Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In linux it's possible to change the owner or the group owner of a symbolic link (symlink). I was wondering why someone would want to do that, since permissions of a symlink are not used when accessing a file through it.

I can only imagine one use case where it could be useful: to allow a user to delete a symlink in a directory with sticky bit.

Do you know other cases where it might be useful to change the owner or group owner of a symlink ?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Suppose root is working in a directory that Eve can write to. There's a file foo in this directory that needs to be changed to belong to Eve. So root types chown eve foo. But just before root hits Enter, Eve runs ln -sf /etc/passwd foo. Now /etc/passwd belongs to Eve! If root can run chown -h eve foo to make sure not to follow symlinks, then the most harm that can be done is that some other file in the same directory has been changed to belong to Eve.

lchown is also convenient when you're changing the owner of a directory tree. You don't need to worry about accidentally affecting a file outside the tree because you called chown on a symbolic link.

share|improve this answer
    
"If root can run chown -h bob foo to make sure not to follow symlinks, then the most harm that can be done is that some other file in the same directory has been changed to belong to Eve.". I guess you mean "chown -h eve foo". The other file that might be changed, it is the symbolic link am i right ? –  user368507 Mar 2 '12 at 0:22
    
@user5528 The other file might not be a symlink: Eve can still run mv myfile foo, and root will end up changing the owner of myfile. But myfile has to be a file that Eve can create or move into that directory, it can't be any file on the system. –  Gilles Mar 2 '12 at 0:47

Apache can be configured to follow symlinks only if the owner of the link matches the owner of the destination. This can help prevent users from creating links for web access to files they don't own (e.g. /etc/passwd).

... so let's say you, as root, wanted apache to follow a link to display a certain logfile, which was owned by xymon or something, but you didn't want to relax apache's security by allowing it to follow symlinks regardless of owner. Then you might want to make xymon the owner of the symlink.

share|improve this answer
    
Ok. I know it's unrelated but what is the point of this behaviour in apache ? I mean if the user is able to read the file, why bother read it from web access ? thx –  user368507 Mar 2 '12 at 0:11
    
Well, it's not just a local user reading the file; if apache can read it, then potentially everybody can read it. And if some apache vulnerability allowed the creation of a symlink to /etc/passwd, then the badguy might have read access to that file without having any other local access -- but would be thwarted by the symlink being owned by apache. –  Lars Rohrbach Mar 13 '12 at 15:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.