The long road to a fix for CVE-2021-20316

Posted Feb 14, 2022 17:32 UTC (Mon) by jra (subscriber, #55261)
In reply to: The long road to a fix for CVE-2021-20316 by eru
Parent article: The long road to a fix for CVE-2021-20316

No, they aren't anymore. Windows has admin-only created symlinks. The key difference is only root can create them.

The long road to a fix for CVE-2021-20316

Posted Feb 15, 2022 12:18 UTC (Tue) by eru (subscriber, #2753) [Link] (1 responses)

The Windows symlink-like feature is hard to use, and last I tried it, it was nearly undocumented (admittedly that was several years ago when I needed it). On the Windows command line, there was no equivalent to "ln -s". They might as well not exist, for all the good they do there. Maybe Windows uses them internally for something, but no end-user does.

The long road to a fix for CVE-2021-20316

Posted Feb 15, 2022 14:09 UTC (Tue) by rahulsundaram (subscriber, #21946) [Link]

> On the Windows command line, there was no equivalent to "ln -s". They might as well not exist, for all the good they do there. Maybe Windows uses them internally for something, but no end-user does.

Your info is heavily outdated. It is well supported and well documented these days.

https://docs.microsoft.com/en-us/windows-server/administr...

The long road to a fix for CVE-2021-20316

Posted Feb 19, 2022 17:10 UTC (Sat) by Jandar (subscriber, #85683) [Link] (2 responses)

> Windows has admin-only created symlinks.

Marvelous, a kind of symlink a user can't use. What comes next, only admin approved (*) programs can create executables? Doubtless it would be a security enhancement if no executable memory-mapping could contain bytes generated by an arbitrary program.

Most symlinks I use or encounter are made by users within their own directories pointing into other parts of their own space.

* The mainframe I used at university had such a concept. IIRC only an admin at the console could set the compiler-permission.

The long road to a fix for CVE-2021-20316

Posted Feb 21, 2022 0:38 UTC (Mon) by Fowl (subscriber, #65667) [Link] (1 responses)

Well, yeah. This is how many corporate managed devices, and all iOS and Android devices work.

The long road to a fix for CVE-2021-20316

Posted Feb 22, 2022 16:56 UTC (Tue) by Jandar (subscriber, #85683) [Link]

> This is how many corporate managed devices, and all iOS and Android devices work.

And this is why an Android device even with a Linux kernel doesn't provide a very Unix like experience.

If my desktop, laptop or servers would restrict me in the same way as an Android device I would immediately switch the distribution or to something more different like one of the BSDs.