In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?

  • 1
    Indeed, why? Might be the references, by default enabled in programming languages like MS C#, is a vulnerability?! – Val Mar 8 '13 at 19:44
  • 6
    What's worse, hard links and directory junctions can be created by regular users AFAIK, just not symlinks. This restriction seems really arbitrary. – Ajedi32 Oct 30 '15 at 15:44
  • 1
    See also: superuser.com/questions/10727/… – Ajedi32 Oct 30 '15 at 15:44
  • 1
    A good answer should give an example how the SeCreateSymbolicLinkPrivilege can be exploited or abused. What is the risk involved? How does it soften security? Give a specific exploit example. – user643011 Jun 8 at 15:34
up vote 20 down vote accepted

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.

From Microsoft TechNet: Security Policy Settings New for Windows Vista:

Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't designed to handle symbolic links.

  • 8
    @ripper234 Maybe something like this. – ordag Dec 29 '11 at 11:53
  • 47
    I wonder how people buy "this is not allowed because this is not allowed" as the answer to the question "why this is not allowed?". When you say that SeCreateSymbolicLinkPrivilege rule prohibits this, you give exactly this stupid answer. Might be this is "Rule of law" mentality: when people hear a rule they stop thinking. – Val Mar 8 '13 at 19:23
  • 22
    @Val Totally agree. The "SeCreateSymbolicLinkPrivilege" part explains HOW the rule is enforced, it doesn't explain WHY the rule exists in the first place. Now, the "security vulnerabilites" part does explain why admin rights were deemed necessary, and for me that's the only relevant part of this answer. – Pedro Rodrigues Mar 12 '14 at 17:21
  • 6
    From what I understand, Symlink Racing is a vulnerability that was patched at the kernel level in Linux some time ago: security.stackexchange.com/a/83977/29865 Is Windows still vulnerable? Is that why only admin users have this privilege? If so, why not just fix the problem instead of introducing stupid restrictions like this? – Ajedi32 Oct 30 '15 at 15:34
  • 15
    Even the "Symbolic links ... can expose security vulnerabilities in applications that aren't designed to handle symbolic links." explanation isn't much of an answer. Examples? This is security.stackexchange.com, a Q&A site full of security experts, yet nobody can provide a concrete answer to this question? That seems telling. – jamesdlin Jun 10 '16 at 7:00

Linux has a compartmentalised file/user structure. What that means is "program A" cannot do "task B" unless it's related to "disk space C". So symlinks don't really affect anything logistically in terms of risk penetration because the entire OS is predicated on the assumption of action->permission.

Or to put it another way, making a gazillion symlinks doesn't help you if you're a hacker with nothing but low-level permissions. So, on Linux or MacOS it doesn't help you.

However, on Windows you don't have a "program A" that runs a program other than the person logged in... so the person logged in can do "task B" to wherever they like. So it DEFINITELY helps you to have penetration to the level of symlinks because you can override commonly found real files with viral payload, and hide that you did it.

So, without the symlink protection level, a virus could infect you, run as its payload a lot of symlinks to, say, redirect "explorer.exe" to a fake "exactly-as-windows-made-it-except-with-a-payload explorer.exe".

Why would you do that? Quite honestly it's the keys to the kingdom. You could recruit that computer reliably into a bot theoretically activating its way into the future etc. There are a million ways why this is better than just "having an infection" because most people remove them when they see them, and this could be hidden.

  • 10
    This answer doesn't make sense to me. You're saying that if regular users could create symlinks, then a virus could overwrite explorer.exe with a symlink? Why wouldn't the virus just overwrite explorer with another executable or a hard link (which don't require admin rights to create)? How does requiring admin privileges for symlinks help here? – Ajedi32 Nov 29 '17 at 16:16
  • As I mentioned before, this isn't very clear. How would a virus redirect explorer.exe via symlinks? The real explorer.exe would still exist as %WINDIR%\explorer.exe, it is not overwritable without administrator privileges, and %WINDIR% should be near the beginning of the executable search path for any administrator users, so administrators would still run the real thing. – jamesdlin Nov 29 '17 at 17:30
  • forget explorer, it's making you confused it was (perhaps) a somewhat poor example. If I can make your user redirect to a location in windows without realising it then I can perform a world of hurt. It's just true. If your argument against it's relevance is "it's as bad as if ..." well true it probably is "as bad as" but all those "as bad as's" are also terrible in terms of outcomes. If you want to think of it as fallout over the larger issue of Windows Security being fundamentally sub optimal then sobeit. Nowadays windows has mitigations in place to fix this(eg:this symlinks prohibition) – Mr Heelis Nov 30 '17 at 10:04
  • 3
    And regarding "virus checkers are optimised to look for filenames...", that also makes no sense. 1. How is it any worse than a hardlink? 2. A symlink itself cannot carry a virus payload. If I have a file with a virus payload on my system, antivirus software would eventually scan it, regardless of what symlinks happen to be pointing to it. – jamesdlin Nov 30 '17 at 20:04
  • 3
    To summarize: please explain how allowing normal users to create symlinks would allow an attacker to do something they wouldn't already be able to do. How can allowing them lead to privilege escalation without already being on the other side of the airtight hatchway? – jamesdlin Dec 5 '17 at 3:20

It is not the case anymore as of Windows 10 Insiders build 14972 (windows 10 creators update).

However, from the comments below the blog post, concerns about the issues mentioned in the other answers are still there, and to make use of this new behaviour, you need to:

  • enable developer mode on your machine
  • pass a SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag to the CreateSymbolicLink API
  • 6
    Sigh. Once again, the blog post just cites unspecified "security requirements" as the reason for why this isn't enabled by default. Then when people question this in the comments, the author responds by again saying "they introduce very real security risks" and "There are some well documented security concerns with symlinks" without explaining what those risks are. This is ridiculous. – Ajedi32 May 9 at 15:19

Hardlinks and directory junctions are only inside one partition(there cant be a hardlink from one drive to another or even to a network location).

SymLinks on the other hand can also link from a place on the system which seems "safe" to a network location.

  • 7
    And this is a problem because...? – jamesdlin Nov 1 '17 at 2:46

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.