Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The admin privileges is just the default security policy, you can configure it to allow regular users.


That is really bad advice.

An application should not change the default security policy.


I'm not saying it should. I'm saying it's not a property of the symlink feature. Some Linux distro could implement the same policy, but symlinks would still be symlinks.


> I'm not saying it should. I'm saying it's not a property of the symlink feature.

When someone uses the term "symbolic link" to mean something different than someone else using the term "symbolic link", we can assume they:

(a) do not understand what UNIX is calling a symbolic link, either because they have never heard the term, did not research it properly, or have some kind of learning disability

(b) are attempting to intentionally confuse users

We do not assume that "symbolic link ``features''" now means something else: We need justification to do that, and we don't have it:

A "link" is what POSIX calls a directory entry (§3.130), and a "symbolic link" is simply a directory entry (link) without a file associated with it.

When we are thinking about this clearly we can see what Microsoft did wrong, but we're under no obligation to support them in their definition because clearly their definition is less useful than the POSIX one.

> Some Linux distro could implement the same policy,

Users would revolt; they did revolt.

SELinux was popularized by a number of Linux distributions, and included a configuration that did exactly this, however people just turned it off because breaking applications pisses people off.

> but symlinks would still be symlinks.

No.

Just because they use the same words does not make them the same thing. You can use α-conversion to fix this without anyone else's help, and call Microsoft's "symbolic link" foo and UNIX's symbolic link bar, then you can find the sentence "foo would still be bar" the nonsense that it is.


No, it cannot be disabled via a policy in Linux, because it is regular FS operation, not a filter.


Sure it could, SELinux policies can operate on regular FS operations just fine.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: