Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?

share|improve this question
    
Indeed, why? Might be the references, by default enabled in programming languages like MS C#, is a vulnerability?! –  Val Mar 8 '13 at 19:44

1 Answer 1

up vote 8 down vote accepted

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.

Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't designed to handle symbolic links.

(Source)

share|improve this answer
    
I'd love to read more details about these security vulnerabilities. –  ripper234 Dec 29 '11 at 10:51
2  
@ripper234 Maybe something like this. –  ordag Dec 29 '11 at 11:53
2  
I wonder how people buy "this is not allowed because this is not allowed" as the answer to the question "why this is not allowed?". When you say that SeCreateSymbolicLinkPrivilege rule prohibits this, you give exactly this stupid answer. Might be this is "Rule of law" mentality: when people hear a rule they stop thinking. –  Val Mar 8 '13 at 19:23
    
@Val Totally agree. The "SeCreateSymbolicLinkPrivilege" part explains HOW the rule is enforced, it doesn't explain WHY the rule exists in the first place. Now, the "security vulnerabilites" part does explain why admin rights were deemed necessary, and for me that's the only relevant part of this answer. –  Pedro Rodrigues Mar 12 at 17:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.