9

[Disclaimer: there's no malicious intent to this question, I'm trying to understand the ln -s command for a school project]

Say I have a file system with my home folder, /home/anna. /home/bob is a folder I can't access, with a file I can't access, foo.txt

Can I successfully run ln -s /home/bob/foo.txt in my home folder? Is it correct to assume that if I can, it will produce a link I can't access (with the same permissions as foo.txt)?

What if I DID have read privileges on foo.txt, just not access to /home/bob?

What about the reverse case, where I could access /home/bob but not read foo.txt?

Gilles 'SO- stop being evil'
  • 829,060
MyStackRunnethOver
  • 193
  • 1
  • 1
  • 6
  • 4
    You can create a symlink to practically anything, including things that don't exist. – muru Apr 13 '17 at 02:48
  • 1
    Technically s symlink doesn't have any permissions of it's own, and ls will typical show that as lrwxrwxrwx, so it's a little wrong to talk about permissions of a llink. – Henrik supports the community Apr 13 '17 at 07:37
  • Tip I used: if file is in a parent dir for which end user doesn't have perms, create hard link to that file (supposes you have perms to do that). Accessing hard links doesn't require perms to target's parent directory. If you want to do the same, but with a directory whose parent directory is inacessible, use mount --bind (additionally you can set a mount point whose location is accessible to end user, and simlink to that mount point instead of directly using the mount point) – Jean Monet Dec 16 '20 at 20:14

1 Answers1

10

Yes, you can create a symbolic link to any location.

Can I successfully run ln -s /home/bob/foo.txt in my home folder? Is it correct to assume that if I can, it will produce a link I can't access (with the same permissions as foo.txt)?

Correct. The access restrictions of the target file apply. If you create a symlink to a restricted resource, you simply won't be able to access it. It is not even required that the target file actually exists.

A demo:

$ ln -s /etc/shadow foo
$ file foo
foo: symbolic link to /etc/shadow
$ cat foo
cat: foo: Permission denied

$ ln -s /etc/nonexistent bar
$ file bar
bar: broken symbolic link to /etc/nonexistent

What if I DID have read privileges on foo.txt, just not access to /home/bob?

If you don't have permissions on the parent directory, you can't access the contained file. So with a symlink you still wouldn't be able to access it. Creating a symlink doesn't affect the permissions.

What about the reverse case, where I could access /home/bob but not read foo.txt?

Again, you can create a symlink to it, but not access the file.

Community
  • 1
Arminius
  • 726
  • 2
    @4o2 Since this is correct, I'm commenting here to elaborate. Your question has more to do with permissions, which you properly tagged, and welcome to the Exchange. When a user is created, they receive a directory under /home and are put in a group the same name as their username, ie user bob is in group bob, until he is added to others to prevent users from reading each others files. In the old days, all users belonged to group users, which allowed the malicious intent you alluded to. In order for Anna to see bob's files, bob must add her to group bob. – eyoung100 Apr 13 '17 at 04:27