Using native symlinks

[Corinna Vinschen]

On May 29 20:43, Chris Sutcliffe wrote:
> On 29 May 2013 13:01, Corinna Vinschen wrote:
> > On May 29 12:40, Chris Sutcliffe wrote:
> >> On 29 May 2013 11:23, Corinna Vinschen wrote:
> >> > On May 29 10:33, Chris Sutcliffe wrote:
> >> >> On 29 May 2013 04:39, Corinna Vinschen wrote:
> >> > Also, either way, did you logoff and logon so that the "Create symbolic
> >> > links" user right can be added to your user token?  Note that your token
> >> > remains unchanged if you didn't exit from your session.  Just changing
> >> > the Policy isn't enough, the OS needs achance to create a new user token
> >> > for you containing the user right.
> >>
> >> I've rebooted the machine since making the change and it has had no
> >> affect.  Is there something else I need to do?
> >
> > I don't know.  I have to try (but not today).  Did you try to add the
> > "Users" group to the Local Security Policy entry instead?
> 
> I tried adding the "Users" group and it didn't help either.

I just tested it and can confirm it.

Try this: Start a login session of a normal user after adding the "Users"
group to the "Create symbolic links" right.  Check the privileges
in the user token:

  $ /cygdrive/c/Windows/System32/whoami /priv

  PRIVILEGES INFORMATION
  ----------------------

  Privilege Name                Description                          State
  ============================= ==================================== ========
  SeShutdownPrivilege           Shut down the system                 Disabled
  SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
  SeUndockPrivilege             Remove computer from docking station Disabled
  SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
  SeTimeZonePrivilege           Change the time zone                 Disabled
  SeCreateSymbolicLinkPrivilege Create symbolic links                Disabled

On the other hand, in the same situation the UAC-crippled admins's token
does not contain the "Create symbolic links" right:

  $ /cygdrive/c/Windows/System32/whoami /priv

  PRIVILEGES INFORMATION
  ----------------------

  Privilege Name                Description                          State
  ============================= ==================================== ========
  SeShutdownPrivilege           Shut down the system                 Disabled
  SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
  SeUndockPrivilege             Remove computer from docking station Disabled
  SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
  SeTimeZonePrivilege           Change the time zone                 Disabled

I also changed the "Create symbolic links" policy so that the "Users"
group is the only group getting this right.  In other words, I removed
the "Administrators" group entirely, logged off, logged on, and the
result was the same as above.

This is a bug in UAC if you ask me.  It seems to remove privileges from
the UAC-crippled admin's token based on a fixed internal list, totally
ignorant of changes in the security policy.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple