Apache has options
SymLinksIfOwnerMatch. However, they "should not be considered a security restriction, since symlink testing is subject to race conditions that make it circumventable." Compare this with Samba:
Samba has an option called
wide links :
Note: Turning this parameter on when UNIX extensions are enabled will allow UNIX clients to create symbolic links on the share that can point to files or directories outside restricted path exported by the share definition. This can cause access to areas outside of the share. Due to this problem, this parameter will be automatically disabled (with a message in the log file) if the
unix extensionsoption is on.
See the parameter
allow insecure wide linksif you wish to change this coupling between the two parameters.
Can the Samba option be bypassed via a race condition?
If not, how is Samba able to prevent the race condition? E.g. what sequence of operations can be used to prevent the race condition?