {
                    ntfs_log_perror( "Index $SII is broken" );
                }
                else
                {
                    /* restore errno */
                    errno = olderrno;
                    entry = xsii->entry;
                }
                retries++;
            }
        }
    }
    if ( !keyid )
    {
        /*
         * could not find any entry, before creating the first
         * entry, make a double check by making sure size of $SII
         * is less than needed for one entry
         */
        securid = const_cpu_to_le32( 0 );
        na = ntfs_attr_open( vol->secure_ni, AT_INDEX_ROOT, sii_stream, 4 );
        if ( na )
        {
            if ( ( size_t )na->data_size < sizeof( struct SII ) )
            {
                ntfs_log_error( "Creating the first security_id\n" );
                securid = const_cpu_to_le32( FIRST_SECURITY_ID );
            }
            ntfs_attr_close( na );
        }
        if ( !securid )
        {
            ntfs_log_error( "Error creating a security_id\n" );
            errno = EIO;
        }
    }
    else
    {
        newkey = le32_to_cpu( keyid ) + 1;
        securid = cpu_to_le32( newkey );
    }
    /*
     * The security attr has to be written twice 256KB
     * apart. This implies that offsets like
     * 0x40000*odd_integer must be left available for
     * the second copy. So align to next block when
     * the last byte overflows on a wrong block.
     */

    if ( securid )
    {
        gap = ( -size ) & ( ALIGN_SDS_ENTRY - 1 );
        offs += gap + size;
        if ( ( offs + attrsz + sizeof( SECURITY_DESCRIPTOR_HEADER ) - 1 )
                & ALIGN_SDS_BLOCK )
        {
            offs = ( ( offs + attrsz
                       + sizeof( SECURITY_DESCRIPTOR_HEADER ) - 1 )
                     | ( ALIGN_SDS_BLOCK - 1 ) ) + 1;
        }
        if ( !( offs & ( ALIGN_SDS_BLOCK - 1 ) ) )
            entersecurity_stuff( vol, offs );
        /*
         * now write the security attr to storage :
         * first data, then SII, then SDH
         * If failure occurs while writing SDS, data will never
         *    be accessed through indexes, and will be overwritten
         *    by the next allocated descriptor
         * If failure occurs while writing SII, the id has not
         *    recorded and will be reallocated later
         * If failure occurs while writing SDH, the space allocated
         *    in SDS or SII will not be reused, an inconsistency
         *    will persist with no significant consequence
         */
        if ( entersecurity_data( vol, attr, attrsz, hash, securid, offs, gap )
                || entersecurity_indexes( vol, attrsz, hash, securid, offs ) )
            securid = const_cpu_to_le32( 0 );
    }
    /* inode now is dirty, synchronize it all */
    ntfs_index_entry_mark_dirty( vol->secure_xsii );
    ntfs_index_ctx_reinit( vol->secure_xsii );
    ntfs_index_entry_mark_dirty( vol->secure_xsdh );
    ntfs_index_ctx_reinit( vol->secure_xsdh );
    NInoSetDirty( vol->secure_ni );
    if ( ntfs_inode_sync( vol->secure_ni ) )
        ntfs_log_perror( "Could not sync $Secure\n" );
    return ( securid );
}

/*
 *      Find a matching security descriptor in $Secure,
 *  if none, allocate a new id and write the descriptor to storage
 *  Returns id of entry, or zero if there is a problem.
 *
 *  important : calls have to be serialized, however no locking is
 *  needed while fuse is not multithreaded
 */

static le32 setsecurityattr( ntfs_volume *vol,
                             const SECURITY_DESCRIPTOR_RELATIVE *attr, s64 attrsz )
{
    struct SDH *psdh;   /* this is an image of index (le) */
    union
    {
        struct
        {
            le32 dataoffsl;
            le32 dataoffsh;
        } parts;
        le64 all;
    } realign;
    BOOL found;
    BOOL collision;
    size_t size;
    size_t rdsize;
    s64 offs;
    int res;
    ntfs_index_context *xsdh;
    char *oldattr;
    SDH_INDEX_KEY key;
    INDEX_ENTRY *entry;
    le32 securid;
    le32 hash;
    int olderrno;

    hash = ntfs_security_hash( attr, attrsz );
    oldattr = ( char* )NULL;
    securid = const_cpu_to_le32( 0 );
    res = 0;
    xsdh = vol->secure_xsdh;
    if ( vol->secure_ni && xsdh && !vol->secure_reentry++ )
    {
        ntfs_index_ctx_reinit( xsdh );
        /*
         * find the nearest key as (hash,0)
         * (do not search for partial key : in case of collision,
         * it could return a key which is not the first one which
         * collides)
         */
        key.hash = hash;
        key.security_id = const_cpu_to_le32( 0 );
        olderrno = errno;
        found = !ntfs_index_lookup( ( char* ) & key,
                                    sizeof( SDH_INDEX_KEY ), xsdh );
        if ( !found && ( errno != ENOENT ) )
            ntfs_log_perror( "Inconsistency in index $SDH" );
        else
        {
            /* restore errno to avoid misinterpretation */
            errno = olderrno;
            entry = xsdh->entry;
            found = FALSE;
            /*
             * lookup() may return a node with no data,
             * if so get next
             */
            if ( entry->ie_flags & INDEX_ENTRY_END )
                entry = ntfs_index_next( entry, xsdh );
            do
            {
                collision = FALSE;
                psdh = ( struct SDH* )entry;
                if ( psdh )
                    size = ( size_t ) le32_to_cpu( psdh->datasize )
                           - sizeof( SECURITY_DESCRIPTOR_HEADER );
                else size = 0;
                /* if hash is not the same, the key is not present */
                if ( psdh && ( size > 0 )
                        && ( psdh->keyhash == hash ) )
                {
                    /* if hash is the same */
                    /* check the whole record */
                    realign.parts.dataoffsh = psdh->dataoffsh;
                    realign.parts.dataoffsl = psdh->dataoffsl;
                    offs = le64_to_cpu( realign.all )
                           + sizeof( SECURITY_DESCRIPTOR_HEADER );
                    oldattr = ( char* )ntfs_malloc( size );
                    if ( oldattr )
                    {
                        rdsize = ntfs_local_read(
                                     vol->secure_ni,
                                     STREAM_SDS, 4,
                                     oldattr, size, offs );
                        found = ( rdsize == size )
                                && !memcmp( oldattr, attr, size );
                        free( oldattr );
                        /* if the records do not compare */
                        /* (hash collision), try next one */
                        if ( !found )
                        {
                            entry = ntfs_index_next(
                                        entry, xsdh );
                            collision = TRUE;
                        }
                    }
                    else
                        res = ENOMEM;
                }
            }
            while ( collision && entry );
            if ( found )
                securid = psdh->keysecurid;
            else
            {
                if ( res )
                {
                    errno = res;
                    securid = const_cpu_to_le32( 0 );
                }
                else
                {
                    /*
                     * no matching key :
                     * have to build a new one
                     */
                    securid = entersecurityattr( vol,
                                                 attr, attrsz, hash );
                }
            }
        }
    }
    if ( --vol->secure_reentry )
        ntfs_log_perror( "Reentry error, check no multithreading\n" );
    return ( securid );
}


/*
 *      Update the security descriptor of a file
 *  Either as an attribute (complying with pre v3.x NTFS version)
 *  or, when possible, as an entry in $Secure (for NTFS v3.x)
 *
 *  returns 0 if success
 */

static int update_secur_descr( ntfs_volume *vol,
                               char *newattr, ntfs_inode *ni )
{
    int newattrsz;
    int written;
    int res;
    ntfs_attr *na;

    newattrsz = ntfs_attr_size( newattr );

#if !FORCE_FORMAT_v1x
    if ( ( vol->major_ver < 3 ) || !vol->secure_ni )
    {
#endif

        /* update for NTFS format v1.x */

        /* update the old security attribute */
        na = ntfs_attr_open( ni, AT_SECURITY_DESCRIPTOR, AT_UNNAMED, 0 );
        if ( na )
        {
            /* resize attribute */
            res = ntfs_attr_truncate( na, ( s64 ) newattrsz );
            /* overwrite value */
            if ( !res )
            {
                written = ( int )ntfs_attr_pwrite( na, ( s64 ) 0,
                                                   ( s64 ) newattrsz, newattr );
                if ( written != newattrsz )
                {
                    ntfs_log_error( "Failed to update "
                                    "a v1.x security descriptor\n" );
                    errno = EIO;
                    res = -1;
                }
            }

            ntfs_attr_close( na );
            /* if old security attribute was found, also */
            /* truncate standard information attribute to v1.x */
            /* this is needed when security data is wanted */
            /* as v1.x though volume is formatted for v3.x */
            na = ntfs_attr_open( ni, AT_STANDARD_INFORMATION,
                                 AT_UNNAMED, 0 );
            if ( na )
            {
                clear_nino_flag( ni, v3_Extensions );
                /*
                 * Truncating the record does not sweep extensions
                 * from copy in memory. Clear security_id to be safe
                 */
                ni->security_id = const_cpu_to_le32( 0 );
                res = ntfs_attr_truncate( na, ( s64 )48 );
                ntfs_attr_close( na );
                clear_nino_flag( ni, v3_Extensions );
            }
        }
        else
        {
            /*
             * insert the new security attribute if there
             * were none
             */
            res = ntfs_attr_add( ni, AT_SECURITY_DESCRIPTOR,
                                 AT_UNNAMED, 0, ( u8* )newattr,
                                 ( s64 ) newattrsz );
        }
#if !FORCE_FORMAT_v1x
    }
    else
    {

        /* update for NTFS format v3.x */

        le32 securid;

        securid = setsecurityattr( vol,
                                   ( const SECURITY_DESCRIPTOR_RELATIVE* )newattr,
                                   ( s64 )newattrsz );
        if ( securid )
        {
            na = ntfs_attr_open( ni, AT_STANDARD_INFORMATION,
                                 AT_UNNAMED, 0 );
            if ( na )
            {
                res = 0;
                if ( !test_nino_flag( ni, v3_Extensions ) )
                {
                    /* expand standard information attribute to v3.x */
                    res = ntfs_attr_truncate( na,
                                              ( s64 )sizeof( STANDARD_INFORMATION ) );
                    ni->owner_id = const_cpu_to_le32( 0 );
                    ni->quota_charged = const_cpu_to_le64( 0 );
                    ni->usn = const_cpu_to_le64( 0 );
                    ntfs_attr_remove( ni,
                                      AT_SECURITY_DESCRIPTOR,
                                      AT_UNNAMED, 0 );
                }
                set_nino_flag( ni, v3_Extensions );
                ni->security_id = securid;
                ntfs_attr_close( na );
            }
            else
            {
                ntfs_log_error( "Failed to update "
                                "standard informations\n" );
                errno = EIO;
                res = -1;
            }
        }
        else
            res = -1;
    }
#endif

    /* mark node as dirty */
    NInoSetDirty( ni );
    return ( res );
}

/*
 *      Upgrade the security descriptor of a file
 *  This is intended to allow graceful upgrades for files which
 *  were created in previous versions, with a security attributes
 *  and no security id.
 *
 *      It will allocate a security id and replace the individual
 *  security attribute by a reference to the global one
 *
 *  Special files are not upgraded (currently / and files in
 *  directories /$*)
 *
 *  Though most code is similar to update_secur_desc() it has
 *  been kept apart to facilitate the further processing of
 *  special cases or even to remove it if found dangerous.
 *
 *  returns 0 if success,
 *      1 if not upgradable. This is not an error.
 *      -1 if there is a problem
 */

static int upgrade_secur_desc( ntfs_volume *vol,
                               const char *attr, ntfs_inode *ni )
{
    int attrsz;
    int res;
    le32 securid;
    ntfs_attr *na;

    /*
     * upgrade requires NTFS format v3.x
     * also refuse upgrading for special files
     * whose number is less than FILE_first_user
     */

    if ( ( vol->major_ver >= 3 )
            && ( ni->mft_no >= FILE_first_user ) )
    {
        attrsz = ntfs_attr_size( attr );
        securid = setsecurityattr( vol,
                                   ( const SECURITY_DESCRIPTOR_RELATIVE* )attr,
                                   ( s64 )attrsz );
        if ( securid )
        {
            na = ntfs_attr_open( ni, AT_STANDARD_INFORMATION,
                                 AT_UNNAMED, 0 );
            if ( na )
            {
                res = 0;
                /* expand standard information attribute to v3.x */
                res = ntfs_attr_truncate( na,
                                          ( s64 )sizeof( STANDARD_INFORMATION ) );
                ni->owner_id = const_cpu_to_le32( 0 );
                ni->quota_charged = const_cpu_to_le64( 0 );
                ni->usn = const_cpu_to_le64( 0 );
                ntfs_attr_remove( ni, AT_SECURITY_DESCRIPTOR,
                                  AT_UNNAMED, 0 );
                set_nino_flag( ni, v3_Extensions );
                ni->security_id = securid;
                ntfs_attr_close( na );
            }
            else
            {
                ntfs_log_error( "Failed to upgrade "
                                "standard informations\n" );
                errno = EIO;
                res = -1;
            }
        }
        else
            res = -1;
        /* mark node as dirty */
        NInoSetDirty( ni );
    }
    else
        res = 1;

    return ( res );
}

/*
 *      Optional simplified checking of group membership
 *
 *  This only takes into account the groups defined in
 *  /etc/group at initialization time.
 *  It does not take into account the groups dynamically set by
 *  setgroups() nor the changes in /etc/group since initialization
 *
 *  This optional method could be useful if standard checking
 *  leads to a performance concern.
 *
 *  Should not be called for user root, however the group may be root
 *
 */

static BOOL staticgroupmember( struct SECURITY_CONTEXT *scx, uid_t uid, gid_t gid )
{
    BOOL ingroup;
    int grcnt;
    gid_t *groups;
    struct MAPPING *user;

    ingroup = FALSE;
    if ( uid )
    {
        user = scx->mapping[MAPUSERS];
        while ( user && ( ( uid_t )user->xid != uid ) )
            user = user->next;
        if ( user )
        {
            groups = user->groups;
            grcnt = user->grcnt;
            while ( ( --grcnt >= 0 ) && ( groups[grcnt] != gid ) ) { }
            ingroup = ( grcnt >= 0 );
        }
    }
    return ( ingroup );
}


/*
 *      Check whether current thread owner is member of file group
 *
 *  Should not be called for user root, however the group may be root
 *
 * As indicated by Miklos Szeredi :
 *
 * The group list is available in
 *
 *   /proc/$PID/task/$TID/status
 *
 * and fuse supplies TID in get_fuse_context()->pid.  The only problem is
 * finding out PID, for which I have no good solution, except to iterate
 * through all processes.  This is rather slow, but may be speeded up
 * with caching and heuristics (for single threaded programs PID = TID).
 *
 * The following implementation gets the group list from
 *   /proc/$TID/task/$TID/status which apparently exists and
 * contains the same data.
 */

static BOOL groupmember( struct SECURITY_CONTEXT *scx, uid_t uid, gid_t gid )
{
    static char key[] = "\nGroups:";
    char buf[BUFSZ+1];
    char filename[64];
    enum { INKEY, INSEP, INNUM, INEND } state;
    int fd;
    char c;
    int matched;
    BOOL ismember;
    int got;
    char *p;
    gid_t grp;
    pid_t tid;

    if ( scx->vol->secure_flags & ( 1 << SECURITY_STATICGRPS ) )
        ismember = staticgroupmember( scx, uid, gid );
    else
    {
        ismember = FALSE; /* default return */
        tid = scx->tid;
        sprintf( filename, "/proc/%u/task/%u/status", tid, tid );
        fd = open( filename, O_RDONLY );
        if ( fd >= 0 )
        {
            got = read( fd, buf, BUFSZ );
            buf[got] = 0;
            state = INKEY;
            matched = 0;
            p = buf;
            grp = 0;
            /*
             *  A simple automaton to process lines like
             *  Groups: 14 500 513
             */
            do
            {
                c = *p++;
                if ( !c )
                {
                    /* refill buffer */
                    got = read( fd, buf, BUFSZ );
                    buf[got] = 0;
                    p = buf;
                    c = *p++; /* 0 at end of file */
                }
                switch ( state )
                {
                    case INKEY :
                        if ( key[matched] == c )
                        {
                            if ( !key[++matched] )
                                state = INSEP;
                        }
                        else if ( key[0] == c )
                            matched = 1;
                        else
                            matched = 0;
                        break;
                    case INSEP :
                        if ( ( c >= '0' ) && ( c <= '9' ) )
                        {
                            grp = c - '0';
                            state = INNUM;
                        }
                        else if ( ( c != ' ' ) && ( c != '\t' ) )
                            state = INEND;
                        break;
                    case INNUM :
                        if ( ( c >= '0' ) && ( c <= '9' ) )
                            grp = grp * 10 + c - '0';
                        else
                        {
                            ismember = ( grp == gid );
                            if ( ( c != ' ' ) && ( c != '\t' ) )
                                state = INEND;
                            else
                                state = INSEP;
                        }
                    default :
                        break;
                }
            }
            while ( !ismember && c && ( state != INEND ) );
            close( fd );
            if ( !c )
                ntfs_log_error( "No group record found in %s\n", filename );
        }
        else
            ntfs_log_error( "Could not open %s\n", filename );
    }
    return ( ismember );
}

/*
 *  Cacheing is done two-way :
 *  - from uid, gid and perm to securid (CACHED_SECURID)
 *  - from a securid to uid, gid and perm (CACHED_PERMISSIONS)
 *
 *  CACHED_SECURID data is kept in a most-recent-first list
 *  which should not be too long to be efficient. Its optimal
 *  size is depends on usage and is hard to determine.
 *
 *  CACHED_PERMISSIONS data is kept in a two-level indexed array. It
 *  is optimal at the expense of storage. Use of a most-recent-first
 *  list would save memory and provide similar performances for
 *  standard usage, but not for file servers with too many file
 *  owners
 *
 *  CACHED_PERMISSIONS_LEGACY is a special case for CACHED_PERMISSIONS
 *  for legacy directories which were not allocated a security_id
 *  it is organized in a most-recent-first list.
 *
 *  In main caches, data is never invalidated, as the meaning of
 *  a security_id only changes when user mapping is changed, which
 *  current implies remounting. However returned entries may be
 *  overwritten at next update, so data has to be copied elsewhere
 *  before another cache update is made.
 *  In legacy cache, data has to be invalidated when protection is
 *  changed.
 *
 *  Though the same data may be found in both list, they
 *  must be kept separately : the interpretation of ACL
 *  in both direction are approximations which could be non
 *  reciprocal for some configuration of the user mapping data
 *
 *  During the process of recompiling ntfs-3g from a tgz archive,
 *  security processing added 7.6% to the cpu time used by ntfs-3g
 *  and 30% if the cache is disabled.
 */

static struct PERMISSIONS_CACHE *create_caches( struct SECURITY_CONTEXT *scx,
        u32 securindex )
{
    struct PERMISSIONS_CACHE *cache;
    unsigned int index1;
    unsigned int i;

    cache = ( struct PERMISSIONS_CACHE* )NULL;
    /* create the first permissions blocks */
    index1 = securindex >> CACHE_PERMISSIONS_BITS;
    cache = ( struct PERMISSIONS_CACHE* )
            ntfs_malloc( sizeof( struct PERMISSIONS_CACHE )
                         + index1*sizeof( struct CACHED_PERMISSIONS* ) );
    if ( cache )
    {
        cache->head.last = index1;
        cache->head.p_reads = 0;
        cache->head.p_hits = 0;
        cache->head.p_writes = 0;
        *scx->pseccache = cache;
        for ( i = 0; i <= index1; i++ )
            cache->cachetable[i]
            = ( struct CACHED_PERMISSIONS* )NULL;
    }
    return ( cache );
}

/*
 *      Free memory used by caches
 *  The only purpose is to facilitate the detection of memory leaks
 */

static void free_caches( struct SECURITY_CONTEXT *scx )
{
    unsigned int index1;
    struct PERMISSIONS_CACHE *pseccache;

    pseccache = *scx->pseccache;
    if ( pseccache )
    {
        for ( index1 = 0; index1 <= pseccache->head.last; index1++ )
            if ( pseccache->cachetable[index1] )
            {
#if POSIXACLS
                struct CACHED_PERMISSIONS *cacheentry;
                unsigned int index2;

                for ( index2 = 0; index2 < ( 1 << CACHE_PERMISSIONS_BITS ); index2++ )
                {
                    cacheentry = &pseccache->cachetable[index1][index2];
                    if ( cacheentry->valid
                            && cacheentry->pxdesc )
                        free( cacheentry->pxdesc );
                }
#endif
                free( pseccache->cachetable[index1] );
            }
        free( pseccache );
    }
}

static int compare( const struct CACHED_SECURID *cached,
                    const struct CACHED_SECURID *item )
{
#if POSIXACLS
    size_t csize;
    size_t isize;

    /* only compare data and sizes */
    csize = ( cached->variable ?
              sizeof( struct POSIX_ACL )
              + ( ( ( struct POSIX_SECURITY* )cached->variable )->acccnt
                  + ( ( struct POSIX_SECURITY* )cached->variable )->defcnt )
              * sizeof( struct POSIX_ACE ) :
              0 );
    isize = ( item->variable ?
              sizeof( struct POSIX_ACL )
              + ( ( ( struct POSIX_SECURITY* )item->variable )->acccnt
                  + ( ( struct POSIX_SECURITY* )item->variable )->defcnt )
              * sizeof( struct POSIX_ACE ) :
              0 );
    return ( ( cached->uid != item->uid )
             || ( cached->gid != item->gid )
             || ( cached->dmode != item->dmode )
             || ( csize != isize )
             || ( csize
                  && isize
                  && memcmp( &( ( struct POSIX_SECURITY* )cached->variable )->acl,
                             &( ( struct POSIX_SECURITY* )item->variable )->acl, csize ) ) );
#else
    return ( ( cached->uid != item->uid )
             || ( cached->gid != item->gid )
             || ( cached->dmode != item->dmode ) );
#endif
}

static int leg_compare( const struct CACHED_PERMISSIONS_LEGACY *cached,
                        const struct CACHED_PERMISSIONS_LEGACY *item )
{
    return ( cached->mft_no != item->mft_no );
}

/*
 *  Resize permission cache table
 *  do not call unless resizing is needed
 *
 *  If allocation fails, the cache size is not updated
 *  Lack of memory is not considered as an error, the cache is left
 *  consistent and errno is not set.
 */

static void resize_cache( struct SECURITY_CONTEXT *scx,
                          u32 securindex )
{
    struct PERMISSIONS_CACHE *oldcache;
    struct PERMISSIONS_CACHE *newcache;
    int newcnt;
    int oldcnt;
    unsigned int index1;
    unsigned int i;

    oldcache = *scx->pseccache;
    index1 = securindex >> CACHE_PERMISSIONS_BITS;
    newcnt = index1 + 1;
    if ( newcnt <= ( ( CACHE_PERMISSIONS_SIZE
                       + ( 1 << CACHE_PERMISSIONS_BITS )
                       - 1 ) >> CACHE_PERMISSIONS_BITS ) )
    {
        /* expand cache beyond current end, do not use realloc() */
        /* to avoid losing data when there is no more memory */
        oldcnt = oldcache->head.last + 1;
        newcache = ( struct PERMISSIONS_CACHE* )
                   ntfs_malloc(
                       sizeof( struct PERMISSIONS_CACHE )
                       + ( newcnt - 1 ) * sizeof( struct CACHED_PERMISSIONS* ) );
        if ( newcache )
        {
            memcpy( newcache, oldcache,
                    sizeof( struct PERMISSIONS_CACHE )
                    + ( oldcnt - 1 )*sizeof( struct CACHED_PERMISSIONS* ) );
            free( oldcache );
            /* mark new entries as not valid */
            for ( i = newcache->head.last + 1; i <= index1; i++ )
                newcache->cachetable[i]
                = ( struct CACHED_PERMISSIONS* )NULL;
            newcache->head.last = index1;
            *scx->pseccache = newcache;
        }
    }
}

/*
 *  Enter uid, gid and mode into cache, if possible
 *
 *  returns the updated or created cache entry,
 *  or NULL if not possible (typically if there is no
 *      security id associated)
 */

#if POSIXACLS
static struct CACHED_PERMISSIONS *enter_cache( struct SECURITY_CONTEXT *scx,
        ntfs_inode *ni, uid_t uid, gid_t gid,
        struct POSIX_SECURITY *pxdesc )
#else
static struct CACHED_PERMISSIONS *enter_cache( struct SECURITY_CONTEXT *scx,
        ntfs_inode *ni, uid_t uid, gid_t gid, mode_t mode )
#endif
{
    struct CACHED_PERMISSIONS *cacheentry;
    struct CACHED_PERMISSIONS *cacheblock;
    struct PERMISSIONS_CACHE *pcache;
    u32 securindex;
#if POSIXACLS
    int pxsize;
    struct POSIX_SECURITY *pxcached;
#endif
    unsigned int index1;
    unsigned int index2;
    int i;

    /* cacheing is only possible if a security_id has been defined */
    if ( test_nino_flag( ni, v3_Extensions )
            && ni->security_id )
    {
        /*
         *  Immediately test the most frequent situation
         *  where the entry exists
         */
        securindex = le32_to_cpu( ni->security_id );
        index1 = securindex >> CACHE_PERMISSIONS_BITS;
        index2 = securindex & ( ( 1 << CACHE_PERMISSIONS_BITS ) - 1 );
        pcache = *scx->pseccache;
        if ( pcache
                && ( pcache->head.last >= index1 )
                && pcache->cachetable[index1] )
        {
            cacheentry = &pcache->cachetable[index1][index2];
            cacheentry->uid = uid;
            cacheentry->gid = gid;
#if POSIXACLS
            if ( cacheentry->valid && cacheentry->pxdesc )
                free( cacheentry->pxdesc );
            if ( pxdesc )
            {
                pxsize = sizeof( struct POSIX_SECURITY )
                         + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
                pxcached = ( struct POSIX_SECURITY* )malloc( pxsize );
                if ( pxcached )
                {
                    memcpy( pxcached, pxdesc, pxsize );
                    cacheentry->pxdesc = pxcached;
                }
                else
                {
                    cacheentry->valid = 0;
                    cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
                }
                cacheentry->mode = pxdesc->mode & 07777;
            }
            else
                cacheentry->pxdesc = ( struct POSIX_SECURITY* )NULL;
#else
            cacheentry->mode = mode & 07777;
#endif
            cacheentry->inh_fileid = const_cpu_to_le32( 0 );
            cacheentry->inh_dirid = const_cpu_to_le32( 0 );
            cacheentry->valid = 1;
            pcache->head.p_writes++;
        }
        else
        {
            if ( !pcache )
            {
                /* create the first cache block */
                pcache = create_caches( scx, securindex );
            }
            else
            {
                if ( index1 > pcache->head.last )
                {
                    resize_cache( scx, securindex );
                    pcache = *scx->pseccache;
                }
            }
            /* allocate block, if cache table was allocated */
            if ( pcache && ( index1 <= pcache->head.last ) )
            {
                cacheblock = ( struct CACHED_PERMISSIONS* )
                             malloc( sizeof( struct CACHED_PERMISSIONS )
                                     << CACHE_PERMISSIONS_BITS );
                pcache->cachetable[index1] = cacheblock;
                for ( i = 0; i < ( 1 << CACHE_PERMISSIONS_BITS ); i++ )
                    cacheblock[i].valid = 0;
                cacheentry = &cacheblock[index2];
                if ( cacheentry )
                {
                    cacheentry->uid = uid;
                    cacheentry->gid = gid;
#if POSIXACLS
                    if ( pxdesc )
                    {
                        pxsize = sizeof( struct POSIX_SECURITY )
                                 + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
                        pxcached = ( struct POSIX_SECURITY* )malloc( pxsize );
                        if ( pxcached )
                        {
                            memcpy( pxcached, pxdesc, pxsize );
                            cacheentry->pxdesc = pxcached;
                        }
                        else
                        {
                            cacheentry->valid = 0;
                            cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
                        }
                        cacheentry->mode = pxdesc->mode & 07777;
                    }
                    else
                        cacheentry->pxdesc = ( struct POSIX_SECURITY* )NULL;
#else
                    cacheentry->mode = mode & 07777;
#endif
                    cacheentry->inh_fileid = const_cpu_to_le32( 0 );
                    cacheentry->inh_dirid = const_cpu_to_le32( 0 );
                    cacheentry->valid = 1;
                    pcache->head.p_writes++;
                }
            }
            else
                cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
        }
    }
    else
    {
        cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
#if CACHE_LEGACY_SIZE
        if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
        {
            struct CACHED_PERMISSIONS_LEGACY wanted;
            struct CACHED_PERMISSIONS_LEGACY *legacy;

            wanted.perm.uid = uid;
            wanted.perm.gid = gid;
#if POSIXACLS
            wanted.perm.mode = pxdesc->mode & 07777;
            wanted.perm.inh_fileid = const_cpu_to_le32( 0 );
            wanted.perm.inh_dirid = const_cpu_to_le32( 0 );
            wanted.mft_no = ni->mft_no;
            wanted.variable = ( void* )pxdesc;
            wanted.varsize = sizeof( struct POSIX_SECURITY )
                             + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
#else
            wanted.perm.mode = mode & 07777;
            wanted.perm.inh_fileid = const_cpu_to_le32( 0 );
            wanted.perm.inh_dirid = const_cpu_to_le32( 0 );
            wanted.mft_no = ni->mft_no;
            wanted.variable = ( void* )NULL;
            wanted.varsize = 0;
#endif
            legacy = ( struct CACHED_PERMISSIONS_LEGACY* )ntfs_enter_cache(
                         scx->vol->legacy_cache, GENERIC( &wanted ),
                         ( cache_compare )leg_compare );
            if ( legacy )
            {
                cacheentry = &legacy->perm;
#if POSIXACLS
                /*
                 * give direct access to the cached pxdesc
                 * in the permissions structure
                 */
                cacheentry->pxdesc = legacy->variable;
#endif
            }
        }
#endif
    }
    return ( cacheentry );
}

/*
 *  Fetch owner, group and permission of a file, if cached
 *
 *  Beware : do not use the returned entry after a cache update :
 *  the cache may be relocated making the returned entry meaningless
 *
 *  returns the cache entry, or NULL if not available
 */

static struct CACHED_PERMISSIONS *fetch_cache( struct SECURITY_CONTEXT *scx,
        ntfs_inode *ni )
{
    struct CACHED_PERMISSIONS *cacheentry;
    struct PERMISSIONS_CACHE *pcache;
    u32 securindex;
    unsigned int index1;
    unsigned int index2;

    /* cacheing is only possible if a security_id has been defined */
    cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
    if ( test_nino_flag( ni, v3_Extensions )
            && ( ni->security_id ) )
    {
        securindex = le32_to_cpu( ni->security_id );
        index1 = securindex >> CACHE_PERMISSIONS_BITS;
        index2 = securindex & ( ( 1 << CACHE_PERMISSIONS_BITS ) - 1 );
        pcache = *scx->pseccache;
        if ( pcache
                && ( pcache->head.last >= index1 )
                && pcache->cachetable[index1] )
        {
            cacheentry = &pcache->cachetable[index1][index2];
            /* reject if entry is not valid */
            if ( !cacheentry->valid )
                cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
            else
                pcache->head.p_hits++;
            if ( pcache )
                pcache->head.p_reads++;
        }
    }
#if CACHE_LEGACY_SIZE
    else
    {
        cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
        if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
        {
            struct CACHED_PERMISSIONS_LEGACY wanted;
            struct CACHED_PERMISSIONS_LEGACY *legacy;

            wanted.mft_no = ni->mft_no;
            wanted.variable = ( void* )NULL;
            wanted.varsize = 0;
            legacy = ( struct CACHED_PERMISSIONS_LEGACY* )ntfs_fetch_cache(
                         scx->vol->legacy_cache, GENERIC( &wanted ),
                         ( cache_compare )leg_compare );
            if ( legacy ) cacheentry = &legacy->perm;
        }
    }
#endif
#if POSIXACLS
    if ( cacheentry && !cacheentry->pxdesc )
    {
        ntfs_log_error( "No Posix descriptor in cache\n" );
        cacheentry = ( struct CACHED_PERMISSIONS* )NULL;
    }
#endif
    return ( cacheentry );
}

/*
 *  Retrieve a security attribute from $Secure
 */

static char *retrievesecurityattr( ntfs_volume *vol, SII_INDEX_KEY id )
{
    struct SII *psii;
    union
    {
        struct
        {
            le32 dataoffsl;
            le32 dataoffsh;
        } parts;
        le64 all;
    } realign;
    int found;
    size_t size;
    size_t rdsize;
    s64 offs;
    ntfs_inode *ni;
    ntfs_index_context *xsii;
    char *securattr;

    securattr = ( char* )NULL;
    ni = vol->secure_ni;
    xsii = vol->secure_xsii;
    if ( ni && xsii )
    {
        ntfs_index_ctx_reinit( xsii );
        found =
            !ntfs_index_lookup( ( char* ) & id,
                                sizeof( SII_INDEX_KEY ), xsii );
        if ( found )
        {
            psii = ( struct SII* )xsii->entry;
            size =
                ( size_t ) le32_to_cpu( psii->datasize )
                - sizeof( SECURITY_DESCRIPTOR_HEADER );
            /* work around bad alignment problem */
            realign.parts.dataoffsh = psii->dataoffsh;
            realign.parts.dataoffsl = psii->dataoffsl;
            offs = le64_to_cpu( realign.all )
                   + sizeof( SECURITY_DESCRIPTOR_HEADER );

            securattr = ( char* )ntfs_malloc( size );
            if ( securattr )
            {
                rdsize = ntfs_local_read(
                             ni, STREAM_SDS, 4,
                             securattr, size, offs );
                if ( ( rdsize != size )
                        || !ntfs_valid_descr( securattr,
                                              rdsize ) )
                {
                    /* error to be logged by caller */
                    free( securattr );
                    securattr = ( char* )NULL;
                }
            }
        }
        else if ( errno != ENOENT )
            ntfs_log_perror( "Inconsistency in index $SII" );
    }
    if ( !securattr )
    {
        ntfs_log_error( "Failed to retrieve a security descriptor\n" );
        errno = EIO;
    }
    return ( securattr );
}

/*
 *      Get the security descriptor associated to a file
 *
 *  Either :
 *     - read the security descriptor attribute (v1.x format)
 *     - or find the descriptor in $Secure:$SDS (v3.x format)
 *
 *  in both case, sanity checks are done on the attribute and
 *  the descriptor can be assumed safe
 *
 *  The returned descriptor is dynamically allocated and has to be freed
 */

static char *getsecurityattr( ntfs_volume *vol, ntfs_inode *ni )
{
    SII_INDEX_KEY securid;
    char *securattr;
    s64 readallsz;

    /*
     * Warning : in some situations, after fixing by chkdsk,
     * v3_Extensions are marked present (long standard informations)
     * with a default security descriptor inserted in an
     * attribute
     */
    if ( test_nino_flag( ni, v3_Extensions )
            && vol->secure_ni && ni->security_id )
    {
        /* get v3.x descriptor in $Secure */
        securid.security_id = ni->security_id;
        securattr = retrievesecurityattr( vol, securid );
        if ( !securattr )
            ntfs_log_error( "Bad security descriptor for 0x%lx\n",
                            ( long )le32_to_cpu( ni->security_id ) );
    }
    else
    {
        /* get v1.x security attribute */
        readallsz = 0;
        securattr = ntfs_attr_readall( ni, AT_SECURITY_DESCRIPTOR,
                                       AT_UNNAMED, 0, &readallsz );
        if ( securattr && !ntfs_valid_descr( securattr, readallsz ) )
        {
            ntfs_log_error( "Bad security descriptor for inode %lld\n",
                            ( long long )ni->mft_no );
            free( securattr );
            securattr = ( char* )NULL;
        }
    }
    if ( !securattr )
    {
        /*
         * in some situations, there is no security
         * descriptor, and chkdsk does not detect or fix
         * anything. This could be a normal situation.
         * When this happens, simulate a descriptor with
         * minimum rights, so that a real descriptor can
         * be created by chown or chmod
         */
        ntfs_log_error( "No security descriptor found for inode %lld\n",
                        ( long long )ni->mft_no );
        securattr = ntfs_build_descr( 0, 0, adminsid, adminsid );
    }
    return ( securattr );
}

#if POSIXACLS

/*
 *      Determine which access types to a file are allowed
 *  according to the relation of current process to the file
 *
 *  Do not call if default_permissions is set
 */

static int access_check_posix( struct SECURITY_CONTEXT *scx,
                               struct POSIX_SECURITY *pxdesc, mode_t request,
                               uid_t uid, gid_t gid )
{
    struct POSIX_ACE *pxace;
    int userperms;
    int groupperms;
    int mask;
    BOOL somegroup;
    BOOL needgroups;
    mode_t perms;
    int i;

    perms = pxdesc->mode;
    /* owner and root access */
    if ( !scx->uid || ( uid == scx->uid ) )
    {
        if ( !scx->uid )
        {
            /* root access if owner or other execution */
            if ( perms & 0101 )
                perms = 07777;
            else
            {
                /* root access if some group execution */
                groupperms = 0;
                mask = 7;
                for ( i = pxdesc->acccnt - 1; i >= 0 ; i-- )
                {
                    pxace = &pxdesc->acl.ace[i];
                    switch ( pxace->tag )
                    {
                        case POSIX_ACL_USER_OBJ :
                        case POSIX_ACL_GROUP_OBJ :
                        case POSIX_ACL_GROUP :
                            groupperms |= pxace->perms;
                            break;
                        case POSIX_ACL_MASK :
                            mask = pxace->perms & 7;
                            break;
                        default :
                            break;
                    }
                }
                perms = ( groupperms & mask & 1 ) | 6;
            }
        }
        else
            perms &= 07700;
    }
    else
    {
        /*
         * analyze designated users, get mask
         * and identify whether we need to check
         * the group memberships. The groups are
         * not needed when all groups have the
         * same permissions as other for the
         * requested modes.
         */
        userperms = -1;
        groupperms = -1;
        needgroups = FALSE;
        mask = 7;
        for ( i = pxdesc->acccnt - 1; i >= 0 ; i-- )
        {
            pxace = &pxdesc->acl.ace[i];
            switch ( pxace->tag )
            {
                case POSIX_ACL_USER :
                    if ( ( uid_t )pxace->id == scx->uid )
                        userperms = pxace->perms;
                    break;
                case POSIX_ACL_MASK :
                    mask = pxace->perms & 7;
                    break;
                case POSIX_ACL_GROUP_OBJ :
                case POSIX_ACL_GROUP :
                    if ( ( ( pxace->perms & mask ) ^ perms )
                            & ( request >> 6 ) & 7 )
                        needgroups = TRUE;
                    break;
                default :
                    break;
            }
        }
        /* designated users */
        if ( userperms >= 0 )
            perms = ( perms & 07000 ) + ( userperms & mask );
        else if ( !needgroups )
            perms &= 07007;
        else
        {
            /* owning group */
            if ( !( ~( perms >> 3 ) & request & mask )
                    && ( ( gid == scx->gid )
                         || groupmember( scx, scx->uid, gid ) ) )
                perms &= 07070;
            else
            {
                /* other groups */
                groupperms = -1;
                somegroup = FALSE;
                for ( i = pxdesc->acccnt - 1; i >= 0 ; i-- )
                {
                    pxace = &pxdesc->acl.ace[i];
                    if ( ( pxace->tag == POSIX_ACL_GROUP )
                            && groupmember( scx, uid, pxace->id ) )
                    {
                        if ( !( ~pxace->perms & request & mask ) )
                            groupperms = pxace->perms;
                        somegroup = TRUE;
                    }
                }
                if ( groupperms >= 0 )
                    perms = ( perms & 07000 ) + ( groupperms & mask );
                else if ( somegroup )
                    perms = 0;
                else
                    perms &= 07007;
            }
        }
    }
    return ( perms );
}

/*
 *      Get permissions to access a file
 *  Takes into account the relation of user to file (owner, group, ...)
 *  Do no use as mode of the file
 *  Do no call if default_permissions is set
 *
 *  returns -1 if there is a problem
 */

static int ntfs_get_perm( struct SECURITY_CONTEXT *scx,
                          ntfs_inode * ni, mode_t request )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *securattr;
    const SID *usid;    /* owner of file/directory */
    const SID *gsid;    /* group of file/directory */
    uid_t uid;
    gid_t gid;
    int perm;
    BOOL isdir;
    struct POSIX_SECURITY *pxdesc;

    if ( !scx->mapping[MAPUSERS] )
        perm = 07777;
    else
    {
        /* check whether available in cache */
        cached = fetch_cache( scx, ni );
        if ( cached )
        {
            uid = cached->uid;
            gid = cached->gid;
            perm = access_check_posix( scx, cached->pxdesc, request, uid, gid );
        }
        else
        {
            perm = 0;   /* default to no permission */
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            securattr = getsecurityattr( scx->vol, ni );
            if ( securattr )
            {
                phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                        securattr;
                gsid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->group )];
                gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
#if OWNERFROMACL
                usid = ntfs_acl_owner( securattr );
                pxdesc = ntfs_build_permissions_posix( scx->mapping, securattr,
                                                       usid, gsid, isdir );
                if ( pxdesc )
                    perm = pxdesc->mode & 07777;
                else
                    perm = -1;
                uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#else
                usid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->owner )];
                pxdesc = ntfs_build_permissions_posix( scx, securattr,
                                                       usid, gsid, isdir );
                if ( pxdesc )
                    perm = pxdesc->mode & 07777;
                else
                    perm = -1;
                if ( !perm && ntfs_same_sid( usid, adminsid ) )
                {
                    uid = find_tenant( scx, securattr );
                    if ( uid )
                        perm = 0700;
                }
                else
                    uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#endif
                /*
                 *  Create a security id if there were none
                 * and upgrade option is selected
                 */
                if ( !test_nino_flag( ni, v3_Extensions )
                        && ( perm >= 0 )
                        && ( scx->vol->secure_flags
                             & ( 1 << SECURITY_ADDSECURIDS ) ) )
                {
                    upgrade_secur_desc( scx->vol,
                                        securattr, ni );
                    /*
                     * fetch owner and group for cacheing
                     * if there is a securid
                     */
                }
                if ( test_nino_flag( ni, v3_Extensions )
                        && ( perm >= 0 ) )
                {
                    enter_cache( scx, ni, uid,
                                 gid, pxdesc );
                }
                if ( pxdesc )
                {
                    perm = access_check_posix( scx, pxdesc, request, uid, gid );
                    free( pxdesc );
                }
                free( securattr );
            }
            else
            {
                perm = -1;
                uid = gid = 0;
            }
        }
    }
    return ( perm );
}

/*
 *      Get a Posix ACL
 *
 *  returns size or -errno if there is a problem
 *  if size was too small, no copy is done and errno is not set,
 *  the caller is expected to issue a new call
 */

int ntfs_get_posix_acl( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                        const char *name, char *value, size_t size )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    struct POSIX_SECURITY *pxdesc;
    const struct CACHED_PERMISSIONS *cached;
    char *securattr;
    const SID *usid;    /* owner of file/directory */
    const SID *gsid;    /* group of file/directory */
    uid_t uid;
    gid_t gid;
    int perm;
    BOOL isdir;
    size_t outsize;

    outsize = 0;    /* default to error */
    if ( !scx->mapping[MAPUSERS] )
        errno = ENOTSUP;
    else
    {
        /* check whether available in cache */
        cached = fetch_cache( scx, ni );
        if ( cached )
            pxdesc = cached->pxdesc;
        else
        {
            securattr = getsecurityattr( scx->vol, ni );
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            if ( securattr )
            {
                phead =
                    ( const SECURITY_DESCRIPTOR_RELATIVE* )
                    securattr;
                gsid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->group )];
#if OWNERFROMACL
                usid = ntfs_acl_owner( securattr );
#else
                usid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->owner )];
#endif
                pxdesc = ntfs_build_permissions_posix( scx->mapping, securattr,
                                                       usid, gsid, isdir );

                /*
                 * fetch owner and group for cacheing
                 */
                if ( pxdesc )
                {
                    perm = pxdesc->mode & 07777;
                    /*
                     *  Create a security id if there were none
                     * and upgrade option is selected
                     */
                    if ( !test_nino_flag( ni, v3_Extensions )
                            && ( scx->vol->secure_flags
                                 & ( 1 << SECURITY_ADDSECURIDS ) ) )
                    {
                        upgrade_secur_desc( scx->vol,
                                            securattr, ni );
                    }
#if OWNERFROMACL
                    uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#else
                    if ( !perm && ntfs_same_sid( usid, adminsid ) )
                    {
                        uid = find_tenant( scx,
                                           securattr );
                        if ( uid )
                            perm = 0700;
                    }
                    else
                        uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#endif
                    gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
                    if ( pxdesc->tagsset & POSIX_ACL_EXTENSIONS )
                        enter_cache( scx, ni, uid,
                                     gid, pxdesc );
                }
                free( securattr );
            }
            else
                pxdesc = ( struct POSIX_SECURITY* )NULL;
        }

        if ( pxdesc )
        {
            if ( ntfs_valid_posix( pxdesc ) )
            {
                if ( !strcmp( name, "system.posix_acl_default" ) )
                {
                    if ( ni->mrec->flags
                            & MFT_RECORD_IS_DIRECTORY )
                        outsize = sizeof( struct POSIX_ACL )
                                  + pxdesc->defcnt * sizeof( struct POSIX_ACE );
                    else
                    {
                        /*
                         * getting default ACL from plain file :
                         * return EACCES if size > 0 as
                         * indicated in the man, but return ok
                         * if size == 0, so that ls does not
                         * display an error
                         */
                        if ( size > 0 )
                        {
                            outsize = 0;
                            errno = EACCES;
                        }
                        else
                            outsize = sizeof( struct POSIX_ACL );
                    }
                    if ( outsize && ( outsize <= size ) )
                    {
                        memcpy( value, &pxdesc->acl, sizeof( struct POSIX_ACL ) );
                        memcpy( &value[sizeof( struct POSIX_ACL )],
                                &pxdesc->acl.ace[pxdesc->firstdef],
                                outsize - sizeof( struct POSIX_ACL ) );
                    }
                }
                else
                {
                    outsize = sizeof( struct POSIX_ACL )
                              + pxdesc->acccnt * sizeof( struct POSIX_ACE );
                    if ( outsize <= size )
                        memcpy( value, &pxdesc->acl, outsize );
                }
            }
            else
            {
                outsize = 0;
                errno = EIO;
                ntfs_log_error( "Invalid Posix ACL built\n" );
            }
            if ( !cached )
                free( pxdesc );
        }
        else
            outsize = 0;
    }
    return ( outsize ? ( int )outsize : -errno );
}

#else /* POSIXACLS */


/*
 *      Get permissions to access a file
 *  Takes into account the relation of user to file (owner, group, ...)
 *  Do no use as mode of the file
 *
 *  returns -1 if there is a problem
 */

static int ntfs_get_perm( struct SECURITY_CONTEXT *scx,
                          ntfs_inode *ni, mode_t request )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *securattr;
    const SID *usid;    /* owner of file/directory */
    const SID *gsid;    /* group of file/directory */
    BOOL isdir;
    uid_t uid;
    gid_t gid;
    int perm;

    if ( !scx->mapping[MAPUSERS] || ( !scx->uid && !( request & S_IEXEC ) ) )
        perm = 07777;
    else
    {
        /* check whether available in cache */
        cached = fetch_cache( scx, ni );
        if ( cached )
        {
            perm = cached->mode;
            uid = cached->uid;
            gid = cached->gid;
        }
        else
        {
            perm = 0;   /* default to no permission */
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            securattr = getsecurityattr( scx->vol, ni );
            if ( securattr )
            {
                phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                        securattr;
                gsid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->group )];
                gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
#if OWNERFROMACL
                usid = ntfs_acl_owner( securattr );
                perm = ntfs_build_permissions( securattr,
                                               usid, gsid, isdir );
                uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#else
usid = ( const SID* ) &
       securattr[le32_to_cpu( phead->owner )];
perm = ntfs_build_permissions( securattr,
                               usid, gsid, isdir );
if ( !perm && ntfs_same_sid( usid, adminsid ) )
{
    uid = find_tenant( scx, securattr );
    if ( uid )
        perm = 0700;
}
else
    uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#endif
                /*
                 *  Create a security id if there were none
                 * and upgrade option is selected
                 */
                if ( !test_nino_flag( ni, v3_Extensions )
                        && ( perm >= 0 )
                        && ( scx->vol->secure_flags
                             & ( 1 << SECURITY_ADDSECURIDS ) ) )
                {
                    upgrade_secur_desc( scx->vol,
                                        securattr, ni );
                    /*
                     * fetch owner and group for cacheing
                     * if there is a securid
                     */
                }
                if ( test_nino_flag( ni, v3_Extensions )
                        && ( perm >= 0 ) )
                {
                    enter_cache( scx, ni, uid,
                                 gid, perm );
                }
                free( securattr );
            }
            else
            {
                perm = -1;
                uid = gid = 0;
            }
        }
        if ( perm >= 0 )
        {
            if ( !scx->uid )
            {
                /* root access and execution */
                if ( perm & 0111 )
                    perm = 07777;
                else
                    perm = 0;
            }
            else if ( uid == scx->uid )
                perm &= 07700;
            else
                /*
                 * avoid checking group membership
                 * when the requested perms for group
                 * are the same as perms for other
                 */
                if ( ( gid == scx->gid )
                        || ( ( ( ( perm >> 3 ) ^ perm )
                               & ( request >> 6 ) & 7 )
                             && groupmember( scx, scx->uid, gid ) ) )
                    perm &= 07070;
                else
                    perm &= 07007;
        }
    }
    return ( perm );
}

#endif /* POSIXACLS */

/*
 *      Get an NTFS ACL
 *
 *  Returns size or -errno if there is a problem
 *  if size was too small, no copy is done and errno is not set,
 *  the caller is expected to issue a new call
 */

int ntfs_get_ntfs_acl( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                       char *value, size_t size )
{
    char *securattr;
    size_t outsize;

    outsize = 0;    /* default to no data and no error */
    securattr = getsecurityattr( scx->vol, ni );
    if ( securattr )
    {
        outsize = ntfs_attr_size( securattr );
        if ( outsize <= size )
        {
            memcpy( value, securattr, outsize );
        }
        free( securattr );
    }
    return ( outsize ? ( int )outsize : -errno );
}

/*
 *      Get owner, group and permissions in an stat structure
 *  returns permissions, or -1 if there is a problem
 */

int ntfs_get_owner_mode( struct SECURITY_CONTEXT *scx,
                         ntfs_inode * ni, struct stat *stbuf )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    char *securattr;
    const SID *usid;    /* owner of file/directory */
    const SID *gsid;    /* group of file/directory */
    const struct CACHED_PERMISSIONS *cached;
    int perm;
    BOOL isdir;
#if POSIXACLS
    struct POSIX_SECURITY *pxdesc;
#endif

    if ( !scx->mapping[MAPUSERS] )
        perm = 07777;
    else
    {
        /* check whether available in cache */
        cached = fetch_cache( scx, ni );
        if ( cached )
        {
            perm = cached->mode;
            stbuf->st_uid = cached->uid;
            stbuf->st_gid = cached->gid;
            stbuf->st_mode = ( stbuf->st_mode & ~07777 ) + perm;
        }
        else
        {
            perm = -1;  /* default to error */
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            securattr = getsecurityattr( scx->vol, ni );
            if ( securattr )
            {
                phead =
                    ( const SECURITY_DESCRIPTOR_RELATIVE* )
                    securattr;
                gsid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->group )];
#if OWNERFROMACL
                usid = ntfs_acl_owner( securattr );
#else
                usid = ( const SID* ) &
                       securattr[le32_to_cpu( phead->owner )];
#endif
#if POSIXACLS
                pxdesc = ntfs_build_permissions_posix( scx->mapping, securattr,
                                                       usid, gsid, isdir );
                if ( pxdesc )
                    perm = pxdesc->mode & 07777;
                else
                    perm = -1;
#else
                perm = ntfs_build_permissions( securattr,
                                               usid, gsid, isdir );
#endif
                /*
                 * fetch owner and group for cacheing
                 */
                if ( perm >= 0 )
                {
                    /*
                     *  Create a security id if there were none
                     * and upgrade option is selected
                     */
                    if ( !test_nino_flag( ni, v3_Extensions )
                            && ( scx->vol->secure_flags
                                 & ( 1 << SECURITY_ADDSECURIDS ) ) )
                    {
                        upgrade_secur_desc( scx->vol,
                                            securattr, ni );
                    }
#if OWNERFROMACL
                    stbuf->st_uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#else
                    if ( !perm && ntfs_same_sid( usid, adminsid ) )
                    {
                        stbuf->st_uid =
                            find_tenant( scx,
                                         securattr );
                        if ( stbuf->st_uid )
                            perm = 0700;
                    }
                    else
                        stbuf->st_uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#endif
                    stbuf->st_gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
                    stbuf->st_mode =
                        ( stbuf->st_mode & ~07777 ) + perm;
#if POSIXACLS
                    enter_cache( scx, ni, stbuf->st_uid,
                                 stbuf->st_gid, pxdesc );
                    free( pxdesc );
#else
                    enter_cache( scx, ni, stbuf->st_uid,
                                 stbuf->st_gid, perm );
#endif
                }
                free( securattr );
            }
        }
    }
    return ( perm );
}

#if POSIXACLS

/*
 *      Get the base for a Posix inheritance and
 *  build an inherited Posix descriptor
 */

static struct POSIX_SECURITY *inherit_posix( struct SECURITY_CONTEXT *scx,
        ntfs_inode *dir_ni, mode_t mode, BOOL isdir )
{
    const struct CACHED_PERMISSIONS *cached;
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    struct POSIX_SECURITY *pxdesc;
    struct POSIX_SECURITY *pydesc;
    char *securattr;
    const SID *usid;
    const SID *gsid;
    uid_t uid;
    gid_t gid;

    pydesc = ( struct POSIX_SECURITY* )NULL;
    /* check whether parent directory is available in cache */
    cached = fetch_cache( scx, dir_ni );
    if ( cached )
    {
        uid = cached->uid;
        gid = cached->gid;
        pxdesc = cached->pxdesc;
        if ( pxdesc )
        {
            pydesc = ntfs_build_inherited_posix( pxdesc, mode,
                                                 scx->umask, isdir );
        }
    }
    else
    {
        securattr = getsecurityattr( scx->vol, dir_ni );
        if ( securattr )
        {
            phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                    securattr;
            gsid = ( const SID* ) &
                   securattr[le32_to_cpu( phead->group )];
            gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
#if OWNERFROMACL
            usid = ntfs_acl_owner( securattr );
            pxdesc = ntfs_build_permissions_posix( scx->mapping, securattr,
                                                   usid, gsid, TRUE );
            uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#else
            usid = ( const SID* ) &
                   securattr[le32_to_cpu( phead->owner )];
            pxdesc = ntfs_build_permissions_posix( scx->mapping, securattr,
                                                   usid, gsid, TRUE );
            if ( pxdesc && ntfs_same_sid( usid, adminsid ) )
            {
                uid = find_tenant( scx, securattr );
            }
            else
                uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
#endif
            if ( pxdesc )
            {
                /*
                 *  Create a security id if there were none
                 * and upgrade option is selected
                 */
                if ( !test_nino_flag( dir_ni, v3_Extensions )
                        && ( scx->vol->secure_flags
                             & ( 1 << SECURITY_ADDSECURIDS ) ) )
                {
                    upgrade_secur_desc( scx->vol,
                                        securattr, dir_ni );
                    /*
                     * fetch owner and group for cacheing
                     * if there is a securid
                     */
                }
                if ( test_nino_flag( dir_ni, v3_Extensions ) )
                {
                    enter_cache( scx, dir_ni, uid,
                                 gid, pxdesc );
                }
                pydesc = ntfs_build_inherited_posix( pxdesc,
                                                     mode, scx->umask, isdir );
                free( pxdesc );
            }
            free( securattr );
        }
    }
    return ( pydesc );
}

/*
 *      Allocate a security_id for a file being created
 *
 *  Returns zero if not possible (NTFS v3.x required)
 */

le32 ntfs_alloc_securid( struct SECURITY_CONTEXT *scx,
                         uid_t uid, gid_t gid, ntfs_inode *dir_ni,
                         mode_t mode, BOOL isdir )
{
#if !FORCE_FORMAT_v1x
    const struct CACHED_SECURID *cached;
    struct CACHED_SECURID wanted;
    struct POSIX_SECURITY *pxdesc;
    char *newattr;
    int newattrsz;
    const SID *usid;
    const SID *gsid;
    BIGSID defusid;
    BIGSID defgsid;
    le32 securid;
#endif

    securid = const_cpu_to_le32( 0 );

#if !FORCE_FORMAT_v1x

    pxdesc = inherit_posix( scx, dir_ni, mode, isdir );
    if ( pxdesc )
    {
        /* check whether target securid is known in cache */

        wanted.uid = uid;
        wanted.gid = gid;
        wanted.dmode = pxdesc->mode & mode & 07777;
        if ( isdir ) wanted.dmode |= 0x10000;
        wanted.variable = ( void* )pxdesc;
        wanted.varsize = sizeof( struct POSIX_SECURITY )
                         + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
        cached = ( const struct CACHED_SECURID* )ntfs_fetch_cache(
                     scx->vol->securid_cache, GENERIC( &wanted ),
                     ( cache_compare )compare );
        /* quite simple, if we are lucky */
        if ( cached )
            securid = cached->securid;

        /* not in cache : make sure we can create ids */

        if ( !cached && ( scx->vol->major_ver >= 3 ) )
        {
            usid = ntfs_find_usid( scx->mapping[MAPUSERS], uid, ( SID* ) & defusid );
            gsid = ntfs_find_gsid( scx->mapping[MAPGROUPS], gid, ( SID* ) & defgsid );
            if ( !usid || !gsid )
            {
                ntfs_log_error( "File created by an unmapped user/group %d/%d\n",
                                ( int )uid, ( int )gid );
                usid = gsid = adminsid;
            }
            newattr = ntfs_build_descr_posix( scx->mapping, pxdesc,
                                              isdir, usid, gsid );
            if ( newattr )
            {
                newattrsz = ntfs_attr_size( newattr );
                securid = setsecurityattr( scx->vol,
                                           ( const SECURITY_DESCRIPTOR_RELATIVE* )newattr,
                                           newattrsz );
                if ( securid )
                {
                    /* update cache, for subsequent use */
                    wanted.securid = securid;
                    ntfs_enter_cache( scx->vol->securid_cache,
                                      GENERIC( &wanted ),
                                      ( cache_compare )compare );
                }
                free( newattr );
            }
            else
            {
                /*
                 * could not build new security attribute
                 * errno set by ntfs_build_descr()
                 */
            }
        }
        free( pxdesc );
    }
#endif
    return ( securid );
}

/*
 *      Apply Posix inheritance to a newly created file
 *  (for NTFS 1.x only : no securid)
 */

int ntfs_set_inherited_posix( struct SECURITY_CONTEXT *scx,
                              ntfs_inode *ni, uid_t uid, gid_t gid,
                              ntfs_inode *dir_ni, mode_t mode )
{
    struct POSIX_SECURITY *pxdesc;
    char *newattr;
    const SID *usid;
    const SID *gsid;
    BIGSID defusid;
    BIGSID defgsid;
    BOOL isdir;
    int res;

    res = -1;
    isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY ) != const_cpu_to_le16( 0 );
    pxdesc = inherit_posix( scx, dir_ni, mode, isdir );
    if ( pxdesc )
    {
        usid = ntfs_find_usid( scx->mapping[MAPUSERS], uid, ( SID* ) & defusid );
        gsid = ntfs_find_gsid( scx->mapping[MAPGROUPS], gid, ( SID* ) & defgsid );
        if ( !usid || !gsid )
        {
            ntfs_log_error( "File created by an unmapped user/group %d/%d\n",
                            ( int )uid, ( int )gid );
            usid = gsid = adminsid;
        }
        newattr = ntfs_build_descr_posix( scx->mapping, pxdesc,
                                          isdir, usid, gsid );
        if ( newattr )
        {
            /* Adjust Windows read-only flag */
            res = update_secur_descr( scx->vol, newattr, ni );
            if ( !res && !isdir )
            {
                if ( mode & S_IWUSR )
                    ni->flags &= ~FILE_ATTR_READONLY;
                else
                    ni->flags |= FILE_ATTR_READONLY;
            }
#if CACHE_LEGACY_SIZE
            /* also invalidate legacy cache */
            if ( isdir && !ni->security_id )
            {
                struct CACHED_PERMISSIONS_LEGACY legacy;

                legacy.mft_no = ni->mft_no;
                legacy.variable = pxdesc;
                legacy.varsize = sizeof( struct POSIX_SECURITY )
                                 + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
                ntfs_invalidate_cache( scx->vol->legacy_cache,
                                       GENERIC( &legacy ),
                                       ( cache_compare )leg_compare, 0 );
            }
#endif
            free( newattr );

        }
        else
        {
            /*
             * could not build new security attribute
             * errno set by ntfs_build_descr()
             */
        }
    }
    return ( res );
}

#else

le32 ntfs_alloc_securid( struct SECURITY_CONTEXT *scx,
                         uid_t uid, gid_t gid, mode_t mode, BOOL isdir )
{
#if !FORCE_FORMAT_v1x
    const struct CACHED_SECURID *cached;
    struct CACHED_SECURID wanted;
    char *newattr;
    int newattrsz;
    const SID *usid;
    const SID *gsid;
    BIGSID defusid;
    BIGSID defgsid;
    le32 securid;
#endif

    securid = const_cpu_to_le32( 0 );

#if !FORCE_FORMAT_v1x
    /* check whether target securid is known in cache */

    wanted.uid = uid;
    wanted.gid = gid;
    wanted.dmode = mode & 07777;
    if ( isdir ) wanted.dmode |= 0x10000;
    wanted.variable = ( void* )NULL;
    wanted.varsize = 0;
    cached = ( const struct CACHED_SECURID* )ntfs_fetch_cache(
                 scx->vol->securid_cache, GENERIC( &wanted ),
                 ( cache_compare )compare );
    /* quite simple, if we are lucky */
    if ( cached )
        securid = cached->securid;

    /* not in cache : make sure we can create ids */

    if ( !cached && ( scx->vol->major_ver >= 3 ) )
    {
        usid = ntfs_find_usid( scx->mapping[MAPUSERS], uid, ( SID* ) & defusid );
        gsid = ntfs_find_gsid( scx->mapping[MAPGROUPS], gid, ( SID* ) & defgsid );
        if ( !usid || !gsid )
        {
            ntfs_log_error( "File created by an unmapped user/group %d/%d\n",
                            ( int )uid, ( int )gid );
            usid = gsid = adminsid;
        }
        newattr = ntfs_build_descr( mode, isdir, usid, gsid );
        if ( newattr )
        {
            newattrsz = ntfs_attr_size( newattr );
            securid = setsecurityattr( scx->vol,
                                       ( const SECURITY_DESCRIPTOR_RELATIVE* )newattr,
                                       newattrsz );
            if ( securid )
            {
                /* update cache, for subsequent use */
                wanted.securid = securid;
                ntfs_enter_cache( scx->vol->securid_cache,
                                  GENERIC( &wanted ),
                                  ( cache_compare )compare );
            }
            free( newattr );
        }
        else
        {
            /*
             * could not build new security attribute
             * errno set by ntfs_build_descr()
             */
        }
    }
#endif
    return ( securid );
}

#endif

/*
 *      Update ownership and mode of a file, reusing an existing
 *  security descriptor when possible
 *
 *  Returns zero if successful
 */

#if POSIXACLS
int ntfs_set_owner_mode( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                         uid_t uid, gid_t gid, mode_t mode,
                         struct POSIX_SECURITY *pxdesc )
#else
int ntfs_set_owner_mode( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                         uid_t uid, gid_t gid, mode_t mode )
#endif
{
    int res;
    const struct CACHED_SECURID *cached;
    struct CACHED_SECURID wanted;
    char *newattr;
    const SID *usid;
    const SID *gsid;
    BIGSID defusid;
    BIGSID defgsid;
    BOOL isdir;

    res = 0;

    /* check whether target securid is known in cache */

    isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY ) != const_cpu_to_le16( 0 );
    wanted.uid = uid;
    wanted.gid = gid;
    wanted.dmode = mode & 07777;
    if ( isdir ) wanted.dmode |= 0x10000;
#if POSIXACLS
    wanted.variable = ( void* )pxdesc;
    if ( pxdesc )
        wanted.varsize = sizeof( struct POSIX_SECURITY )
                         + ( pxdesc->acccnt + pxdesc->defcnt ) * sizeof( struct POSIX_ACE );
    else
        wanted.varsize = 0;
#else
    wanted.variable = ( void* )NULL;
    wanted.varsize = 0;
#endif
    if ( test_nino_flag( ni, v3_Extensions ) )
    {
        cached = ( const struct CACHED_SECURID* )ntfs_fetch_cache(
                     scx->vol->securid_cache, GENERIC( &wanted ),
                     ( cache_compare )compare );
        /* quite simple, if we are lucky */
        if ( cached )
        {
            ni->security_id = cached->securid;
            NInoSetDirty( ni );
        }
    }
    else cached = ( struct CACHED_SECURID* )NULL;

    if ( !cached )
    {
        /*
         * Do not use usid and gsid from former attributes,
         * but recompute them to get repeatable results
         * which can be kept in cache.
         */
        usid = ntfs_find_usid( scx->mapping[MAPUSERS], uid, ( SID* ) & defusid );
        gsid = ntfs_find_gsid( scx->mapping[MAPGROUPS], gid, ( SID* ) & defgsid );
        if ( !usid || !gsid )
        {
            ntfs_log_error( "File made owned by an unmapped user/group %d/%d\n",
                            uid, gid );
            usid = gsid = adminsid;
        }
#if POSIXACLS
        if ( pxdesc )
            newattr = ntfs_build_descr_posix( scx->mapping, pxdesc,
                                              isdir, usid, gsid );
        else
            newattr = ntfs_build_descr( mode,
                                        isdir, usid, gsid );
#else
        newattr = ntfs_build_descr( mode,
                                    isdir, usid, gsid );
#endif
        if ( newattr )
        {
            res = update_secur_descr( scx->vol, newattr, ni );
            if ( !res )
            {
                /* adjust Windows read-only flag */
                if ( !isdir )
                {
                    if ( mode & S_IWUSR )
                        ni->flags &= ~FILE_ATTR_READONLY;
                    else
                        ni->flags |= FILE_ATTR_READONLY;
                    NInoFileNameSetDirty( ni );
                }
                /* update cache, for subsequent use */
                if ( test_nino_flag( ni, v3_Extensions ) )
                {
                    wanted.securid = ni->security_id;
                    ntfs_enter_cache( scx->vol->securid_cache,
                                      GENERIC( &wanted ),
                                      ( cache_compare )compare );
                }
#if CACHE_LEGACY_SIZE
                /* also invalidate legacy cache */
                if ( isdir && !ni->security_id )
                {
                    struct CACHED_PERMISSIONS_LEGACY legacy;

                    legacy.mft_no = ni->mft_no;
#if POSIXACLS
                    legacy.variable = wanted.variable;
                    legacy.varsize = wanted.varsize;
#else
                    legacy.variable = ( void* )NULL;
                    legacy.varsize = 0;
#endif
                    ntfs_invalidate_cache( scx->vol->legacy_cache,
                                           GENERIC( &legacy ),
                                           ( cache_compare )leg_compare, 0 );
                }
#endif
            }
            free( newattr );
        }
        else
        {
            /*
             * could not build new security attribute
             * errno set by ntfs_build_descr()
             */
            res = -1;
        }
    }
    return ( res );
}

/*
 *      Check whether user has ownership rights on a file
 *
 *  Returns TRUE if allowed
 *      if not, errno tells why
 */

BOOL ntfs_allowed_as_owner( struct SECURITY_CONTEXT *scx, ntfs_inode *ni )
{
    const struct CACHED_PERMISSIONS *cached;
    char *oldattr;
    const SID *usid;
    uid_t processuid;
    uid_t uid;
    BOOL gotowner;
    int allowed;

    processuid = scx->uid;
    /* TODO : use CAP_FOWNER process capability */
    /*
     * Always allow for root
     * Also always allow if no mapping has been defined
     */
    if ( !scx->mapping[MAPUSERS] || !processuid )
        allowed = TRUE;
    else
    {
        gotowner = FALSE; /* default */
        /* get the owner, either from cache or from old attribute  */
        cached = fetch_cache( scx, ni );
        if ( cached )
        {
            uid = cached->uid;
            gotowner = TRUE;
        }
        else
        {
            oldattr = getsecurityattr( scx->vol, ni );
            if ( oldattr )
            {
#if OWNERFROMACL
                usid = ntfs_acl_owner( oldattr );
#else
                const SECURITY_DESCRIPTOR_RELATIVE *phead;

                phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                        oldattr;
                usid = ( const SID* ) & oldattr
                       [le32_to_cpu( phead->owner )];
#endif
                uid = ntfs_find_user( scx->mapping[MAPUSERS],
                                      usid );
                gotowner = TRUE;
                free( oldattr );
            }
        }
        allowed = FALSE;
        if ( gotowner )
        {
            /* TODO : use CAP_FOWNER process capability */
            if ( !processuid || ( processuid == uid ) )
                allowed = TRUE;
            else
                errno = EPERM;
        }
    }
    return ( allowed );
}

#ifdef HAVE_SETXATTR    /* extended attributes interface required */

#if POSIXACLS

/*
 *      Set a new access or default Posix ACL to a file
 *      (or remove ACL if no input data)
 *  Validity of input data is checked after merging
 *
 *  Returns 0, or -1 if there is a problem which errno describes
 */

int ntfs_set_posix_acl( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                        const char *name, const char *value, size_t size,
                        int flags )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *oldattr;
    uid_t processuid;
    const SID *usid;
    const SID *gsid;
    uid_t uid;
    uid_t gid;
    int res;
    mode_t mode;
    BOOL isdir;
    BOOL deflt;
    BOOL exist;
    int count;
    struct POSIX_SECURITY *oldpxdesc;
    struct POSIX_SECURITY *newpxdesc;

    /* get the current pxsec, either from cache or from old attribute  */
    res = -1;
    deflt = !strcmp( name, "system.posix_acl_default" );
    if ( size )
        count = ( size - sizeof( struct POSIX_ACL ) ) / sizeof( struct POSIX_ACE );
    else
        count = 0;
    isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY ) != const_cpu_to_le16( 0 );
    newpxdesc = ( struct POSIX_SECURITY* )NULL;
    if ( !deflt || isdir || !size )
    {
        cached = fetch_cache( scx, ni );
        if ( cached )
        {
            uid = cached->uid;
            gid = cached->gid;
            oldpxdesc = cached->pxdesc;
            if ( oldpxdesc )
            {
                mode = oldpxdesc->mode;
                newpxdesc = ntfs_replace_acl( oldpxdesc,
                                              ( const struct POSIX_ACL* )value, count, deflt );
            }
        }
        else
        {
            oldattr = getsecurityattr( scx->vol, ni );
            if ( oldattr )
            {
                phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )oldattr;
#if OWNERFROMACL
                usid = ntfs_acl_owner( oldattr );
#else
                usid = ( const SID* ) & oldattr[le32_to_cpu( phead->owner )];
#endif
                gsid = ( const SID* ) & oldattr[le32_to_cpu( phead->group )];
                uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
                gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
                oldpxdesc = ntfs_build_permissions_posix( scx->mapping,
                            oldattr, usid, gsid, isdir );
                if ( oldpxdesc )
                {
                    if ( deflt )
                        exist = oldpxdesc->defcnt > 0;
                    else
                        exist = oldpxdesc->acccnt > 3;
                    if ( ( exist && ( flags & XATTR_CREATE ) )
                            || ( !exist && ( flags & XATTR_REPLACE ) ) )
                    {
                        errno = ( exist ? EEXIST : ENODATA );
                    }
                    else
                    {
                        mode = oldpxdesc->mode;
                        newpxdesc = ntfs_replace_acl( oldpxdesc,
                                                      ( const struct POSIX_ACL* )value, count, deflt );
                    }
                    free( oldpxdesc );
                }
                free( oldattr );
            }
        }
    }
    else
        errno = EINVAL;

    if ( newpxdesc )
    {
        processuid = scx->uid;
        /* TODO : use CAP_FOWNER process capability */
        if ( !processuid || ( uid == processuid ) )
        {
            /*
             * clear setgid if file group does
             * not match process group
             */
            if ( processuid && ( gid != scx->gid )
                    && !groupmember( scx, scx->uid, gid ) )
            {
                newpxdesc->mode &= ~S_ISGID;
            }
            res = ntfs_set_owner_mode( scx, ni, uid, gid,
                                       newpxdesc->mode, newpxdesc );
        }
        else
            errno = EPERM;
        free( newpxdesc );
    }
    return ( res ? -1 : 0 );
}

/*
 *      Remove a default Posix ACL from a file
 *
 *  Returns 0, or -1 if there is a problem which errno describes
 */

int ntfs_remove_posix_acl( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                           const char *name )
{
    return ( ntfs_set_posix_acl( scx, ni, name,
                                 ( const char* )NULL, 0, 0 ) );
}

#endif

/*
 *      Set a new NTFS ACL to a file
 *
 *  Returns 0, or -1 if there is a problem
 */

int ntfs_set_ntfs_acl( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                       const char *value, size_t size, int flags )
{
    char *attr;
    int res;

    res = -1;
    if ( ( size > 0 )
            && !( flags & XATTR_CREATE )
            && ntfs_valid_descr( value, size )
            && ( ntfs_attr_size( value ) == size ) )
    {
        /* need copying in order to write */
        attr = ( char* )ntfs_malloc( size );
        if ( attr )
        {
            memcpy( attr, value, size );
            res = update_secur_descr( scx->vol, attr, ni );
            /*
             * No need to invalidate standard caches :
             * the relation between a securid and
             * the associated protection is unchanged,
             * only the relation between a file and
             * its securid and protection is changed.
             */
#if CACHE_LEGACY_SIZE
            /*
             * we must however invalidate the legacy
             * cache, which is based on inode numbers.
             * For safety, invalidate even if updating
             * failed.
             */
            if ( ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    && !ni->security_id )
            {
                struct CACHED_PERMISSIONS_LEGACY legacy;

                legacy.mft_no = ni->mft_no;
                legacy.variable = ( char* )NULL;
                legacy.varsize = 0;
                ntfs_invalidate_cache( scx->vol->legacy_cache,
                                       GENERIC( &legacy ),
                                       ( cache_compare )leg_compare, 0 );
            }
#endif
            free( attr );
        }
        else
            errno = ENOMEM;
    }
    else
        errno = EINVAL;
    return ( res ? -1 : 0 );
}

#endif /* HAVE_SETXATTR */

/*
 *      Set new permissions to a file
 *  Checks user mapping has been defined before request for setting
 *
 *  rejected if request is not originated by owner or root
 *
 *  returns 0 on success
 *      -1 on failure, with errno = EIO
 */

int ntfs_set_mode( struct SECURITY_CONTEXT *scx, ntfs_inode *ni, mode_t mode )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *oldattr;
    const SID *usid;
    const SID *gsid;
    uid_t processuid;
    uid_t uid;
    uid_t gid;
    int res;
#if POSIXACLS
    BOOL isdir;
    int pxsize;
    const struct POSIX_SECURITY *oldpxdesc;
    struct POSIX_SECURITY *newpxdesc = ( struct POSIX_SECURITY* )NULL;
#endif

    /* get the current owner, either from cache or from old attribute  */
    res = 0;
    cached = fetch_cache( scx, ni );
    if ( cached )
    {
        uid = cached->uid;
        gid = cached->gid;
#if POSIXACLS
        oldpxdesc = cached->pxdesc;
        if ( oldpxdesc )
        {
            /* must copy before merging */
            pxsize = sizeof( struct POSIX_SECURITY )
                     + ( oldpxdesc->acccnt + oldpxdesc->defcnt ) * sizeof( struct POSIX_ACE );
            newpxdesc = ( struct POSIX_SECURITY* )malloc( pxsize );
            if ( newpxdesc )
            {
                memcpy( newpxdesc, oldpxdesc, pxsize );
                if ( ntfs_merge_mode_posix( newpxdesc, mode ) )
                    res = -1;
            }
            else
                res = -1;
        }
        else
            newpxdesc = ( struct POSIX_SECURITY* )NULL;
#endif
    }
    else
    {
        oldattr = getsecurityattr( scx->vol, ni );
        if ( oldattr )
        {
            phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )oldattr;
#if OWNERFROMACL
            usid = ntfs_acl_owner( oldattr );
#else
            usid = ( const SID* ) & oldattr[le32_to_cpu( phead->owner )];
#endif
            gsid = ( const SID* ) & oldattr[le32_to_cpu( phead->group )];
            uid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
            gid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
#if POSIXACLS
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY ) != const_cpu_to_le16( 0 );
            newpxdesc = ntfs_build_permissions_posix( scx->mapping,
                        oldattr, usid, gsid, isdir );
            if ( !newpxdesc || ntfs_merge_mode_posix( newpxdesc, mode ) )
                res = -1;
#endif
            free( oldattr );
        }
        else
            res = -1;
    }

    if ( !res )
    {
        processuid = scx->uid;
        /* TODO : use CAP_FOWNER process capability */
        if ( !processuid || ( uid == processuid ) )
        {
            /*
             * clear setgid if file group does
             * not match process group
             */
            if ( processuid && ( gid != scx->gid )
                    && !groupmember( scx, scx->uid, gid ) )
                mode &= ~S_ISGID;
#if POSIXACLS
            if ( newpxdesc )
            {
                newpxdesc->mode = mode;
                res = ntfs_set_owner_mode( scx, ni, uid, gid,
                                           mode, newpxdesc );
            }
            else
                res = ntfs_set_owner_mode( scx, ni, uid, gid,
                                           mode, newpxdesc );
#else
            res = ntfs_set_owner_mode( scx, ni, uid, gid, mode );
#endif
        }
        else
        {
            errno = EPERM;
            res = -1;   /* neither owner nor root */
        }
    }
    else
    {
        /*
         * Should not happen : a default descriptor is generated
         * by getsecurityattr() when there are none
         */
        ntfs_log_error( "File has no security descriptor\n" );
        res = -1;
        errno = EIO;
    }
#if POSIXACLS
    if ( newpxdesc ) free( newpxdesc );
#endif
    return ( res ? -1 : 0 );
}

/*
 *  Create a default security descriptor for files whose descriptor
 *  cannot be inherited
 */

int ntfs_sd_add_everyone( ntfs_inode *ni )
{
    /* JPA SECURITY_DESCRIPTOR_ATTR *sd; */
    SECURITY_DESCRIPTOR_RELATIVE *sd;
    ACL *acl;
    ACCESS_ALLOWED_ACE *ace;
    SID *sid;
    int ret, sd_len;

    /* Create SECURITY_DESCRIPTOR attribute (everyone has full access). */
    /*
     * Calculate security descriptor length. We have 2 sub-authorities in
     * owner and group SIDs, but structure SID contain only one, so add
     * 4 bytes to every SID.
     */
    sd_len = sizeof( SECURITY_DESCRIPTOR_ATTR ) + 2 * ( sizeof( SID ) + 4 ) +
             sizeof( ACL ) + sizeof( ACCESS_ALLOWED_ACE );
    sd = ( SECURITY_DESCRIPTOR_RELATIVE* )ntfs_calloc( sd_len );
    if ( !sd )
        return -1;

    sd->revision = SECURITY_DESCRIPTOR_REVISION;
    sd->control = SE_DACL_PRESENT | SE_SELF_RELATIVE;

    sid = ( SID* )( ( u8* )sd + sizeof( SECURITY_DESCRIPTOR_ATTR ) );
    sid->revision = SID_REVISION;
    sid->sub_authority_count = 2;
    sid->sub_authority[0] = const_cpu_to_le32( SECURITY_BUILTIN_DOMAIN_RID );
    sid->sub_authority[1] = const_cpu_to_le32( DOMAIN_ALIAS_RID_ADMINS );
    sid->identifier_authority.value[5] = 5;
    sd->owner = cpu_to_le32( ( u8* )sid - ( u8* )sd );

    sid = ( SID* )( ( u8* )sid + sizeof( SID ) + 4 );
    sid->revision = SID_REVISION;
    sid->sub_authority_count = 2;
    sid->sub_authority[0] = const_cpu_to_le32( SECURITY_BUILTIN_DOMAIN_RID );
    sid->sub_authority[1] = const_cpu_to_le32( DOMAIN_ALIAS_RID_ADMINS );
    sid->identifier_authority.value[5] = 5;
    sd->group = cpu_to_le32( ( u8* )sid - ( u8* )sd );

    acl = ( ACL* )( ( u8* )sid + sizeof( SID ) + 4 );
    acl->revision = ACL_REVISION;
    acl->size = const_cpu_to_le16( sizeof( ACL ) + sizeof( ACCESS_ALLOWED_ACE ) );
    acl->ace_count = const_cpu_to_le16( 1 );
    sd->dacl = cpu_to_le32( ( u8* )acl - ( u8* )sd );

    ace = ( ACCESS_ALLOWED_ACE* )( ( u8* )acl + sizeof( ACL ) );
    ace->type = ACCESS_ALLOWED_ACE_TYPE;
    ace->flags = OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE;
    ace->size = const_cpu_to_le16( sizeof( ACCESS_ALLOWED_ACE ) );
    ace->mask = const_cpu_to_le32( 0x1f01ff ); /* FIXME */
    ace->sid.revision = SID_REVISION;
    ace->sid.sub_authority_count = 1;
    ace->sid.sub_authority[0] = const_cpu_to_le32( 0 );
    ace->sid.identifier_authority.value[5] = 1;

    ret = ntfs_attr_add( ni, AT_SECURITY_DESCRIPTOR, AT_UNNAMED, 0, ( u8* )sd,
                         sd_len );
    if ( ret )
        ntfs_log_perror( "Failed to add initial SECURITY_DESCRIPTOR" );

    free( sd );
    return ret;
}

/*
 *      Check whether user can access a file in a specific way
 *
 *  Returns 1 if access is allowed, including user is root or no
 *        user mapping defined
 *      2 if sticky and accesstype is S_IWRITE + S_IEXEC + S_ISVTX
 *      0 and sets errno if there is a problem or if access
 *        is not allowed
 *
 *  This is used for Posix ACL and checking creation of DOS file names
 */

int ntfs_allowed_access( struct SECURITY_CONTEXT *scx,
                         ntfs_inode *ni,
                         int accesstype ) /* access type required (S_Ixxx values) */
{
    int perm;
    int res;
    int allow;
    struct stat stbuf;

    /*
     * Always allow for root unless execution is requested.
     * (was checked by fuse until kernel 2.6.29)
     * Also always allow if no mapping has been defined
     */
    if ( !scx->mapping[MAPUSERS]
            || ( !scx->uid
                 && ( !( accesstype & S_IEXEC )
                      || ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY ) ) ) )
        allow = 1;
    else
    {
        perm = ntfs_get_perm( scx, ni, accesstype );
        if ( perm >= 0 )
        {
            res = EACCES;
            switch ( accesstype )
            {
                case S_IEXEC:
                    allow = ( perm & ( S_IXUSR | S_IXGRP | S_IXOTH ) ) != 0;
                    break;
                case S_IWRITE:
                    allow = ( perm & ( S_IWUSR | S_IWGRP | S_IWOTH ) ) != 0;
                    break;
                case S_IWRITE + S_IEXEC:
                    allow = ( ( perm & ( S_IWUSR | S_IWGRP | S_IWOTH ) ) != 0 )
                            && ( ( perm & ( S_IXUSR | S_IXGRP | S_IXOTH ) ) != 0 );
                    break;
                case S_IREAD:
                    allow = ( perm & ( S_IRUSR | S_IRGRP | S_IROTH ) ) != 0;
                    break;
                case S_IREAD + S_IEXEC:
                    allow = ( ( perm & ( S_IRUSR | S_IRGRP | S_IROTH ) ) != 0 )
                            && ( ( perm & ( S_IXUSR | S_IXGRP | S_IXOTH ) ) != 0 );
                    break;
                case S_IREAD + S_IWRITE:
                    allow = ( ( perm & ( S_IRUSR | S_IRGRP | S_IROTH ) ) != 0 )
                            && ( ( perm & ( S_IWUSR | S_IWGRP | S_IWOTH ) ) != 0 );
                    break;
                case S_IWRITE + S_IEXEC + S_ISVTX:
                    if ( perm & S_ISVTX )
                    {
                        if ( ( ntfs_get_owner_mode( scx, ni, &stbuf ) >= 0 )
                                && ( stbuf.st_uid == scx->uid ) )
                            allow = 1;
                        else
                            allow = 2;
                    }
                    else
                        allow = ( ( perm & ( S_IWUSR | S_IWGRP | S_IWOTH ) ) != 0 )
                                && ( ( perm & ( S_IXUSR | S_IXGRP | S_IXOTH ) ) != 0 );
                    break;
                case S_IREAD + S_IWRITE + S_IEXEC:
                    allow = ( ( perm & ( S_IRUSR | S_IRGRP | S_IROTH ) ) != 0 )
                            && ( ( perm & ( S_IWUSR | S_IWGRP | S_IWOTH ) ) != 0 )
                            && ( ( perm & ( S_IXUSR | S_IXGRP | S_IXOTH ) ) != 0 );
                    break;
                default :
                    res = EINVAL;
                    allow = 0;
                    break;
            }
            if ( !allow )
                errno = res;
        }
        else
            allow = 0;
    }
    return ( allow );
}

#if 0 /* not needed any more */

/*
 *      Check whether user can access the parent directory
 *  of a file in a specific way
 *
 *  Returns true if access is allowed, including user is root and
 *      no user mapping defined
 *
 *  Sets errno if there is a problem or if not allowed
 *
 *  This is used for Posix ACL and checking creation of DOS file names
 */

BOOL old_ntfs_allowed_dir_access( struct SECURITY_CONTEXT *scx,
                                  const char *path, int accesstype )
{
    int allow;
    char *dirpath;
    char *name;
    ntfs_inode *ni;
    ntfs_inode *dir_ni;
    struct stat stbuf;

    allow = 0;
    dirpath = strdup( path );
    if ( dirpath )
    {
        /* the root of file system is seen as a parent of itself */
        /* is that correct ? */
        name = strrchr( dirpath, '/' );
        *name = 0;
        dir_ni = ntfs_pathname_to_inode( scx->vol, NULL, dirpath );
        if ( dir_ni )
        {
            allow = ntfs_allowed_access( scx,
                                         dir_ni, accesstype );
            ntfs_inode_close( dir_ni );
            /*
             * for an not-owned sticky directory, have to
             * check whether file itself is owned
             */
            if ( ( accesstype == ( S_IWRITE + S_IEXEC + S_ISVTX ) )
                    && ( allow == 2 ) )
            {
                ni = ntfs_pathname_to_inode( scx->vol, NULL,
                                             path );
                allow = FALSE;
                if ( ni )
                {
                    allow = ( ntfs_get_owner_mode( scx, ni, &stbuf ) >= 0 )
                            && ( stbuf.st_uid == scx->uid );
                    ntfs_inode_close( ni );
                }
            }
        }
        free( dirpath );
    }
    return ( allow );   /* errno is set if not allowed */
}

#endif

/*
 *      Define a new owner/group to a file
 *
 *  returns zero if successful
 */

int ntfs_set_owner( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                    uid_t uid, gid_t gid )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *oldattr;
    const SID *usid;
    const SID *gsid;
    uid_t fileuid;
    uid_t filegid;
    mode_t mode;
    int perm;
    BOOL isdir;
    int res;
#if POSIXACLS
    struct POSIX_SECURITY *pxdesc;
    BOOL pxdescbuilt = FALSE;
#endif

    res = 0;
    /* get the current owner and mode from cache or security attributes */
    oldattr = ( char* )NULL;
    cached = fetch_cache( scx, ni );
    if ( cached )
    {
        fileuid = cached->uid;
        filegid = cached->gid;
        mode = cached->mode;
#if POSIXACLS
        pxdesc = cached->pxdesc;
        if ( !pxdesc )
            res = -1;
#endif
    }
    else
    {
        fileuid = 0;
        filegid = 0;
        mode = 0;
        oldattr = getsecurityattr( scx->vol, ni );
        if ( oldattr )
        {
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                    oldattr;
            gsid = ( const SID* )
                   & oldattr[le32_to_cpu( phead->group )];
#if OWNERFROMACL
            usid = ntfs_acl_owner( oldattr );
#else
            usid = ( const SID* )
                   & oldattr[le32_to_cpu( phead->owner )];
#endif
#if POSIXACLS
            pxdesc = ntfs_build_permissions_posix( scx->mapping, oldattr,
                                                   usid, gsid, isdir );
            if ( pxdesc )
            {
                pxdescbuilt = TRUE;
                fileuid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
                filegid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
                mode = perm = pxdesc->mode;
            }
            else
                res = -1;
#else
            mode = perm = ntfs_build_permissions( oldattr,
                                                  usid, gsid, isdir );
            if ( perm >= 0 )
            {
                fileuid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
                filegid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
            }
            else
                res = -1;
#endif
            free( oldattr );
        }
        else
            res = -1;
    }
    if ( !res )
    {
        /* check requested by root */
        /* or chgrp requested by owner to an owned group */
        if ( !scx->uid
                || ( ( ( ( int )uid < 0 ) || ( uid == fileuid ) )
                     && ( ( gid == scx->gid ) || groupmember( scx, scx->uid, gid ) )
                     && ( fileuid == scx->uid ) ) )
        {
            /* replace by the new usid and gsid */
            /* or reuse old gid and sid for cacheing */
            if ( ( int )uid < 0 )
                uid = fileuid;
            if ( ( int )gid < 0 )
                gid = filegid;
            /* clear setuid and setgid if owner has changed */
            /* unless request originated by root */
            if ( uid && ( fileuid != uid ) )
                mode &= 01777;
#if POSIXACLS
            res = ntfs_set_owner_mode( scx, ni, uid, gid,
                                       mode, pxdesc );
#else
            res = ntfs_set_owner_mode( scx, ni, uid, gid, mode );
#endif
        }
        else
        {
            res = -1;   /* neither owner nor root */
            errno = EPERM;
        }
#if POSIXACLS
        if ( pxdescbuilt )
            free( pxdesc );
#endif
    }
    else
    {
        /*
         * Should not happen : a default descriptor is generated
         * by getsecurityattr() when there are none
         */
        ntfs_log_error( "File has no security descriptor\n" );
        res = -1;
        errno = EIO;
    }
    return ( res ? -1 : 0 );
}

/*
 *      Define new owner/group and mode to a file
 *
 *  returns zero if successful
 */

int ntfs_set_ownmod( struct SECURITY_CONTEXT *scx, ntfs_inode *ni,
                     uid_t uid, gid_t gid, const mode_t mode )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    const struct CACHED_PERMISSIONS *cached;
    char *oldattr;
    const SID *usid;
    const SID *gsid;
    uid_t fileuid;
    uid_t filegid;
    BOOL isdir;
    int res;
#if POSIXACLS
    const struct POSIX_SECURITY *oldpxdesc;
    struct POSIX_SECURITY *newpxdesc = ( struct POSIX_SECURITY* )NULL;
    int pxsize;
#endif

    res = 0;
    /* get the current owner and mode from cache or security attributes */
    oldattr = ( char* )NULL;
    cached = fetch_cache( scx, ni );
    if ( cached )
    {
        fileuid = cached->uid;
        filegid = cached->gid;
#if POSIXACLS
        oldpxdesc = cached->pxdesc;
        if ( oldpxdesc )
        {
            /* must copy before merging */
            pxsize = sizeof( struct POSIX_SECURITY )
                     + ( oldpxdesc->acccnt + oldpxdesc->defcnt ) * sizeof( struct POSIX_ACE );
            newpxdesc = ( struct POSIX_SECURITY* )malloc( pxsize );
            if ( newpxdesc )
            {
                memcpy( newpxdesc, oldpxdesc, pxsize );
                if ( ntfs_merge_mode_posix( newpxdesc, mode ) )
                    res = -1;
            }
            else
                res = -1;
        }
#endif
    }
    else
    {
        fileuid = 0;
        filegid = 0;
        oldattr = getsecurityattr( scx->vol, ni );
        if ( oldattr )
        {
            isdir = ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                    != const_cpu_to_le16( 0 );
            phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )
                    oldattr;
            gsid = ( const SID* )
                   & oldattr[le32_to_cpu( phead->group )];
#if OWNERFROMACL
            usid = ntfs_acl_owner( oldattr );
#else
            usid = ( const SID* )
                   & oldattr[le32_to_cpu( phead->owner )];
#endif
#if POSIXACLS
            newpxdesc = ntfs_build_permissions_posix( scx->mapping, oldattr,
                        usid, gsid, isdir );
            if ( !newpxdesc || ntfs_merge_mode_posix( newpxdesc, mode ) )
                res = -1;
            else
            {
                fileuid = ntfs_find_user( scx->mapping[MAPUSERS], usid );
                filegid = ntfs_find_group( scx->mapping[MAPGROUPS], gsid );
            }
#endif
            free( oldattr );
        }
        else
            res = -1;
    }
    if ( !res )
    {
        /* check requested by root */
        /* or chgrp requested by owner to an owned group */
        if ( !scx->uid
                || ( ( ( ( int )uid < 0 ) || ( uid == fileuid ) )
                     && ( ( gid == scx->gid ) || groupmember( scx, scx->uid, gid ) )
                     && ( fileuid == scx->uid ) ) )
        {
            /* replace by the new usid and gsid */
            /* or reuse old gid and sid for cacheing */
            if ( ( int )uid < 0 )
                uid = fileuid;
            if ( ( int )gid < 0 )
                gid = filegid;
#if POSIXACLS
            res = ntfs_set_owner_mode( scx, ni, uid, gid,
                                       mode, newpxdesc );
#else
            res = ntfs_set_owner_mode( scx, ni, uid, gid, mode );
#endif
        }
        else
        {
            res = -1;   /* neither owner nor root */
            errno = EPERM;
        }
    }
    else
    {
        /*
         * Should not happen : a default descriptor is generated
         * by getsecurityattr() when there are none
         */
        ntfs_log_error( "File has no security descriptor\n" );
        res = -1;
        errno = EIO;
    }
#if POSIXACLS
    free( newpxdesc );
#endif
    return ( res ? -1 : 0 );
}

/*
 *      Build a security id for a descriptor inherited from
 *  parent directory the Windows way
 */

static le32 build_inherited_id( struct SECURITY_CONTEXT *scx,
                                const char *parentattr, BOOL fordir )
{
    const SECURITY_DESCRIPTOR_RELATIVE *pphead;
    const ACL *ppacl;
    const SID *usid;
    const SID *gsid;
    BIGSID defusid;
    BIGSID defgsid;
    int offpacl;
    int offowner;
    int offgroup;
    SECURITY_DESCRIPTOR_RELATIVE *pnhead;
    ACL *pnacl;
    int parentattrsz;
    char *newattr;
    int newattrsz;
    int aclsz;
    int usidsz;
    int gsidsz;
    int pos;
    le32 securid;

    parentattrsz = ntfs_attr_size( parentattr );
    pphead = ( const SECURITY_DESCRIPTOR_RELATIVE* )parentattr;
    if ( scx->mapping[MAPUSERS] )
    {
        usid = ntfs_find_usid( scx->mapping[MAPUSERS], scx->uid, ( SID* ) & defusid );
        gsid = ntfs_find_gsid( scx->mapping[MAPGROUPS], scx->gid, ( SID* ) & defgsid );
        if ( !usid )
            usid = adminsid;
        if ( !gsid )
            gsid = adminsid;
    }
    else
    {
        /*
         * If there is no user mapping, we have to copy owner
         * and group from parent directory.
         * Windows never has to do that, because it can always
         * rely on a user mapping
         */
        offowner = le32_to_cpu( pphead->owner );
        usid = ( const SID* ) & parentattr[offowner];
        offgroup = le32_to_cpu( pphead->group );
        gsid = ( const SID* ) & parentattr[offgroup];
    }
    /*
     * new attribute is smaller than parent's
     * except for differences in SIDs which appear in
     * owner, group and possible grants and denials in
     * generic creator-owner and creator-group ACEs.
     * For directories, an ACE may be duplicated for
     * access and inheritance, so we double the count.
     */
    usidsz = ntfs_sid_size( usid );
    gsidsz = ntfs_sid_size( gsid );
    newattrsz = parentattrsz + 3 * usidsz + 3 * gsidsz;
    if ( fordir )
        newattrsz *= 2;
    newattr = ( char* )ntfs_malloc( newattrsz );
    if ( newattr )
    {
        pnhead = ( SECURITY_DESCRIPTOR_RELATIVE* )newattr;
        pnhead->revision = SECURITY_DESCRIPTOR_REVISION;
        pnhead->alignment = 0;
        pnhead->control = SE_SELF_RELATIVE;
        pos = sizeof( SECURITY_DESCRIPTOR_RELATIVE );
        /*
         * locate and inherit DACL
         * do not test SE_DACL_PRESENT (wrong for "DR Watson")
         */
        pnhead->dacl = const_cpu_to_le32( 0 );
        if ( pphead->dacl )
        {
            offpacl = le32_to_cpu( pphead->dacl );
            ppacl = ( const ACL* ) & parentattr[offpacl];
            pnacl = ( ACL* ) & newattr[pos];
            aclsz = ntfs_inherit_acl( ppacl, pnacl, usid, gsid, fordir );
            if ( aclsz )
            {
                pnhead->dacl = cpu_to_le32( pos );
                pos += aclsz;
                pnhead->control |= SE_DACL_PRESENT;
            }
        }
        /*
         * locate and inherit SACL
         */
        pnhead->sacl = const_cpu_to_le32( 0 );
        if ( pphead->sacl )
        {
            offpacl = le32_to_cpu( pphead->sacl );
            ppacl = ( const ACL* ) & parentattr[offpacl];
            pnacl = ( ACL* ) & newattr[pos];
            aclsz = ntfs_inherit_acl( ppacl, pnacl, usid, gsid, fordir );
            if ( aclsz )
            {
                pnhead->sacl = cpu_to_le32( pos );
                pos += aclsz;
                pnhead->control |= SE_SACL_PRESENT;
            }
        }
        /*
         * inherit or redefine owner
         */
        memcpy( &newattr[pos], usid, usidsz );
        pnhead->owner = cpu_to_le32( pos );
        pos += usidsz;
        /*
         * inherit or redefine group
         */
        memcpy( &newattr[pos], gsid, gsidsz );
        pnhead->group = cpu_to_le32( pos );
        pos += usidsz;
        securid = setsecurityattr( scx->vol,
                                   ( SECURITY_DESCRIPTOR_RELATIVE* )newattr, pos );
        free( newattr );
    }
    else
        securid = const_cpu_to_le32( 0 );
    return ( securid );
}

/*
 *      Get an inherited security id
 *
 *  For Windows compatibility, the normal initial permission setting
 *  may be inherited from the parent directory instead of being
 *  defined by the creation arguments.
 *
 *  The following creates an inherited id for that purpose.
 *
 *  Note : the owner and group of parent directory are also
 *  inherited (which is not the case on Windows) if no user mapping
 *  is defined.
 *
 *  Returns the inherited id, or zero if not possible (eg on NTFS 1.x)
 */

le32 ntfs_inherited_id( struct SECURITY_CONTEXT *scx,
                        ntfs_inode *dir_ni, BOOL fordir )
{
    struct CACHED_PERMISSIONS *cached;
    char *parentattr;
    le32 securid;

    securid = const_cpu_to_le32( 0 );
    cached = ( struct CACHED_PERMISSIONS* )NULL;
    /*
     * Try to get inherited id from cache
     */
    if ( test_nino_flag( dir_ni, v3_Extensions )
            && dir_ni->security_id )
    {
        cached = fetch_cache( scx, dir_ni );
        if ( cached )
            securid = ( fordir ? cached->inh_dirid
                        : cached->inh_fileid );
    }
    /*
     * Not cached or not available in cache, compute it all
     * Note : if parent directory has no id, it is not cacheable
     */
    if ( !securid )
    {
        parentattr = getsecurityattr( scx->vol, dir_ni );
        if ( parentattr )
        {
            securid = build_inherited_id( scx,
                                          parentattr, fordir );
            free( parentattr );
            /*
             * Store the result into cache for further use
             */
            if ( securid )
            {
                cached = fetch_cache( scx, dir_ni );
                if ( cached )
                {
                    if ( fordir )
                        cached->inh_dirid = securid;
                    else
                        cached->inh_fileid = securid;
                }
            }
        }
    }
    return ( securid );
}

/*
 *      Link a group to a member of group
 *
 *  Returns 0 if OK, -1 (and errno set) if error
 */

static int link_single_group( struct MAPPING *usermapping, struct passwd *user,
                              gid_t gid )
{
    struct group *group;
    char **grmem;
    int grcnt;
    gid_t *groups;
    int res;

    res = 0;
    group = getgrgid( gid );
    if ( group && group->gr_mem )
    {
        grcnt = usermapping->grcnt;
        groups = usermapping->groups;
        grmem = group->gr_mem;
        while ( *grmem && strcmp( user->pw_name, *grmem ) )
            grmem++;
        if ( *grmem )
        {
            if ( !grcnt )
                groups = ( gid_t* )malloc( sizeof( gid_t ) );
            else
                groups = ( gid_t* )realloc( groups,
                                            ( grcnt + 1 ) * sizeof( gid_t ) );
            if ( groups )
                groups[grcnt++] = gid;
            else
            {
                res = -1;
                errno = ENOMEM;
            }
        }
        usermapping->grcnt = grcnt;
        usermapping->groups = groups;
    }
    return ( res );
}


/*
 *      Statically link group to users
 *  This is based on groups defined in /etc/group and does not take
 *  the groups dynamically set by setgroups() nor any changes in
 *  /etc/group into account
 *
 *  Only mapped groups and root group are linked to mapped users
 *
 *  Returns 0 if OK, -1 (and errno set) if error
 *
 */

static int link_group_members( struct SECURITY_CONTEXT *scx )
{
    struct MAPPING *usermapping;
    struct MAPPING *groupmapping;
    struct passwd *user;
    int res;

    res = 0;
    for ( usermapping = scx->mapping[MAPUSERS]; usermapping && !res;
            usermapping = usermapping->next )
    {
        usermapping->grcnt = 0;
        usermapping->groups = ( gid_t* )NULL;
        user = getpwuid( usermapping->xid );
        if ( user && user->pw_name )
        {
            for ( groupmapping = scx->mapping[MAPGROUPS];
                    groupmapping && !res;
                    groupmapping = groupmapping->next )
            {
                if ( link_single_group( usermapping, user,
                                        groupmapping->xid ) )
                    res = -1;
            }
            if ( !res && link_single_group( usermapping,
                                            user, ( gid_t )0 ) )
                res = -1;
        }
    }
    return ( res );
}

/*
 *      Apply default single user mapping
 *  returns zero if successful
 */

static int ntfs_do_default_mapping( struct SECURITY_CONTEXT *scx,
                                    uid_t uid, gid_t gid, const SID *usid )
{
    struct MAPPING *usermapping;
    struct MAPPING *groupmapping;
    SID *sid;
    int sidsz;
    int res;

    res = -1;
    sidsz = ntfs_sid_size( usid );
    sid = ( SID* )ntfs_malloc( sidsz );
    if ( sid )
    {
        memcpy( sid, usid, sidsz );
        usermapping = ( struct MAPPING* )ntfs_malloc( sizeof( struct MAPPING ) );
        if ( usermapping )
        {
            groupmapping = ( struct MAPPING* )ntfs_malloc( sizeof( struct MAPPING ) );
            if ( groupmapping )
            {
                usermapping->sid = sid;
                usermapping->xid = uid;
                usermapping->next = ( struct MAPPING* )NULL;
                groupmapping->sid = sid;
                groupmapping->xid = gid;
                groupmapping->next = ( struct MAPPING* )NULL;
                scx->mapping[MAPUSERS] = usermapping;
                scx->mapping[MAPGROUPS] = groupmapping;
                res = 0;
            }
        }
    }
    return ( res );
}

/*
 *      Make sure there are no ambiguous mapping
 *  Ambiguous mapping may lead to undesired configurations and
 *  we had rather be safe until the consequences are understood
 */

#if 0 /* not activated for now */

static BOOL check_mapping( const struct MAPPING *usermapping,
                           const struct MAPPING *groupmapping )
{
    const struct MAPPING *mapping1;
    const struct MAPPING *mapping2;
    BOOL ambiguous;

    ambiguous = FALSE;
    for ( mapping1 = usermapping; mapping1; mapping1 = mapping1->next )
        for ( mapping2 = mapping1->next; mapping2; mapping1 = mapping2->next )
            if ( ntfs_same_sid( mapping1->sid, mapping2->sid ) )
            {
                if ( mapping1->xid != mapping2->xid )
                    ambiguous = TRUE;
            }
            else
            {
                if ( mapping1->xid == mapping2->xid )
                    ambiguous = TRUE;
            }
    for ( mapping1 = groupmapping; mapping1; mapping1 = mapping1->next )
        for ( mapping2 = mapping1->next; mapping2; mapping1 = mapping2->next )
            if ( ntfs_same_sid( mapping1->sid, mapping2->sid ) )
            {
                if ( mapping1->xid != mapping2->xid )
                    ambiguous = TRUE;
            }
            else
            {
                if ( mapping1->xid == mapping2->xid )
                    ambiguous = TRUE;
            }
    return ( ambiguous );
}

#endif

#if 0 /* not used any more */

/*
 *      Try and apply default single user mapping
 *  returns zero if successful
 */

static int ntfs_default_mapping( struct SECURITY_CONTEXT *scx )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    ntfs_inode *ni;
    char *securattr;
    const SID *usid;
    int res;

    res = -1;
    ni = ntfs_pathname_to_inode( scx->vol, NULL, "/." );
    if ( ni )
    {
        securattr = getsecurityattr( scx->vol, ni );
        if ( securattr )
        {
            phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )securattr;
            usid = ( SID* ) & securattr[le32_to_cpu( phead->owner )];
            if ( ntfs_is_user_sid( usid ) )
                res = ntfs_do_default_mapping( scx,
                                               scx->uid, scx->gid, usid );
            free( securattr );
        }
        ntfs_inode_close( ni );
    }
    return ( res );
}

#endif

/*
 *      Basic read from a user mapping file on another volume
 */

static int basicread( void *fileid, char *buf, size_t size, off_t offs __attribute__( ( unused ) ) )
{
    return ( read( *( int* )fileid, buf, size ) );
}


/*
 *      Read from a user mapping file on current NTFS partition
 */

static int localread( void *fileid, char *buf, size_t size, off_t offs )
{
    return ( ntfs_local_read( ( ntfs_inode* )fileid,
                              AT_UNNAMED, 0, buf, size, offs ) );
}

/*
 *      Build the user mapping
 *  - according to a mapping file if defined (or default present),
 *  - or try default single user mapping if possible
 *
 *  The mapping is specific to a mounted device
 *  No locking done, mounting assumed non multithreaded
 *
 *  returns zero if mapping is successful
 *  (failure should not be interpreted as an error)
 */

int ntfs_build_mapping( struct SECURITY_CONTEXT *scx, const char *usermap_path,
                        BOOL allowdef )
{
    struct MAPLIST *item;
    struct MAPLIST *firstitem;
    struct MAPPING *usermapping;
    struct MAPPING *groupmapping;
    ntfs_inode *ni;
    int fd;
    static struct
    {
        u8 revision;
        u8 levels;
        be16 highbase;
        be32 lowbase;
        le32 level1;
        le32 level2;
        le32 level3;
        le32 level4;
        le32 level5;
    } defmap =
    {
        1, 5, const_cpu_to_be16( 0 ), const_cpu_to_be32( 5 ),
        const_cpu_to_le32( 21 ),
        const_cpu_to_le32( DEFSECAUTH1 ), const_cpu_to_le32( DEFSECAUTH2 ),
        const_cpu_to_le32( DEFSECAUTH3 ), const_cpu_to_le32( DEFSECBASE )
    } ;

    /* be sure not to map anything until done */
    scx->mapping[MAPUSERS] = ( struct MAPPING* )NULL;
    scx->mapping[MAPGROUPS] = ( struct MAPPING* )NULL;

    if ( !usermap_path ) usermap_path = MAPPINGFILE;
    if ( usermap_path[0] == '/' )
    {
        fd = open( usermap_path, O_RDONLY );
        if ( fd > 0 )
        {
            firstitem = ntfs_read_mapping( basicread, ( void* ) & fd );
            close( fd );
        }
        else
            firstitem = ( struct MAPLIST* )NULL;
    }
    else
    {
        ni = ntfs_pathname_to_inode( scx->vol, NULL, usermap_path );
        if ( ni )
        {
            firstitem = ntfs_read_mapping( localread, ni );
            ntfs_inode_close( ni );
        }
        else
            firstitem = ( struct MAPLIST* )NULL;
    }


    if ( firstitem )
    {
        usermapping = ntfs_do_user_mapping( firstitem );
        groupmapping = ntfs_do_group_mapping( firstitem );
        if ( usermapping && groupmapping )
        {
            scx->mapping[MAPUSERS] = usermapping;
            scx->mapping[MAPGROUPS] = groupmapping;
        }
        else
            ntfs_log_error( "There were no valid user or no valid group\n" );
        /* now we can free the memory copy of input text */
        /* and rely on internal representation */
        while ( firstitem )
        {
            item = firstitem->next;
            free( firstitem );
            firstitem = item;
        }
    }
    else
    {
        /* no mapping file, try a default mapping */
        if ( allowdef )
        {
            if ( !ntfs_do_default_mapping( scx,
                                           0, 0, ( const SID* )&defmap ) )
                ntfs_log_info( "Using default user mapping\n" );
        }
    }
    return ( !scx->mapping[MAPUSERS] || link_group_members( scx ) );
}

#ifdef HAVE_SETXATTR    /* extended attributes interface required */

/*
 *      Get the ntfs attribute into an extended attribute
 *  The attribute is returned according to cpu endianness
 */

int ntfs_get_ntfs_attrib( ntfs_inode *ni, char *value, size_t size )
{
    u32 attrib;
    size_t outsize;

    outsize = 0;    /* default to no data and no error */
    if ( ni )
    {
        attrib = le32_to_cpu( ni->flags );
        if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
            attrib |= const_le32_to_cpu( FILE_ATTR_DIRECTORY );
        else
            attrib &= ~const_le32_to_cpu( FILE_ATTR_DIRECTORY );
        if ( !attrib )
            attrib |= const_le32_to_cpu( FILE_ATTR_NORMAL );
        outsize = sizeof( FILE_ATTR_FLAGS );
        if ( size >= outsize )
        {
            if ( value )
                memcpy( value, &attrib, outsize );
            else
                errno = EINVAL;
        }
    }
    return ( outsize ? ( int )outsize : -errno );
}

/*
 *      Return the ntfs attribute into an extended attribute
 *  The attribute is expected according to cpu endianness
 *
 *  Returns 0, or -1 if there is a problem
 */

int ntfs_set_ntfs_attrib( ntfs_inode *ni,
                          const char *value, size_t size, int flags )
{
    u32 attrib;
    le32 settable;
    ATTR_FLAGS dirflags;
    int res;

    res = -1;
    if ( ni && value && ( size >= sizeof( FILE_ATTR_FLAGS ) ) )
    {
        if ( !( flags & XATTR_CREATE ) )
        {
            /* copy to avoid alignment problems */
            memcpy( &attrib, value, sizeof( FILE_ATTR_FLAGS ) );
            settable = FILE_ATTR_SETTABLE;
            res = 0;
            if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
            {
                /*
                 * Accept changing compression for a directory
                 * and set index root accordingly
                 */
                settable |= FILE_ATTR_COMPRESSED;
                if ( ( ni->flags ^ cpu_to_le32( attrib ) )
                        & FILE_ATTR_COMPRESSED )
                {
                    if ( ni->flags & FILE_ATTR_COMPRESSED )
                        dirflags = const_cpu_to_le16( 0 );
                    else
                        dirflags = ATTR_IS_COMPRESSED;
                    res = ntfs_attr_set_flags( ni,
                                               AT_INDEX_ROOT,
                                               NTFS_INDEX_I30, 4,
                                               dirflags,
                                               ATTR_COMPRESSION_MASK );
                }
            }
            if ( !res )
            {
                ni->flags = ( ni->flags & ~settable )
                            | ( cpu_to_le32( attrib ) & settable );
                NInoFileNameSetDirty( ni );
                NInoSetDirty( ni );
            }
        }
        else
            errno = EEXIST;
    }
    else
        errno = EINVAL;
    return ( res ? -1 : 0 );
}

#endif /* HAVE_SETXATTR */

/*
 *  Open $Secure once for all
 *  returns zero if it succeeds
 *      non-zero if it fails. This is not an error (on NTFS v1.x)
 */


int ntfs_open_secure( ntfs_volume *vol )
{
    ntfs_inode *ni;
    int res;

    res = -1;
    vol->secure_ni = ( ntfs_inode* )NULL;
    vol->secure_xsii = ( ntfs_index_context* )NULL;
    vol->secure_xsdh = ( ntfs_index_context* )NULL;
    if ( vol->major_ver >= 3 )
    {
        /* make sure this is a genuine $Secure inode 9 */
        ni = ntfs_pathname_to_inode( vol, NULL, "$Secure" );
        if ( ni && ( ni->mft_no == 9 ) )
        {
            vol->secure_reentry = 0;
            vol->secure_xsii = ntfs_index_ctx_get( ni,
                                                   sii_stream, 4 );
            vol->secure_xsdh = ntfs_index_ctx_get( ni,
                                                   sdh_stream, 4 );
            if ( ni && vol->secure_xsii && vol->secure_xsdh )
            {
                vol->secure_ni = ni;
                res = 0;
            }
        }
    }
    return ( res );
}

/*
 *      Final cleaning
 *  Allocated memory is freed to facilitate the detection of memory leaks
 */

void ntfs_close_secure( struct SECURITY_CONTEXT *scx )
{
    ntfs_volume *vol;

    vol = scx->vol;
    if ( vol->secure_ni )
    {
        ntfs_index_ctx_put( vol->secure_xsii );
        ntfs_index_ctx_put( vol->secure_xsdh );
        ntfs_inode_close( vol->secure_ni );

    }
    ntfs_free_mapping( scx->mapping );
    free_caches( scx );
}

/*
 *      API for direct access to security descriptors
 *  based on Win32 API
 */


/*
 *      Selective feeding of a security descriptor into user buffer
 *
 *  Returns TRUE if successful
 */

static BOOL feedsecurityattr( const char *attr, u32 selection,
                              char *buf, u32 buflen, u32 *psize )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    SECURITY_DESCRIPTOR_RELATIVE *pnhead;
    const ACL *pdacl;
    const ACL *psacl;
    const SID *pusid;
    const SID *pgsid;
    unsigned int offdacl;
    unsigned int offsacl;
    unsigned int offowner;
    unsigned int offgroup;
    unsigned int daclsz;
    unsigned int saclsz;
    unsigned int usidsz;
    unsigned int gsidsz;
    unsigned int size; /* size of requested attributes */
    BOOL ok;
    unsigned int pos;
    unsigned int avail;
    le16 control;

    avail = 0;
    control = SE_SELF_RELATIVE;
    phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )attr;
    size = sizeof( SECURITY_DESCRIPTOR_RELATIVE );

    /* locate DACL if requested and available */
    if ( phead->dacl && ( selection & DACL_SECURITY_INFORMATION ) )
    {
        offdacl = le32_to_cpu( phead->dacl );
        pdacl = ( const ACL* ) & attr[offdacl];
        daclsz = le16_to_cpu( pdacl->size );
        size += daclsz;
        avail |= DACL_SECURITY_INFORMATION;
    }
    else
        offdacl = daclsz = 0;

    /* locate owner if requested and available */
    offowner = le32_to_cpu( phead->owner );
    if ( offowner && ( selection & OWNER_SECURITY_INFORMATION ) )
    {
        /* find end of USID */
        pusid = ( const SID* ) & attr[offowner];
        usidsz = ntfs_sid_size( pusid );
        size += usidsz;
        avail |= OWNER_SECURITY_INFORMATION;
    }
    else
        offowner = usidsz = 0;

    /* locate group if requested and available */
    offgroup = le32_to_cpu( phead->group );
    if ( offgroup && ( selection & GROUP_SECURITY_INFORMATION ) )
    {
        /* find end of GSID */
        pgsid = ( const SID* ) & attr[offgroup];
        gsidsz = ntfs_sid_size( pgsid );
        size += gsidsz;
        avail |= GROUP_SECURITY_INFORMATION;
    }
    else
        offgroup = gsidsz = 0;

    /* locate SACL if requested and available */
    if ( phead->sacl && ( selection & SACL_SECURITY_INFORMATION ) )
    {
        /* find end of SACL */
        offsacl = le32_to_cpu( phead->sacl );
        psacl = ( const ACL* ) & attr[offsacl];
        saclsz = le16_to_cpu( psacl->size );
        size += saclsz;
        avail |= SACL_SECURITY_INFORMATION;
    }
    else
        offsacl = saclsz = 0;

    /*
     * Check having enough size in destination buffer
     * (required size is returned nevertheless so that
     * the request can be reissued with adequate size)
     */
    if ( size > buflen )
    {
        *psize = size;
        errno = EINVAL;
        ok = FALSE;
    }
    else
    {
        if ( selection & OWNER_SECURITY_INFORMATION )
            control |= phead->control & SE_OWNER_DEFAULTED;
        if ( selection & GROUP_SECURITY_INFORMATION )
            control |= phead->control & SE_GROUP_DEFAULTED;
        if ( selection & DACL_SECURITY_INFORMATION )
            control |= phead->control
                       & ( SE_DACL_PRESENT
                           | SE_DACL_DEFAULTED
                           | SE_DACL_AUTO_INHERITED
                           | SE_DACL_PROTECTED );
        if ( selection & SACL_SECURITY_INFORMATION )
            control |= phead->control
                       & ( SE_SACL_PRESENT
                           | SE_SACL_DEFAULTED
                           | SE_SACL_AUTO_INHERITED
                           | SE_SACL_PROTECTED );
        /*
         * copy header and feed new flags, even if no detailed data
         */
        memcpy( buf, attr, sizeof( SECURITY_DESCRIPTOR_RELATIVE ) );
        pnhead = ( SECURITY_DESCRIPTOR_RELATIVE* )buf;
        pnhead->control = control;
        pos = sizeof( SECURITY_DESCRIPTOR_RELATIVE );

        /* copy DACL if requested and available */
        if ( selection & avail & DACL_SECURITY_INFORMATION )
        {
            pnhead->dacl = cpu_to_le32( pos );
            memcpy( &buf[pos], &attr[offdacl], daclsz );
            pos += daclsz;
        }
        else
            pnhead->dacl = const_cpu_to_le32( 0 );

        /* copy SACL if requested and available */
        if ( selection & avail & SACL_SECURITY_INFORMATION )
        {
            pnhead->sacl = cpu_to_le32( pos );
            memcpy( &buf[pos], &attr[offsacl], saclsz );
            pos += saclsz;
        }
        else
            pnhead->sacl = const_cpu_to_le32( 0 );

        /* copy owner if requested and available */
        if ( selection & avail & OWNER_SECURITY_INFORMATION )
        {
            pnhead->owner = cpu_to_le32( pos );
            memcpy( &buf[pos], &attr[offowner], usidsz );
            pos += usidsz;
        }
        else
            pnhead->owner = const_cpu_to_le32( 0 );

        /* copy group if requested and available */
        if ( selection & avail & GROUP_SECURITY_INFORMATION )
        {
            pnhead->group = cpu_to_le32( pos );
            memcpy( &buf[pos], &attr[offgroup], gsidsz );
            pos += gsidsz;
        }
        else
            pnhead->group = const_cpu_to_le32( 0 );
        if ( pos != size )
            ntfs_log_error( "Error in security descriptor size\n" );
        *psize = size;
        ok = TRUE;
    }

    return ( ok );
}

/*
 *      Merge a new security descriptor into the old one
 *  and assign to designated file
 *
 *  Returns TRUE if successful
 */

static BOOL mergesecurityattr( ntfs_volume *vol, const char *oldattr,
                               const char *newattr, u32 selection, ntfs_inode *ni )
{
    const SECURITY_DESCRIPTOR_RELATIVE *oldhead;
    const SECURITY_DESCRIPTOR_RELATIVE *newhead;
    SECURITY_DESCRIPTOR_RELATIVE *targhead;
    const ACL *pdacl;
    const ACL *psacl;
    const SID *powner;
    const SID *pgroup;
    int offdacl;
    int offsacl;
    int offowner;
    int offgroup;
    unsigned int size;
    le16 control;
    char *target;
    int pos;
    int oldattrsz;
    int newattrsz;
    BOOL ok;

    ok = FALSE; /* default return */
    oldhead = ( const SECURITY_DESCRIPTOR_RELATIVE* )oldattr;
    newhead = ( const SECURITY_DESCRIPTOR_RELATIVE* )newattr;
    oldattrsz = ntfs_attr_size( oldattr );
    newattrsz = ntfs_attr_size( newattr );
    target = ( char* )ntfs_malloc( oldattrsz + newattrsz );
    if ( target )
    {
        targhead = ( SECURITY_DESCRIPTOR_RELATIVE* )target;
        pos = sizeof( SECURITY_DESCRIPTOR_RELATIVE );
        control = SE_SELF_RELATIVE;
        /*
         * copy new DACL if selected
         * or keep old DACL if any
         */
        if ( ( selection & DACL_SECURITY_INFORMATION ) ?
                newhead->dacl : oldhead->dacl )
        {
            if ( selection & DACL_SECURITY_INFORMATION )
            {
                offdacl = le32_to_cpu( newhead->dacl );
                pdacl = ( const ACL* ) & newattr[offdacl];
            }
            else
            {
                offdacl = le32_to_cpu( oldhead->dacl );
                pdacl = ( const ACL* ) & oldattr[offdacl];
            }
            size = le16_to_cpu( pdacl->size );
            memcpy( &target[pos], pdacl, size );
            targhead->dacl = cpu_to_le32( pos );
            pos += size;
        }
        else
            targhead->dacl = const_cpu_to_le32( 0 );
        if ( selection & DACL_SECURITY_INFORMATION )
        {
            control |= newhead->control
                       & ( SE_DACL_PRESENT
                           | SE_DACL_DEFAULTED
                           | SE_DACL_PROTECTED );
            if ( newhead->control & SE_DACL_AUTO_INHERIT_REQ )
                control |= SE_DACL_AUTO_INHERITED;
        }
        else
            control |= oldhead->control
                       & ( SE_DACL_PRESENT
                           | SE_DACL_DEFAULTED
                           | SE_DACL_AUTO_INHERITED
                           | SE_DACL_PROTECTED );
        /*
         * copy new SACL if selected
         * or keep old SACL if any
         */
        if ( ( selection & SACL_SECURITY_INFORMATION ) ?
                newhead->sacl : oldhead->sacl )
        {
            if ( selection & SACL_SECURITY_INFORMATION )
            {
                offsacl = le32_to_cpu( newhead->sacl );
                psacl = ( const ACL* ) & newattr[offsacl];
            }
            else
            {
                offsacl = le32_to_cpu( oldhead->sacl );
                psacl = ( const ACL* ) & oldattr[offsacl];
            }
            size = le16_to_cpu( psacl->size );
            memcpy( &target[pos], psacl, size );
            targhead->sacl = cpu_to_le32( pos );
            pos += size;
        }
        else
            targhead->sacl = const_cpu_to_le32( 0 );
        if ( selection & SACL_SECURITY_INFORMATION )
        {
            control |= newhead->control
                       & ( SE_SACL_PRESENT
                           | SE_SACL_DEFAULTED
                           | SE_SACL_PROTECTED );
            if ( newhead->control & SE_SACL_AUTO_INHERIT_REQ )
                control |= SE_SACL_AUTO_INHERITED;
        }
        else
            control |= oldhead->control
                       & ( SE_SACL_PRESENT
                           | SE_SACL_DEFAULTED
                           | SE_SACL_AUTO_INHERITED
                           | SE_SACL_PROTECTED );
        /*
         * copy new OWNER if selected
         * or keep old OWNER if any
         */
        if ( ( selection & OWNER_SECURITY_INFORMATION ) ?
                newhead->owner : oldhead->owner )
        {
            if ( selection & OWNER_SECURITY_INFORMATION )
            {
                offowner = le32_to_cpu( newhead->owner );
                powner = ( const SID* ) & newattr[offowner];
            }
            else
            {
                offowner = le32_to_cpu( oldhead->owner );
                powner = ( const SID* ) & oldattr[offowner];
            }
            size = ntfs_sid_size( powner );
            memcpy( &target[pos], powner, size );
            targhead->owner = cpu_to_le32( pos );
            pos += size;
        }
        else
            targhead->owner = const_cpu_to_le32( 0 );
        if ( selection & OWNER_SECURITY_INFORMATION )
            control |= newhead->control & SE_OWNER_DEFAULTED;
        else
            control |= oldhead->control & SE_OWNER_DEFAULTED;
        /*
         * copy new GROUP if selected
         * or keep old GROUP if any
         */
        if ( ( selection & GROUP_SECURITY_INFORMATION ) ?
                newhead->group : oldhead->group )
        {
            if ( selection & GROUP_SECURITY_INFORMATION )
            {
                offgroup = le32_to_cpu( newhead->group );
                pgroup = ( const SID* ) & newattr[offgroup];
                control |= newhead->control
                           & SE_GROUP_DEFAULTED;
            }
            else
            {
                offgroup = le32_to_cpu( oldhead->group );
                pgroup = ( const SID* ) & oldattr[offgroup];
                control |= oldhead->control
                           & SE_GROUP_DEFAULTED;
            }
            size = ntfs_sid_size( pgroup );
            memcpy( &target[pos], pgroup, size );
            targhead->group = cpu_to_le32( pos );
            pos += size;
        }
        else
            targhead->group = const_cpu_to_le32( 0 );
        if ( selection & GROUP_SECURITY_INFORMATION )
            control |= newhead->control & SE_GROUP_DEFAULTED;
        else
            control |= oldhead->control & SE_GROUP_DEFAULTED;
        targhead->revision = SECURITY_DESCRIPTOR_REVISION;
        targhead->alignment = 0;
        targhead->control = control;
        ok = !update_secur_descr( vol, target, ni );
        free( target );
    }
    return ( ok );
}

/*
 *      Return the security descriptor of a file
 *  This is intended to be similar to GetFileSecurity() from Win32
 *  in order to facilitate the development of portable tools
 *
 *  returns zero if unsuccessful (following Win32 conventions)
 *      -1 if no securid
 *      the securid if any
 *
 *  The Win32 API is :
 *
 *  BOOL WINAPI GetFileSecurity(
 *    __in          LPCTSTR lpFileName,
 *    __in          SECURITY_INFORMATION RequestedInformation,
 *    __out_opt     PSECURITY_DESCRIPTOR pSecurityDescriptor,
 *    __in          DWORD nLength,
 *    __out         LPDWORD lpnLengthNeeded
 *  );
 *
 */

int ntfs_get_file_security( struct SECURITY_API *scapi,
                            const char *path, u32 selection,
                            char *buf, u32 buflen, u32 *psize )
{
    ntfs_inode *ni;
    char *attr;
    int res;

    res = 0; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        ni = ntfs_pathname_to_inode( scapi->security.vol, NULL, path );
        if ( ni )
        {
            attr = getsecurityattr( scapi->security.vol, ni );
            if ( attr )
            {
                if ( feedsecurityattr( attr, selection,
                                       buf, buflen, psize ) )
                {
                    if ( test_nino_flag( ni, v3_Extensions )
                            && ni->security_id )
                        res = le32_to_cpu(
                                  ni->security_id );
                    else
                        res = -1;
                }
                free( attr );
            }
            ntfs_inode_close( ni );
        }
        else
            errno = ENOENT;
        if ( !res ) *psize = 0;
    }
    else
        errno = EINVAL; /* do not clear *psize */
    return ( res );
}


/*
 *      Set the security descriptor of a file or directory
 *  This is intended to be similar to SetFileSecurity() from Win32
 *  in order to facilitate the development of portable tools
 *
 *  returns zero if unsuccessful (following Win32 conventions)
 *      -1 if no securid
 *      the securid if any
 *
 *  The Win32 API is :
 *
 *  BOOL WINAPI SetFileSecurity(
 *    __in          LPCTSTR lpFileName,
 *    __in          SECURITY_INFORMATION SecurityInformation,
 *    __in          PSECURITY_DESCRIPTOR pSecurityDescriptor
 *  );
 */

int ntfs_set_file_security( struct SECURITY_API *scapi,
                            const char *path, u32 selection, const char *attr )
{
    const SECURITY_DESCRIPTOR_RELATIVE *phead;
    ntfs_inode *ni;
    int attrsz;
    BOOL missing;
    char *oldattr;
    int res;

    res = 0; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) && attr )
    {
        phead = ( const SECURITY_DESCRIPTOR_RELATIVE* )attr;
        attrsz = ntfs_attr_size( attr );
        /* if selected, owner and group must be present or defaulted */
        missing = ( ( selection & OWNER_SECURITY_INFORMATION )
                    && !phead->owner
                    && !( phead->control & SE_OWNER_DEFAULTED ) )
                  || ( ( selection & GROUP_SECURITY_INFORMATION )
                       && !phead->group
                       && !( phead->control & SE_GROUP_DEFAULTED ) );
        if ( !missing
                && ( phead->control & SE_SELF_RELATIVE )
                && ntfs_valid_descr( attr, attrsz ) )
        {
            ni = ntfs_pathname_to_inode( scapi->security.vol,
                                         NULL, path );
            if ( ni )
            {
                oldattr = getsecurityattr( scapi->security.vol,
                                           ni );
                if ( oldattr )
                {
                    if ( mergesecurityattr(
                                scapi->security.vol,
                                oldattr, attr,
                                selection, ni ) )
                    {
                        if ( test_nino_flag( ni,
                                             v3_Extensions ) )
                            res = le32_to_cpu(
                                      ni->security_id );
                        else
                            res = -1;
                    }
                    free( oldattr );
                }
                ntfs_inode_close( ni );
            }
        }
        else
            errno = EINVAL;
    }
    else
        errno = EINVAL;
    return ( res );
}


/*
 *      Return the attributes of a file
 *  This is intended to be similar to GetFileAttributes() from Win32
 *  in order to facilitate the development of portable tools
 *
 *  returns -1 if unsuccessful (Win32 : INVALID_FILE_ATTRIBUTES)
 *
 *  The Win32 API is :
 *
 *  DWORD WINAPI GetFileAttributes(
 *   __in  LPCTSTR lpFileName
 *  );
 */

int ntfs_get_file_attributes( struct SECURITY_API *scapi, const char *path )
{
    ntfs_inode *ni;
    s32 attrib;

    attrib = -1; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) && path )
    {
        ni = ntfs_pathname_to_inode( scapi->security.vol, NULL, path );
        if ( ni )
        {
            attrib = le32_to_cpu( ni->flags );
            if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
                attrib |= const_le32_to_cpu( FILE_ATTR_DIRECTORY );
            else
                attrib &= ~const_le32_to_cpu( FILE_ATTR_DIRECTORY );
            if ( !attrib )
                attrib |= const_le32_to_cpu( FILE_ATTR_NORMAL );

            ntfs_inode_close( ni );
        }
        else
            errno = ENOENT;
    }
    else
        errno = EINVAL; /* do not clear *psize */
    return ( attrib );
}


/*
 *      Set attributes to a file or directory
 *  This is intended to be similar to SetFileAttributes() from Win32
 *  in order to facilitate the development of portable tools
 *
 *  Only a few flags can be set (same list as Win32)
 *
 *  returns zero if unsuccessful (following Win32 conventions)
 *      nonzero if successful
 *
 *  The Win32 API is :
 *
 *  BOOL WINAPI SetFileAttributes(
 *    __in  LPCTSTR lpFileName,
 *    __in  DWORD dwFileAttributes
 *  );
 */

BOOL ntfs_set_file_attributes( struct SECURITY_API *scapi,
                               const char *path, s32 attrib )
{
    ntfs_inode *ni;
    le32 settable;
    ATTR_FLAGS dirflags;
    int res;

    res = 0; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) && path )
    {
        ni = ntfs_pathname_to_inode( scapi->security.vol, NULL, path );
        if ( ni )
        {
            settable = FILE_ATTR_SETTABLE;
            if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
            {
                /*
                 * Accept changing compression for a directory
                 * and set index root accordingly
                 */
                settable |= FILE_ATTR_COMPRESSED;
                if ( ( ni->flags ^ cpu_to_le32( attrib ) )
                        & FILE_ATTR_COMPRESSED )
                {
                    if ( ni->flags & FILE_ATTR_COMPRESSED )
                        dirflags = const_cpu_to_le16( 0 );
                    else
                        dirflags = ATTR_IS_COMPRESSED;
                    res = ntfs_attr_set_flags( ni,
                                               AT_INDEX_ROOT,
                                               NTFS_INDEX_I30, 4,
                                               dirflags,
                                               ATTR_COMPRESSION_MASK );
                }
            }
            if ( !res )
            {
                ni->flags = ( ni->flags & ~settable )
                            | ( cpu_to_le32( attrib ) & settable );
                NInoSetDirty( ni );
            }
            if ( !ntfs_inode_close( ni ) )
                res = -1;
        }
        else
            errno = ENOENT;
    }
    return ( res );
}


BOOL ntfs_read_directory( struct SECURITY_API *scapi,
                          const char *path, ntfs_filldir_t callback, void *context )
{
    ntfs_inode *ni;
    BOOL ok;
    s64 pos;

    ok = FALSE; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) && callback )
    {
        ni = ntfs_pathname_to_inode( scapi->security.vol, NULL, path );
        if ( ni )
        {
            if ( ni->mrec->flags & MFT_RECORD_IS_DIRECTORY )
            {
                pos = 0;
                ntfs_readdir( ni, &pos, context, callback );
                ok = !ntfs_inode_close( ni );
            }
            else
            {
                ntfs_inode_close( ni );
                errno = ENOTDIR;
            }
        }
        else
            errno = ENOENT;
    }
    else
        errno = EINVAL; /* do not clear *psize */
    return ( ok );
}

/*
 *      read $SDS (for auditing security data)
 *
 *  Returns the number or read bytes, or -1 if there is an error
 */

int ntfs_read_sds( struct SECURITY_API *scapi,
                   char *buf, u32 size, u32 offset )
{
    int got;

    got = -1; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        if ( scapi->security.vol->secure_ni )
            got = ntfs_local_read( scapi->security.vol->secure_ni,
                                   STREAM_SDS, 4, buf, size, offset );
        else
            errno = EOPNOTSUPP;
    }
    else
        errno = EINVAL;
    return ( got );
}

/*
 *      read $SII (for auditing security data)
 *
 *  Returns next entry, or NULL if there is an error
 */

INDEX_ENTRY *ntfs_read_sii( struct SECURITY_API *scapi,
                            INDEX_ENTRY *entry )
{
    SII_INDEX_KEY key;
    INDEX_ENTRY *ret;
    BOOL found;
    ntfs_index_context *xsii;

    ret = ( INDEX_ENTRY* )NULL; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        xsii = scapi->security.vol->secure_xsii;
        if ( xsii )
        {
            if ( !entry )
            {
                key.security_id = const_cpu_to_le32( 0 );
                found = !ntfs_index_lookup( ( char* ) & key,
                                            sizeof( SII_INDEX_KEY ), xsii );
                /* not supposed to find */
                if ( !found && ( errno == ENOENT ) )
                    ret = xsii->entry;
            }
            else
                ret = ntfs_index_next( entry, xsii );
            if ( !ret )
                errno = ENODATA;
        }
        else
            errno = EOPNOTSUPP;
    }
    else
        errno = EINVAL;
    return ( ret );
}

/*
 *      read $SDH (for auditing security data)
 *
 *  Returns next entry, or NULL if there is an error
 */

INDEX_ENTRY *ntfs_read_sdh( struct SECURITY_API *scapi,
                            INDEX_ENTRY *entry )
{
    SDH_INDEX_KEY key;
    INDEX_ENTRY *ret;
    BOOL found;
    ntfs_index_context *xsdh;

    ret = ( INDEX_ENTRY* )NULL; /* default return */
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        xsdh = scapi->security.vol->secure_xsdh;
        if ( xsdh )
        {
            if ( !entry )
            {
                key.hash = const_cpu_to_le32( 0 );
                key.security_id = const_cpu_to_le32( 0 );
                found = !ntfs_index_lookup( ( char* ) & key,
                                            sizeof( SDH_INDEX_KEY ), xsdh );
                /* not supposed to find */
                if ( !found && ( errno == ENOENT ) )
                    ret = xsdh->entry;
            }
            else
                ret = ntfs_index_next( entry, xsdh );
            if ( !ret )
                errno = ENODATA;
        }
        else errno = ENOTSUP;
    }
    else
        errno = EINVAL;
    return ( ret );
}

/*
 *      Get the mapped user SID
 *  A buffer of 40 bytes has to be supplied
 *
 *  returns the size of the SID, or zero and errno set if not found
 */

int ntfs_get_usid( struct SECURITY_API *scapi, uid_t uid, char *buf )
{
    const SID *usid;
    BIGSID defusid;
    int size;

    size = 0;
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        usid = ntfs_find_usid( scapi->security.mapping[MAPUSERS], uid, ( SID* ) & defusid );
        if ( usid )
        {
            size = ntfs_sid_size( usid );
            memcpy( buf, usid, size );
        }
        else
            errno = ENODATA;
    }
    else
        errno = EINVAL;
    return ( size );
}

/*
 *      Get the mapped group SID
 *  A buffer of 40 bytes has to be supplied
 *
 *  returns the size of the SID, or zero and errno set if not found
 */

int ntfs_get_gsid( struct SECURITY_API *scapi, gid_t gid, char *buf )
{
    const SID *gsid;
    BIGSID defgsid;
    int size;

    size = 0;
    if ( scapi && ( scapi->magic == MAGIC_API ) )
    {
        gsid = ntfs_find_gsid( scapi->security.mapping[MAPGROUPS], gid, ( SID* ) & defgsid );
        if ( gsid )
        {
            size = ntfs_sid_size( gsid );
            memcpy( buf, gsid, size );
        }
        else
            errno = ENODATA;
    }
    else
        errno = EINVAL;
    return ( size );
}

/*
 *      Get the user mapped to a SID
 *
 *  returns the uid, or -1 if not found
 */

int ntfs_get_user( struct SECURITY_API *scapi, const SID *usid )
{
    int uid;

    uid = -1;
    if ( scapi && ( scapi->magic == MAGIC_API ) && ntfs_valid_sid( usid ) )
    {
        if ( ntfs_same_sid( usid, adminsid ) )
            uid = 0;
        else
        {
            uid = ntfs_find_user( scapi->security.mapping[MAPUSERS], usid );
            if ( !uid )
            {
                uid = -1;
                errno = ENODATA;
            }
        }
    }
    else
        errno = EINVAL;
    return ( uid );
}

/*
 *      Get the group mapped to a SID
 *
 *  returns the uid, or -1 if not found
 */

int ntfs_get_group( struct SECURITY_API *scapi, const SID *gsid )
{
    int gid;

    gid = -1;
    if ( scapi && ( scapi->magic == MAGIC_API ) && ntfs_valid_sid( gsid ) )
    {
        if ( ntfs_same_sid( gsid, adminsid ) )
            gid = 0;
        else
        {
            gid = ntfs_find_group( scapi->security.mapping[MAPGROUPS], gsid );
            if ( !gid )
            {
                gid = -1;
                errno = ENODATA;
            }
        }
    }
    else
        errno = EINVAL;
    return ( gid );
}

/*
 *      Initializations before calling ntfs_get_file_security()
 *  ntfs_set_file_security() and ntfs_read_directory()
 *
 *  Only allowed for root
 *
 *  Returns an (obscured) struct SECURITY_API* needed for further calls
 *      NULL if not root (EPERM) or device is mounted (EBUSY)
 */

struct SECURITY_API *ntfs_initialize_file_security( const char *device,
        int flags )
{
    ntfs_volume *vol;
    unsigned long mntflag;
    int mnt;
    struct SECURITY_API *scapi;
    struct SECURITY_CONTEXT *scx;

    scapi = ( struct SECURITY_API* )NULL;
    mnt = ntfs_check_if_mounted( device, &mntflag );
    if ( !mnt && !( mntflag & NTFS_MF_MOUNTED ) && !getuid() )
    {
        vol = ntfs_mount( device, flags );
        if ( vol )
        {
            scapi = ( struct SECURITY_API* )
                    ntfs_malloc( sizeof( struct SECURITY_API ) );
            if ( !ntfs_volume_get_free_space( vol )
                    && scapi )
            {
                scapi->magic = MAGIC_API;
                scapi->seccache = ( struct PERMISSIONS_CACHE* )NULL;
                scx = &scapi->security;
                scx->vol = vol;
                scx->uid = getuid();
                scx->gid = getgid();
                scx->pseccache = &scapi->seccache;
                scx->vol->secure_flags = 0;
                /* accept no mapping and no $Secure */
                ntfs_build_mapping( scx, ( const char* )NULL, TRUE );
                ntfs_open_secure( vol );
            }
            else
            {
                if ( scapi )
                    free( scapi );
                else
                    errno = ENOMEM;
                mnt = ntfs_umount( vol, FALSE );
                scapi = ( struct SECURITY_API* )NULL;
            }
        }
    }
    else if ( getuid() )
        errno = EPERM;
    else
        errno = EBUSY;
    return ( scapi );
}

/*
 *      Leaving after ntfs_initialize_file_security()
 *
 *  Returns FALSE if FAILED
 */

BOOL ntfs_leave_file_security( struct SECURITY_API *scapi )
{
    int ok;
    ntfs_volume *vol;

    ok = FALSE;
    if ( scapi && ( scapi->magic == MAGIC_API ) && scapi->security.vol )
    {
        vol = scapi->security.vol;
        ntfs_close_secure( &scapi->security );
        free( scapi );
        if ( !ntfs_umount( vol, 0 ) )
            ok = TRUE;
    }
    return ( ok );
}