In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
By default, only administrators can create symbolic links, because they are the only ones who have the
SeCreateSymbolicLinkPrivilege privilege found under
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.
From Microsoft TechNet: Security Policy Settings New for Windows Vista:
Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't designed to handle symbolic links.
I found the reason when Vista was launched. The given reason for admins only is very simple. It's not unspecified security problems, it's thousands of pieces of software have to be upgraded to use API calls that literally didn't exist before they were added to avoid gaping security holes when traversing symbolic links.
Windows is horribly vulnerable to symbolic link racing; there are ways to avoid this, kind of, but virtually no applications are using the APIs in such a way at all. Even Microsoft is not accepting security bugs that involve symbolic link racing. I just tried to report one September 2018.
Update: During COVID we chose to patch one of our applications against symbolic link racing because some customer wanted to enable sideloading of "modern" applications (starting on Windows 10, unprivileged symbolic link creation is turned on by the same switch that enables sideloading). In going through one by one and fixing all the symbolic link races by total code audit we found that about one symbolic race in five was actually a junction race as well. Assuming we are typical, the reason is unreliable and most applications that would be vulnerable to symbolic link races were already vulnerable to junction races.
It is not entirely (see below) the case anymore as of Windows 10 Insiders build 14972 (windows 10 creators update ~ 1703).
However, from the comments below the blog post, concerns about the issues mentioned in the other answers are still there, and to make use of this new behaviour, you need to:
- enable developer mode on your machine
- pass a
SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATEflag to the
Linux has a compartmentalised file/user structure. What that means is "program A" cannot do "task B" unless it's related to "disk space C". So symlinks don't really affect anything logistically in terms of risk penetration because the entire OS is predicated on the assumption of action->permission.
Or to put it another way, making a gazillion symlinks doesn't help you if you're a hacker with nothing but low-level permissions. So, on Linux or MacOS it doesn't help you.
However, on Windows you don't have a "program A" that runs a program other than the person logged in... so the person logged in can do "task B" to wherever they like. So it DEFINITELY helps you to have penetration to the level of symlinks because you can override commonly found real files with viral payload, and hide that you did it.
So, without the
symlink protection level, a virus could infect you, run as its payload a lot of symlinks to, say, redirect "
explorer.exe" to a fake "
Why would you do that? Quite honestly it's the keys to the kingdom. You could recruit that computer reliably into a bot theoretically activating its way into the future etc. There are a million ways why this is better than just "having an infection" because most people remove them when they see them, and this could be hidden.