In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?

  • 1
    Indeed, why? Might be the references, by default enabled in programming languages like MS C#, is a vulnerability?! – Val Mar 8 '13 at 19:44
  • 6
    What's worse, hard links and directory junctions can be created by regular users AFAIK, just not symlinks. This restriction seems really arbitrary. – Ajedi32 Oct 30 '15 at 15:44
  • 1
    See also: superuser.com/questions/10727/… – Ajedi32 Oct 30 '15 at 15:44
  • 1
    A good answer should give an example how the SeCreateSymbolicLinkPrivilege can be exploited or abused. What is the risk involved? How does it soften security? Give a specific exploit example. – user643011 Jun 8 '18 at 15:34

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.

From Microsoft TechNet: Security Policy Settings New for Windows Vista:

Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't designed to handle symbolic links.

  • 8
    @ripper234 Maybe something like this. – ordag Dec 29 '11 at 11:53
  • 55
    I wonder how people buy "this is not allowed because this is not allowed" as the answer to the question "why this is not allowed?". When you say that SeCreateSymbolicLinkPrivilege rule prohibits this, you give exactly this stupid answer. Might be this is "Rule of law" mentality: when people hear a rule they stop thinking. – Val Mar 8 '13 at 19:23
  • 23
    @Val Totally agree. The "SeCreateSymbolicLinkPrivilege" part explains HOW the rule is enforced, it doesn't explain WHY the rule exists in the first place. Now, the "security vulnerabilites" part does explain why admin rights were deemed necessary, and for me that's the only relevant part of this answer. – Pedro Rodrigues Mar 12 '14 at 17:21
  • 7
    From what I understand, Symlink Racing is a vulnerability that was patched at the kernel level in Linux some time ago: security.stackexchange.com/a/83977/29865 Is Windows still vulnerable? Is that why only admin users have this privilege? If so, why not just fix the problem instead of introducing stupid restrictions like this? – Ajedi32 Oct 30 '15 at 15:34
  • 15
    Even the "Symbolic links ... can expose security vulnerabilities in applications that aren't designed to handle symbolic links." explanation isn't much of an answer. Examples? This is security.stackexchange.com, a Q&A site full of security experts, yet nobody can provide a concrete answer to this question? That seems telling. – jamesdlin Jun 10 '16 at 7:00

Linux has a compartmentalised file/user structure. What that means is "program A" cannot do "task B" unless it's related to "disk space C". So symlinks don't really affect anything logistically in terms of risk penetration because the entire OS is predicated on the assumption of action->permission.

Or to put it another way, making a gazillion symlinks doesn't help you if you're a hacker with nothing but low-level permissions. So, on Linux or MacOS it doesn't help you.

However, on Windows you don't have a "program A" that runs a program other than the person logged in... so the person logged in can do "task B" to wherever they like. So it DEFINITELY helps you to have penetration to the level of symlinks because you can override commonly found real files with viral payload, and hide that you did it.

So, without the symlink protection level, a virus could infect you, run as its payload a lot of symlinks to, say, redirect "explorer.exe" to a fake "exactly-as-windows-made-it-except-with-a-payload explorer.exe".

Why would you do that? Quite honestly it's the keys to the kingdom. You could recruit that computer reliably into a bot theoretically activating its way into the future etc. There are a million ways why this is better than just "having an infection" because most people remove them when they see them, and this could be hidden.

  • 11
    This answer doesn't make sense to me. You're saying that if regular users could create symlinks, then a virus could overwrite explorer.exe with a symlink? Why wouldn't the virus just overwrite explorer with another executable or a hard link (which don't require admin rights to create)? How does requiring admin privileges for symlinks help here? – Ajedi32 Nov 29 '17 at 16:16
  • As I mentioned before, this isn't very clear. How would a virus redirect explorer.exe via symlinks? The real explorer.exe would still exist as %WINDIR%\explorer.exe, it is not overwritable without administrator privileges, and %WINDIR% should be near the beginning of the executable search path for any administrator users, so administrators would still run the real thing. – jamesdlin Nov 29 '17 at 17:30
  • forget explorer, it's making you confused it was (perhaps) a somewhat poor example. If I can make your user redirect to a location in windows without realising it then I can perform a world of hurt. It's just true. If your argument against it's relevance is "it's as bad as if ..." well true it probably is "as bad as" but all those "as bad as's" are also terrible in terms of outcomes. If you want to think of it as fallout over the larger issue of Windows Security being fundamentally sub optimal then sobeit. Nowadays windows has mitigations in place to fix this(eg:this symlinks prohibition) – Mr Heelis Nov 30 '17 at 10:04
  • 3
    And regarding "virus checkers are optimised to look for filenames...", that also makes no sense. 1. How is it any worse than a hardlink? 2. A symlink itself cannot carry a virus payload. If I have a file with a virus payload on my system, antivirus software would eventually scan it, regardless of what symlinks happen to be pointing to it. – jamesdlin Nov 30 '17 at 20:04
  • 4
    To summarize: please explain how allowing normal users to create symlinks would allow an attacker to do something they wouldn't already be able to do. How can allowing them lead to privilege escalation without already being on the other side of the airtight hatchway? – jamesdlin Dec 5 '17 at 3:20

It is not the case anymore as of Windows 10 Insiders build 14972 (windows 10 creators update).

However, from the comments below the blog post, concerns about the issues mentioned in the other answers are still there, and to make use of this new behaviour, you need to:

  • enable developer mode on your machine
  • pass a SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag to the CreateSymbolicLink API
  • 9
    Sigh. Once again, the blog post just cites unspecified "security requirements" as the reason for why this isn't enabled by default. Then when people question this in the comments, the author responds by again saying "they introduce very real security risks" and "There are some well documented security concerns with symlinks" without explaining what those risks are. This is ridiculous. – Ajedi32 May 9 '18 at 15:19

Hardlinks and directory junctions are only inside one partition(there cant be a hardlink from one drive to another or even to a network location).

SymLinks on the other hand can also link from a place on the system which seems "safe" to a network location.

  • 8
    And this is a problem because...? – jamesdlin Nov 1 '17 at 2:46

I found the reason when Vista was launched. The given reason for admins only is very simple. It's not unspecified security problems, it's thousands of pieces of software have to be upgraded to use API calls that literally didn't exist before they were added to avoid gaping security holes when traversing symbolic links.

Windows is horribly vulnerable to symbolic link racing; there are ways to avoid this, kind of, but virtually no applications are using the APIs in such a way at all. Even Microsoft is not accepting security bugs that involve symbolic link racing. I just tried to report one three months ago.

  • Interesting. Any idea why Windows couldn't patch this at the kernel level like Linux did? (github.com/torvalds/linux/commit/…) Also, why aren't hardlinks vulnerable? – Ajedi32 Jan 3 at 14:22
  • @Ajedi32: Because Windows doesn't have a direct equivalent of root, and looking up group membership at path traversal time is stupid and the root of the drive is equivalent to stickty tmp – Joshua Jan 3 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.