Hard Links and Permissions / ACLs

Windows Internals
Published May 14, 2009

Commenter Lee asked how ACLs are evaluated when an object has multiple hard links. I replied with comments of my own, which turned out to be wrong after I did some experiments. Here is what I found out about hard link permissions and believe to be true.

Can permissions on multiple hard links to the same data be different?

No. Permissions on all hard links to the same data on disk are always identical. The same applies to attributes. That means if you change the permissions/owner/attributes on one hard link, you will immediately see the changes on all other hard links.

Which permissions on the link target are required to create a hard link?

Only the permission “write attributes” (for programmers: FILE_WRITE_ATTRIBUTES) is needed on the target. Whether or not you are the owner of the target is not relevant.

These topics do not seem to be documented anywhere. So how did I find out? I tried it out (on Windows 7 RC).

Attribute DACL Hard Link Owner Permissions SACL

Comments

Comments are powered by Giscus. Please enable JavaScript to view them, or view discussions directly on GitHub.

Related Posts

Finding (Executables in) User-Writeable Directories

Finding (Executables in) User-Writeable Directories

This article presents two different detection types for insecure filesystem permissions on Windows endpoints: scanning for directories that are user-writable, and detecting processes that are started from user-writeable directories. Directory Scan With ListUserWriteableDirectories & SetACL My ListUserWriteableDirectories script is an implementation of the first detection type: it scans the filesystem listing any permissions not known to be safe.

Permissions Windows Does Not Show You

Permissions Windows Does Not Show You

Sometimes it is good not to know the truth, but as an administrator you better know what is going on! Most IT pros know that Explorer lies a lot (on a German system C:\Users magically becomes C:\Benutzer), but few are aware that Windows’ permission handling dialog ACL Editor also tends to “pretty up” things.

Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained

Updated: 2021-06-22 Every object that can have a security descriptor (SD) is a securable object that may be protected by permissions. All named and several unnamed Windows objects are securable and can have SDs, although this is not widely known. There does not even exist a GUI for manipulating the SDs of many object types! Have you ever tried to kill a system process in Task Manager and got the message “Access denied”? This is due to the fact that this process’ SD does not allow even administrators to kill the process. But it is, of course, possible, as an administrator, to obtain the necessary permissions, provided a GUI or some other tool is available.

Windows Internals

Hard Links, Soft (Symbolic) Links and Junctions in NTFS: What Are They (For)?

This is an attempt at demystification. In the Windows world, links in the file system are often regarded as obscure, except for the infamous .LNK files, of course. But file system links are neither freaky UNIX/Linux command line stuff, nor are they new: Microsoft’s OS offers two types of links since Windows 2000 and a third type since Vista/Server 2008. And boy, can they come in handy!

Windows Internals

Latest Posts

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0 is now available! This milestone marks the end of the beta and pre-release phases. What Is Sambee? Sambee turns your existing storage into a modern workspace - no migration, syncing, or cloud required.

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser is being archived. As the author writes, the codebase dates back to when he was but 15 years old. Having created such a popular file management tool is a more than impressive achievement for anyone, let alone a teenager. However, when it comes to security and reliability, Filebrowser seems to be built on a less than ideal foundation, so much so that the author states:

Home Automation, Networking & Self-Hosting

Auditing Samba File & Directory Changes With Elasticsearch

Auditing Samba File & Directory Changes With Elasticsearch

This article explains how to set up an auditing (change-tracking) system for Samba file shares that shows who created, deleted, or changed a file or directory and when. The solution is optimized for security, high performance, and low maintenance.

Home Automation, Networking & Self-Hosting

Samba & SMB Web Access Through Sambee With Automatic HTTPS & OIDC SSO

Samba & SMB Web Access Through Sambee With Automatic HTTPS & OIDC SSO

This article explains how to set up Sambee in a Docker container as a web interface for browser-based access to a Samba or SMB file server, complete with automatic HTTPS certificates (via Caddy) and OpenID Connect single sign-on (via Authelia).

Home Automation, Networking & Self-Hosting