8

[Disclaimer: there's no malicious intent to this question, I'm trying to understand the ln -s command for a school project]

Say I have a file system with my home folder, /home/anna. /home/bob is a folder I can't access, with a file I can't access, foo.txt

Can I successfully run ln -s /home/bob/foo.txt in my home folder? Is it correct to assume that if I can, it will produce a link I can't access (with the same permissions as foo.txt)?

What if I DID have read privileges on foo.txt, just not access to /home/bob?

What about the reverse case, where I could access /home/bob but not read foo.txt?

  • 4
    You can create a symlink to practically anything, including things that don't exist. – muru Apr 13 '17 at 2:48
  • 1
    Technically s symlink doesn't have any permissions of it's own, and ls will typical show that as lrwxrwxrwx, so it's a little wrong to talk about permissions of a llink. – Henrik Apr 13 '17 at 7:37
9

Yes, you can create a symbolic link to any location.

Can I successfully run ln -s /home/bob/foo.txt in my home folder? Is it correct to assume that if I can, it will produce a link I can't access (with the same permissions as foo.txt)?

Correct. The access restrictions of the target file apply. If you create a symlink to a restricted resource, you simply won't be able to access it. It is not even required that the target file actually exists.

A demo:

$ ln -s /etc/shadow foo
$ file foo
foo: symbolic link to /etc/shadow
$ cat foo
cat: foo: Permission denied

$ ln -s /etc/nonexistent bar
$ file bar
bar: broken symbolic link to /etc/nonexistent

What if I DID have read privileges on foo.txt, just not access to /home/bob?

If you don't have permissions on the parent directory, you can't access the contained file. So with a symlink you still wouldn't be able to access it. Creating a symlink doesn't affect the permissions.

What about the reverse case, where I could access /home/bob but not read foo.txt?

Again, you can create a symlink to it, but not access the file.

  • 2
    @4o2 Since this is correct, I'm commenting here to elaborate. Your question has more to do with permissions, which you properly tagged, and welcome to the Exchange. When a user is created, they receive a directory under /home and are put in a group the same name as their username, ie user bob is in group bob, until he is added to others to prevent users from reading each others files. In the old days, all users belonged to group users, which allowed the malicious intent you alluded to. In order for Anna to see bob's files, bob must add her to group bob. – eyoung100 Apr 13 '17 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.