File Ownership/Permission on Softlinks

[Manoj1]

Hi All,

Suppose softlink points like this:

moon --->/opt/a/b/c

Also moon has ownership root:sys

In case we want to change ownership of moon then do we change ownership of /opt/a/b/c or moon ?

Is same rule applies while changing permission of moon also ?

Thanks,
Manoj

[Jose Mosquera · Accepted solution]

Hi,

The "-h" option of chown command conditions the behavior.

-h Change the owner or group of a symbolic link.
By default, the owner or group of the target file that a symbolic link points to is changed. With -h, the target file that the symbolic link points to is not affected.

In your case, if you execute:
#chown -h bob:users moon
The new ownership (bob:users) only afect at softlink (moon), and real file (/opt/a/b/c) keeps original ownership.

Rgds.

[P Arumugavel]

In addition to above points,

If chmod is used on a symbolic link, the mode of the file referred to by the link is changed.

Rgds...

[Matti_Kurkela]

The ownership and permissions of a softlink are normally completely ignored. In your example, only the ownership and permissions of /opt/a/b/c will have real significance.

"man 4 symlink" says this:
-----
The mode and ownership of a symbolic link is ignored by the system, which means that chmod affects the actual file, but not the file containing the symbolic link (see chmod(1)).
-----

Think about it: any normal user can create softlinks, pointing to any file at all. If the permissions of a softlink had any meaning, it would be an easy way to access any file whose pathname is known.

(In other words, a regular user might try making a softlink pointing to /etc/shadow or /tcb/files/auth/r/root. If the ownership & permissions of the link were effective, s/he could now read the root password hash, crack it on his/her own computer, and later come back to login/su to root. But in reality, this does not work.)

Jose already told you how to change the ownership of a softlink if you need to.

MK

[Dennis Handly]

>MK: If the permissions of a softlink had any meaning, it would be an easy way to access any file whose pathname is known.

Well the permissions could be additive, only providing extra security.