@ttsc/linux-arm 0.7.2 → 0.8.0-dev.20260505

package/bin/go/src/html/template/transition.go

@@ -23,6 +23,8 @@ var transitionFunc = [...]func(context, []byte) (context, int){
 	stateRCDATA:         tSpecialTagEnd,
 	stateAttr:           tAttr,
 	stateURL:            tURL,
+	stateMetaContent:    tMetaContent,
+	stateMetaContentURL: tMetaContentURL,
 	stateSrcset:         tURL,
 	stateJS:             tJS,
 	stateJSDqStr:        tJSDelimited,
@@ -83,6 +85,7 @@ var elementContentType = [...]state{
 	elementStyle:    stateCSS,
 	elementTextarea: stateRCDATA,
 	elementTitle:    stateRCDATA,
+	elementMeta:     stateText,
 }
 
 // tTag is the context transition function for the tag state.
@@ -93,6 +96,11 @@ func tTag(c context, s []byte) (context, int) {
 		return c, len(s)
 	}
 	if s[i] == '>' {
+		// Treat <meta> specially, because it doesn't have an end tag, and we
+		// want to transition into the correct state/element for it.
+		if c.element == elementMeta {
+			return context{state: stateText, element: elementNone}, i + 1
+		}
 		return context{
 			state:   elementContentType[c.element],
 			element: c.element,
@@ -113,6 +121,8 @@ func tTag(c context, s []byte) (context, int) {
 	attrName := strings.ToLower(string(s[i:j]))
 	if c.element == elementScript && attrName == "type" {
 		attr = attrScriptType
+	} else if c.element == elementMeta && attrName == "content" {
+		attr = attrMetaContent
 	} else {
 		switch attrType(attrName) {
 		case contentTypeURL:
@@ -162,12 +172,13 @@ func tAfterName(c context, s []byte) (context, int) {
 }
 
 var attrStartStates = [...]state{
-	attrNone:       stateAttr,
-	attrScript:     stateJS,
-	attrScriptType: stateAttr,
-	attrStyle:      stateCSS,
-	attrURL:        stateURL,
-	attrSrcset:     stateSrcset,
+	attrNone:        stateAttr,
+	attrScript:      stateJS,
+	attrScriptType:  stateAttr,
+	attrStyle:       stateCSS,
+	attrURL:         stateURL,
+	attrSrcset:      stateSrcset,
+	attrMetaContent: stateMetaContent,
 }
 
 // tBeforeValue is the context transition function for stateBeforeValue.
@@ -203,6 +214,7 @@ var specialTagEndMarkers = [...][]byte{
 	elementStyle:    []byte("style"),
 	elementTextarea: []byte("textarea"),
 	elementTitle:    []byte("title"),
+	elementMeta:     []byte(""),
 }
 
 var (
@@ -612,6 +624,28 @@ func tError(c context, s []byte) (context, int) {
 	return c, len(s)
 }
 
+// tMetaContent is the context transition function for the meta content attribute state.
+func tMetaContent(c context, s []byte) (context, int) {
+	for i := 0; i < len(s); i++ {
+		if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) {
+			c.state = stateMetaContentURL
+			return c, i + 4
+		}
+	}
+	return c, len(s)
+}
+
+// tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state.
+func tMetaContentURL(c context, s []byte) (context, int) {
+	for i := 0; i < len(s); i++ {
+		if s[i] == ';' {
+			c.state = stateMetaContent
+			return c, i + 1
+		}
+	}
+	return c, len(s)
+}
+
 // eatAttrName returns the largest j such that s[i:j] is an attribute name.
 // It returns an error if s[i:] does not look like it begins with an
 // attribute name, such as encountering a quote mark without a preceding
@@ -638,6 +672,7 @@ var elementNameMap = map[string]element{
 	"style":    elementStyle,
 	"textarea": elementTextarea,
 	"title":    elementTitle,
+	"meta":     elementMeta,
 }
 
 // asciiAlpha reports whether c is an ASCII letter.

package/bin/go/src/internal/buildcfg/zbootstrap.go

@@ -15,7 +15,7 @@ const DefaultGORISCV64 = `rva20u64`
 const defaultGOEXPERIMENT = ``
 const defaultGO_EXTLINK_ENABLED = ``
 const defaultGO_LDSO = ``
-const version = `go1.26.0`
+const version = `go1.26.2`
 const defaultGOOS = runtime.GOOS
 const defaultGOARCH = runtime.GOARCH
 const DefaultGOFIPS140 = `off`

package/bin/go/src/internal/godebugs/table.go

@@ -40,6 +40,7 @@ var All = []Info{
 	{Name: "gocacheverify", Package: "cmd/go"},
 	{Name: "gotestjsonbuildtext", Package: "cmd/go", Changed: 24, Old: "1"},
 	{Name: "gotypesalias", Package: "go/types", Changed: 23, Old: "0"},
+	{Name: "htmlmetacontenturlescape", Package: "html/template"},
 	{Name: "http2client", Package: "net/http"},
 	{Name: "http2debug", Package: "net/http", Opaque: true},
 	{Name: "http2server", Package: "net/http"},

package/bin/go/src/internal/poll/fd_windows.go

@@ -149,7 +149,7 @@ var wsaMsgPool = sync.Pool{
 
 // newWSAMsg creates a new WSAMsg with the provided parameters.
 // Use [freeWSAMsg] to free it.
-func newWSAMsg(p []byte, oob []byte, flags int, unconnected bool) *windows.WSAMsg {
+func newWSAMsg(p []byte, oob []byte, flags int, rsa *wsaRsa) *windows.WSAMsg {
 	// The returned object can't be allocated in the stack because it is accessed asynchronously
 	// by Windows in between several system calls. If the stack frame is moved while that happens,
 	// then Windows may access invalid memory.
@@ -159,39 +159,53 @@ func newWSAMsg(p []byte, oob []byte, flags int, unconnected bool) *windows.WSAMs
 	msg := wsaMsgPool.Get().(*windows.WSAMsg)
 	msg.Buffers.Len = uint32(len(p))
 	msg.Buffers.Buf = unsafe.SliceData(p)
-	msg.Control = syscall.WSABuf{
-		Len: uint32(len(oob)),
-		Buf: unsafe.SliceData(oob),
+	if len(oob) > 0 {
+		msg.Control = syscall.WSABuf{
+			Len: uint32(len(oob)),
+			Buf: unsafe.SliceData(oob),
+		}
 	}
 	msg.Flags = uint32(flags)
-	if unconnected {
-		msg.Name = wsaRsaPool.Get().(*syscall.RawSockaddrAny)
-		msg.Namelen = int32(unsafe.Sizeof(syscall.RawSockaddrAny{}))
+	if rsa != nil {
+		msg.Name = &rsa.name
+		msg.Namelen = rsa.namelen
 	}
 	return msg
 }
 
 func freeWSAMsg(msg *windows.WSAMsg) {
 	// Clear pointers to buffers so they can be released by garbage collector.
+	msg.Name = nil
+	msg.Namelen = 0
 	msg.Buffers.Len = 0
 	msg.Buffers.Buf = nil
 	msg.Control.Len = 0
 	msg.Control.Buf = nil
-	if msg.Name != nil {
-		*msg.Name = syscall.RawSockaddrAny{}
-		wsaRsaPool.Put(msg.Name)
-		msg.Name = nil
-		msg.Namelen = 0
-	}
 	wsaMsgPool.Put(msg)
 }
 
+// wsaRsa bundles a [syscall.RawSockaddrAny] with its length for efficient caching.
+//
+// When used by WSARecvFrom, wsaRsa must be on the heap. See
+// https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsarecvfrom.
+type wsaRsa struct {
+	name    syscall.RawSockaddrAny
+	namelen int32
+}
+
 var wsaRsaPool = sync.Pool{
 	New: func() any {
-		return new(syscall.RawSockaddrAny)
+		return new(wsaRsa)
 	},
 }
 
+func newWSARsa() *wsaRsa {
+	rsa := wsaRsaPool.Get().(*wsaRsa)
+	rsa.name = syscall.RawSockaddrAny{}
+	rsa.namelen = int32(unsafe.Sizeof(syscall.RawSockaddrAny{}))
+	return rsa
+}
+
 var operationPool = sync.Pool{
 	New: func() any {
 		return new(operation)
@@ -737,19 +751,18 @@ func (fd *FD) ReadFrom(buf []byte) (int, syscall.Sockaddr, error) {
 
 	fd.pin('r', &buf[0])
 
-	rsa := wsaRsaPool.Get().(*syscall.RawSockaddrAny)
+	rsa := newWSARsa()
 	defer wsaRsaPool.Put(rsa)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
-		rsan := int32(unsafe.Sizeof(*rsa))
 		var flags uint32
-		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, rsa, &rsan, &o.o, nil)
+		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, &rsa.name, &rsa.namelen, &o.o, nil)
 		return qty, err
 	})
 	err = fd.eofError(n, err)
 	if err != nil {
 		return n, nil, err
 	}
-	sa, _ := rsa.Sockaddr()
+	sa, _ := rsa.name.Sockaddr()
 	return n, sa, nil
 }
 
@@ -768,19 +781,18 @@ func (fd *FD) ReadFromInet4(buf []byte, sa4 *syscall.SockaddrInet4) (int, error)
 
 	fd.pin('r', &buf[0])
 
-	rsa := wsaRsaPool.Get().(*syscall.RawSockaddrAny)
+	rsa := newWSARsa()
 	defer wsaRsaPool.Put(rsa)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
-		rsan := int32(unsafe.Sizeof(*rsa))
 		var flags uint32
-		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, rsa, &rsan, &o.o, nil)
+		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, &rsa.name, &rsa.namelen, &o.o, nil)
 		return qty, err
 	})
 	err = fd.eofError(n, err)
 	if err != nil {
 		return n, err
 	}
-	rawToSockaddrInet4(rsa, sa4)
+	rawToSockaddrInet4(&rsa.name, sa4)
 	return n, err
 }
 
@@ -799,19 +811,18 @@ func (fd *FD) ReadFromInet6(buf []byte, sa6 *syscall.SockaddrInet6) (int, error)
 
 	fd.pin('r', &buf[0])
 
-	rsa := wsaRsaPool.Get().(*syscall.RawSockaddrAny)
+	rsa := newWSARsa()
 	defer wsaRsaPool.Put(rsa)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
-		rsan := int32(unsafe.Sizeof(*rsa))
 		var flags uint32
-		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, rsa, &rsan, &o.o, nil)
+		err = syscall.WSARecvFrom(fd.Sysfd, newWsaBuf(buf), 1, &qty, &flags, &rsa.name, &rsa.namelen, &o.o, nil)
 		return qty, err
 	})
 	err = fd.eofError(n, err)
 	if err != nil {
 		return n, err
 	}
-	rawToSockaddrInet6(rsa, sa6)
+	rawToSockaddrInet6(&rsa.name, sa6)
 	return n, err
 }
 
@@ -1371,7 +1382,9 @@ func (fd *FD) ReadMsg(p []byte, oob []byte, flags int) (int, int, int, syscall.S
 		p = p[:maxRW]
 	}
 
-	msg := newWSAMsg(p, oob, flags, true)
+	rsa := newWSARsa()
+	defer wsaRsaPool.Put(rsa)
+	msg := newWSAMsg(p, oob, flags, rsa)
 	defer freeWSAMsg(msg)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
 		err = windows.WSARecvMsg(fd.Sysfd, msg, &qty, &o.o, nil)
@@ -1396,7 +1409,9 @@ func (fd *FD) ReadMsgInet4(p []byte, oob []byte, flags int, sa4 *syscall.Sockadd
 		p = p[:maxRW]
 	}
 
-	msg := newWSAMsg(p, oob, flags, true)
+	rsa := newWSARsa()
+	defer wsaRsaPool.Put(rsa)
+	msg := newWSAMsg(p, oob, flags, rsa)
 	defer freeWSAMsg(msg)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
 		err = windows.WSARecvMsg(fd.Sysfd, msg, &qty, &o.o, nil)
@@ -1420,7 +1435,9 @@ func (fd *FD) ReadMsgInet6(p []byte, oob []byte, flags int, sa6 *syscall.Sockadd
 		p = p[:maxRW]
 	}
 
-	msg := newWSAMsg(p, oob, flags, true)
+	rsa := newWSARsa()
+	defer wsaRsaPool.Put(rsa)
+	msg := newWSAMsg(p, oob, flags, rsa)
 	defer freeWSAMsg(msg)
 	n, err := fd.execIO('r', func(o *operation) (qty uint32, err error) {
 		err = windows.WSARecvMsg(fd.Sysfd, msg, &qty, &o.o, nil)
@@ -1444,15 +1461,18 @@ func (fd *FD) WriteMsg(p []byte, oob []byte, sa syscall.Sockaddr) (int, int, err
 	}
 	defer fd.writeUnlock()
 
-	msg := newWSAMsg(p, oob, 0, sa != nil)
-	defer freeWSAMsg(msg)
+	var rsa *wsaRsa
 	if sa != nil {
+		rsa = newWSARsa()
+		defer wsaRsaPool.Put(rsa)
 		var err error
-		msg.Namelen, err = sockaddrToRaw(msg.Name, sa)
+		rsa.namelen, err = sockaddrToRaw(&rsa.name, sa)
 		if err != nil {
 			return 0, 0, err
 		}
 	}
+	msg := newWSAMsg(p, oob, 0, rsa)
+	defer freeWSAMsg(msg)
 	n, err := fd.execIO('w', func(o *operation) (qty uint32, err error) {
 		err = windows.WSASendMsg(fd.Sysfd, msg, 0, nil, &o.o, nil)
 		return qty, err
@@ -1471,11 +1491,14 @@ func (fd *FD) WriteMsgInet4(p []byte, oob []byte, sa *syscall.SockaddrInet4) (in
 	}
 	defer fd.writeUnlock()
 
-	msg := newWSAMsg(p, oob, 0, sa != nil)
-	defer freeWSAMsg(msg)
+	var rsa *wsaRsa
 	if sa != nil {
-		msg.Namelen = sockaddrInet4ToRaw(msg.Name, sa)
+		rsa = newWSARsa()
+		defer wsaRsaPool.Put(rsa)
+		rsa.namelen = sockaddrInet4ToRaw(&rsa.name, sa)
 	}
+	msg := newWSAMsg(p, oob, 0, rsa)
+	defer freeWSAMsg(msg)
 	n, err := fd.execIO('w', func(o *operation) (qty uint32, err error) {
 		err = windows.WSASendMsg(fd.Sysfd, msg, 0, nil, &o.o, nil)
 		return qty, err
@@ -1494,11 +1517,14 @@ func (fd *FD) WriteMsgInet6(p []byte, oob []byte, sa *syscall.SockaddrInet6) (in
 	}
 	defer fd.writeUnlock()
 
-	msg := newWSAMsg(p, oob, 0, sa != nil)
-	defer freeWSAMsg(msg)
+	var rsa *wsaRsa
 	if sa != nil {
-		msg.Namelen = sockaddrInet6ToRaw(msg.Name, sa)
+		rsa = newWSARsa()
+		defer wsaRsaPool.Put(rsa)
+		rsa.namelen = sockaddrInet6ToRaw(&rsa.name, sa)
 	}
+	msg := newWSAMsg(p, oob, 0, rsa)
+	defer freeWSAMsg(msg)
 	n, err := fd.execIO('w', func(o *operation) (qty uint32, err error) {
 		err = windows.WSASendMsg(fd.Sysfd, msg, 0, nil, &o.o, nil)
 		return qty, err

package/bin/go/src/internal/poll/fstatat_unix.go

@@ -0,0 +1,22 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build unix || wasip1
+
+package poll
+
+import (
+	"internal/syscall/unix"
+	"syscall"
+)
+
+func (fd *FD) Fstatat(name string, s *syscall.Stat_t, flags int) error {
+	if err := fd.incref(); err != nil {
+		return err
+	}
+	defer fd.decref()
+	return ignoringEINTR(func() error {
+		return unix.Fstatat(fd.Sysfd, name, s, flags)
+	})
+}

package/bin/go/src/internal/poll/sendfile_windows.go

@@ -68,8 +68,10 @@ func SendFile(fd *FD, src uintptr, size int64) (written int64, err error, handle
 			chunkSize = size
 		}
 
-		fd.setOffset(startpos + written)
 		n, err := fd.execIO('w', func(o *operation) (uint32, error) {
+			off := startpos + written
+			o.o.OffsetHigh = uint32(off >> 32)
+			o.o.Offset = uint32(off)
 			err := syscall.TransmitFile(fd.Sysfd, hsrc, uint32(chunkSize), 0, &o.o, nil, syscall.TF_WRITE_BEHIND)
 			if err != nil {
 				return 0, err

package/bin/go/src/internal/syscall/unix/at.go

@@ -80,23 +80,6 @@ func Mkdirat(dirfd int, path string, mode uint32) error {
 	return nil
 }
 
-func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
-	p, err := syscall.BytePtrFromString(path)
-	if err != nil {
-		return err
-	}
-	_, _, errno := syscall.Syscall6(fchmodatTrap,
-		uintptr(dirfd),
-		uintptr(unsafe.Pointer(p)),
-		uintptr(mode),
-		uintptr(flags),
-		0, 0)
-	if errno != 0 {
-		return errno
-	}
-	return nil
-}
-
 func Fchownat(dirfd int, path string, uid, gid int, flags int) error {
 	p, err := syscall.BytePtrFromString(path)
 	if err != nil {

package/bin/go/src/internal/syscall/unix/at_sysnum_linux.go

@@ -11,7 +11,6 @@ const (
 	openatTrap     uintptr = syscall.SYS_OPENAT
 	readlinkatTrap uintptr = syscall.SYS_READLINKAT
 	mkdiratTrap    uintptr = syscall.SYS_MKDIRAT
-	fchmodatTrap   uintptr = syscall.SYS_FCHMODAT
 	fchownatTrap   uintptr = syscall.SYS_FCHOWNAT
 	linkatTrap     uintptr = syscall.SYS_LINKAT
 	symlinkatTrap  uintptr = syscall.SYS_SYMLINKAT
@@ -24,4 +23,6 @@ const (
 	AT_SYMLINK_NOFOLLOW = 0x100
 
 	UTIME_OMIT = 0x3ffffffe
+
+	O_PATH = 0x200000
 )

package/bin/go/src/internal/syscall/unix/fchmodat_linux.go

@@ -0,0 +1,51 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux
+
+package unix
+
+import (
+	"internal/strconv"
+	"syscall"
+)
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
+	// On Linux, the fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag.
+	// We need to use fchmodat2 instead.
+	// syscall.Fchmodat handles this.
+	if err := syscall.Fchmodat(dirfd, path, mode, flags); err != syscall.EOPNOTSUPP {
+		return err
+	}
+
+	// This kernel doesn't appear to support fchmodat2 (added in Linux 6.6).
+	// We can't fall back to Fchmod, because it requires write permissions on the file.
+	// Instead, use the same workaround as GNU libc and musl, which is to open the file
+	// and then fchmodat the FD in /proc/self/fd.
+	// See: https://lwn.net/Articles/939217/
+	fd, err := Openat(dirfd, path, O_PATH|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+	procPath := "/proc/self/fd/" + strconv.Itoa(fd)
+
+	// Check to see if this file is a symlink.
+	// (We passed O_NOFOLLOW above, but O_PATH|O_NOFOLLOW will open a symlink.)
+	var st syscall.Stat_t
+	if err := syscall.Stat(procPath, &st); err != nil {
+		if err == syscall.ENOENT {
+			// /proc has probably not been mounted. Give up.
+			return syscall.EOPNOTSUPP
+		}
+		return err
+	}
+	if st.Mode&syscall.S_IFMT == syscall.S_IFLNK {
+		// fchmodat on the proc FD for a symlink apparently gives inconsistent
+		// results, so just refuse to try.
+		return syscall.EOPNOTSUPP
+	}
+
+	return syscall.Fchmodat(AT_FDCWD, procPath, mode, flags&^AT_SYMLINK_NOFOLLOW)
+}

package/bin/go/src/internal/syscall/unix/fchmodat_other.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build dragonfly || freebsd || netbsd || (openbsd && mips64)
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
+	p, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	_, _, errno := syscall.Syscall6(fchmodatTrap,
+		uintptr(dirfd),
+		uintptr(unsafe.Pointer(p)),
+		uintptr(mode),
+		uintptr(flags),
+		0, 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}

package/bin/go/src/internal/syscall/windows/at_windows.go

@@ -246,14 +246,31 @@ func Deleteat(dirfd syscall.Handle, name string, options uint32) error {
 	var h syscall.Handle
 	err := NtOpenFile(
 		&h,
-		SYNCHRONIZE|FILE_READ_ATTRIBUTES|DELETE,
+		FILE_READ_ATTRIBUTES|DELETE,
 		objAttrs,
 		&IO_STATUS_BLOCK{},
 		FILE_SHARE_DELETE|FILE_SHARE_READ|FILE_SHARE_WRITE,
-		FILE_OPEN_REPARSE_POINT|FILE_OPEN_FOR_BACKUP_INTENT|FILE_SYNCHRONOUS_IO_NONALERT|options,
+		FILE_OPEN_REPARSE_POINT|FILE_OPEN_FOR_BACKUP_INTENT|options,
 	)
 	if err != nil {
-		return ntCreateFileError(err, 0)
+		if ntStatus, ok := err.(NTStatus); !ok || ntStatus != STATUS_ACCESS_DENIED {
+			return ntCreateFileError(err, 0)
+		}
+
+		// Access denied, try opening with DELETE only.
+		// This may succeed if the file has restrictive permissions
+		// but the caller has delete child permission on the parent directory.
+		err = NtOpenFile(
+			&h,
+			DELETE,
+			objAttrs,
+			&IO_STATUS_BLOCK{},
+			FILE_SHARE_DELETE|FILE_SHARE_READ|FILE_SHARE_WRITE,
+			FILE_OPEN_REPARSE_POINT|FILE_OPEN_FOR_BACKUP_INTENT|options,
+		)
+		if err != nil {
+			return ntCreateFileError(err, 0)
+		}
 	}
 	defer syscall.CloseHandle(h)
 

package/bin/go/src/internal/syscall/windows/syscall_windows.go

@@ -561,6 +561,7 @@ const (
 	STATUS_NOT_SUPPORTED             NTStatus = 0xC00000BB
 	STATUS_INVALID_PARAMETER         NTStatus = 0xC000000D
 	STATUS_INVALID_INFO_CLASS        NTStatus = 0xC0000003
+	STATUS_ACCESS_DENIED             NTStatus = 0xC0000022
 )
 
 const (
@@ -579,3 +580,6 @@ type FILE_MODE_INFORMATION struct {
 //sys   NtSetInformationFile(handle syscall.Handle, iosb *IO_STATUS_BLOCK, inBuffer unsafe.Pointer, inBufferLen uint32, class uint32) (ntstatus error) = ntdll.NtSetInformationFile
 //sys	RtlIsDosDeviceName_U(name *uint16) (ret uint32) = ntdll.RtlIsDosDeviceName_U
 //sys   NtQueryInformationFile(handle syscall.Handle, iosb *IO_STATUS_BLOCK, inBuffer unsafe.Pointer, inBufferLen uint32, class uint32) (ntstatus error) = ntdll.NtQueryInformationFile
+
+//sys	SetEntriesInAcl(countExplicitEntries uint32, explicitEntries *EXPLICIT_ACCESS, oldACL *ACL, newACL **ACL) (ret error) =  advapi32.SetEntriesInAclW
+//sys	SetNamedSecurityInfo(objectName string, objectType uint32, securityInformation uint32, owner *syscall.SID, group *syscall.SID, dacl *ACL, sacl *ACL) (ret error) = advapi32.SetNamedSecurityInfoW

package/bin/go/src/internal/syscall/windows/types_windows.go

@@ -301,3 +301,85 @@ const ValidFileFlagsMask = O_FILE_FLAG_OPEN_REPARSE_POINT |
 	O_FILE_FLAG_NO_BUFFERING |
 	O_FILE_FLAG_RANDOM_ACCESS |
 	O_FILE_FLAG_WRITE_THROUGH
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa379636.aspx
+type TRUSTEE struct {
+	MultipleTrustee          *TRUSTEE
+	MultipleTrusteeOperation uint32
+	TrusteeForm              uint32
+	TrusteeType              uint32
+	Name                     uintptr
+}
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa379638.aspx
+const (
+	TRUSTEE_IS_SID              = 0x0
+	TRUSTEE_IS_NAME             = 0x1
+	TRUSTEE_BAD_FORM            = 0x2
+	TRUSTEE_IS_OBJECTS_AND_SID  = 0x3
+	TRUSTEE_IS_OBJECTS_AND_NAME = 0x4
+)
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa446627.aspx
+type EXPLICIT_ACCESS struct {
+	AccessPermissions uint32
+	AccessMode        uint32
+	Inheritance       uint32
+	Trustee           TRUSTEE
+}
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa374899.aspx
+const (
+	NOT_USED_ACCESS   = 0x0
+	GRANT_ACCESS      = 0x1
+	SET_ACCESS        = 0x2
+	DENY_ACCESS       = 0x3
+	REVOKE_ACCESS     = 0x4
+	SET_AUDIT_SUCCESS = 0x5
+	SET_AUDIT_FAILURE = 0x6
+)
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa446627.aspx
+const (
+	NO_INHERITANCE                     = 0x0
+	SUB_OBJECTS_ONLY_INHERIT           = 0x1
+	SUB_CONTAINERS_ONLY_INHERIT        = 0x2
+	SUB_CONTAINERS_AND_OBJECTS_INHERIT = 0x3
+	INHERIT_NO_PROPAGATE               = 0x4
+	INHERIT_ONLY                       = 0x8
+)
+
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593.aspx
+const (
+	SE_UNKNOWN_OBJECT_TYPE     = 0x0
+	SE_FILE_OBJECT             = 0x1
+	SE_SERVICE                 = 0x2
+	SE_PRINTER                 = 0x3
+	SE_REGISTRY_KEY            = 0x4
+	SE_LMSHARE                 = 0x5
+	SE_KERNEL_OBJECT           = 0x6
+	SE_WINDOW_OBJECT           = 0x7
+	SE_DS_OBJECT               = 0x8
+	SE_DS_OBJECT_ALL           = 0x9
+	SE_PROVIDER_DEFINED_OBJECT = 0xa
+	SE_WMIGUID_OBJECT          = 0xb
+	SE_REGISTRY_WOW64_32KEY    = 0xc
+	SE_REGISTRY_WOW64_64KEY    = 0xd
+)
+
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/23e75ca3-98fd-4396-84e5-86cd9d40d343
+const (
+	OWNER_SECURITY_INFORMATION               = 0x00000001
+	GROUP_SECURITY_INFORMATION               = 0x00000002
+	DACL_SECURITY_INFORMATION                = 0x00000004
+	SACL_SECURITY_INFORMATION                = 0x00000008
+	LABEL_SECURITY_INFORMATION               = 0x00000010
+	UNPROTECTED_SACL_SECURITY_INFORMATION    = 0x10000000
+	UNPROTECTED_DACL_SECURITY_INFORMATION    = 0x20000000
+	PROTECTED_SACL_SECURITY_INFORMATION      = 0x40000000
+	PROTECTED_DACL_SECURITY_INFORMATION      = 0x80000000
+	ATTRIBUTE_SECURITY_INFORMATION           = 0x00000020
+	SCOPE_SECURITY_INFORMATION               = 0x00000040
+	PROCESS_TRUST_LABEL_SECURITY_INFORMATION = 0x00000080
+	BACKUP_SECURITY_INFORMATION              = 0x00010000
+)