]> wimlib.net Git - wimlib/blobdiff - src/win32_apply.c
Don't set FILE_ATTRIBUTE_SPARSE on Windows
[wimlib] / src / win32_apply.c
index c182862ea42af8e4483a687df00d665222184216..3f4a4562567ba223183636f2836fde07fb0bf660 100644 (file)
@@ -3,7 +3,7 @@
  */
 
 /*
- * Copyright (C) 2013 Eric Biggers
+ * Copyright (C) 2013, 2014 Eric Biggers
  *
  * This file is part of wimlib, a library for working with WIM files.
  *
 #include "wimlib/win32_common.h"
 
 #include "wimlib/apply.h"
-#include "wimlib/capture.h"
+#include "wimlib/capture.h" /* for mangle_pat() and match_pattern_list()  */
 #include "wimlib/dentry.h"
 #include "wimlib/error.h"
 #include "wimlib/lookup_table.h"
-#include "wimlib/paths.h"
+#include "wimlib/resource.h"
 #include "wimlib/textfile.h"
 #include "wimlib/xml.h"
 #include "wimlib/wim.h"
 #include "wimlib/wimboot.h"
 
-static void
-ctx_save_data_source_id(struct apply_ctx *ctx, u64 data_source_id)
-{
-       ctx->private[0] = data_source_id & 0xFFFFFFFF;
-       ctx->private[1] = data_source_id >> 32;
-}
-
-static u64
-ctx_get_data_source_id(const struct apply_ctx *ctx)
-{
-       return (u32)ctx->private[0] | ((u64)(u32)ctx->private[1] << 32);
-}
-
-static void
-set_prepopulate_pats(struct apply_ctx *ctx, struct string_set *s)
-{
-       ctx->private[2] = (intptr_t)s;
-}
+struct win32_apply_private_data {
+       u64 data_source_id;
+       struct string_set *prepopulate_pats;
+       void *mem_prepopulate_pats;
+       u8 wim_lookup_table_hash[SHA1_HASH_SIZE];
+       bool wof_running;
+};
 
-static struct string_set *
-get_prepopulate_pats(struct apply_ctx *ctx)
+static struct win32_apply_private_data *
+get_private_data(struct apply_ctx *ctx)
 {
-       return (struct string_set *)(ctx->private[2]);
+       BUILD_BUG_ON(sizeof(ctx->private) < sizeof(struct win32_apply_private_data));
+       return (struct win32_apply_private_data *)(ctx->private);
 }
 
 static void
-free_prepopulate_pats(struct apply_ctx *ctx)
+free_prepopulate_pats(struct win32_apply_private_data *dat)
 {
-       struct string_set *s;
-
-       s = get_prepopulate_pats(ctx);
-       if (s) {
-               FREE(s->strings);
-               FREE(s);
+       if (dat->prepopulate_pats) {
+               FREE(dat->prepopulate_pats->strings);
+               FREE(dat->prepopulate_pats);
+               dat->prepopulate_pats = NULL;
        }
-       set_prepopulate_pats(ctx, NULL);
 
-       FREE((void *)ctx->private[3]);
-       ctx->private[3] = (intptr_t)NULL;
+       if (dat->mem_prepopulate_pats) {
+               FREE(dat->mem_prepopulate_pats);
+               dat->mem_prepopulate_pats = NULL;
+       }
 }
 
 static int
@@ -94,6 +83,7 @@ load_prepopulate_pats(struct apply_ctx *ctx)
        void *buf;
        void *mem;
        struct text_file_section sec;
+       struct win32_apply_private_data *dat = get_private_data(ctx);
 
        dentry = get_dentry(ctx->wim, path, WIMLIB_CASE_INSENSITIVE);
        if (!dentry ||
@@ -123,31 +113,157 @@ load_prepopulate_pats(struct apply_ctx *ctx)
                                LOAD_TEXT_FILE_REMOVE_QUOTES |
                                        LOAD_TEXT_FILE_NO_WARNINGS,
                                mangle_pat);
+       BUILD_BUG_ON(OS_PREFERRED_PATH_SEPARATOR != WIM_PATH_SEPARATOR);
        FREE(buf);
        if (ret) {
                FREE(s);
                return ret;
        }
-       set_prepopulate_pats(ctx, s);
-       ctx->private[3] = (intptr_t)mem;
+       dat->prepopulate_pats = s;
+       dat->mem_prepopulate_pats = mem;
        return 0;
 }
 
 static bool
-in_prepopulate_list(struct wim_dentry *dentry,
-                   struct apply_ctx *ctx)
+in_prepopulate_list(struct wim_dentry *dentry, struct apply_ctx *ctx)
 {
        struct string_set *pats;
        const tchar *path;
 
-       pats = get_prepopulate_pats(ctx);
-       if (!pats)
+       pats = get_private_data(ctx)->prepopulate_pats;
+       if (!pats || !pats->num_strings)
                return false;
+
        path = dentry_full_path(dentry);
        if (!path)
                return false;
 
-       return match_pattern(path, path_basename(path), pats);
+       return match_pattern_list(path, tstrlen(path), pats);
+}
+
+static int
+hash_lookup_table(WIMStruct *wim, u8 hash[SHA1_HASH_SIZE])
+{
+       return wim_reshdr_to_hash(&wim->hdr.lookup_table_reshdr, wim, hash);
+}
+
+/* Given a Windows-style path, return the number of characters of the prefix
+ * that specify the path to the root directory of a drive, or return 0 if the
+ * drive is relative (or at least on the current drive, in the case of
+ * absolute-but-not-really-absolute paths like \Windows\System32) */
+static size_t
+win32_path_drive_spec_len(const wchar_t *path)
+{
+       size_t n = 0;
+
+       if (!wcsncmp(path, L"\\\\?\\", 4)) {
+               /* \\?\-prefixed path.  Check for following drive letter and
+                * path separator. */
+               if (path[4] != L'\0' && path[5] == L':' &&
+                   is_any_path_separator(path[6]))
+                       n = 7;
+       } else {
+               /* Not a \\?\-prefixed path.  Check for an initial drive letter
+                * and path separator. */
+               if (path[0] != L'\0' && path[1] == L':' &&
+                   is_any_path_separator(path[2]))
+                       n = 3;
+       }
+       /* Include any additional path separators.*/
+       if (n > 0)
+               while (is_any_path_separator(path[n]))
+                       n++;
+       return n;
+}
+
+static bool
+win32_path_is_root_of_drive(const wchar_t *path)
+{
+       size_t drive_spec_len;
+       wchar_t full_path[32768];
+       DWORD ret;
+
+       ret = GetFullPathName(path, ARRAY_LEN(full_path), full_path, NULL);
+       if (ret > 0 && ret < ARRAY_LEN(full_path))
+               path = full_path;
+
+       /* Explicit drive letter and path separator? */
+       drive_spec_len = win32_path_drive_spec_len(path);
+       if (drive_spec_len > 0 && path[drive_spec_len] == L'\0')
+               return true;
+
+       /* All path separators? */
+       for (const wchar_t *p = path; *p != L'\0'; p++)
+               if (!is_any_path_separator(*p))
+                       return false;
+       return true;
+}
+
+/* Given a path, which may not yet exist, get a set of flags that describe the
+ * features of the volume the path is on. */
+static int
+win32_get_vol_flags(const wchar_t *path, unsigned *vol_flags_ret,
+                   bool *supports_SetFileShortName_ret)
+{
+       wchar_t *volume;
+       BOOL bret;
+       DWORD vol_flags;
+       size_t drive_spec_len;
+       wchar_t filesystem_name[MAX_PATH + 1];
+
+       if (supports_SetFileShortName_ret)
+               *supports_SetFileShortName_ret = false;
+
+       drive_spec_len = win32_path_drive_spec_len(path);
+
+       if (drive_spec_len == 0)
+               if (path[0] != L'\0' && path[1] == L':') /* Drive-relative path? */
+                       drive_spec_len = 2;
+
+       if (drive_spec_len == 0) {
+               /* Path does not start with a drive letter; use the volume of
+                * the current working directory. */
+               volume = NULL;
+       } else {
+               /* Path starts with a drive letter (or \\?\ followed by a drive
+                * letter); use it. */
+               volume = alloca((drive_spec_len + 2) * sizeof(wchar_t));
+               wmemcpy(volume, path, drive_spec_len);
+               /* Add trailing backslash in case this was a drive-relative
+                * path. */
+               volume[drive_spec_len] = L'\\';
+               volume[drive_spec_len + 1] = L'\0';
+       }
+       bret = GetVolumeInformation(
+                       volume,                         /* lpRootPathName */
+                       NULL,                           /* lpVolumeNameBuffer */
+                       0,                              /* nVolumeNameSize */
+                       NULL,                           /* lpVolumeSerialNumber */
+                       NULL,                           /* lpMaximumComponentLength */
+                       &vol_flags,                     /* lpFileSystemFlags */
+                       filesystem_name,                /* lpFileSystemNameBuffer */
+                       ARRAY_LEN(filesystem_name));    /* nFileSystemNameSize */
+       if (!bret) {
+               set_errno_from_GetLastError();
+               WARNING_WITH_ERRNO("Failed to get volume information for "
+                                  "path \"%ls\"", path);
+               vol_flags = 0xffffffff;
+               goto out;
+       }
+
+       if (wcsstr(filesystem_name, L"NTFS")) {
+               /* FILE_SUPPORTS_HARD_LINKS is only supported on Windows 7 and later.
+                * Force it on anyway if filesystem is NTFS.  */
+               vol_flags |= FILE_SUPPORTS_HARD_LINKS;
+
+               if (supports_SetFileShortName_ret)
+                       *supports_SetFileShortName_ret = true;
+       }
+
+out:
+       DEBUG("using vol_flags = %x", vol_flags);
+       *vol_flags_ret = vol_flags;
+       return 0;
 }
 
 static int
@@ -156,10 +272,11 @@ win32_start_extract(const wchar_t *path, struct apply_ctx *ctx)
        int ret;
        unsigned vol_flags;
        bool supports_SetFileShortName;
+       struct win32_apply_private_data *dat = get_private_data(ctx);
 
        ret = win32_get_vol_flags(path, &vol_flags, &supports_SetFileShortName);
        if (ret)
-               return ret;
+               goto err;
 
        ctx->supported_features.archive_files = 1;
        ctx->supported_features.hidden_files = 1;
@@ -175,8 +292,10 @@ win32_start_extract(const wchar_t *path, struct apply_ctx *ctx)
 
        ctx->supported_features.not_context_indexed_files = 1;
 
+#if 0
        if (vol_flags & FILE_SUPPORTS_SPARSE_FILES)
                ctx->supported_features.sparse_files = 1;
+#endif
 
        if (vol_flags & FILE_NAMED_STREAMS)
                ctx->supported_features.named_data_streams = 1;
@@ -186,7 +305,7 @@ win32_start_extract(const wchar_t *path, struct apply_ctx *ctx)
 
        if (vol_flags & FILE_SUPPORTS_REPARSE_POINTS) {
                ctx->supported_features.reparse_points = 1;
-               if (win32func_CreateSymbolicLinkW)
+               if (func_CreateSymbolicLinkW)
                        ctx->supported_features.symlink_reparse_points = 1;
        }
 
@@ -200,32 +319,38 @@ win32_start_extract(const wchar_t *path, struct apply_ctx *ctx)
 
                ret = load_prepopulate_pats(ctx);
                if (ret == WIMLIB_ERR_NOMEM)
-                       return ret;
-
-               u64 data_source_id;
+                       goto err;
 
                if (!wim_info_get_wimboot(ctx->wim->wim_info,
                                          ctx->wim->current_image))
                        WARNING("Image is not marked as WIMBoot compatible!");
 
+
+               ret = hash_lookup_table(ctx->wim, dat->wim_lookup_table_hash);
+               if (ret)
+                       goto err;
+
                ret = wimboot_alloc_data_source_id(ctx->wim->filename,
+                                                  ctx->wim->hdr.guid,
                                                   ctx->wim->current_image,
-                                                  path, &data_source_id);
-               if (ret) {
-                       free_prepopulate_pats(ctx);
-                       return ret;
-               }
-
-               ctx_save_data_source_id(ctx, data_source_id);
+                                                  path,
+                                                  &dat->data_source_id,
+                                                  &dat->wof_running);
+               if (ret)
+                       goto err;
        }
 
        return 0;
+
+err:
+       free_prepopulate_pats(dat);
+       return ret;
 }
 
 static int
 win32_finish_extract(struct apply_ctx *ctx)
 {
-       free_prepopulate_pats(ctx);
+       free_prepopulate_pats(get_private_data(ctx));
        return 0;
 }
 
@@ -335,12 +460,12 @@ static int
 win32_create_symlink(const wchar_t *oldpath, const wchar_t *newpath,
                     struct apply_ctx *ctx)
 {
-       if (!(*win32func_CreateSymbolicLinkW)(newpath, oldpath, 0)) {
+       if (!(*func_CreateSymbolicLinkW)(newpath, oldpath, 0)) {
                if (GetLastError() != ERROR_ALREADY_EXISTS)
                        goto error;
                if (!win32_delete_file_wrapper(newpath))
                        goto error;
-               if (!(*win32func_CreateSymbolicLinkW)(newpath, oldpath, 0))
+               if (!(*func_CreateSymbolicLinkW)(newpath, oldpath, 0))
                        goto error;
        }
        return 0;
@@ -389,23 +514,48 @@ win32_extract_stream(const wchar_t *path, const wchar_t *stream_name,
                       creationDisposition, FILE_FLAG_BACKUP_SEMANTICS |
                                            FILE_FLAG_OPEN_REPARSE_POINT,
                       NULL);
-       if (h == INVALID_HANDLE_VALUE)
-               goto error;
+       if (h == INVALID_HANDLE_VALUE) {
+               set_errno_from_GetLastError();
+               ret = WIMLIB_ERR_OPEN;
+               goto out;
+       }
 
-       ret = 0;
-       if (!lte)
+       if (!lte) {
+               ret = 0;
                goto out_close_handle;
+       }
+
+       if (!SetFilePointerEx(h,
+                             (LARGE_INTEGER) { .QuadPart = lte->size},
+                             NULL,
+                             FILE_BEGIN))
+               goto write_error;
+
+       if (!SetEndOfFile(h))
+               goto write_error;
+
+       if (!SetFilePointerEx(h,
+                             (LARGE_INTEGER) { .QuadPart = 0},
+                             NULL,
+                             FILE_BEGIN))
+               goto write_error;
+
        ret = extract_stream(lte, lte->size, win32_extract_wim_chunk, h);
-out_close_handle:
-       if (!CloseHandle(h))
-               goto error;
-       if (ret && !errno)
-               errno = -1;
-       return ret;
+       goto out_close_handle;
 
-error:
+write_error:
        set_errno_from_GetLastError();
-       return WIMLIB_ERR_WRITE;
+       ret = WIMLIB_ERR_WRITE;
+
+out_close_handle:
+       if (!CloseHandle(h)) {
+               if (!ret) {
+                       set_errno_from_GetLastError();
+                       ret = WIMLIB_ERR_WRITE;
+               }
+       }
+out:
+       return ret;
 }
 
 static int
@@ -418,11 +568,27 @@ win32_extract_unnamed_stream(file_spec_t file,
            && lte
            && lte->resource_location == RESOURCE_IN_WIM
            && lte->rspec->wim == ctx->wim
-           && !in_prepopulate_list(dentry, ctx))
+           && lte->size == lte->rspec->uncompressed_size)
        {
-               return wimboot_set_pointer(file.path,
-                                          ctx_get_data_source_id(ctx),
-                                          lte->hash);
+               if (in_prepopulate_list(dentry, ctx)) {
+                       if (ctx->progress_func) {
+                               union wimlib_progress_info info;
+
+                               info.wimboot_exclude.path_in_wim = dentry->_full_path;
+                               info.wimboot_exclude.extraction_path = file.path;
+
+                               ctx->progress_func(WIMLIB_PROGRESS_MSG_WIMBOOT_EXCLUDE,
+                                                  &info);
+                       }
+               } else {
+                       const struct win32_apply_private_data *dat;
+
+                       dat = get_private_data(ctx);
+                       return wimboot_set_pointer(file.path, lte,
+                                                  dat->data_source_id,
+                                                  dat->wim_lookup_table_hash,
+                                                  dat->wof_running);
+               }
        }
 
        return win32_extract_stream(file.path, NULL, 0, lte, ctx);
@@ -506,12 +672,27 @@ win32_set_special_file_attributes(const wchar_t *path, u32 attributes)
        if (h == INVALID_HANDLE_VALUE)
                goto error;
 
+       /* Don't make extracted files sparse.  It is pointless without also
+        * skipping over runs of zeroes when writing the file, and in fact
+        * increases disk usage --- apparently, allocation sizes in sparse files
+        * are rounded up to multiples of 131072 bytes rather than 4096 bytes.
+        * And in some Windows 7 images, *all* files are set as sparse for some
+        * reason, which causes 1 GB+ of disk space to be wasted on the target
+        * drive of a full extraction.
+        *
+        * WIMGAPI seemingly does not make extracted files sparse either.
+        *
+        * XXX: We really ought to do a proper sparse extraction anyway if the
+        * file meets some heuristic that indicates this would be beneficial.
+        */
+#if 0
        if (attributes & FILE_ATTRIBUTE_SPARSE_FILE)
                if (!DeviceIoControl(h, FSCTL_SET_SPARSE,
                                     NULL, 0,
                                     NULL, 0,
                                     &bytes_returned, NULL))
                        goto error_close_handle;
+#endif
 
        if (attributes & FILE_ATTRIBUTE_COMPRESSED)
                if (!DeviceIoControl(h, FSCTL_SET_COMPRESSION,
@@ -676,23 +857,6 @@ error:
        return WIMLIB_ERR_WRITE; /* XXX: need better error code */
 }
 
-static DWORD
-do_win32_set_security_descriptor(HANDLE h, const wchar_t *path,
-                                SECURITY_INFORMATION info,
-                                PSECURITY_DESCRIPTOR desc)
-{
-#ifdef WITH_NTDLL
-       if (func_NtSetSecurityObject) {
-               return (*func_RtlNtStatusToDosError)(
-                               (*func_NtSetSecurityObject)(h, info, desc));
-       }
-#endif
-       if (SetFileSecurity(path, info, desc))
-               return ERROR_SUCCESS;
-       else
-               return GetLastError();
-}
-
 /*
  * Set an arbitrary security descriptor on an arbitrary file (or directory),
  * working around bugs and design flaws in the Windows operating system.
@@ -707,7 +871,9 @@ win32_set_security_descriptor(const wchar_t *path, const u8 *desc,
                              size_t desc_size, struct apply_ctx *ctx)
 {
        SECURITY_INFORMATION info;
+       DWORD dwDesiredAccess;
        HANDLE h;
+       DWORD status;
        int ret;
 
        /* We really just want to set entire the security descriptor as-is, but
@@ -719,8 +885,6 @@ win32_set_security_descriptor(const wchar_t *path, const u8 *desc,
        info = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
               DACL_SECURITY_INFORMATION  | SACL_SECURITY_INFORMATION;
 
-       h = INVALID_HANDLE_VALUE;
-
        /* Prefer NtSetSecurityObject() to SetFileSecurity().  SetFileSecurity()
         * itself necessarily uses NtSetSecurityObject() as the latter is the
         * underlying system call for setting security information, but
@@ -730,83 +894,69 @@ win32_set_security_descriptor(const wchar_t *path, const u8 *desc,
         * Administrator can have access denied.  (Of course, this not mentioned
         * in the MS "documentation".)  */
 
-#ifdef WITH_NTDLL
-       if (func_NtSetSecurityObject) {
-               DWORD dwDesiredAccess;
-
-               /* Open a handle for NtSetSecurityObject() with as many relevant
-                * access rights as possible.
-                *
-                * We don't know which rights will be actually granted.  It
-                * could be less than what is needed to actually assign the full
-                * security descriptor, especially if the process is running as
-                * a non-Administrator.  However, by default we just do the best
-                * we can, unless WIMLIB_EXTRACT_FLAG_STRICT_ACLS has been
-                * enabled.  The MAXIMUM_ALLOWED access right is seemingly
-                * designed for this use case; however, it does not work
-                * properly in all cases: it can cause CreateFile() to fail with
-                * ERROR_ACCESS_DENIED, even though by definition
-                * MAXIMUM_ALLOWED access only requests access rights that are
-                * *not* denied.  (Needless to say, MS does not document this
-                * bug.)  */
-
-               dwDesiredAccess = WRITE_DAC |
-                                 WRITE_OWNER |
-                                 ACCESS_SYSTEM_SECURITY;
-               for (;;) {
-                       DWORD err;
-
-                       h = win32_open_existing_file(path, dwDesiredAccess);
-                       if (h != INVALID_HANDLE_VALUE)
-                               break;
-                       err = GetLastError();
-                       if (err == ERROR_ACCESS_DENIED ||
-                           err == ERROR_PRIVILEGE_NOT_HELD)
-                       {
-                               /* Don't increment partial_security_descriptors
-                                * here or check WIMLIB_EXTRACT_FLAG_STRICT_ACLS
-                                * here.  It will be done later if needed; here
-                                * we are just trying to get as many relevant
-                                * access rights as possible.  */
-                               if (dwDesiredAccess & ACCESS_SYSTEM_SECURITY) {
-                                       dwDesiredAccess &= ~ACCESS_SYSTEM_SECURITY;
-                                       continue;
-                               }
-                               if (dwDesiredAccess & WRITE_DAC) {
-                                       dwDesiredAccess &= ~WRITE_DAC;
-                                       continue;
-                               }
-                               if (dwDesiredAccess & WRITE_OWNER) {
-                                       dwDesiredAccess &= ~WRITE_OWNER;
-                                       continue;
-                               }
+       /* Open a handle for NtSetSecurityObject() with as many relevant
+        * access rights as possible.
+        *
+        * We don't know which rights will be actually granted.  It
+        * could be less than what is needed to actually assign the full
+        * security descriptor, especially if the process is running as
+        * a non-Administrator.  However, by default we just do the best
+        * we can, unless WIMLIB_EXTRACT_FLAG_STRICT_ACLS has been
+        * enabled.  The MAXIMUM_ALLOWED access right is seemingly
+        * designed for this use case; however, it does not work
+        * properly in all cases: it can cause CreateFile() to fail with
+        * ERROR_ACCESS_DENIED, even though by definition
+        * MAXIMUM_ALLOWED access only requests access rights that are
+        * *not* denied.  (Needless to say, MS does not document this
+        * bug.)  */
+
+       dwDesiredAccess = WRITE_DAC | WRITE_OWNER | ACCESS_SYSTEM_SECURITY;
+       while ((h = win32_open_existing_file(path,
+                                            dwDesiredAccess)) == INVALID_HANDLE_VALUE)
+       {
+               DWORD err;
+
+               err = GetLastError();
+               if (err == ERROR_ACCESS_DENIED ||
+                   err == ERROR_PRIVILEGE_NOT_HELD)
+               {
+                       /* Don't increment partial_security_descriptors
+                        * here or check WIMLIB_EXTRACT_FLAG_STRICT_ACLS
+                        * here.  It will be done later if needed; here
+                        * we are just trying to get as many relevant
+                        * access rights as possible.  */
+                       if (dwDesiredAccess & ACCESS_SYSTEM_SECURITY) {
+                               dwDesiredAccess &= ~ACCESS_SYSTEM_SECURITY;
+                               continue;
+                       }
+                       if (dwDesiredAccess & WRITE_DAC) {
+                               dwDesiredAccess &= ~WRITE_DAC;
+                               continue;
+                       }
+                       if (dwDesiredAccess & WRITE_OWNER) {
+                               dwDesiredAccess &= ~WRITE_OWNER;
+                               continue;
                        }
-                       /* Other error, or couldn't open the file even with no
-                        * access rights specified.  Something else must be
-                        * wrong.  */
-                       set_errno_from_win32_error(err);
-                       return WIMLIB_ERR_SET_SECURITY;
                }
+               /* Other error, or couldn't open the file even with no
+                * access rights specified.  Something else must be
+                * wrong.  */
+               set_errno_from_win32_error(err);
+               return WIMLIB_ERR_SET_SECURITY;
        }
-#endif
 
        /* Try setting the security descriptor.  */
-       for (;;) {
-               DWORD err;
-
-               err = do_win32_set_security_descriptor(h, path, info,
-                                                      (PSECURITY_DESCRIPTOR)desc);
-               if (err == ERROR_SUCCESS) {
-                       ret = 0;
-                       break;
-               }
-
+       ret = 0;
+       while (!(NT_SUCCESS(status = (*func_NtSetSecurityObject)(h,
+                                                                info,
+                                                                (PSECURITY_DESCRIPTOR)desc))))
+       {
                /* Failed to set the requested parts of the security descriptor.
                 * If the error was permissions-related, try to set fewer parts
                 * of the security descriptor, unless
                 * WIMLIB_EXTRACT_FLAG_STRICT_ACLS is enabled.  */
-               if ((err == ERROR_PRIVILEGE_NOT_HELD ||
-                    err == ERROR_ACCESS_DENIED) &&
+               if ((status == STATUS_PRIVILEGE_NOT_HELD ||
+                    status == STATUS_ACCESS_DENIED) &&
                    !(ctx->extract_flags & WIMLIB_EXTRACT_FLAG_STRICT_ACLS))
                {
                        if (info & SACL_SECURITY_INFORMATION) {
@@ -830,16 +980,13 @@ win32_set_security_descriptor(const wchar_t *path, const u8 *desc,
                 * security descriptor could not be set.  */
                if (!(info & SACL_SECURITY_INFORMATION))
                        ctx->partial_security_descriptors--;
-               set_errno_from_win32_error(err);
+               set_errno_from_nt_status(status);
                ret = WIMLIB_ERR_SET_SECURITY;
                break;
        }
 
        /* Close handle opened for NtSetSecurityObject().  */
-#ifdef WITH_NTDLL
-       if (func_NtSetSecurityObject)
-               CloseHandle(h);
-#endif
+       CloseHandle(h);
        return ret;
 }